Examples with PostAuthorize org.springframework.security.access.prepost.PostAuthorize used on opensource projects

Example 1 with PostAuthorize

use of org.springframework.security.access.prepost.PostAuthorize in project ArachneCentralAPI by OHDSI.

the class BaseSubmissionInsightServiceImpl method getSubmissionInsight.

@Override
@PostAuthorize("@ArachnePermissionEvaluator.addPermissions(principal, returnObject )")
public SubmissionInsight getSubmissionInsight(Long submissionId) throws NotExistException {
    final SubmissionInsight insight = submissionInsightRepository.findOneBySubmissionId(submissionId);
    throwNotExistExceptionIfNull(insight, submissionId);
    return insight;
}

Example 2 with PostAuthorize

use of org.springframework.security.access.prepost.PostAuthorize in project ArachneCentralAPI by OHDSI.

the class BasePaperServiceImpl method update.

@PreAuthorize("hasPermission(#paper.id, 'Paper', " + "T(com.odysseusinc.arachne.portal.security.ArachnePermission).EDIT_PAPER)")
@PostAuthorize("@ArachnePermissionEvaluator.processPermissions(principal, returnObject )")
@Override
public P update(P paper) {
    final P exists = getPaperByIdOrThrow(paper.getId());
    final PublishState publishState = paper.getPublishState();
    if (publishState != null && validatePublishStateTransition(publishState, exists)) {
        exists.setPublishState(publishState);
        exists.setPublishedDate(publishState == PublishState.PUBLISHED ? new Date() : null);
    }
    beforePaperUpdate(exists, paper);
    P save = paperRepository.save(exists);
    afterPaperUpdate(exists, paper);
    return save;
}

Example 3 with PostAuthorize

use of org.springframework.security.access.prepost.PostAuthorize in project motech by motech.

the class SecurityAnnotationBeanPostProcessor method postProcessAfterInitialization.

/**
 * Searches for {@link org.springframework.security.access.prepost.PreAuthorize}
 * and {@link org.springframework.security.access.prepost.PostAuthorize} annotations
 * representing permissions and parses them. Parsed annotations are used
 * to find permissions. After that those permissions are added to
 * {@link org.motechproject.security.service.MotechPermissionService}
 *
 * @param bean to be processed
 * @param beanName name of the bean
 * @return processed bean
 */
@Override
public Object postProcessAfterInitialization(final Object bean, final String beanName) {
    LOGGER.debug("Searching for security annotations in: {}", beanName);
    doWithMethods(bean.getClass(), new MethodCallback() {

        @Override
        public void doWith(Method method) throws IllegalAccessException {
            Method methodOfOriginalClassIfProxied = findMethod(getTargetClass(bean), method.getName(), method.getParameterTypes());
            if (methodOfOriginalClassIfProxied != null) {
                PreAuthorize preAuthorize = findAnnotation(methodOfOriginalClassIfProxied, PreAuthorize.class);
                PostAuthorize postAuthorize = findAnnotation(methodOfOriginalClassIfProxied, PostAuthorize.class);
                List<String> annotations = new ArrayList<>(2);
                List<String> permissions = new ArrayList<>();
                if (preAuthorize != null) {
                    annotations.add(preAuthorize.value());
                }
                if (postAuthorize != null) {
                    annotations.add(postAuthorize.value());
                }
                for (String annotation : annotations) {
                    SpelExpression expression = (SpelExpression) annotationParser.parseExpression(annotation);
                    permissions.addAll(findPermissions(expression.getAST()));
                }
                addRoleAndPermissions(permissions);
            }
        }
    });
    LOGGER.debug("Searched for security annotations in: {}", beanName);
    return bean;
}

Example 4 with PostAuthorize

use of org.springframework.security.access.prepost.PostAuthorize in project xm-ms-entity by xm-online.

the class XmEntitySpecResource method getTypeSpec.

/**
 * GET  /xm-entity-specs/:key : get the "key" typeSpec.
 *
 * @param key the key of the typeSpec to retrieve
 * @return the ResponseEntity with status 200 (OK) and with body the typeSpec, or with status 404 (Not Found)
 */
@GetMapping("/xm-entity-specs/{key}")
@Timed
@PostAuthorize("hasPermission({'returnObject': returnObject.body}, 'XMENTITY_SPEC.GET_LIST.ITEM')")
public ResponseEntity<TypeSpec> getTypeSpec(@PathVariable String key) {
    log.debug("REST request to get TypeSpec : {}", key);
    TypeSpec typeSpec = xmEntitySpecService.findTypeByKey(key);
    return RespContentUtil.wrapOrNotFound(Optional.ofNullable(typeSpec));
}

Example 5 with PostAuthorize

use of org.springframework.security.access.prepost.PostAuthorize in project ArachneCentralAPI by OHDSI.

the class BaseSubmissionServiceImpl method getSubmissionGroups.

@Override
@PreAuthorize("hasPermission(#submissoinGroupSearch.analysisId,  'Analysis', " + "T(com.odysseusinc.arachne.portal.security.ArachnePermission).ACCESS_STUDY)")
@PostAuthorize("@ArachnePermissionEvaluator.addPermissionsToSubmissions(principal, returnObject )")
public Page<SubmissionGroup> getSubmissionGroups(SubmissionGroupSearch submissoinGroupSearch) {
    final SubmissionGroupSpecification submissionGroupSpecification = new SubmissionGroupSpecification(submissoinGroupSearch);
    final Integer page = submissoinGroupSearch.getPage();
    final PageRequest pageRequest = PageRequest.of(page == null ? 0 : page - 1, submissoinGroupSearch.getPageSize(), Sort.by(Sort.Direction.DESC, "created"));
    final Page<SubmissionGroup> submissionGroups = submissionGroupRepository.findAll(submissionGroupSpecification, pageRequest);
    final List<SubmissionGroup> content = submissionGroups.getContent();
    final Map<Long, SubmissionGroup> submissionGroupMap = content.stream().collect(Collectors.toMap(SubmissionGroup::getId, sg -> {
        sg.setSubmissions(new ArrayList<>());
        return sg;
    }));
    final Set<Long> submissionGroupIds = submissionGroupMap.keySet();
    if (!CollectionUtils.isEmpty(submissionGroupIds)) {
        final SubmissionSpecification<T> submissionSpecification = SubmissionSpecification.<T>builder(submissionGroupIds).withStatuses(submissoinGroupSearch.getSubmissionStatuses()).withDataSourceIds(submissoinGroupSearch.getDataSourceIds()).hasInsight(submissoinGroupSearch.getHasInsight()).showHidden(submissoinGroupSearch.getShowHidden()).build();
        submissionRepository.findAll(submissionSpecification).forEach(s -> submissionGroupMap.get(s.getSubmissionGroup().getId()).getSubmissions().add(s));
    }
    return submissionGroups;
}