title: Spring Security: provide access depending on service call
body: <p>I have spring boot application which exposes REST endpoints protected by spring security. </p>
  
  <p><strong>I need to restrict access to some paths depending on service call.</strong> Let's say I have a service like this:</p>
  
  <pre><code>@Service
  public class AccessService {
      boolean hasAccess(String requestedPath) {
          // some business logic here
      }
  }
  </code></pre>
  
  <p>The service will check user roles, some business conditions and return <code>true</code> or <code>false</code>.</p>
  
  <p><strong>Now I need to integrate this service call into my security configuration</strong>.</p>
  
  <p>So far I have configuration like this:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
          http
                  ...
                  .and().authorizeRequests()
                  .anyRequest().hasRole("USER");
  }
  </code></pre>
  
  <p>I see no way of adding the service call here (as it is completely static).</p>
  
  <p><strong>What I'm trying:</strong></p>
  
  <p>Currently I'm thinking of overriding my <code>AuthenticationProvider</code> and extending it with the additional functionality. </p>
  
  <p>The other option would be to extend my REST controllers from a class which would do some sort of authorization, but I'm not sure if it is possible.</p>
  
  <p><strong>Question:</strong> How can I protect REST endpoints based on service method call? What is the proper way of doing that?</p>