Spring @PreAuthorize将null传递给服务

Question

我有一个问题@PreAuthorize和一个服务器，用于检查经过身份验证的用户是否可以访问搜索到的项目。

的一个服务callDistributionRequest是获取项目工作正常 - @PreAuthorize临危并将distId的权利。另一种updateDistributionRequestExportFileName也得到正确distId并把它传递给distributionRequestService。在方法userBelongsToRecipientOfTheDistributionRequest distId来作为空

春季RestController与两个Web服务

@RestController 
@RequestMapping(produces = MediaType.APPLICATION_JSON_UTF8_VALUE) 
public class DistributionRequestRESTController { 

    @Autowired 
    private @Getter @Setter DistributionRequestService distributionRequestService; 

    private final Logger log = LoggerFactory.getLogger(this.getClass()); 
    private String logResponse = " - response: "; 

    @Autowired 
    public DistributionRequestRESTController(DistributionRequestService distributionRequestService) { 
     this.distributionRequestService = distributionRequestService; 
    } 

    @RequestMapping(value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID) 
    public DistributionRequest callDistributionRequest(@PathVariable long distId) { 

     String loginfo = "get distribution with id: " + distId; 
     //log.info(loginfo); 

     DistributionRequest found = distributionRequestService.findOne(distId); 

     log.info(loginfo + logResponse + JSONParser.toJsonString(found)); 

     return found; 
    } 

    @RequestMapping(method = RequestMethod.POST, value = Consts.URLDISTRIBUTIONREQUEST + Consts.URLDISTREQID + Consts.URLUPDATE + Consts.URLFILENAME) 
    public DistributionRequest updateDistributionRequestExportFileName(
      @PathVariable long distId, 
      @RequestBody String fileName, 
      @AuthenticationPrincipal UserDetails user) { 

     String loginfo = user.getUsername() + " try to update filename with : " + fileName; 
     //log.info(loginfo); 

     DistributionRequest updated = 
       distributionRequestService.updateExportFilename(distId, fileName); 

     log.info(loginfo + logResponse + JSONParser.toJsonString(updated)); 

     return updated; 
    } 

} 

服务接口：

public interface DistributionRequestService { 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest findOne(Long distId); 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest updateExportFilename(Long distId, String filename); 
} 

以及检查，如果类用户可以访问搜索到的项目

@Service(value = "distributionRequestOwnerService") 
public class DistributionRequestOwnerServiceImpl implements DistributionRequestOwnerService { 

    @Autowired 
    private AccountService accountService; 

    @Autowired 
    private DistributionRequestsRepository distributionRequestsRepository; 

    @Override 
    public boolean userBelongsToRecipientOfTheDistributionRequest(Long distId) { 
     return userBelongsToRecipientOfTheDistributionRequest(distId, null); 
    } 

    @Override 
    public boolean userBelongsToRecipientOfTheDistributionRequest(Long distributionRequestId, String username) { 
     DistributionRequest distributionRequest = distributionRequestsRepository.findOne(distributionRequestId); 

     ServiceAccount currentUser; 
     if (username == null) 
      currentUser = accountService.getCurrentUser(); 
     else 
      currentUser = accountService.findByUsername(username); 

     if (distributionRequest != null 
       && distributionRequest.getRecipientId() == currentUser.getRecipientId()) 
      return true; 

     throw new AercacheWSException(Consts.EXCEPTIONMISSINGELEMENTORPERMITION); 
    } 

} 

任何想法？

由于事先

Answer 1

实测溶液duplicate to

如@teppic指出在接口参数应注明。

public interface DistributionRequestService { 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest findOne(@Param("distId") Long distId); 

    @PreAuthorize(value = "hasAnyAuthority('USER', 'ADMIN') and @distributionRequestOwnerService.userBelongsToRecipientOfTheDistributionRequest(#distId)") 
    DistributionRequest updateExportFilename(@Param("distId") Long distId, String filename); 
}