Evaluating Domain-Level Access with Custom Spring Security PermissionEvaluators

@Component
public class DocumentPermissionEvaluator implements PermissionEvaluator {
    @Override
    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
        if (targetDomainObject instanceof Document doc && permission instanceof String perm) {
            return doc.getOwnerId().equals(auth.getName()) || "READ".equalsIgnoreCase(perm);
        }
        return false;
    }
 
    @Override
    public boolean hasPermission(Authentication auth, Serializable targetId, String targetType, Object permission) {
        return false;
    }
}