asmhatreandClaude Sonnet 5.5
d1b9339951
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6
1.4 KiB
1.4 KiB
permission-evaluator
Companion code for Spring Security hasPermission() with PermissionEvaluator and @EnableMethodSecurity.
A Document has an owner and a team. DocumentPermissionEvaluator decides: admins can do everything, the owner or a team-mate can read, only the owner can write or delete.
Run it: mvn test (JDK 25, Spring Boot 4.1.2, Spring Security 7.1.2). Each test writes what it observed to output/.
| file | what it shows |
|---|---|
00-denyall-log.txt |
log lines from the bean-only setup: Spring Security's default evaluator denies |
01-bean-only-wiring.txt |
only a PermissionEvaluator bean, no handler bean: everything is denied |
02-explicit-handler-matrix.txt |
with a MethodSecurityExpressionHandler bean: the allow/deny matrix |
03-postauthorize-side-effect.txt |
@PostAuthorize runs the method body before denying |
04-forged-owner.txt |
hasPermission(#doc, ...) trusts the caller's object; the id-only variant does not |
05-load-counts.txt |
document loads per call: get, list, @PostFilter by id |
06-cache-and-staleness.txt |
a caching evaluator saves loads and serves a stale allow |
07-http-status-codes.txt |
401, 200, 403 over HTTP Basic, including a missing document |
Profiles: handler registers the MethodSecurityExpressionHandler bean, cache adds the caching evaluator.