baso53

@RestController
@RequestMapping("/app")
@RequiredArgsConstructor
public class AppController {

    private final CompanyJpaRepository companyRepo;
    private final SubsidiaryJpaRepository subsidiaryRepo;

    @GetMapping(path = "/company/{id}")
    @PreAuthorize("hasAuthority('COMPANY:' + #id  + ':READ')")

baso53

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();

        http.oauth2ResourceServer()
                .jwt()
                .jwtAuthenticationConverter(jwtAuthenticationConverter());

baso53

@RequiredArgsConstructor
public class DomainGrantedAuthority implements GrantedAuthority {

    private final EntityType entityType;
    private final Long entityId;
    private final Permission permission;

    @Override
    public String getAuthority() {
        return entityType +

baso53

{
  "custom_claims": [
    "COMPANY:1:READ",
    "COMPANY:1:WRITE",
    "COMPANY:2:READ",
    "SUBSIDIARY:125:READ"
  ],
  "iss": "https://securetoken.google.com/fir-auth-springsecurity",
  "aud": "fir-auth-springsecurity",
  "auth_time": 1636893816,

baso53

curl --location --request POST 'http://localhost:8080/admin/user-claims/WsD5H21KFKYyCOTIbkOwjXLQRsu1' \
--header 'Content-Type: application/json' \
--data-raw '{
    "COMPANY": {
        "1": [
            "READ",
            "WRITE"
        ],
        "2": [
            "READ"

baso53

@RestController
@RequestMapping("/admin")
@RequiredArgsConstructor
public class AdminController {

    private final UserManagementService userManagementService;

    @Secured("ROLE_ANONYMOUS")
    @PostMapping(path = "/user-claims/{uid}")
    public void setUserClaims(

baso53

[
  "COMPANY:1:READ",
  "COMPANY:1:WRITE",
  "COMPANY:2:READ",
  "SUBSIDIARY:125:READ"
]

baso53

{
    "COMPANY": {
        "1": [
            "READ",
            "WRITE"
        ],
        "2": [
            "READ"
        ]
    },

baso53

@Service
@RequiredArgsConstructor
public class UserManagementService {

    private final FirebaseAuth firebaseAuth;

    public void setTokenClaims(String uid, Map<EntityType, Map<Long, Set<Permission>>> requestedPermissions) throws FirebaseAuthException {
        var claims = toUserClaims(requestedPermissions);

        firebaseAuth.setCustomUserClaims(uid, claims);

baso53

public enum EntityType {
    COMPANY,
    SUBSIDIARY
}