Grails check role access for specific controller action

Question

I need to display/hide action buttons depending if the user can access (by role definition) the specific controller/action. I'm using Spring Security plugin.

My goal is to used the annotation @Secured("ROLE_...") for every method of each of my controller and I'm looking for a way to check, before calling the action, if the user has access to this specific action. I'm guessing there is way to check this because the annotation brings the information but I cannot find any solution.

In this example I'm trying to find the HASACCESS method:

The controller with the @Secured annotation

    class MyExampleController{

      @Secured("ROLE_ADMIN")
      def myMethod(){ do stuff.. }

    }

The HTML code to include de link

    <role:link controller="myExample" action="myMethod">Action</role:link>

And my tagLib role

    class RoleTagLib {
     static namespace = "role"

      def link = {attrs, body ->
        User user = (User) springSecurityService.currentUser          
        if(HASACCESS(user, attrs.controller, attrs.action)){
          out << g.link(attrs, body)
        }
      }
    }

I found in this thread the "hasAccess()" method contained into the SecurityTagLib but this method is protected and even when I extend the SecurityTagLib with mine the call of this method returns me "No signature of method...". I think it uses the interceptUrlMap defined in Config.groovy and not the annotations anyway.

EDIT: I succeed to extend the security tagLib and use the "hasAccess" method but it seems that it uses only the interceptUrlMap contained in Config.groovy and doesn't care about the annotations I put in my controllers.

Answer 1

Use

<sec:ifAllGranted roles="ROLE_ADMIN,ROLE_SUPERVISOR">
  secure stuff here
</sec:ifAllGranted>

or

<sec:ifAnyGranted roles="ROLE_ADMIN,ROLE_SUPERVISOR">
    secure stuff here
</sec:ifAnyGranted>

according the Spring Security Core Grails plugin documentation.

Or simply use the Spring security core taglib with your tag library.

class RoleTagLib {
  static namespace = "role"

  SpringSecurityService springSecurityService

  def link = { attrs, body ->
    User user = (User) springSecurityService.currentUser          
    sec.ifAnyGranted(roles: 'ROLE_ADMIN,ROLE_SUPERVISOR'){
      out << g.link(attrs, body)
    }
  }
}