asmhatre/spring-auth-demo
1
0
Fork 0
Code Activity

Add permission-evaluator module: hasPermission() with PermissionEvaluator and @EnableMethodSecurity

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6
This commit is contained in:
asmhatre
2026-10-25 16:55:23 +00:00
co-authored by Claude Sonnet 5.5
parent 6b09fe7b82
commit d1b9339951
27 changed files with 857 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
permission-evaluator/output/00-denyall-log.txt
+3
View File
@@ -0,0 +1,3 @@
o.s.s.a.e.DenyAllPermissionEvaluator : Denying user alice permission 'read' on object with Id 1
o.s.s.a.e.DenyAllPermissionEvaluator : Denying user alice permission 'write' on object with Id 1
o.s.s.a.e.DenyAllPermissionEvaluator : Denying user alice permission 'delete' on object with Id 1
permission-evaluator/output/01-bean-only-wiring.txt
+14
View File
@@ -0,0 +1,14 @@
PermissionEvaluator beans: [documentPermissionEvaluator]
MethodSecurityExpressionHandler beans: []
alice read doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
alice write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
alice delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
bob read doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
bob write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
bob delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol read doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
admin read doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
admin write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
admin delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
permission-evaluator/output/02-explicit-handler-matrix.txt
+12
View File
@@ -0,0 +1,12 @@
alice read doc 1 -> ALLOWED
alice write doc 1 -> ALLOWED
alice delete doc 1 -> ALLOWED
bob read doc 1 -> ALLOWED
bob write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
bob delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol read doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol write doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
carol delete doc 1 -> DENIED (AuthorizationDeniedException: Access Denied)
admin read doc 1 -> ALLOWED
admin write doc 1 -> ALLOWED
admin delete doc 1 -> ALLOWED
permission-evaluator/output/03-postauthorize-side-effect.txt
+2
View File
@@ -0,0 +1,2 @@
carol getThenCheck(1) -> DENIED (AuthorizationDeniedException: Access Denied)
method body ran 1 time(s) during that call
permission-evaluator/output/04-forged-owner.txt
+5
View File
@@ -0,0 +1,5 @@
document 1 before: Document[id=1, owner=alice, team=team-a, title=Q3 plan]
carol update(forged owner=carol) -> ALLOWED
document 1 after: Document[id=1, owner=carol, team=team-b, title=hijacked]
carol updateTitle(1, "hijacked") -> DENIED (AuthorizationDeniedException: Access Denied)
document 1 after: Document[id=1, owner=alice, team=team-a, title=Q3 plan]
permission-evaluator/output/05-load-counts.txt
+3
View File
@@ -0,0 +1,3 @@
get(1) loads: 2
list() loads: 0 (returned 3 of 4)
listByIdCheck() loads: 4 (returned 3 of 4)
permission-evaluator/output/06-cache-and-staleness.txt
+5
View File
@@ -0,0 +1,5 @@
3 x get(1) with cache: 4 loads (uncached it is 6)
alice updateTitle(1) -> ALLOWED
owner of doc 1 is now bob
alice updateTitle(1) -> ALLOWED (cached allow)
after evictAll() -> DENIED (AuthorizationDeniedException: Access Denied)
permission-evaluator/output/07-http-status-codes.txt
+7
View File
@@ -0,0 +1,7 @@
no credentials GET /documents/1 -> 401
alice GET /documents/1 -> 200
carol GET /documents/1 -> 403
alice GET /documents/99 -> 403
admin GET /documents/99 -> 403
bob PUT /documents/1?title=x -> 403
alice PUT /documents/1?title=x -> 200