Auswertung hierarchischer Rollenberechtigungen mit Methodensicherheitsausdrücken

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
 
    @Bean
    public RoleHierarchy roleHierarchy() {
        return RoleHierarchyImpl.withDefaultRolePrefix()
            .role("ADMIN").implies("MANAGER")
            .role("MANAGER").implies("USER")
            .build();
    }
 
    @Bean
    public MethodSecurityExpressionHandler methodSecurityExpressionHandler(RoleHierarchy roleHierarchy) {
        DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
        expressionHandler.setRoleHierarchy(roleHierarchy);
        return expressionHandler;
    }
}
 
@Service
public class ReportService {
    @PreAuthorize("hasRole('USER') and #reportType != 'FINANCIAL'")
    public Report generateReport(String reportType) {
        return new Report(reportType, "Generated data");
    }
}