Defense in Depth

@Configuration
@EnableWebSecurity
public class ResourceServerConfig {

    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
            .authorizeHttpRequests(auth -> auth
                // One rule for the entire service. It asks whether the token is
                // valid, and nothing whatsoever about what the token permits.
                .anyRequest().authenticated()
            );
        return http.build();
    }
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity            // switches on @PreAuthorize, see the next tab
public class ResourceServerConfig {

    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .oauth2ResourceServer(o -> o.jwt(j -> j.jwtAuthenticationConverter(claimsToAuthorities())))
            .authorizeHttpRequests(auth -> auth
                // Pairs are evaluated top to bottom and the FIRST match wins,
                // so the most specific rule has to be declared first.
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers(HttpMethod.GET,    "/reports/**").hasAuthority("report:read")
                .requestMatchers(HttpMethod.POST,   "/reports/**").hasAuthority("report:write")
                .requestMatchers(HttpMethod.DELETE, "/reports/**").hasAuthority("report:admin")

                // Deny by default. A route added next sprint is closed until
                // somebody opens it deliberately, the exact opposite of
                // authenticated(), which would have opened it on creation.
                .anyRequest().denyAll()
            );
        return http.build();
    }
}

@Service
@RequiredArgsConstructor
public class ReportService {

    private final ReportRepository reports;

    /**
     * Layer 4: may this caller do this KIND of thing? Spring AOP evaluates
     * the expression before the method body is entered, so a denial never
     * reaches the repository at all.
     *
     * CAVEAT, and it is the one that catches people: this holds only for calls
     * arriving through the Spring proxy. A self-invocation, another method on
     * THIS class calling this.find(...), bypasses the proxy, and with it the
     * @PreAuthorize check, silently and with no warning. Treat annotated
     * methods as an external entry point only, or resolve the bean through
     * AopContext / a self-reference if an internal caller genuinely needs it.
     */
    @PreAuthorize("hasAuthority('report:read')")
    public ReportView find(UUID reportId, AuthenticatedCaller caller) {

        // Layer 6: may this caller see THIS record?
        //
        // `caller` is a parameter, but it is NOT client-supplied: it is
        // resolved from the validated token by the argument resolver below,
        // never bound from the request body, query string or a path variable.
        // That distinction is the whole guarantee, so it is worth stating
        // precisely rather than as "never from a parameter": parameters are
        // fine; parameters populated from untrusted input are not.
        return reports.findScoped(reportId, caller.tenantId())
                      .map(ReportView::of)
                      .orElseThrow(() -> new ReportNotFound(reportId));
    }
}

public interface ReportRepository extends JpaRepository<Report, UUID> {

    /**
     * The scope lives in the WHERE clause, not in a check performed after the
     * fetch. A row outside the caller's tenant is never loaded, so it cannot
     * be logged, cached, or handed out by a mapper written next quarter.
     */
    @Query("select r from Report r where r.id = :id and r.tenantId = :tenantId")
    Optional<Report> findScoped(@Param("id") UUID id, @Param("tenantId") UUID tenantId);
}

/**
 * The part the guarantee actually rests on, shown rather than assumed.
 *
 * The caller is built from the validated JWT and from nothing else. There is
 * no setter, no binding annotation and no constructor reachable from request
 * data, so no request can forge a tenant. If this resolver is wrong, every
 * scoped query above is wrong with it, which is exactly why it belongs in
 * the example instead of off-screen.
 */
@Component
class AuthenticatedCallerResolver implements HandlerMethodArgumentResolver {

    @Override
    public boolean supportsParameter(MethodParameter p) {
        return AuthenticatedCaller.class.equals(p.getParameterType());
    }

    @Override
    public AuthenticatedCaller resolveArgument(MethodParameter p, ModelAndViewContainer m,
                                               NativeWebRequest req, WebDataBinderFactory b) {
        var jwt = (Jwt) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
        return new AuthenticatedCaller(
                UUID.fromString(jwt.getSubject()),
                UUID.fromString(jwt.getClaimAsString("tenant_id")));
    }
}

/** Immutable, and constructible only from a verified token. */
public record AuthenticatedCaller(UUID userId, UUID tenantId) {}

<script setup lang="ts">
import { computed, onMounted, ref } from 'vue'
import { listReports, exportReport, archiveReport } from '../api/reports'

/**
 * A capability is a verb the SERVER has already decided this caller may
 * attempt on this row. The client renders capabilities; it never derives
 * them from a role string it holds locally.
 */
type Capability = 'export' | 'archive'

interface ReportRow {
  id: string
  title: string
  owner: string
  capabilities: Capability[]   // sent per row, by the server, with the payload
}

const rows = ref<ReportRow[]>([])
const can = (row: ReportRow, verb: Capability) => row.capabilities.includes(verb)

// A column earns its width only when some visible row grants the capability.
const showExport  = computed(() => rows.value.some(r => can(r, 'export')))
const showArchive = computed(() => rows.value.some(r => can(r, 'archive')))

onMounted(async () => { rows.value = await listReports() })

async function onExport(row: ReportRow) {
  await exportReport(row.id)
}

async function onArchive(row: ReportRow) {
  // The control was rendered because the server said this row allowed it.
  // The server checks AGAIN on invoke: a client that fabricates the flag
  // receives 403, not an archived row. That second check is the control.
  await archiveReport(row.id)
}
</script>

<template>
  <table>
    <thead>
      <tr>
        <th>Title</th>
        <th>Owner</th>
        <th v-if="showExport">Export</th>
        <th v-if="showArchive">Archive</th>
      </tr>
    </thead>
    <tbody>
      <tr v-for="row in rows" :key="row.id">
        <td>{{ row.title }}</td>
        <td>{{ row.owner }}</td>
        <td v-if="showExport">
          <button v-if="can(row, 'export')" @click="onExport(row)">CSV</button>
        </td>
        <td v-if="showArchive">
          <button v-if="can(row, 'archive')" @click="onArchive(row)">Archive</button>
        </td>
      </tr>
    </tbody>
  </table>
</template>