@PreAuthorize and SpEL

@PreAuthorize takes a SpEL (Spring Expression Language) expression. It runs before the method. You can use the same functions as URL rules plus the method arguments with #name.

@Service
public class ProductService {

    @PreAuthorize("hasAnyRole('SELLER', 'ADMIN')")
    public ProductDto create(CreateProductRequest req) { ... }

    @PreAuthorize("hasRole('ADMIN')")
    public void delete(Long productId) { ... }

    // the seller may only change their own products; admins may change any
    @PreAuthorize("hasRole('ADMIN') or #sellerEmail == authentication.name")
    public ProductDto updatePrice(Long productId, String sellerEmail, BigDecimal price) { ... }
}