How to secure grails web services with spring security

Question

Assume I have the following Domain class:

import grails.rest.Resource
@Resource(formats=['json'], uri='/api/book')
class Book {
    String name
    static belongsTo = [user: User]
}

I have defined spring security interceptUrlMap in Config.groovy to restrict url access:

'/api/book':                      ['ROLE_USER']

Lets assume that there are two books and two users in the system and book with id 1 belongs to user 1 and the second book belongs to user 2. User 1 is logged in and the following request should return book 1 (which it does):

localhost:8080/myapp/api/book/1

but if the same user makes a request to the following resource:

localhost:8080/myapp/api/book/2

I want the rest API to return an empty array or "access denied". How do I achieve this? I need an approach there all request types i.e. GET/POST/PUT/DELETE are taken care of.

Answer 1

Solved this issue by generating the corresponding web-service controller:

grails generate-controller Book

And added restriction for every actions, i.e. Index, Show, Save, Update, Delete.

For example the Show action which is used to GET a resource:

localhost:8080/myapp/api/book/1

is changed to look as the following code:

import static org.springframework.http.HttpStatus.*
import grails.transaction.Transactional

@Transactional(readOnly = true)
class BookController {

   def springSecurityService
   static allowedMethods = [save: "POST", update: "PUT", delete: "DELETE"]

   Code omitted...

   def show(Book bookInstance) {
       if(bookInstance == null){
           notFound()
           return
       }
       def user = springSecurityService.currentUser 
       if(bookInstance.user.id == user.id) {
           respond bookInstance
           return
       }
       notFound()
   }

   Code omitted...
}

Grails version: 2.4.4