Describe a way to define and configure Custom Access Constraint

[syncro]

It'is possbile to implement own Security Constraint that can extend other Constraint class (e.g. CrudEntityConstraint) or any other and apply application-wide e.g. to forbid UI edit for all entities. This needs registring with accessConstraintsRegistry.register() method call in some @PostConstruct annotated method and this is done in the following configuration:

This should be described in documentaion and/or cookbook for developers to know how to customize security contranints, e.g. at the following page: https://docs.jmix.io/jmix/security/authorization.html

[syncro]

original request was the following:

Alex
We named a class like this:

@Component
public class MySecurityConstraint implements AccessConstraint<CrudEntityContext> {
    private static final Logger log = LoggerFactory.getLogger(MySecurityConstraint.class);

    @Override
    public Class<CrudEntityContext> getContextType() {
        return CrudEntityContext.class;
    }

    @Override
    public void applyTo(CrudEntityContext context) {
        log.info("MySecurityConstraint.applyTo for {}", context.getEntityClass());

        context.setCreateDenied();
        context.setUpdateDenied();
        context.setDeleteDenied();
    }
}

It should forbid editing of all entities in the system. But it doesn't work, it’s not even called