Custom Method-Level Authorization via SpEL Bean Evaluation

@Service
public class DocumentService {
 
    @PreAuthorize("@documentSecurity.canAccess(#documentId, authentication)")
    public Document getDocument(Long documentId) {
        return findDocumentById(documentId);
    }
}
 
@Component("documentSecurity")
public class DocumentSecurityChecker {
 
    private final DocumentRepository repository;
 
    public DocumentSecurityChecker(DocumentRepository repository) {
        this.repository = repository;
    }
 
    public boolean canAccess(Long documentId, Authentication auth) {
        if (auth == null || !auth.isAuthenticated()) {
            return false;
        }
        return repository.isOwnerOrShared(documentId, auth.getName());
    }
}