title: Spring-Boot @PreAuthorize allow operation only for admin or if the authenticated user id is same as path parameter id
body: <p>I have a controller which has User CRUD operations. </p>
  
  <pre><code>@Controller
  public class UserController {
  
    // @TODO need to check whether userId == authUser.id or authUser is admin??
    //
    @PreAuthorize("hasRole('ROLE_ADMIN) or ...???...")
    @PostMapping("/user/{id}/edit")
    public boolean editUser(@PathVariable("id") long userId,
                            @RequestBody User newUserObj,
                            @CurrentUser authUser) {
       // I don't like to always call a helper function from here
       // check(authUser.getId() == userId);
  
       return userService.edit(userId, newUserObj);
    }
  
   // ... rest of the methods
  
  }
  </code></pre>
  
  <p>This operation is allowed only for the admin or user him/herself. No user can edit any other's user profiles.</p>
  
  <p>I have tried <code>@PreAuthorize("hasRole('ROLE_ADMIN'))</code>, it works only for admin user, but I want to check whether authenticated user is the same user as indicated by the parameter <code>userId</code> (<code>authUser.getId() == userId</code>). How can I define this expression inside the annotation? Is this possible without writing a helper function.</p>
  
  <p>I also have the current authenticated user injected in to the controller method using <code>@CurrentUser</code> annotation, in case it needs.</p>