PermissionEvaluator & ACLs

## Step 1 — implement the SPI `PermissionEvaluator` has **two methods**, both of which you must implement (delegate one to the other if you only support one style): ```java public class DocumentPermissionEvaluator implements PermissionEvaluator { private final DocumentRepository repo; public DocumentPermissionEvaluator(DocumentRepository repo) { this.repo = repo; } @Override public boolean hasPermission(Authentication auth, Object target, Object permission) { if (auth == null || !(target instanceof Document doc)) return false; return check(doc, auth.getName(), permission.toString()); } @Override public boolean hasPermission(Authentication auth, Serializable id, String type, Object permission) { if (auth == null || id == null) return false; Document doc = repo.findById((Long) id).orElse(null); if (doc == null) return false; return check(doc, auth.getName(), permission.toString()); } private boolean check(Document doc, String user, String perm) { if ("READ".equals(perm)) return doc.isPublic() || doc.getOwner().equals(user); if ("WRITE".equals(perm)) return doc.getOwner().equals(user); return false; } } ``` Key points: **return false, never throw**, for the 'not allowed' case (an exception becomes a 500, not a clean 403). Guard against `null` authentication and wrong `instanceof` types. The `permission` object is whatever the SpEL passed — commonly a `String`. ## Step 2 — register it via the expression handler Spring builds SpEL for method security through a **`MethodSecurityExpressionHandler`** (default impl `DefaultMethodSecurityExpressionHandler`). You override the bean and inject your evaluator: ```java @Configuration @EnableMethodSecurity public class MethodSecurityConfig { @Bean static MethodSecurityExpressionHandler expressionHandler(DocumentPermissionEvaluator evaluator) { var handler = new DefaultMethodSecurityExpressionHandler(); handler.setPermissionEvaluator(evaluator); return handler; } } ``` ### Why `static`? `@EnableMethodSecurity` registers `BeanPostProcessor`-adjacent infrastructure very early. A **non-static** `@Bean` method lives on a `@Configuration` instance that must be fully constructed (and CGLIB-proxied) before the method runs; if the security infrastructure needs the expression handler before that, you get premature-initialization warnings or subtle ordering bugs. Marking the bean method **static** lets Spring invoke it without instantiating the enclosing config, sidestepping the cycle. This is the officially recommended pattern for security beans that feed the method-security setup. ## Step 3 — use it Any `@PreAuthorize("hasPermission(#doc,'WRITE')")` now dispatches to your evaluator. Nothing else changes. ## Gotchas - **Only one PermissionEvaluator** is held by the handler; to combine strategies, write a composite that delegates by target type. - **`@PostAuthorize`** runs the method first, so a denied `hasPermission(returnObject,…)` still executed the query/side-effects — fine for reads, dangerous for mutations. - The evaluator must be **fast**: it runs on every guarded call. Cache or use the id-overload to avoid redundant loads. - If you also use `@PreFilter`/`@PostFilter` with `hasPermission`, the evaluator is called **once per element** — watch N+1 loads. - Prefer returning a plain `boolean`; do not rely on throwing `AccessDeniedException` yourself — the framework raises it when the expression is false.