I am trying to restrict saving a certain object (a Stream
) with an expression in the StreamRepository
.
My domain model structure is as follows: a Project
has an owner and a list of members, which are both of the type Account
, these are linked to Users in the application. A stream belongs to a project.
I have this:
@PreAuthorize("#stream?.project?.owner?.name == authentication?.name")
Stream save(@Param("stream") Stream stream);
That should work, but I also want members of projects (which are the same kind of object as owner) to be able to add streams to a project.
I tried the following:
@PreAuthorize("#stream?.project?.owner?.name == authentication?.name or authentication?.name in #stream?.project?.members?.name")
Stream save(@Param("stream") Stream stream);
But that is throwing the error: org.springframework.expression.spel.SpelParseException: EL1041E: After parsing a valid expression, there is still more data in the expression: 'in'
I also tried:
@PreAuthorize("#stream?.project?.owner?.name == authentication?.name or #stream?.project?.members?.name contains authentication?.name")
But that leads to the exception: Caused by: org.springframework.expression.spel.SpelParseException: EL1041E: After parsing a valid expression, there is still more data in the expression: 'contains'
Then I tried: @PreAuthorize("#stream?.project?.owner?.name == authentication?.name or #stream?.project?.members?.name.contains(authentication?.name)")
and it's not throwing errors anymore on startup. But now I am getting this runtime error when I try to insert a Stream: Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1008E: Property or field 'name' cannot be found on object of type 'org.hibernate.collection.internal.PersistentBag' - maybe not public?
I would hope I don't have to make the 'name' field public in my Account object, but I did make it public just to try and the error is the same.
(prePostEnable=true)
something like this?