How do you implement method-level security with @PreAuthorize and @PostAuthorize? @PreAuthorize और @PostAuthorize से मेथड-लेवल सिक्योरिटी कैसे इम्प्लीमेंट करें?

Method-level security lets you enforce authorization rules directly on service or controller methods instead of only at the URL level, enabled with @EnableMethodSecurity. @PreAuthorize evaluates a SpEL expression before the method executes and blocks the call if it evaluates to false, commonly checking roles or matching the authenticated user against a method argument.

@PostAuthorize evaluates after the method executes, allowing checks against the returned object (e.g. ensuring a fetched document belongs to the requesting user), and @PreFilter/@PostFilter can filter collection arguments or return values based on a condition per element.

@PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
public User getUser(Long userId) { ... }

@PostAuthorize("returnObject.owner == authentication.name")
public Document getDocument(Long id) { ... }