Spring Cloud Gateway YML routing - is there a way to check permissions?

I have some microservices, and a Gateway using Spring Cloud. I'm trying to set up the routing in the Gateway. Ideally, I would like to set up the routing in the YML file, or with a RouteLocator bean.

But currently, in my Gateway, I have REST endpoints for every route, which is just sending the request onwards using a WebClient.

(Prior to this, I have a ReactiveAuthenticationManager filter which validates a JWT token. It returns a UsernamePasswordAuthenticationToken which includes some user authorities it gets from the token).

Here's an example where I have set up a route to a microservice called the tracking service:

Controller:

@RestController
@RequestMapping("/tracking-service/tracking")
public class TrackingController {

  @Autowired
  private TrackingService trackingService;

  @GetMapping
  public Flux getAllTracking() {
    return trackingService.getAllTracking();
  }

}

Service:

@Service
public class TrackingService {

  private WebClient webClient;

  @PreAuthorize("hasAuthority('MANAGER')")
  public Flux getAllTracking() {
    //Make HTTP call to the tracking service
  }

}

The reason I have done it this way is because of the @PreAuthorize annotation. If the client's JWT token does not include the 'MANAGER' token, then this will return a 403 forbidden status. Not all of the endpoints require the MANAGER authority and some of the endpoints require other authorities.

My question - is it possible to do this when routing with the YML? I was hoping to see something that looks like this, but I'm not sure it is possible? I have read the Spring docs and looked at all the available filters, and there was nothing that does this job that I could see.

spring:
  cloud:
    gateway:
      routes:
        - id: tracking
          uri: http://tracking-service
          predicates:
            - Path=/tracking-service/**
          filters:
            - StripPrefix=1
            - PreAuthorize=hasAuthority('MANAGER')

Thanks.

API Gateway and authorization are two separation of concern. Ideally authorization should not be mixed in gateway application. For permission you can directly map it to service like this.

@RestController
public class ResourceREST {

	@RequestMapping(value = "/resource/", method = RequestMethod.GET)
	 @PreAuthorize("@customPermissionEvaluator.hasPrivilege(authentication,'somepermission')")
	public Mono<ResponseEntity<?>> user() {
		return Mono.just(ResponseEntity.ok(new Message("Access allowed")));
	}
}

And define custom permission evaluator

@Service
public class CustomPermissionEvaluator {

	public boolean hasPrivilege(Authentication auth, String permission) {
		String requiredPermissionCheck = permission.toLowerCase();
		for (GrantedAuthority grantedAuth : auth.getAuthorities()) {
			if (grantedAuth.getAuthority().contains(requiredPermissionCheck)) {
				return true;
			}
		}
		return false;
	}
}

As such gateway does not provide any authorization in the routing which is ideal.