Spring Expression Language (SpEL) supplies boolean expressions for Spring authorization decisions. In a @PreAuthorize annotation, hasRole('PREMIUM_USER') permits a method call when the security context contains that role; otherwise Spring throws AccessDeniedException. section 10.2
@Tool(name = "getGameComplexity",
description = "Returns a game's complexity/difficulty " +
"given the game's title/name.")
@PreAuthorize("hasRole('PREMIUM_USER')")
public GameComplexityResponse getGameComplexity(
@ToolParam(description="The title of the game")
String gameTitle) {
// ...
}
Secure a tool method by combining @PreAuthorize with a SpEL role expression. section 10.2
Use related method-security annotations for different authorization points:
- @PostAuthorize allows invocation but checks the returned value afterward. section 10.2
- @PreFilter and @PostFilter filter method parameters or return values with SpEL expressions. section 10.2
Restricting a tool
Enable method security with @EnableMethodSecurity, then annotate getGameComplexity—or a Function implementation's apply method—with @PreAuthorize("hasRole('PREMIUM_USER')"). Premium users receive the complexity; other users receive an access-denied response. section 10.2
