Keselamatan Tahap Kaedah dengan Anotasi

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class AdminService {

    @PreAuthorize("hasRole('ADMIN')")
    public String deleteSensitiveData() {
        return "Sensitive data deleted!";
    }

    @PreAuthorize("hasAuthority('product:write')")
    public String createProduct(String productName) {
        return "Product '" + productName + "' created.";
    }
}

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

public class Main {

    // This method simulates a service method protected by @PreAuthorize("hasRole('ADMIN')")
    public static String getAdminMessage() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        // In a real Spring app, AOP would handle this check before method entry.
        // We simulate it here for demonstration.
        if (auth != null && auth.getAuthorities().stream()
                .anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return "Welcome, Admin! Here's your secret message.";
        } else {
            return "Access Denied: ADMIN role required.";
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User with ADMIN role
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("adminUser", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("Admin user attempt: " + getAdminMessage());

        // Scenario 2: User with USER role
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("regularUser", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("\nRegular user attempt: " + getAdminMessage());

        SecurityContextHolder.clearContext(); // Clean up
    }
}

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;

@Service
public class UserService {

    // Only allow users to view their own profile
    @PreAuthorize("#userId == authentication.principal.username")
    public String viewUserProfile(String userId) {
        return "Viewing profile for: " + userId;
    }

    // Allow ADMIN or the owner of the resource
    @PreAuthorize("hasRole('ADMIN') or #resourceOwner == authentication.principal.username")
    public String editResource(String resourceId, String resourceOwner) {
        return "Editing resource '" + resourceId + "' by '" + resourceOwner + "'.";
    }
}

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.stereotype.Service;

// A simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
}

@Service
public class ProfileService {

    // Only allow access to profile if current user is the owner or an ADMIN
    @PostAuthorize("returnObject.username == authentication.principal.username or hasRole('ADMIN')")
    public UserProfile getUserProfile(String requestedUsername) {
        // In a real app, this would fetch from a database
        if ("john.doe".equals(requestedUsername)) {
            return new UserProfile("john.doe", "john@example.com");
        }
        return new UserProfile("guest", "guest@example.com");
    }
}

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import java.util.Collections;
import java.util.List;

// Simple data class for demonstration
class UserProfile {
    String username;
    String email;
    public UserProfile(String username, String email) {
        this.username = username;
        this.email = email;
    }
    public String getUsername() { return username; }
    public String getEmail() { return email; }
    @Override
    public String toString() { return "Profile: " + username + " (" + email + ")"; }
}

public class Main {

    // Simulates a service method with @PostAuthorize("returnObject.username == authentication.principal.username")
    public static UserProfile getSecuredUserProfile(String requestedUsername) {
        UserProfile profile = new UserProfile(requestedUsername, requestedUsername + "@example.com");
        
        // Simulate @PostAuthorize check
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.isAuthenticated() && 
            profile.getUsername().equals(auth.getName())) {
            return profile; // Allowed to view own profile
        } else if (auth != null && auth.isAuthenticated() && 
                   auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("ROLE_ADMIN"))) {
            return profile; // Admin can view any profile
        } else {
            // In a real app, this would be an AccessDeniedException
            System.out.println("Access Denied to view profile for " + requestedUsername);
            return null; // Or throw an exception
        }
    }

    public static void main(String[] args) {
        // Scenario 1: User viewing their own profile
        List<GrantedAuthority> userAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_USER"));
        Authentication userAuth = new UsernamePasswordAuthenticationToken("alice", "pass", userAuthorities);
        SecurityContextHolder.getContext().setAuthentication(userAuth);
        System.out.println("Alice viewing her own profile: " + getSecuredUserProfile("alice"));

        // Scenario 2: Alice trying to view Bob's profile
        System.out.println("\nAlice viewing Bob's profile: " + getSecuredUserProfile("bob"));

        // Scenario 3: Admin viewing Bob's profile
        List<GrantedAuthority> adminAuthorities = Collections.singletonList(new SimpleGrantedAuthority("ROLE_ADMIN"));
        Authentication adminAuth = new UsernamePasswordAuthenticationToken("admin", "pass", adminAuthorities);
        SecurityContextHolder.getContext().setAuthentication(adminAuth);
        System.out.println("\nAdmin viewing Bob's profile: " + getSecuredUserProfile("bob"));

        SecurityContextHolder.clearContext();
    }
}

import org.springframework.security.access.prepost.PreFilter;
import org.springframework.security.access.prepost.PostFilter;
import java.util.List;

class Item { String owner; String name; }

public class ItemService {

    // Only allow items owned by the current user to be processed
    @PreFilter("filterObject.owner == authentication.principal.username")
    public void processItems(List<Item> items) {
        // ... process only allowed items ...
    }

    // Only return items owned by the current user
    @PostFilter("filterObject.owner == authentication.principal.username")
    public List<Item> getAllItemsForUser() {
        // ... fetch all items from DB ...
        return List.of(new Item(), new Item()); // Returns filtered list
    }
}