Spring Security@preauthorize或

Question

最近我发现有一种使用Spring Security预授权方法的方法。但我不确定我是否可以实现我想要的注释。

@DeleteMapping("/delete/{configId}")
public ResponseEntity<Object> deleteMlpConfig(@RequestHeader HttpHeaders headers,
        @PathVariable("configId") long mlpConfigId, Authentication authentication) {
    MlpConfig config = mlpConfigService.findById(mlpConfigId);
    User user = userService.findByUsername(authentication.getName());

    if (config.getUser().equals(user)) {
        mlpConfigRepository.delete(config);
        return ResponseEntity.ok(new MessageResponse("Configuration removed successfully!"));
    } else {
        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Error: Unauthorized");
    }

}

@PreAuthorize("#config.user == authentication.id")

Answer 1

您可以通过执行以下操作来实现您想要的目标：

@Service
public class MlpConfigService {

    @Transactional
    public boolean ownedByUser(Long mlpConfigId, String name){
    
        MlpConfig config = mlpConfigService.findById(mlpConfigId);
        User user = userService.findByUsername(name);
        return config.getUser().equals(user);
    }
    
}

后来呢：

@PreAuthorize("@mlpConfigService.ownedByUser(#mlpConfigId, authentication.name)")