Add permission-evaluator module: hasPermission() with PermissionEvaluator and @EnableMethodSecurity

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6

permission-evaluator/README.md

@@ -0,0 +1,20 @@
+# permission-evaluator
+
+Companion code for [Spring Security hasPermission() with PermissionEvaluator and @EnableMethodSecurity](https://ankurm.com/spring-security-haspermission-permissionevaluator-method-security/).
+
+A `Document` has an owner and a team. `DocumentPermissionEvaluator` decides: admins can do everything, the owner or a team-mate can read, only the owner can write or delete.
+
+Run it: `mvn test` (JDK 25, Spring Boot 4.1.2, Spring Security 7.1.2). Each test writes what it observed to [`output/`](output).
+
+| file | what it shows |
+|---|---|
+| `00-denyall-log.txt` | log lines from the bean-only setup: Spring Security's default evaluator denies |
+| `01-bean-only-wiring.txt` | only a `PermissionEvaluator` bean, no handler bean: everything is denied |
+| `02-explicit-handler-matrix.txt` | with a `MethodSecurityExpressionHandler` bean: the allow/deny matrix |
+| `03-postauthorize-side-effect.txt` | `@PostAuthorize` runs the method body before denying |
+| `04-forged-owner.txt` | `hasPermission(#doc, ...)` trusts the caller's object; the id-only variant does not |
+| `05-load-counts.txt` | document loads per call: `get`, `list`, `@PostFilter` by id |
+| `06-cache-and-staleness.txt` | a caching evaluator saves loads and serves a stale allow |
+| `07-http-status-codes.txt` | 401, 200, 403 over HTTP Basic, including a missing document |
+
+Profiles: `handler` registers the `MethodSecurityExpressionHandler` bean, `cache` adds the caching evaluator.