app-controller-domain-level.java

@RestController
@RequestMapping("/app")
@RequiredArgsConstructor
public class AppController {

    private final CompanyJpaRepository companyRepo;
    private final SubsidiaryJpaRepository subsidiaryRepo;

    @GetMapping(path = "/company/{id}")
    @PreAuthorize("hasAuthority('COMPANY:' + #id  + ':READ')")
    public Company getCompany(@PathVariable Long id) {
        return companyRepo.getById(id);
    }

    @GetMapping(path = "/subsidiary/{id}")
    @PostAuthorize("hasAuthority('COMPANY:' + returnObject.getCompany().getId() + ':READ')")
    public Subsidiary getSubsidiary(@PathVariable Long id) {
        return subsidiaryRepo.getById(id);
    }
}