Method Level Security

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(
    securedEnabled = true,   // @Secured  (default false)
    jsr250Enabled = true     // @RolesAllowed, @PermitAll, @DenyAll (default false)
)                            // prePostEnabled defaults to true
public class SecurityConfig {
    // SecurityFilterChain bean ...
}

@Service
public class OrderService {

    @PreAuthorize("hasRole('ADMIN')")
    public List<Order> findAllOrders() { ... }

    public void processOrders() {
        // BYPASSES the check: 'this' is the raw bean, not the proxy
        List<Order> orders = this.findAllOrders();
    }
}
// Fix: move the secured method to another bean and inject it,
// or decide that the internal caller is trusted and skip the annotation there.

@Service
@RequiredArgsConstructor
public class UserService {

    private final UserRepository userRepository;

    @PreAuthorize("hasRole('ADMIN')")
    public List<UserResponse> findAll() { ... }

    @PreAuthorize("hasAuthority('user:read')")
    public UserResponse findById(Long id) { ... }

    // Owner or admin. 'principal.id' needs a custom UserDetails that exposes getId();
    // the default User class has no id property.
    @PreAuthorize("hasRole('ADMIN') or #id == principal.id")
    public UserResponse findOwnProfileOrAny(Long id) { ... }

    // Fields of a request object
    @PreAuthorize("hasRole('ADMIN') or #request.email == authentication.name")
    public UserResponse update(Long id, UpdateUserRequest request) { ... }

    // Delegate non-trivial rules to a bean that is easy to test
    @PreAuthorize("@userAccess.canEdit(authentication, #id)")
    public UserResponse edit(Long id, EditUserRequest request) { ... }

    @PreAuthorize("isAuthenticated()")
    public UserResponse currentUser() {
        // read the user from SecurityContextHolder inside the method
    }
}

@Component("userAccess")
public class UserAccess {
    public boolean canEdit(Authentication auth, Long targetId) {
        return auth.getAuthorities().stream()
                   .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))
            || ((AppUser) auth.getPrincipal()).getId().equals(targetId);
    }
}

@Service
@RequiredArgsConstructor
public class DocumentService {

    private final DocumentRepository documentRepository;

    // Read-only check on the loaded object
    @PostAuthorize("returnObject.ownerUsername == authentication.name or hasRole('ADMIN')")
    public Document findById(Long id) {
        return documentRepository.findById(id).orElseThrow();
    }

    // Fine for small, bounded result sets only
    @PostFilter("filterObject.visibility == 'PUBLIC' or filterObject.ownerUsername == authentication.name")
    public List<Document> findByTag(String tag) {
        return documentRepository.findByTag(tag);   // must return a mutable collection
    }

    // Better for large data: let the database do the filtering
    @PreAuthorize("isAuthenticated()")
    public Page<Document> findVisible(Pageable pageable) {
        String username = SecurityContextHolder.getContext().getAuthentication().getName();
        return documentRepository.findVisibleTo(username, pageable);
    }

    @PreFilter(value = "filterObject.ownerUsername == authentication.name",
               filterTarget = "documents")   // required with more than one collection parameter
    public void archive(List<Document> documents, List<Long> auditIds) { ... }
}

@Service
public class AdminService {

    @Secured("ROLE_ADMIN")                       // prefix is part of the string
    public void purgeCache() { ... }

    @Secured({"ROLE_ADMIN", "ROLE_MODERATOR"})   // any of
    public void moderate() { ... }

    @RolesAllowed("ADMIN")                       // ROLE_ added automatically
    public void jsr250AdminAction() { ... }

    @PermitAll
    public void publicAction() { ... }

    @DenyAll
    public void disabled() { ... }
}

// These pairs behave the same:
//   @Secured("ROLE_ADMIN")   ==  @PreAuthorize("hasRole('ADMIN')")
//   @Secured("user:read")    ==  @PreAuthorize("hasAuthority('user:read')")

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface IsAdmin { }

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("isAuthenticated() and @userAccess.canEdit(authentication, #id)")
public @interface CanEditUser { }

@Service
public class ReportService {

    @IsAdmin
    public Report generateAuditReport() { ... }

    @CanEditUser
    public void resetPassword(Long id) { ... }
}

@Component
@RequiredArgsConstructor
public class DocumentPermissionEvaluator implements PermissionEvaluator {

    private final DocumentRepository documents;

    @Override
    public boolean hasPermission(Authentication auth, Object target, Object permission) {
        return target instanceof Document doc && check(auth, doc, permission.toString());
    }

    @Override
    public boolean hasPermission(Authentication auth, Serializable id,
                                 String type, Object permission) {
        if (!"Document".equals(type)) return false;
        return documents.findById((Long) id)
            .map(d -> check(auth, d, permission.toString()))
            .orElse(false);   // missing row reads as 403, not 404
    }

    private boolean check(Authentication auth, Document doc, String permission) {
        boolean owner = doc.getOwnerUsername().equals(auth.getName());
        boolean admin = auth.getAuthorities().stream()
            .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"));
        return switch (permission) {
            case "READ"   -> doc.isPublic() || owner || admin;
            case "WRITE", "DELETE" -> owner || admin;
            default       -> false;
        };
    }
}

@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig {

    @Bean
    static MethodSecurityExpressionHandler methodSecurityExpressionHandler(
            @Lazy DocumentPermissionEvaluator evaluator) {
        var handler = new DefaultMethodSecurityExpressionHandler();
        handler.setPermissionEvaluator(evaluator);
        return handler;
    }
}

@Service
public class DocumentService {

    @PreAuthorize("hasPermission(#doc, 'WRITE')")
    public Document save(Document doc) { ... }

    @PreAuthorize("hasPermission(#id, 'Document', 'DELETE')")
    public void delete(Long id) { ... }
}

@RestControllerAdvice
public class GlobalExceptionHandler {

    // Explicit mapping, so the catch-all below never swallows it
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ProblemDetail> handleDenied(AccessDeniedException ex) {
        ProblemDetail body = ProblemDetail.forStatusAndDetail(
            HttpStatus.FORBIDDEN, "You do not have permission to perform this action");
        return ResponseEntity.status(HttpStatus.FORBIDDEN).body(body);
    }

    @ExceptionHandler(Exception.class)
    public ResponseEntity<ProblemDetail> handleAny(Exception ex) throws Exception {
        if (ex instanceof AccessDeniedException || ex instanceof AuthenticationException) {
            throw ex;   // let Spring Security's filters respond
        }
        return ResponseEntity.internalServerError()
            .body(ProblemDetail.forStatus(HttpStatus.INTERNAL_SERVER_ERROR));
    }
}

// pom.xml
// <dependency>
//   <groupId>org.springframework.security</groupId>
//   <artifactId>spring-security-test</artifactId>
//   <scope>test</scope>
// </dependency>

@SpringJUnitConfig
class UserServiceSecurityTest {

    @Configuration
    @EnableMethodSecurity
    @Import(UserService.class)
    static class Config {
        @Bean UserRepository userRepository() { return mock(UserRepository.class); }
    }

    @Autowired UserService userService;

    @Test
    @WithMockUser(roles = "ADMIN")
    void findAll_allowedForAdmin() {
        assertThatNoException().isThrownBy(() -> userService.findAll());
    }

    @Test
    @WithMockUser(roles = "USER")
    void findAll_deniedForUser() {
        assertThatThrownBy(() -> userService.findAll())
            .isInstanceOf(AccessDeniedException.class);
    }

    @Test
    @WithMockUser(authorities = "user:read")    // authority, no ROLE_ prefix
    void findById_allowedWithAuthority() {
        assertThatNoException().isThrownBy(() -> userService.findById(1L));
    }

    @Test
    void findAll_deniedWhenAnonymous() {
        assertThatThrownBy(() -> userService.findAll())
            .isInstanceOf(AuthenticationCredentialsNotFoundException.class);
    }
}

@WebMvcTest(UserController.class)
class UserControllerSecurityTest {

    @Autowired MockMvc mockMvc;
    @MockitoBean UserService userService;

    @Test
    void getUsers_returns403WhenServiceDenies() throws Exception {
        when(userService.findAll()).thenThrow(new AccessDeniedException("denied"));

        mockMvc.perform(get("/api/users").with(user("bob").roles("USER")))
            .andExpect(status().isForbidden());
    }
}

// 1. Wrong prefix
@PreAuthorize("hasRole('ROLE_ADMIN')")   // BAD: checks ROLE_ROLE_ADMIN
@PreAuthorize("hasRole('ADMIN')")        // GOOD

// 2. Parameter name unavailable without -parameters
@PreAuthorize("#id == principal.id")     // may resolve #id to null
@PreAuthorize("#userId == principal.id")
public void update(@P("userId") Long id) { ... }

// 3. Write operation guarded after the fact
@PostAuthorize("returnObject.owner == authentication.name")
public Document rename(Long id, String name) { ... }   // BAD: already saved
@PreAuthorize("hasPermission(#id, 'Document', 'WRITE')")
public Document rename(Long id, String name) { ... }   // GOOD: checked first

// 4. Private methods are not intercepted
@PreAuthorize("hasRole('ADMIN')")
private void internalCleanup() { ... }                 // annotation ignored