Let CountryRepo be a Spring RepositoryRestResource
@RepositoryRestResource
public interface CountryRepo implements CrudRepository<Country, Long> { }
for a simple Country domain with country code and common name.
Can I override the methods and introduce method level security to allow only users with ADMIN role to send e.g. POST or DELETE requests?
@RepositoryRestResource
public interface CountryRepo extends CrudRepository<Country, Long> {
@Override
public Iterable<Country> findAll(); // <-- Globally allowed
@Override
@PreAuthorize("hasRole('ADMIN')")
public <S extends Country> S save(S entity); // <-- Only admins can create countries.
// ... Remaining methods from CRUD repository interface.
}
I'm trying to build a simple example to see if it works, but I think I'm having problem elsewhere, so interested in hearing if this at all is possible.
