asmhatreandClaude Sonnet 5.5
d1b9339951
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6
21 lines
1.4 KiB
Markdown
21 lines
1.4 KiB
Markdown
# permission-evaluator
|
|
|
|
Companion code for [Spring Security hasPermission() with PermissionEvaluator and @EnableMethodSecurity](https://ankurm.com/spring-security-haspermission-permissionevaluator-method-security/).
|
|
|
|
A `Document` has an owner and a team. `DocumentPermissionEvaluator` decides: admins can do everything, the owner or a team-mate can read, only the owner can write or delete.
|
|
|
|
Run it: `mvn test` (JDK 25, Spring Boot 4.1.2, Spring Security 7.1.2). Each test writes what it observed to [`output/`](output).
|
|
|
|
| file | what it shows |
|
|
|---|---|
|
|
| `00-denyall-log.txt` | log lines from the bean-only setup: Spring Security's default evaluator denies |
|
|
| `01-bean-only-wiring.txt` | only a `PermissionEvaluator` bean, no handler bean: everything is denied |
|
|
| `02-explicit-handler-matrix.txt` | with a `MethodSecurityExpressionHandler` bean: the allow/deny matrix |
|
|
| `03-postauthorize-side-effect.txt` | `@PostAuthorize` runs the method body before denying |
|
|
| `04-forged-owner.txt` | `hasPermission(#doc, ...)` trusts the caller's object; the id-only variant does not |
|
|
| `05-load-counts.txt` | document loads per call: `get`, `list`, `@PostFilter` by id |
|
|
| `06-cache-and-staleness.txt` | a caching evaluator saves loads and serves a stale allow |
|
|
| `07-http-status-codes.txt` | 401, 200, 403 over HTTP Basic, including a missing document |
|
|
|
|
Profiles: `handler` registers the `MethodSecurityExpressionHandler` bean, `cache` adds the caching evaluator.
|