Spring Security: Authorization with domain logic - spring-boot

Question

Prerequisite
I'm using Spring Security to authenticate my users with firebase. During authentication I also extract the users roles from the JWT token and convert them into SimpleGrantedAuthorities.
In most cases I can use #PreAuthorize("hasRole('ROLE_ADMIN')") to apply authorization to an endpoint. But now I have a more complex authorization scenario.
I have a Service that fetches a Product, but only users who have purchased the product are allowed to receive it.
fun fetchProduct(val id: Int, userId: String) {
val product = productRepository.findById(id)
// only users that purchased the product are allowed to fetch it!
if (!product.isAccessibleAtNoCharge(userId) && !purchaseCheck.hasUserPurchased(userId, product.id)) {
throw ForbiddenException("User has not purchased product")
}
return product
}
What I want to achieve
My requirement is, that users with the role ROLE_ADMIN can bypass that check, so that they can access products without purchasing them before.
What I have tried
My only idea so far is to retrieve the roles from SecurityContext like so:
fun fetchProduct(val id: Int, userId: String) {
val product = productRepository.findById(id)
val isAdmin = SecurityContextHolder.getContext().authentication.authorities.any { it.authority == "ROLE_ADMIN" }
if(isAdmin) {
return product
} else {
// check if purchased
...
}
}
Considerations
I have doubts that this solution is well testable, because of the static method call
I feel that the solution is not abstracted (mixing business logic and authorization logic)
Usually authorization seems to be done in the controller, which is not possible in this case?
Do you have suggestions for alternative solutions?

Answer 1

One way to abstract away the authorization logic is to create a PermissionEvaluator and put authorization logic there.
#Component
public class ProductPermissionEvaluator implements PermissionEvaluator {
#Override
public boolean hasPermission(Authentication authentication, Object id, Object role) {
Long productId = (Long) id;
Optional<Product> productOptional = productRepository.findById(productId);
boolean isAdmin = authentication.getAuthorities()
.stream()
.anyMatch(a -> a.getAuthority().equals(role));
boolean hasPurchased = // Logic to find if user has purchased the product
return isAdmin || hasPurchased;
}
#Override
public boolean hasPermission(Authentication authentication, Serializable id, String product, Object role) {
return false;
}
}
and use the PermissionEvaluator like this:
#PreAuthorize("hasPermission(#id, 'ROLE_ADMIN')")
public Product fetchProduct(Long id) { // Logic to fetch product }
You'll need to register the PermissionEvaluator as well, which you can do like this:
#Configuration
#EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecConfig extends GlobalMethodSecurityConfiguration {
#Autowired
private ProductPermissionEvaluator productPermissionEvaluator;
#Override
protected MethodSecurityExpressionHandler createExpressionHandler() {
var expressionHandler = new DefaultMethodSecurityExpressionHandler();
expressionHandler.setPermissionEvaluator(productPermissionEvaluator);
return expressionHandler;
}
}

Answer 2

Additionally to the other answer, you can define your own bean with custom authorization logic for your products and call it inside an SPeL.
#Component
public class ProductPermissionEvaluator {
public boolean canFetchProduct(Long productId, Long userId) {
// perform your logic
}
}
#PreAuthorize("hasRole('ADMIN') || #productPermissionEvaluator.canFetchProduct(#id, #userId)")
fun fetchProduct(val id: Int, userId: String) {
...
}