[BAEL-1411:tlinh2110] Add example for PostAuthorize

spring-security-core/src/main/java/org/baeldung/methodsecurity/service/UserRoleService.java

@@ -64,11 +64,13 @@ public class UserRoleService {
     @PreAuthorize("#username == authentication.principal.username")
     public String getMyRoles(String username) {
         SecurityContext securityContext = SecurityContextHolder.getContext();
-        return securityContext
+        return securityContext.getAuthentication().getAuthorities().stream().map(auth -> auth.getAuthority()).collect(Collectors.joining(","));
-                .getAuthentication()
+    }
-                .getAuthorities()
+
-                .stream()
+    @PostAuthorize("#username == authentication.principal.username")
-                .map(auth -> auth.getAuthority()).collect(Collectors.joining(","));
+    public String getMyRoles2(String username) {
+        SecurityContext securityContext = SecurityContextHolder.getContext();
+        return securityContext.getAuthentication().getAuthorities().stream().map(auth -> auth.getAuthority()).collect(Collectors.joining(","));
     }
 
     @PostAuthorize("returnObject.username == authentication.principal.nickName")

spring-security-core/src/test/java/org/baeldung/methodsecurity/TestMethodSecurity.java

@@ -98,6 +98,19 @@ public class TestMethodSecurity {
         userRoleService.getMyRoles("jane");
     }
     
+    @Test
+    @WithMockUser(username = "john", roles = { "ADMIN", "USER", "VIEWER" })
+    public void givenUserJohn_whenCallGetMyRoles2WithJohn_thenReturnRoles() {
+        String roles = userRoleService.getMyRoles2("john");
+        assertEquals("ROLE_ADMIN,ROLE_USER,ROLE_VIEWER", roles);
+    }
+
+    @Test(expected = AccessDeniedException.class)
+    @WithMockUser(username = "john", roles = { "ADMIN", "USER", "VIEWER" })
+    public void givenUserJane_whenCallGetMyRoles2WithJane_thenAccessDenied() {
+        userRoleService.getMyRoles2("jane");
+    }
+
     @Test(expected = AccessDeniedException.class)
     @WithAnonymousUser
     public void givenAnomynousUser_whenCallGetUsername_thenAccessDenied() {