spring security : Why can't we access Hibernate entitiy parameters in @PreAuthorize?

Question

I have the following interface method on which I am applying @PreAuthorize :

@PreAuthorize(\"doSomething(#user.id)\")
void something(User user,          


        

Answer 1

I need to add something to this as the title indicates that we cannot access hibernate properties.

There are two editions of hasPermission, the loaded object and the serialized object. Here is some code from a test case:

@PreAuthorize("isAuthenticated() and hasPermission(#organization, 'edit')")
public long protectedMethod(Organization organization)
{
    return organization.getId();
}

And for the latter here we see that we can infact access the id proprty of the organization (which is a hibernate entity):

@PreAuthorize("isAuthenticated() and hasPermission(#organization.getId(), 'organization', 'edit')")
public long protectedMethodSerializableEdtion(Organization organization)
{
    return organization.getId();
}