Implementing Authorization Logic

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(UUID id) { ... }

public boolean canEdit(UserId actor, OrderId order) {
    var o = orderRepo.findById(order).orElseThrow();
    return o.ownerId().equals(actor) || rbac.hasRole(actor, "ADMIN");
}

package orders.allow
default allow = false
allow {
    input.action == "read"
    input.user.tenant == input.resource.tenant
}
allow {
    input.action == "delete"
    "admin" in input.user.roles
}

@Bean
RoleHierarchy roleHierarchy() {
    var h = new RoleHierarchyImpl();
    h.setHierarchy("""
        ROLE_SUPERADMIN > ROLE_ADMIN
        ROLE_ADMIN > ROLE_USER
        """);
    return h;
}

@PreAuthorize("authentication.principal.claims['scope'].contains('orders:write')")
public Order place(...) { ... }