Full Stack Development with JHipster - Second Edition

Limiting access to create/edit/delete entities

Now we need to ensure that only admin users can edit entities; normal users should only be able to view entities authorized to them. For this, it would be better to handle it at the API level using the Spring Security PreAuthorize annotation. Let's start with the OrderItem entity. Go to src/main/java/com/mycompany/store/web/rest/OrderItemResource.java and add @PreAuthorize("hasAuthority('ROLE_ADMIN')") to the createOrderItem, updateOrderItem, and deleteOrderItem methods:

    @DeleteMapping("/order-items/{id}")    @PreAuthorize("hasAuthority('ROLE_ADMIN')")    public ResponseEntity<Void> deleteOrderItem(@PathVariable Long id) {        ...    }

We are asking Spring Security interceptors to provide access to these ...