Spring Data Rest doesn't rollback after Access Denied Exception - spring-boot

Question

I have an application built with Spring Data Rest, when saving an entity using an unauthorized account through preAuthorize, the system throws the Access Denied exception, however the registration is performed. Analyzing the log below it is possible to see a jpaTransaction performing a flush and updating the entity before the exception. Can anyone tell me how to avoid saving in this case or how I can perform a rollback?
... com.mysql.cj.jdbc.result.ResultSetImpl#2393ebf8]
2022-10-19 13:20:11.320 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Closing prepared statement [HikariProxyPreparedStatement#91893682 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: select chain0_.category_id as category1_3_0_, c... where chain0_.category_id=13122]
2022-10-19 13:20:11.321 TRACE 705721 --- [nio-8080-exec-6] o.h.e.j.i.JdbcCoordinatorImpl : Starting after statement execution processing [ON_CLOSE]
2022-10-19 13:20:11.321 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.StatefulPersistenceContext : Initializing non-lazy collections
2022-10-19 13:20:11.321 DEBUG 705721 --- [nio-8080-exec-6] stractLoadPlanBasedCollectionInitializer : Done loading collection
2022-10-19 13:20:11.321 TRACE 705721 --- [nio-8080-exec-6] DefaultInitializeCollectionEventListener : Collection initialized
2022-10-19 13:20:13.373 DEBUG 705721 --- [SchedulerThread] o.q.c.QuartzSchedulerThread : batch acquisition of 0 triggers
2022-10-19 13:20:13.423 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.name is dirty
2022-10-19 13:20:13.423 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.updateDate is dirty
2022-10-19 13:20:13.423 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.DefaultFlushEntityEventListener : Found dirty properties [[com.springboot.api.entities.Category#13122]] : [name, updateDate]
2022-10-19 13:20:13.423 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Versioning : Incrementing: 76 to 77
2022-10-19 13:20:13.424 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.Collections : Collection found: [com.springboot.api.entities.Category.chain#13122], was: [com.springboot.api.entities.Category.chain#13122] (initialized)
2022-10-19 13:20:13.424 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Processing unreferenced collections
2022-10-19 13:20:13.425 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Scheduling collection removes/(re)creates/updates
2022-10-19 13:20:13.425 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushed: 0 insertions, 1 updates, 0 deletions to 2 objects
2022-10-19 13:20:13.425 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushed: 0 (re)creations, 0 updates, 0 removals to 1 collections
2022-10-19 13:20:13.425 DEBUG 705721 --- [nio-8080-exec-6] o.h.i.u.EntityPrinter : Listing entities:
2022-10-19 13:20:13.425 DEBUG 705721 --- [nio-8080-exec-6] o.h.i.u.EntityPrinter : com.springboot.api.entities.Category{chain=[], updateDate=2022-10-19T13:20:08.095108, typeCategoryResultReports=NOT_APPLIED, businessAccount=com.springboot.api.entities.BusinessAccount#13119, description=Conta somatória de vendas dos produtos e serviços., typeResultReports=NOT_APPLIED_TO_DRE, typeCategory=INCOME, version=77, ordder=1, deleted=false, name=RECEITAS DE VENDAS 789, parentCategory=null, id=13122, createDate=2022-07-25T11:06:40, enumerated=1}
2022-10-19 13:20:13.426 DEBUG 705721 --- [nio-8080-exec-6] o.h.i.u.EntityPrinter : com.springboot.api.entities.BusinessAccount{updateDate=2022-07-25T11:07:46, active=true, contactPerson=Erik, version=1, legalName=Erick e Tatiane Restaurante Ltda, deleted=false, blocked=false, phone=1138234204, name=ERIT Restaurante Ltda, tin=02669055000114, id=13119, businessAccountParent=null, email=timlerirde#vusra.com, createDate=2022-07-25T11:06:36}
2022-10-19 13:20:13.426 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.DefaultAutoFlushEventListener : Don't need to execute flush
2022-10-19 13:20:13.426 TRACE 705721 --- [nio-8080-exec-6] o.h.e.q.s.HQLQueryPlan : Find: select b from BusinessAccount b where b.deleted = false and b.id = :id
2022-10-19 13:20:13.426 TRACE 705721 --- [nio-8080-exec-6] o.h.e.s.QueryParameters : Named parameters: {id=13119}
2022-10-19 13:20:13.426 DEBUG 705721 --- [nio-8080-exec-6] o.h.SQL : select businessac0_.id as id1_1_, ... where businessac0_.deleted=0 and businessac0_.id=?
2022-10-19 13:20:13.427 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Registering statement [HikariProxyPreparedStatement#1827444228 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: select businessac0_.id as id1_1_, businessac0_.active as active2_1_, ... businessac0_.id=** NOT SPECIFIED **]
2022-10-19 13:20:13.427 TRACE 705721 --- [nio-8080-exec-6] o.h.e.j.i.JdbcCoordinatorImpl : Registering last query statement [HikariProxyPreparedStatement#1827444228 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: select businessac0_.id as id1_1_, businessac0_.active as active2_1_, ... businessac0_.version as version13_1_ from business_account businessac0_ where businessac0_.deleted=0 and businessac0_.id=** NOT SPECIFIED **]
2022-10-19 13:20:13.428 TRACE 705721 --- [nio-8080-exec-6] o.h.t.d.s.BasicBinder : binding parameter [1] as [BIGINT] - [13119]
2022-10-19 13:20:13.428 TRACE 705721 --- [nio-8080-exec-6] o.h.l.Loader : Bound [2] parameters total
2022-10-19 13:20:13.583 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Registering result set [HikariProxyResultSet#212627179 wrapping com.mysql.cj.jdbc.result.ResultSetImpl#305c88ad]
2022-10-19 13:20:13.584 TRACE 705721 --- [nio-8080-exec-6] o.h.l.Loader : Processing result set
2022-10-19 13:20:13.584 DEBUG 705721 --- [nio-8080-exec-6] o.h.l.Loader : Result set row: 0
2022-10-19 13:20:13.584 TRACE 705721 --- [nio-8080-exec-6] o.h.t.d.s.BasicExtractor : extracted value ([id1_1_] : [BIGINT]) - [13119]
2022-10-19 13:20:13.585 DEBUG 705721 --- [nio-8080-exec-6] o.h.l.Loader : Result row: EntityKey[com.springboot.api.entities.BusinessAccount#13119]
2022-10-19 13:20:13.585 TRACE 705721 --- [nio-8080-exec-6] o.h.l.Loader : Done processing result set (1 rows)
2022-10-19 13:20:13.585 TRACE 705721 --- [nio-8080-exec-6] o.h.l.Loader : Total objects hydrated: 0
2022-10-19 13:20:13.586 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Releasing statement [HikariProxyPreparedStatement#1827444228 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: select businessac0_.id as id1_1_, businessac0_.active as active2_1_, businessac0_.blocked as blocked3_1_, businessac0_.business_account_parent_id as busines14_1_, businessac0_.contact_person as contact_4_1_, businessac0_.create_date as create_d5_1_, businessac0_.deleted as deleted6_1_, businessac0_.email as email7_1_, businessac0_.legal_name as legal_na8_1_, businessac0_.name as name9_1_, businessac0_.phone as phone10_1_, businessac0_.tin as tin11_1_, businessac0_.update_date as update_12_1_, businessac0_.version as version13_1_ from business_account businessac0_ where businessac0_.deleted=0 and businessac0_.id=13119]
2022-10-19 13:20:13.586 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Closing result set [HikariProxyResultSet#212627179 wrapping com.mysql.cj.jdbc.result.ResultSetImpl#305c88ad]
2022-10-19 13:20:13.586 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Closing prepared statement [HikariProxyPreparedStatement#1827444228 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: select businessac0_.id as id1_1_, businessac0_.active as active2_1_, businessac0_.blocked as blocked3_1_, businessac0_.business_account_parent_id as busines14_1_, businessac0_.contact_person as contact_4_1_, businessac0_.create_date as create_d5_1_, businessac0_.deleted as deleted6_1_, businessac0_.email as email7_1_, businessac0_.legal_name as legal_na8_1_, businessac0_.name as name9_1_, businessac0_.phone as phone10_1_, businessac0_.tin as tin11_1_, businessac0_.update_date as update_12_1_, businessac0_.version as version13_1_ from business_account businessac0_ where businessac0_.deleted=0 and businessac0_.id=13119]
2022-10-19 13:20:13.586 TRACE 705721 --- [nio-8080-exec-6] o.h.e.j.i.JdbcCoordinatorImpl : Starting after statement execution processing [ON_CLOSE]
2022-10-19 13:20:13.586 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.StatefulPersistenceContext : Initializing non-lazy collections
2022-10-19 13:20:13.589 TRACE 705721 --- [nio-8080-exec-6] o.s.t.i.TransactionInterceptor : Completing transaction for [org.springframework.data.jpa.repository.support.SimpleJpaRepository.findById]
2022-10-19 13:20:13.589 TRACE 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Triggering beforeCommit synchronization
2022-10-19 13:20:13.589 TRACE 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Triggering beforeCompletion synchronization
2022-10-19 13:20:13.589 DEBUG 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Initiating transaction commit
2022-10-19 13:20:13.589 DEBUG 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Committing JPA transaction on EntityManager [SessionImpl(329218779PersistenceContext[entityKeys=[EntityKey[com.springboot.api.entities.Category#13122], EntityKey[com.springboot.api.entities.BusinessAccount#13119]], collectionKeys=[CollectionKey[com.springboot.api.entities.Category.chain#13122]]];ActionQueue[insertions=ExecutableList{size=0} updates=ExecutableList{size=0} deletions=ExecutableList{size=0} orphanRemovals=ExecutableList{size=0} collectionCreations=ExecutableList{size=0} collectionRemovals=ExecutableList{size=0} collectionUpdates=ExecutableList{size=0} collectionQueuedOps=ExecutableList{size=0} unresolvedInsertDependencies=null])]
2022-10-19 13:20:13.589 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.t.i.TransactionImpl : committing
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] cResourceLocalTransactionCoordinatorImpl : ResourceLocalTransactionCoordinatorImpl#beforeCompletionCallback
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] o.h.i.SessionImpl : SessionImpl#beforeTransactionCompletion()
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] o.h.i.SessionImpl : Automatically flushing session
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushing session
2022-10-19 13:20:13.590 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Processing flush-time cascades
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Cascade : Processing cascade ACTION_PERSIST_ON_FLUSH for: com.springboot.api.entities.Category
2022-10-19 13:20:13.590 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Cascade : Done processing cascade ACTION_PERSIST_ON_FLUSH for: com.springboot.api.entities.Category
2022-10-19 13:20:13.591 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Cascade : Processing cascade ACTION_PERSIST_ON_FLUSH for: com.springboot.api.entities.BusinessAccount
2022-10-19 13:20:13.592 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Cascade : Done processing cascade ACTION_PERSIST_ON_FLUSH for: com.springboot.api.entities.BusinessAccount
2022-10-19 13:20:13.592 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Dirty checking collections
2022-10-19 13:20:13.592 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushing entities and processing referenced collections
2022-10-19 13:20:13.593 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.name is dirty
2022-10-19 13:20:13.593 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.updateDate is dirty
2022-10-19 13:20:13.593 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.version is dirty
2022-10-19 13:20:13.593 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.DefaultFlushEntityEventListener : Found dirty properties [[com.springboot.api.entities.Category#13122]] : [name, updateDate, version]
2022-10-19 13:20:13.593 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.DefaultFlushEntityEventListener : Updating entity: [com.springboot.api.entities.Category#13122]
2022-10-19 13:20:16.443 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.name is dirty
2022-10-19 13:20:16.444 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.updateDate is dirty
2022-10-19 13:20:16.444 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : com.springboot.api.entities.Category.version is dirty
2022-10-19 13:20:16.444 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.DefaultFlushEntityEventListener : Found dirty properties [[com.springboot.api.entities.Category#13122]] : [name, updateDate, version]
2022-10-19 13:20:16.444 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.Versioning : Incrementing: 76 to 77
2022-10-19 13:20:16.445 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.Collections : Collection found: [com.springboot.api.entities.Category.chain#13122], was: [com.springboot.api.entities.Category.chain#13122] (initialized)
2022-10-19 13:20:16.445 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Processing unreferenced collections
2022-10-19 13:20:16.445 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Scheduling collection removes/(re)creates/updates
2022-10-19 13:20:16.445 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushed: 0 insertions, 1 updates, 0 deletions to 2 objects
2022-10-19 13:20:16.445 DEBUG 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Flushed: 0 (re)creations, 0 updates, 0 removals to 1 collections
2022-10-19 13:20:16.445 DEBUG 705721 --- [nio-8080-exec-6] o.h.i.u.EntityPrinter : Listing entities:
2022-10-19 13:20:16.446 DEBUG 705721 --- [nio-8080-exec-6] o.h.i.u.EntityPrinter : com.springboot.api.entities.Category{chain=[], updateDate=2022-10-19T13:20:13.593846, typeCategoryResultReports=NOT_APPLIED, businessAccount=com.springboot.api.entities.BusinessAccount#13119, description=Conta somatória de vendas dos produtos e serviços., typeResultReports=NOT_APPLIED_TO_DRE, typeCategory=INCOME, version=77, ordder=1, deleted=false, name=RECEITAS DE VENDAS 789, ...
2022-10-19 13:20:16.446 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Executing flush
2022-10-19 13:20:16.447 TRACE 705721 --- [nio-8080-exec-6] o.h.v.i.e.c.SimpleConstraintTree : Validating value RECEITAS DE VENDAS 789 against constraint defined by ConstraintDescriptorImpl{annotation=j.v.c.NotEmpty, payloads=[], hasComposingConstraints=true, isReportAsSingleInvalidConstraint=false, elementType=FIELD, definedOn=DEFINED_LOCALLY, groups=[interface javax.validation.groups.Default], attributes={groups=[Ljava.lang.Class;#7375d1f6, message={name.required}, payload=[Ljava.lang.Class;#261e67fb}, constraintType=GENERIC, valueUnwrapping=DEFAULT}.
2022-10-19 13:20:16.454 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : Updating entity: [com.springboot.api.entities.Category#13122]
2022-10-19 13:20:16.454 TRACE 705721 --- [nio-8080-exec-6] o.h.p.e.AbstractEntityPersister : Existing version: 76 -> New version:77
2022-10-19 13:20:16.454 DEBUG 705721 --- [nio-8080-exec-6] o.h.SQL : update category set business_account_id=?, create_date=?, deleted=?, description=?, enumerated=?, name=?, ordder=?, parent_category_id=?, type_category=?, type_category_result_reports=?, type_result_reports=?, update_date=?, version=? where id=? and version=?
...
2022-10-19 13:20:16.461 TRACE 705721 --- [nio-8080-exec-6] o.h.t.d.s.BasicBinder : binding parameter [15] as [INTEGER] - [76]
2022-10-19 13:20:16.627 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Releasing statement [HikariProxyPreparedStatement#1680526329 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: update category set business_account_id=13119, create_date='2022-07-25 11:06:40.0', deleted=0, description='Conta somatória de vendas dos produtos e serviços.', enumerated='1', name='RECEITAS DE VENDAS 789', ordder='1', parent_category_id=null, type_category='INCOME', type_category_result_reports='NOT_APPLIED', type_result_reports='NOT_APPLIED_TO_DRE', update_date='2022-10-19 13:20:13.593846', version=77 where id=13122 and version=76]
2022-10-19 13:20:16.628 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Closing prepared statement [HikariProxyPreparedStatement#1680526329 wrapping com.mysql.cj.jdbc.ClientPreparedStatement: update category set business_account_id=13119, create_date='2022-07-25 11:06:40.0', deleted=0, description='Conta somatória de vendas dos produtos e serviços.', enumerated='1', name='RECEITAS DE VENDAS 789', ordder='1', parent_category_id=null, type_category='INCOME', type_category_result_reports='NOT_APPLIED', type_result_reports='NOT_APPLIED_TO_DRE', update_date='2022-10-19 13:20:13.593846', version=77 where id=13122 and version=76]
2022-10-19 13:20:16.628 TRACE 705721 --- [nio-8080-exec-6] o.h.e.j.i.JdbcCoordinatorImpl : Starting after statement execution processing [ON_CLOSE]
2022-10-19 13:20:16.629 TRACE 705721 --- [nio-8080-exec-6] o.h.e.j.i.JdbcCoordinatorImpl : Starting after statement execution processing [ON_CLOSE]
2022-10-19 13:20:16.629 TRACE 705721 --- [nio-8080-exec-6] o.h.e.i.AbstractFlushingEventListener : Post flush
2022-10-19 13:20:16.629 TRACE 705721 --- [nio-8080-exec-6] .t.i.SynchronizationRegistryStandardImpl : SynchronizationRegistryStandardImpl.notifySynchronizationsBeforeTransactionCompletion
2022-10-19 13:20:16.629 TRACE 705721 --- [nio-8080-exec-6] j.i.AbstractLogicalConnectionImplementor : Preparing to commit transaction via JDBC Connection.commit()
2022-10-19 13:20:16.786 TRACE 705721 --- [nio-8080-exec-6] j.i.AbstractLogicalConnectionImplementor : Transaction committed via JDBC Connection.commit()
2022-10-19 13:20:16.787 TRACE 705721 --- [nio-8080-exec-6] j.i.AbstractLogicalConnectionImplementor : re-enabling auto-commit on JDBC Connection after completion of JDBC-based transaction
2022-10-19 13:20:16.940 TRACE 705721 --- [nio-8080-exec-6] j.i.AbstractLogicalConnectionImplementor : LogicalConnection#afterTransaction
2022-10-19 13:20:16.940 TRACE 705721 --- [nio-8080-exec-6] o.h.r.j.i.ResourceRegistryStandardImpl : Releasing JDBC resources
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] cResourceLocalTransactionCoordinatorImpl : ResourceLocalTransactionCoordinatorImpl#afterCompletionCallback(true)
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] .t.i.SynchronizationRegistryStandardImpl : SynchronizationRegistryStandardImpl.notifySynchronizationsAfterTransactionCompletion(3)
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] o.h.i.SessionImpl : SessionImpl#afterTransactionCompletion(successful=true, delayed=false)
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Triggering afterCommit synchronization
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] .s.t.s.TransactionSynchronizationManager : Clearing transaction synchronization
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Triggering afterCompletion synchronization
2022-10-19 13:20:16.941 TRACE 705721 --- [nio-8080-exec-6] .s.t.s.TransactionSynchronizationManager : Removed value [org.springframework.jdbc.datasource.ConnectionHolder#710d834f] for key [HikariDataSource (HikariPool-10)] from thread [http-nio-8080-exec-6]
2022-10-19 13:20:16.942 DEBUG 705721 --- [nio-8080-exec-6] o.s.o.j.JpaTransactionManager : Not closing pre-bound JPA EntityManager after transaction
2022-10-19 13:20:16.952 TRACE 705721 --- [nio-8080-exec-6] .w.s.m.m.a.ServletInvocableHandlerMethod : Arguments: [org.springframework.data.rest.webmvc.RootResourceInformation#6e5097f2, Resource { content: Category(id=13122, name=RECEITAS DE VENDAS 789, description=Conta somatória de vendas dos produtos e serviços., parentCategory=null, chain=null, typeCategory=INCOME, typeResultReports=NOT_APPLIED_TO_DRE, ordder=1, typeCategoryResultReports=NOT_APPLIED, businessAccount=BusinessAccount(id=13119, name=ERIT Restaurante Ltda, legalName=Erick e Tatiane Restaurante Ltda, tin=02669055000114, email=timlerirde#vusra.com, phone=1138234204, contactPerson=Erik, businessAccountParent=null, active=true, blocked=false, deleted=false, createDate=2022-07-25T11:06:36, updateDate=2022-07-25T11:07:46, version=1), deleted=false, createDate=2022-07-25T11:06:40, updateDate=2022-10-19T13:20:13.593846, version=76, enumerated=1, unselectable=false), links: [] }, 13122, org.springframework.data.rest.webmvc.PersistentEntityResourceAssembler#299ef425, null, application/json;charset=UTF-8]
...
2022-10-19 13:20:16.959 TRACE 705721 --- [nio-8080-exec-6] o.s.b.f.s.DefaultListableBeanFactory : Returning cached instance of singleton bean 'persistentEntities'
2022-10-19 13:20:16.960 TRACE 705721 --- [nio-8080-exec-6] .PrePostAnnotationSecurityMetadataSource : Looking for Pre/Post annotations for method 'save' on target class 'class com.sun.proxy.$Proxy552'
2022-10-19 13:20:16.961 DEBUG 705721 --- [nio-8080-exec-6] .PrePostAnnotationSecurityMetadataSource : #org.springframework.security.access.prepost.PreAuthorize(value=hasAuthority('ROLE_ADMIN') or (#category.businessAccount.id == principal.businessAccountId && hasAuthority('MODULE_FINANCE_AND_ACCOUNTING_WRITE'))) found on specific method: public final com.springboot.api.entities.Category com.sun.proxy.$Proxy552.save(com.springboot.api.entities.Category)
2022-10-19 13:20:16.961 DEBUG 705721 --- [nio-8080-exec-6] m.DelegatingMethodSecurityMetadataSource : Caching method [CacheKey[com.sun.proxy.$Proxy552; public abstract com.springboot.api.entities.Category com.springboot.api.repositories.CategoryRepository.save(com.springboot.api.entities.Category)]] with attributes [[authorize: 'hasAuthority('ROLE_ADMIN') or (#category.businessAccount.id == principal.businessAccountId && hasAuthority('MODULE_FINANCE_AND_ACCOUNTING_WRITE'))', filter: 'null', filterTarget: 'null']]
2022-10-19 13:20:16.972 TRACE 705721 --- [nio-8080-exec-6] .PrePostAnnotationSecurityMetadataSource : Looking for Pre/Post annotations for method 'save' on target class 'class org.springframework.data.jpa.repository.support.SimpleJpaRepository'
2022-10-19 13:20:16.974 DEBUG 705721 --- [nio-8080-exec-6] .PrePostAnnotationSecurityMetadataSource : #org.springframework.security.access.prepost.PreAuthorize(value=hasAuthority('ROLE_ADMIN') or (#category.businessAccount.id == principal.businessAccountId && hasAuthority('MODULE_FINANCE_AND_ACCOUNTING_WRITE'))) found on specific method: public abstract com.springboot.api.entities.Category com.springboot.api.repositories.CategoryRepository.save(com.springboot.api.entities.Category)
...
2022-10-19 13:20:16.975 DEBUG 705721 --- [nio-8080-exec-6] o.s.s.a.i.a.MethodSecurityInterceptor : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken#5ebb3b09: Principal: com.springboot.api.security.JwtUser#37c7e936; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails#b364: RemoteIpAddress: 0:0:0:0:0:0:0:1; SessionId: null; Granted Authorities: ROLE_OPERATOR, MODULE_ACCOUNTS_MANAGEMENT_READ, MODULE_USERS_MANAGEMENT_READ, MODULE_HUMAN_RESOURCE_READ, MODULE_SALES_AND_MARKETING_READ, MODULE_PURCHASE_READ, MODULE_FINANCE_AND_ACCOUNTING_READ, MODULE_CUSTOMERS_RELATIONSHIP_MANAGEMENT_READ
2022-10-19 13:20:16.992 DEBUG 705721 --- [nio-8080-exec-6] o.s.s.a.v.AffirmativeBased : Voter: org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter#261e06ac, returned: -1
2022-10-19 13:20:16.992 DEBUG 705721 --- [nio-8080-exec-6] o.s.s.a.v.AffirmativeBased : Voter: org.springframework.security.access.annotation.Jsr250Voter#2b59105d, returned: 0
2022-10-19 13:20:16.992 DEBUG 705721 --- [nio-8080-exec-6] o.s.s.a.v.AffirmativeBased : Voter: org.springframework.security.access.vote.RoleVoter#ef6ea6b, returned: 0
2022-10-19 13:20:16.992 DEBUG 705721 --- [nio-8080-exec-6] o.s.s.a.v.AffirmativeBased : Voter: org.springframework.security.access.vote.AuthenticatedVoter#1e3b3303, returned: 0
2022-10-19 13:20:17.025 TRACE 705721 --- [nio-8080-exec-6] o.s.b.f.s.DefaultListableBeanFactory : Returning cached instance of singleton bean 'delegatingApplicationListener'
2022-10-19 13:20:17.025 TRACE 705721 --- [nio-8080-exec-6] o.s.b.f.s.DefaultListableBeanFactory : Returning cached instance of singleton bean 'springApplicationAdminRegistrar'
2022-10-19 13:20:17.025 TRACE 705721 --- [nio-8080-exec-6] o.s.b.f.s.DefaultListableBeanFactory : Returning cached instance of singleton bean 'liveReloadServerEventListener'
2022-10-19 13:20:17.036 DEBUG 705721 --- [nio-8080-exec-6] .m.m.a.ExceptionHandlerExceptionResolver : Using #ExceptionHandler com.springboot.api.controllers.ExceptionHandlerController#handleAccessDeniedException(AccessDeniedException, WebRequest)
2022-10-19 13:20:17.036 TRACE 705721 --- [nio-8080-exec-6] .w.s.m.m.a.ServletInvocableHandlerMethod : Arguments: [org.springframework.security.access.AccessDeniedException: Access is denied, ServletWebRequest: uri=/categories/13122;client=0:0:0:0:0:0:0:1;user=jo#eriti.com.br]
2022-10-19 13:20:17.037 ERROR 705721 --- [nio-8080-exec-6] c.s.a.c.ExceptionHandlerController : Access is denied
org.springframework.security.access.AccessDeniedException: Access is denied
at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65) ~[spring-security-core-5.2.1.RELEASE.jar:5.2.1.RELEASE]
Here is my Repository
#PreAuthorize("hasAuthority('ROLE_ADMIN')")
#Transactional(readOnly=true)
#RepositoryRestResource(collectionResourceRel = "categories", path = "categories")
public interface CategoryRepository extends PagingAndSortingRepository<Category, Long> {
#Transactional(readOnly=false)
#PreAuthorize("hasAuthority('ROLE_ADMIN') or (#category.businessAccount.id == principal.businessAccountId && "
+ "hasAuthority('MODULE_FINANCE_AND_ACCOUNTING_WRITE'))")
#Override
<S extends Category> S save(#Param("category") S file);
...
}
Here is my EventHandler
#Component
#RepositoryEventHandler(Category.class)
public class CategoryEventHandler {
#Autowired
private CategoryRepository categoryRepository;
#Autowired
private MessageSource messageSource;
#HandleBeforeCreate
public void handleEntityAccountBeforeCreate(Category category) throws Exception {
...
}
...
}
Here is my Security Config
...
#Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
.cors()
.and()
.csrf()
.disable()
.exceptionHandling()
.authenticationEntryPoint(unauthorizedHandler)
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers(AUTH_WHITELIST).permitAll()
.and()
.authorizeRequests()
.anyRequest()
.authenticated();
httpSecurity.addFilterBefore(authenticationTokenFilterBean(), UsernamePasswordAuthenticationFilter.class);
httpSecurity.headers().cacheControl();
}
...