SEC-16: BasicAclEntryAfterInvocationCollectionFilteringProvider reflectively process domain object Collections and Arrays about spring-security

[spring-projects-issues]

Ben Alex said:

Should be against component SecurityACL.

[spring-projects-issues]

Luke Taylor said:

I think this requirement should (at least partially) be possible using the new expression syntax. For example, if filtering a Person domain object, the expression

hasPermission(filterObject, ‘read’) and hasPermission(filterObject.address, ‘read’)

should evaluate the read permission on both the object itself and a contained “address”. It should also be possible to extend the logic to handle checking permissions on each member of a collection directly e.g.

hasPermission(filterObject, ‘read’) and hasPermission(filterObject.addresses, ‘read’)

[spring-projects-issues]

Luke Taylor said:

Closing. As indicated, the expression support allows for more sophisticated ACL controls than just at the level of a collection argument.