Revize 72188b9a

re #37 replace auth expressions with custom annotation

re #37 replace auth expressions with custom annotation

server/src/main/java/org/danekja/ymanager/business/ApiManager.java

@@ -1 +1 @@
 package org.danekja.ymanager.business;
 
-import org.danekja.ymanager.business.auth.AuthExpressions;
+import org.danekja.ymanager.business.auth.anot.IsOwner;
 import org.danekja.ymanager.domain.*;
 import org.danekja.ymanager.dto.DefaultSettings;
 import org.danekja.ymanager.dto.*;
@@ -12 +12 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.dao.DataAccessException;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 import java.time.LocalDate;
@@ -27 +26 @@
      */
     private static final Logger log = LoggerFactory.getLogger(UserRepository.class);
 
-    private RequestRepository requestRepository;
-    private UserRepository userRepository;
-    private VacationRepository vacationRepository;
+    private final RequestRepository requestRepository;
+    private final UserRepository userRepository;
+    private final VacationRepository vacationRepository;
 
     @Autowired
     public ApiManager(RequestRepository requestRepository, UserRepository userRepository, VacationRepository vacationRepository) {
@@ -104 +103 @@
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public void createVacation(Long userId, VacationDay vacationDay) throws RESTFullException {
 
         if (vacationDay.getDate().isBefore(LocalDate.now())) {
@@ -207 +206 @@
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public void changeVacation(Long userId, VacationDay vacationDay) throws RESTFullException {
         try {
             Optional<Vacation> vacation = vacationRepository.getVacationDay(vacationDay.getId());

server/src/main/java/org/danekja/ymanager/business/auth/AuthExpressions.java

@@ -1 @@
-package org.danekja.ymanager.business.auth;
-
-/**
- * This class holds String expressions used in authorization checks.
- * <p>
- * Please comment each expressions well enough to clarify what constraints on user authority it enforces.
- */
-public class AuthExpressions {
-
-    /**
-     * Used in cases where the action can be triggered by either:
-     * <ul>
-     * <li>employer - typically can edit all records</li>
-     * <li>data owner - employee can edit only his records</li>
-     * </ul>
-     * <p>
-     * In this case, the protected method needs to take <b>userId</b> parameter which represents the "userId" value and
-     * is compared to principal id.
-     */
-    public static final String MASTER_SELF_ID_PARAM = "hasAuthority('EMPLOYER') or #userId == authentication.principal.id";
-}

server/src/main/java/org/danekja/ymanager/business/auth/anot/IsOwner.java

@@ +1 @@
+package org.danekja.ymanager.business.auth.anot;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+
+import java.lang.annotation.*;
+
+/**
+ * Used in cases where the action can be triggered by either:
+ * <ul>
+ * <li>employer - typically can edit all records</li>
+ * <li>data owner - employee can edit only his records</li>
+ * </ul>
+ * <p>
+ * In this case, the protected method needs to take <b>userId</b> parameter which represents the "userId" value and
+ * is compared to principal id.
+ */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Inherited
+@Documented
+@PreAuthorize("hasAuthority('EMPLOYER') or #userId == authentication.principal.id")
+public @interface IsOwner {
+}

server/src/main/java/org/danekja/ymanager/business/impl/DefaultUserManager.java

@@ -1 +1 @@
 package org.danekja.ymanager.business.impl;
 
 import org.danekja.ymanager.business.UserManager;
-import org.danekja.ymanager.business.auth.AuthExpressions;
 import org.danekja.ymanager.business.auth.anot.IsEmployer;
+import org.danekja.ymanager.business.auth.anot.IsOwner;
 import org.danekja.ymanager.domain.Status;
 import org.danekja.ymanager.domain.User;
 import org.danekja.ymanager.dto.BasicProfileUser;
@@ -13 +13 @@
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.dao.DataAccessException;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -42 +41 @@
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public User getUser(Long userId) {
         return userRepository.getUser(userId);
     }