SEC-2852: Possibility to impersonate a Principal when using annotation hasPermission #3074
Description
Oliver Fernandez (Migrated from SEC-2852) said:
It would be very useful to be able to impersonate another principal when using the annotation hasPermission
The current interface SecurityExpressionOperations only declares the following method
boolean hasPermission(Object target, Object permission)
I propose to also declare:
boolean hasPermission(UserDetails principal, Object target, Object permission)
A very typical use case is that an administrator wants to list the entities a given user has permissions to read, and then manage those permissions.
In the following gist there is a possible implementation of this method:
https://gist.github.com/oliverfernandez/c56f833d058fcae53a1b