Spring Security - Third Edition

Benefits of a custom PermissionEvaluator

With only a single method being protected, it would be trivial to update the annotation to check if the user has the role of ROLE_ADMIN or has permission. However, if we had protected all of our service methods that use an event, it would have become quite cumbersome. Instead, we could just update our CalendarPermissionEvaluator. Make the following changes:

private boolean hasPermission(Authentication authentication, Event event, Object permission) {   if(event == null) {       return true;   }   GrantedAuthority adminRole =           new SimpleGrantedAuthority("ROLE_ADMIN");   if(authentication.getAuthorities().contains(adminRole)) {       return true;   }   ...}

Now, restart the application and repeat the previous exercise. This ...