SpEL expression with String list fails to be evaluated - acl

Question

Update on Oct 27
The following method has a SpEL based ACL annotation. It's meant to check whether the file object of fileId has permissions of Read and Write. If the file object contains any of the two permission, the ACL passes, otherwise, it throws an exception.
#Component
public class ApiImpl {
#PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)")
public FileListVO getFiles(String fileId) {
...
}
}
The annotation is through acl component below.
public interface AclService {
boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext);
}
#Component("acl")
public class AclServiceImpl implements AclService {
#Override
public boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext) {
List<String> resourcePermissions = get permissions of resource
if (resourcePermissions contains any of permissions) {
return true;
}
throw exception here
}
}
The question is, the SpEL expression below fails to be evaluated:
#PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)")
java.lang.IllegalArgumentException: Failed to evaluate expression '#acl.hasPermissions('File',{'Read','Write'}, #fileId)'
There is a List<String> permissions in it. What is the correct expression for this?
Please note that the throw exception behavior in AclServiceImpl.hasPermissions() is legacy code which I don't want to change. #PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)") is expected to return true not throw exception. I know the following could be an option,
public interface AclService {
boolean hasPermission(String type, String permission, Object resource, Object... resourceContext);
}
#Component("acl")
public class AclServiceImpl implements AclService {
#Override
public boolean hasPermission(String type, String permission, Object resource, Object... resourceContext) {
List<String> resourcePermissions = get permissions of resource
if (resourcePermissions contains permission) {
return true;
}
return false; // not throw exception
}
}
#Component
public class ApiImpl {
#PreAuthorize("#acl.hasPermissions('File','Read', #fileId)"
+ "|| #acl.hasPermissions('File','Write', #fileId)")
#PostMeetingTelemetry()
public FileListVO getFiles(String fileId) {
...
}
}
but I just wonder how to enhance
#PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)")
so that the following code works.
public interface AclService {
boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext);
}
#Component("acl")
public class AclServiceImpl implements AclService {
#Override
public boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext) {
List<String> resourcePermissions = get permissions of resource
if (resourcePermissions contains any of permissions) {
return true;
}
throw exception here
}
}
#Component
public class ApiImpl {
#PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)")
public FileListVO getFiles(String fileId) {
...
}
}

Answer 1

throw exception here
Of course the evaluation fails if you throw an exception there.
You should return false instead.

Answer 2

With the following changes, it works. Not sure the 1st change is required, but the 2nd change is a must.
Replace List<String> with String[] for permissions
Replace {'Read','Write'} with new String[]{'Read','Write'}
Before
public interface AclService {
boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext);
}
#Component("acl")
public class AclServiceImpl implements AclService {
#Override
public boolean hasPermissions(String type, List<String> permissions, Object resource, Object... resourceContext) {
List<String> resourcePermissions = get permissions of resource
if (resourcePermissions contains any of permissions) {
return true;
}
throw exception here
}
}
#Component
public class ApiImpl {
#PreAuthorize("#acl.hasPermissions('File',{'Read','Write'}, #fileId)")
#PostMeetingTelemetry()
public FileListVO getFiles(String fileId) {
...
}
}
After
public interface AclService {
// Replace List<String> with String[]
boolean hasPermissions(String type, String[] permissions, Object resource, Object... resourceContext);
}
#Component("acl")
public class AclServiceImpl implements AclService {
#Override
public boolean hasPermissions(String type, String[] permissions, Object resource, Object... resourceContext) {
List<String> resourcePermissions = get permissions of resource
if (resourcePermissions contains any of permissions) {
return true;
}
throw exception here
}
}
#Component
public class ApiImpl {
// Replace {'Read','Write'} with new String[]{'Read','Write'}
#PreAuthorize("#acl.hasPermissions('File',new String[]{'Read','Write'}, #fileId)")
#PostMeetingTelemetry()
public FileListVO getFiles(String fileId) {
...
}
}