I have an API which need to be authorized before running.
So, the allowed roles and authorities here is:
1. hasRole('ADMIN') + hasAuthority('Edit_Post')
2. hasRole('USER') + hasAuthority('Manage_Post')
3. author of the post
So, the user needs to be either ADMIN and has editpost authority, or need to be user with manage_post right, or author of the post to edit post.
I know @PreAuthorize can manage to do with multiple role by using hasAnyRole, but it doesn't work as I expected in this one. I know how to do each of these separately, but combining them together is an issue.
I thought about use @PreAuthorize('hasAnyRole') and check for Authority in the backend block, but it would be the best if I have a way to deal with @PreAuthorize.
How should I do this. Thank you