title: @PreAuthorize with hasPermission() executes code twice
body: <p>I want to use @PreAuthorize Spring annotation to controll access in my application.</p>
  
  <p>The problem is, that I have a lot of conditions depends not on the request parameters, but on the database entities.</p>
  
  <p><strong>Overview:</strong></p>
  
  <p>I have an <code>Route</code> entity, that has <code>User owner</code> field. You can remove the <code>Route</code> only if you are an owner.</p>
  
  <p>I have written my controller method:</p>
  
  <pre><code>@RequestMapping(value = "/route/remove/{id}", method = RequestMethod.GET)
  @PreAuthorize("hasPermission(#id, 'RouteRemove')")
    public String removeRoute(@PathVariable("id") Integer id, ModelMap model) {
  
    Route route = routeBO.getById(id);
  
    if(null == route)
      return "forward:/errors/404";
  
    // ... remove route here.
    // routeBO.remove(id);
  }
  </code></pre>
  
  <p>My <code>RouteRemove</code> permission is defined as:</p>
  
  <pre><code>@Component
  public class RouteRemovePermission implements Permission {
  
      @Autowired
      private RouteBO routeBO;
  
      @Override
      public boolean isAllowed(Authentication authentication, Object targetDomainObject) {
          if(!(targetDomainObject instanceof Integer))
              return false;
  
          Route route = routeBO.getById((Integer) targetDomainObject);
  
          if(route == null)
              return false;
  
          User user = AthenticationUtil.getUser();
  
          return null != user &amp;&amp; user.equals(route.getOwner());
      }
  
  }
  </code></pre>
  
  <p>As you can see, I have to evaluate <code>routeBO.getById()</code> twice.</p>
  
  <p><strong>Question:</strong></p>
  
  <p>is it possible to evaluate this code only once?</p>
  
  <p><em>Of course i have tried:</em></p>
  
  <pre><code>@RequestMapping(value = "/route/remove/{id}", method = RequestMethod.GET)
  public String removeRoute(@PathVariable("id") Integer id, ModelMap model) {
  
  Route route = routeBO.getById(id);
  
  if(null == route)
    return "forward:/errors/404";
  
  return removeRoute(route, model);
  }
  
  @PreAuthorize("hasPermission(#id, 'RouteRemove')")
  public String removeRoute(Route id, ModelMap model) {
  
      return "route/display";
  }
  </code></pre>
  
  <p>but there no invocation of permission method before <code>removeRoute(Route id, ModelMap model)</code>. Maybe I have incorrect configuration?</p>
  
  <p>mvc-dispatcher-servlet.xml</p>
  
  <pre><code>&lt;sec:global-method-security secured-annotations="enabled" pre-post-annotations="enabled"&gt;
    &lt;sec:expression-handler ref="expressionHandler"/&gt;
  &lt;/sec:global-method-security&gt;
  </code></pre>
  
  <p>security.xml</p>
  
  <pre><code>&lt;beans:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"&gt;
      &lt;beans:property name="permissionEvaluator" ref="permissionEvaluator"/&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="permissionEvaluator" class="pl.wsiadamy.common.security.BasePermissionEvaluator"&gt;
    &lt;beans:constructor-arg index="0"&gt;
          &lt;beans:map key-type="java.lang.String"
               value-type="pl.wsiadamy.common.security.Permission"&gt;
              &lt;beans:entry key="RouteView" value-ref="routeViewPermission" /&gt;
              &lt;beans:entry key="RouteRemove" value-ref="routeRemovePermission" /&gt;
          &lt;/beans:map&gt;
      &lt;/beans:constructor-arg&gt;
  &lt;/beans:bean&gt;
  &lt;beans:bean id="routeViewPermission" class="pl.wsiadamy.common.security.permission.RouteViewPermission" /&gt;
  &lt;beans:bean id="routeRemovePermission" class="pl.wsiadamy.common.security.permission.RouteRemovePermission" /&gt;
  </code></pre>