عرض عملي: أمان الدوال مع فحوص الملكية

خطوة بخطوة

1. Enable method security.
2. Add @PreAuthorize("hasRole('ADMIN')") to the "list all orders" service method.
3. Add a service method getMyOrders(currentUser) that filters by owner.
4. Remove customerId from the create-order request body and take it from the principal.
5. Planned mistake: leaving the customerId in the body, so customer A creates an order for B. Show the attack, then fix.
6. Add tests for customer A, customer B, and admin.