Full Stack Development with JHipster

Limiting access to create/edit/delete entities

Now we need to ensure that only admin users can edit entities, normal users should only be able to view entities authorized to them. For this, it would be better to handle it at the API level using the Spring Security PreAuthorize annotation. Let's start with the order item. Go to src/main/java/com/mycompany/store/web/rest/OrderItemResource.java and add @PreAuthorize("hasAuthority('ROLE_ADMIN')") to methods createOrderItem, updateOrderItem, and deleteOrderItem:

    @DeleteMapping("/order-items/{id}")    @Timed    @PreAuthorize("hasAuthority('ROLE_ADMIN')")    public ResponseEntity<Void> deleteOrderItem(@PathVariable Long id) {        ...    }

We are asking Spring Security interceptors to provide access to these methods ...