Restricting access to data by user in Spring with Spring Expression Language -

i have task management application, tasks defined so:

@entity @data public class taskrecord {      @id     @generatedvalue(strategy = generationtype.auto)     private long id;      @column(length = 999)     private string name;      @manytomany(cascade = cascadetype.all, fetch = fetchtype.eager)     private set<user> users; } 

i want wire things such user can retrieves tasks s/he in set of users for.

a user object has unique id , i've configured principal object have correct user member (following successful authentication).

is using @postauthorize spring expression language way go doing this? have , works skeptical quality or worthwhileness.

@repository public interface taskrepository extends crudrepository<taskrecord, long> {     @override     @postauthorize("!returnobject.users.?[id == principal.user.id].empty")     taskrecord findone(long id); } 

also use of empty @ end right way go this? feels bit hackish.

finally, there way @preauthorize not expose findone result jvm?

wiki