spring-projects / spring-projects/spring-security
SEC-2379: add support for ACL filtered SQL pagination with Hibernate or JPA
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Thomas Koch (Migrated from SEC-2379) said:
I've a model class supported by Hibernate/JPA with row level security and a PagingAndSortingRepository interface for this model. I want to call findAll(pageable) on this repository and get a list of only those model instances to which the current principal has read access to.
The method should not be unnecessarily slow or waste resources. This might mean that the ACL filtering should be done by the database.
All features of Spring Security ACL should still be supported, in particular hierarchic ACL. The later should be possible with recursive query evaluation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing Spring Security ACL's existing integration with Hibernate/JPA and PagingAndSortingRepository; the issue names no files or tests, so first map those entry points and the current pagination path. Done means supporting ACL-filtered pageable results efficiently, including hierarchical ACLs and database-side filtering where appropriate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, database, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100