package de.terrestris.shogun2.service;

import java.util.List;

import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.prepost.PostFilter;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.transaction.annotation.Transactional;

import de.terrestris.shogun2.model.PersistentObject;

/**
 * This abstract service class provides basic CRUD functionality.
 * 
 * @author Nils Bühner
 * @see AbstractDaoService
 * 
 */
public abstract class AbstractCrudService<E extends PersistentObject> extends
		AbstractDaoService<E> {

	/**
	 * 
	 * @param e
	 * @return
	 */
	@Transactional(readOnly = false)
	@PreAuthorize("isAuthenticated()")
	public E saveOrUpdate(E e) {
		dao.saveOrUpdate(e);
		return e;
	}

	/**
	 * 
	 * @param id
	 * @return
	 */
	@PostAuthorize("hasPermission(returnObject, 'READ')")
	public E findById(Integer id) {
		return dao.findById(id);
	}

	/**
	 * 
	 * @return
	 */
	@PostFilter("hasPermission(filterObject, 'READ')")
	public List<E> findAll() {
		return dao.findAll();
	}

	/**
	 * 
	 * @param e
	 */
	@PreAuthorize("hasPermission(#e, 'DELETE')")
	@Transactional(readOnly = false)
	public void delete(E e) {
		dao.delete(e);
	}

}

package de.terrestris.shogun2.service;

import java.util.List;

import org.springframework.transaction.annotation.Transactional;

import de.terrestris.shogun2.model.PersistentObject;

/**
 * This abstract service class provides basic CRUD functionality.
 * 
 * @author Nils Bühner
 * @see AbstractDaoService
 * 
 */
public abstract class AbstractCrudService<E extends PersistentObject> extends
		AbstractDaoService<E> {

	/**
	 * 
	 * @param e
	 * @return
	 */
	@Transactional(readOnly = false)
	public E saveOrUpdate(E e) {
		dao.saveOrUpdate(e);
		return e;
	}

	/**
	 * 
	 * @param id
	 * @return
	 */
	public E findById(Integer id) {
		return dao.findById(id);
	}

	/**
	 * 
	 * @return
	 */
	public List<E> findAll() {
		return dao.findAll();
	}

	/**
	 * 
	 * @param e
	 */
	@Transactional(readOnly = false)
	public void delete(E e) {
		dao.delete(e);
	}

}

--- 
+++ 
@@ -2,6 +2,9 @@
 
 import java.util.List;
 
+import org.springframework.security.access.prepost.PostAuthorize;
+import org.springframework.security.access.prepost.PostFilter;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.transaction.annotation.Transactional;
 
 import de.terrestris.shogun2.model.PersistentObject;
@@ -22,6 +25,7 @@
 	 * @return
 	 */
 	@Transactional(readOnly = false)
+	@PreAuthorize("isAuthenticated()")
 	public E saveOrUpdate(E e) {
 		dao.saveOrUpdate(e);
 		return e;
@@ -32,6 +36,7 @@
 	 * @param id
 	 * @return
 	 */
+	@PostAuthorize("hasPermission(returnObject, 'READ')")
 	public E findById(Integer id) {
 		return dao.findById(id);
 	}
@@ -40,6 +45,7 @@
 	 * 
 	 * @return
 	 */
+	@PostFilter("hasPermission(filterObject, 'READ')")
 	public List<E> findAll() {
 		return dao.findAll();
 	}
@@ -48,6 +54,7 @@
 	 * 
 	 * @param e
 	 */
+	@PreAuthorize("hasPermission(#e, 'DELETE')")
 	@Transactional(readOnly = false)
 	public void delete(E e) {
 		dao.delete(e);
Add basic security annotations to the CRUD service
