Method-Level Role Authorization with a Custom @RequireRole Annotation and Spring AOP

package com.example.security;

import java.util.Arrays;
import java.util.Set;

import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.stereotype.Component;

@Aspect
@Component
public class RoleGuardAspect {

    private final CurrentUserProvider currentUser;

    public RoleGuardAspect(CurrentUserProvider currentUser) {
        this.currentUser = currentUser;
    }

    @Before("@annotation(requireRole)")
    public void enforce(RequireRole requireRole) {
        Set<String> granted = currentUser.grantedRoles();
        String[] required = requireRole.value();

        if (!isAllowed(granted, required, requireRole.anyOf())) {
            throw new AccessDeniedException(
                    "Missing required role(s): " + Arrays.toString(required));
        }
    }

    private boolean isAllowed(Set<String> granted, String[] required, boolean anyOf) {
        if (anyOf) {
            for (String role : required) {
                if (granted.contains(role)) {
                    return true;
                }
            }
            return false;
        }
        for (String role : required) {
            if (!granted.contains(role)) {
                return false;
            }
        }
        return true;
    }
}

package com.example.account;

import com.example.security.RequireRole;
import org.springframework.stereotype.Service;

@Service
public class AccountService {

    private final AccountRepository accounts;

    public AccountService(AccountRepository accounts) {
        this.accounts = accounts;
    }

    @RequireRole("ADMIN")
    public void closeAccount(long accountId, String reason) {
        Account account = accounts.findByIdOrThrow(accountId);
        account.markClosed(reason);
        accounts.save(account);
    }

    @RequireRole(value = {"ADMIN", "AUDITOR"}, anyOf = true)
    public Statement viewStatement(long accountId, int year, int month) {
        Account account = accounts.findByIdOrThrow(accountId);
        return account.statementFor(year, month);
    }
}

package com.example.security;

import java.util.Set;
import java.util.stream.Collectors;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.EnableAspectJAutoProxy;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;

@Configuration
@EnableAspectJAutoProxy
public class SecurityConfig {

    @Bean
    public CurrentUserProvider currentUserProvider() {
        return () -> {
            Authentication auth = SecurityContextHolder.getContext().getAuthentication();
            if (auth == null || !auth.isAuthenticated()) {
                return Set.of();
            }
            return auth.getAuthorities().stream()
                    .map(GrantedAuthority::getAuthority)
                    .map(a -> a.startsWith("ROLE_") ? a.substring(5) : a)
                    .collect(Collectors.toSet());
        };
    }
}