Spring @PreAuthorize將null傳遞給服務

Question

我有一個問題@PreAuthorize和一個服務器，用於檢查經過身份驗證的用戶是否可以訪問搜索到的項目。

的一個服務callDistributionRequest是獲取項目工作正常 - @PreAuthorize臨危並將distId的權利。另一種updateDistributionRequestExportFileName也得到正確distId並把它傳遞給distributionRequestService。在方法userBelongsToRecipientOfTheDistributionRequest distId來作爲空

春季RestController與兩個Web服務

@RestController 
@RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE) 
public class DistributionRequestRESTController { 

    @Autowired 
    private @Getter @Setter DistributionRequestService distributionRequestService; 

    private final Logger log = LoggerFactory.getLogger(this.getClass()); 
    private String logResponse = " - response: "; 

    @Autowired 
    public DistributionRequestRESTController(DistributionRequestService distributionRequestService) { 
     this.distributionRequestService = distributionRequestService; 
    } 

    @RequestMapping(value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID) 
    public DistributionRequest callDistributionRequest(@PathVariable long distId) { 

     String loginfo = "get distribution with id: " + distId; 
     //log.info(loginfo); 

     DistributionRequest found = distributionRequestService.findOne(distId); 

     log.info(loginfo + logResponse + JSONParser.toJsonString(found)); 

     return found; 
    } 

    @RequestMapping(method = RequestMethod.POST, value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID + Consts.URLUPDATE + Consts.URLFILENAME) 
    public DistributionRequest updateDistributionRequestExportFileName(
      @PathVariable long distId, 
      @RequestBody String fileName, 
      @AuthenticationPrincipal UserDetails user) { 

     String loginfo = user.getUsername() + " try to update filename with : " + fileName; 
     //log.info(loginfo); 

     DistributionRequest updated = 
       distributionRequestService.updateExportFilename(distId, fileName); 

     log.info(loginfo + logResponse + JSONParser.toJsonString(updated)); 

     return updated; 
    } 

} 

服務接口：

public interface DistributionRequestService { 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest findOne(Long distId); 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest updateExportFilename(Long distId, String filename); 
} 

以及檢查，如果類用戶可以訪問搜索到的項目

@Service(value = "distributionRequestOwnerService") 
public class DistributionRequestOwnerServiceImpl implements DistributionRequestOwnerService { 

    @Autowired 
    private AccountService accountService; 

    @Autowired 
    private DistributionRequestsRepository distributionRequestsRepository; 

    @Override 
    public boolean userBelongsToRecipientOfTheDistributionRequest(Long distId) { 
     return userBelongsToRecipientOfTheDistributionRequest(distId, null); 
    } 

    @Override 
    public boolean userBelongsToRecipientOfTheDistributionRequest(Long distributionRequestId, String username) { 
     DistributionRequest distributionRequest = distributionRequestsRepository.findOne(distributionRequestId); 

     ServiceAccount currentUser; 
     if (username == null) 
      currentUser = accountService.getCurrentUser(); 
     else 
      currentUser = accountService.findByUsername(username); 

     if (distributionRequest != null 
       && distributionRequest.getRecipientId() == currentUser.getRecipientId()) 
      return true; 

     throw new AercacheWSException(Consts.EXCEPTIONMISSINGELEMENTORPERMITION); 
    } 

} 

任何想法？

由於事先

Answer 1

實測溶液duplicate to

如@teppic指出在接口參數應註明。

public interface DistributionRequestService { 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest findOne(@Param("distId") Long distId); 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest updateExportFilename(@Param("distId") Long distId, String filename); 
}