Secure pages with tapestry5

AdminHome.java

@Allow(Authorities.ROLE_ADMIN)
public class AdminHome {
    // some stuff
}

AdminPage.java

public class AdminHome {
    // some stuff

    void onActivate() {
        if (!isAllowed()) {
            throw new AccessDeniedException("Access denied");
        }
    }

    // some stuff
}

Allow.java

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Allow {
    String[] value();
}

OurModule.java

public class OurModule {
    // some stuff

    public void contributeComponentClassTransformWorker(final OrderedConfiguration<ComponentClassTransformWorker2> configuration) {
        configuration.addInstance("PageSecurity", SecurityAnnotationWorker.class, "after:OnEvent");
    }

    // some stuff
}

SecurityAnnotationWorker.java

public class SecurityAnnotationWorker implements ComponentClassTransformWorker2 {

    public void transform(final PlasticClass plasticClass, final TransformationSupport support, final MutableComponentModel model) {
        final Allow allow = plasticClass.getAnnotation(Allow.class);
        if (model.isPage() && allow != null) {
            support.addEventHandler(EventConstants.ACTIVATE, 0, "Page Security", new ComponentEventHandler() {
                public void handleEvent(final Component instance, final ComponentEvent event) {
                    final List<String> authorities = getAuthorities();

                    if (!authorities.containsAll(Arrays.asList(allow.value()))) {
                        throw new AccessDeniedException(String.format("Access denied for authorities: '%s'", authorities));
                    }
                }
            });
        }
    }

    private List<String> getAuthorities() {
        // get authorities from any security context
    }
}