1

I am trying to restrict saving a certain object (a Stream) with an expression in the StreamRepository.

My domain model structure is as follows: a Project has an owner and a list of members, which are both of the type Account, these are linked to Users in the application. A stream belongs to a project.

I have this:

   @PreAuthorize("#stream?.project?.owner?.name == authentication?.name")
   Stream save(@Param("stream") Stream stream);

That should work, but I also want members of projects (which are the same kind of object as owner) to be able to add streams to a project.

I tried the following:

   @PreAuthorize("#stream?.project?.owner?.name == authentication?.name or authentication?.name in #stream?.project?.members?.name")
   Stream save(@Param("stream") Stream stream);

But that is throwing the error: org.springframework.expression.spel.SpelParseException: EL1041E: After parsing a valid expression, there is still more data in the expression: 'in'

I also tried:

@PreAuthorize("#stream?.project?.owner?.name == authentication?.name or #stream?.project?.members?.name contains authentication?.name")

But that leads to the exception: Caused by: org.springframework.expression.spel.SpelParseException: EL1041E: After parsing a valid expression, there is still more data in the expression: 'contains'

Then I tried: @PreAuthorize("#stream?.project?.owner?.name == authentication?.name or #stream?.project?.members?.name.contains(authentication?.name)") and it's not throwing errors anymore on startup. But now I am getting this runtime error when I try to insert a Stream: Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E: Property or field 'name' cannot be found on object of type 'org.hibernate.collection.internal.PersistentBag' - maybe not public?

I would hope I don't have to make the 'name' field public in my Account object, but I did make it public just to try and the error is the same.

2
  • Did you configure method security config ? (prePostEnable=true) something like this? Feb 8, 2018 at 11:35
  • @AtaurRahmanMunna yes I did, note there is actually an exception thrown. I have applied security like this in simpler cases for other objects. Feb 8, 2018 at 11:37

0

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.