Support for Security Expression about springfilter HOT 4 CLOSED

Hey @vittoN :)
I am not sure if I have understood correctly your suggestion, can you give an example of how would you use that in a filter query?

from springfilter.

Let's assume i would extract all messages where recipient is the user logged in the system. So, using a custom JPA query i'll write:

@Query("select m from Message m where m.to.id = ?#{ principal?.id }")
Page<Message> findInbox(Pageable pageable);

I would like a way to limit searched results in the same way using spring-filter.

from springfilter.

I see what you mean, I think it will be quiet hard to support @Query. What you can do is anding the user's filter with an another filter:

Specification<Message> incomingFilter = // user's filter

Specification<Message> loggedInUserFilter = new FilterSpecification<Message>(FilterBuilder.equal("principal.id", getLoggedInUserId()));

Specification<Message> finalFilter = FilterSpecification.merge(incomingFilter, loggedInUserFilter); // or Specification.where(loggedInUserFilter).and(incomingFilter);

Page<Message> messages = repository.findAll(finalFilter, pageable);

That way, no matter what the user's filter is, he will only and only be able to get/filter his own messages.

Hope it's clear.

from springfilter.

@vittoN I think that anding filters should have met your requirements, closing the issue for now.

from springfilter.