title: Spring Security custom PermissionEvaluator
body: <p>I'm using JWT token authorization.
  I'm trying to restrict access to some of REST api endpoints. I would like it to work like that: code below should be only executed when authenticated user id == id given in <code>@PathVariable</code></p>
  
  <pre><code>@PreAuthorize("hasAnyAuthority('ADMIN', 'USER')")
  @GetMapping(value = "orders/{id}", produces = "application/json")
  public EntityModel&lt;Order&gt; getOrders(@PathVariable Long id) { ... )
  </code></pre>
  
  <p>These articles more or less describe what I trying to acomplish: <a href="https://stackoverflow.com/questions/37057175/spring-security-in-conjuction-with-spring-repositories-to-secure-and-authenticat/37060389#37060389">similar post</a>, <a href="https://www.baeldung.com/spring-security-create-new-custom-security-expression" rel="nofollow noreferrer">article</a></p>
  
  <p><strong>I don't understand how second link <code>CustomPermissionEvaluator implements PermissionEvaluator</code> should look like in my case. I would be grateful if someone would give me some tips.</strong></p>
  
  <p><strong>My second concern</strong> is that all I can do later on, is to get username <code>authentication.getName()</code>, and then i have to use <code>UserRepository</code> to <code>findUserByUsername(String username)</code>. Is it normal to do it this way? That's additional database query. I wonder if it is possible to somehow add userID to token (because function that returns <code>UsernamePasswordAuthenticationToken</code> already is getting user by username anyway).</p>