title: Spring Security hasPermission for Collection<Object>
body: <p>I have working application secured with method-level security:</p>
  
  <p><strong>RestController:</strong></p>
  
  <pre><code>@PreAuthorize("hasPermission(#product, 'WRITE')")
  @RequestMapping(value = "/save", method = RequestMethod.POST)
  public Product save(@RequestBody Product product) {
      return productService.save(product);
  }
  </code></pre>
  
  <p><strong>PermissionEvaluator:</strong></p>
  
  <pre><code>public class SecurityPermissionEvaluator implements PermissionEvaluator {
  
      private Logger log = LoggerFactory.getLogger(SecurityPermissionEvaluator.class);
  
      private final PermissionService permissionService;
  
      public SecurityPermissionEvaluator(PermissionService permissionService) {
          this.permissionService = permissionService;
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
          CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
          return permissionService.isAuthorized(userDetails.getUser(), targetDomainObject, permission.toString());
      }
  
      @Override
      public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
          // almost the same implementation
      }
  }
  </code></pre>
  
  <p>And everything works fine until I implemented API which saves collection of objects. The logic of this service is to update existing entities and/or create new entities.</p>
  
  <pre><code>@PreAuthorize("hasPermission(#products, 'WRITE')")
  @RequestMapping(value = "/saveCollection", method = RequestMethod.POST)
  public Collection&lt;Product&gt; save(@RequestBody Collection&lt;Product&gt; products) {
      return productService.save(products);
  }
  </code></pre>
  
  <p>After this my permission service handles the collection object and looks like this now:</p>
  
  <p><strong>PemissionService:</strong></p>
  
  <pre><code>public class PermissionService {
  
      public boolean isAuthorized(User user, Object targetDomainObject, String permission) {
          if (targetDomainObject instanceof TopAppEntity) {
              if (((TopAppEntity) targetDomainObject).getId() == null) {
                  // check authorities and give response
              } else {
                  // check ACL and give response
              }
          } else if(targetDomainObject instanceof Collection) {
              boolean isAuthorized = false;
              Collection targetDomainObjects = (Collection) targetDomainObject;
              for (Object targetObject : targetDomainObjects) {
                  isAuthorized = isAuthorized(user, targetObject, permission);
                  if (!isAuthorized) break;
              }
              return isAuthorized;
          }
      }
  }
  </code></pre>
  
  <p>My question is:</p>
  
  <p>How I can handle collections using <code>@PreAuthorize("hasPermission(#object, '...')")</code> more elegant way? Is there some implementations in Spring Security for handling collections? At least, how can I optimize <code>PemissionService</code> for handling <code>Collections</code>?</p>