Revize a1306c71

re #37 support for custom permission evaluators based on type

server/src/main/java/org/danekja/ymanager/MethodSecurityConfiguration.java

@@ -1 +1 @@
 package org.danekja.ymanager;
 
+import org.danekja.ymanager.business.auth.permissions.DelegatingPermissionEvaluator;
+import org.danekja.ymanager.business.auth.permissions.TypedPermissionEvaluator;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.access.PermissionEvaluator;
+import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
+import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration;
 
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
 @Configuration
 @EnableGlobalMethodSecurity (jsr250Enabled = true, prePostEnabled = true)
 public class MethodSecurityConfiguration extends GlobalMethodSecurityConfiguration {
+
+    private final List<TypedPermissionEvaluator> permissionEvaluators;
+
+    @Autowired
+    public MethodSecurityConfiguration(List<TypedPermissionEvaluator> permissionEvaluators) {
+        this.permissionEvaluators = permissionEvaluators;
+    }
+
+    @Override
+    protected MethodSecurityExpressionHandler createExpressionHandler() {
+        DefaultMethodSecurityExpressionHandler methodSecurityExpressionHandler = new DefaultMethodSecurityExpressionHandler();
+        methodSecurityExpressionHandler.setPermissionEvaluator(permissionEvaluator());
+
+        return methodSecurityExpressionHandler;
+    }
+
+    @Bean
+    public PermissionEvaluator permissionEvaluator() {
+        Map<String, PermissionEvaluator> map = new HashMap<>();
+
+        // Build lookup table of PermissionEvaluator by supported target type
+        for (TypedPermissionEvaluator permissionEvaluator : permissionEvaluators) {
+            map.put(permissionEvaluator.getTargetType(), permissionEvaluator);
+        }
+
+        return new DelegatingPermissionEvaluator(map);
+    }
 }

server/src/main/java/org/danekja/ymanager/business/auth/permissions/DelegatingPermissionEvaluator.java

@@ +1 @@
+package org.danekja.ymanager.business.auth.permissions;
+
+import org.springframework.security.access.PermissionEvaluator;
+import org.springframework.security.access.expression.DenyAllPermissionEvaluator;
+import org.springframework.security.core.Authentication;
+
+import java.io.Serializable;
+import java.util.Map;
+
+/**
+ * Custom permission evaluator which delegates permission check to other custom evaluators based on
+ * target type.
+ * <p>
+ * This mechanism allows for custom evaluator for each of domain classes -> different logic when evaluating permissions.
+ * <p>
+ * Documentation: <a href="https://insource.io/blog/articles/custom-authorization-with-spring-boot.html">Source</a>
+ */
+public class DelegatingPermissionEvaluator implements PermissionEvaluator {
+
+    private static final PermissionEvaluator denyAll = new DenyAllPermissionEvaluator();
+    private final Map<String, PermissionEvaluator> permissionEvaluators;
+
+    public DelegatingPermissionEvaluator(Map<String, PermissionEvaluator> permissionEvaluators) {
+        this.permissionEvaluators = permissionEvaluators;
+    }
+
+    @Override
+    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
+        PermissionEvaluator permissionEvaluator = permissionEvaluators.get(targetDomainObject.getClass().getSimpleName());
+        if (permissionEvaluator == null) {
+            permissionEvaluator = denyAll;
+        }
+
+        return permissionEvaluator.hasPermission(authentication, targetDomainObject, permission);
+    }
+
+    @Override
+    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
+        PermissionEvaluator permissionEvaluator = permissionEvaluators.get(targetType);
+        if (permissionEvaluator == null) {
+            permissionEvaluator = denyAll;
+        }
+
+        return permissionEvaluator.hasPermission(authentication, targetId, targetType, permission);
+    }
+}

server/src/main/java/org/danekja/ymanager/business/auth/permissions/TypedPermissionEvaluator.java

@@ +1 @@
+package org.danekja.ymanager.business.auth.permissions;
+
+import org.springframework.security.access.PermissionEvaluator;
+
+/**
+ * Custom {@link PermissionEvaluator} which is capable of checking
+ * user permissions for single type.
+ */
+public interface TypedPermissionEvaluator extends PermissionEvaluator {
+
+    /**
+     * @return simpleName of target type (class)
+     */
+    String getTargetType();
+
+}