commit 72188b9aca0e576a4c033a0f606cf284ddb960c5
Author: Jakub Danek <jakub.danek@yoso.fi>
Date:   Fri Oct 11 15:20:14 2019 +0200

    re #37 replace auth expressions with custom annotation
    
    re #37 replace auth expressions with custom annotation

diff --git a/server/src/main/java/org/danekja/ymanager/business/ApiManager.java b/server/src/main/java/org/danekja/ymanager/business/ApiManager.java
index 6926844..08c47be 100644
--- a/server/src/main/java/org/danekja/ymanager/business/ApiManager.java
+++ b/server/src/main/java/org/danekja/ymanager/business/ApiManager.java
@@ -1,6 +1,6 @@
 package org.danekja.ymanager.business;
 
-import org.danekja.ymanager.business.auth.AuthExpressions;
+import org.danekja.ymanager.business.auth.anot.IsOwner;
 import org.danekja.ymanager.domain.*;
 import org.danekja.ymanager.dto.DefaultSettings;
 import org.danekja.ymanager.dto.*;
@@ -12,7 +12,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.dao.DataAccessException;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
 
 import java.time.LocalDate;
@@ -27,9 +26,9 @@ public class ApiManager implements Manager {
      */
     private static final Logger log = LoggerFactory.getLogger(UserRepository.class);
 
-    private RequestRepository requestRepository;
-    private UserRepository userRepository;
-    private VacationRepository vacationRepository;
+    private final RequestRepository requestRepository;
+    private final UserRepository userRepository;
+    private final VacationRepository vacationRepository;
 
     @Autowired
     public ApiManager(RequestRepository requestRepository, UserRepository userRepository, VacationRepository vacationRepository) {
@@ -104,7 +103,7 @@ public class ApiManager implements Manager {
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public void createVacation(Long userId, VacationDay vacationDay) throws RESTFullException {
 
         if (vacationDay.getDate().isBefore(LocalDate.now())) {
@@ -207,7 +206,7 @@ public class ApiManager implements Manager {
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public void changeVacation(Long userId, VacationDay vacationDay) throws RESTFullException {
         try {
             Optional<Vacation> vacation = vacationRepository.getVacationDay(vacationDay.getId());
diff --git a/server/src/main/java/org/danekja/ymanager/business/auth/AuthExpressions.java b/server/src/main/java/org/danekja/ymanager/business/auth/AuthExpressions.java
deleted file mode 100644
index a7ffb75..0000000
--- a/server/src/main/java/org/danekja/ymanager/business/auth/AuthExpressions.java
+++ /dev/null
@@ -1,21 +0,0 @@
-package org.danekja.ymanager.business.auth;
-
-/**
- * This class holds String expressions used in authorization checks.
- * <p>
- * Please comment each expressions well enough to clarify what constraints on user authority it enforces.
- */
-public class AuthExpressions {
-
-    /**
-     * Used in cases where the action can be triggered by either:
-     * <ul>
-     * <li>employer - typically can edit all records</li>
-     * <li>data owner - employee can edit only his records</li>
-     * </ul>
-     * <p>
-     * In this case, the protected method needs to take <b>userId</b> parameter which represents the "userId" value and
-     * is compared to principal id.
-     */
-    public static final String MASTER_SELF_ID_PARAM = "hasAuthority('EMPLOYER') or #userId == authentication.principal.id";
-}
diff --git a/server/src/main/java/org/danekja/ymanager/business/auth/anot/IsOwner.java b/server/src/main/java/org/danekja/ymanager/business/auth/anot/IsOwner.java
new file mode 100644
index 0000000..5139a20
--- /dev/null
+++ b/server/src/main/java/org/danekja/ymanager/business/auth/anot/IsOwner.java
@@ -0,0 +1,23 @@
+package org.danekja.ymanager.business.auth.anot;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+
+import java.lang.annotation.*;
+
+/**
+ * Used in cases where the action can be triggered by either:
+ * <ul>
+ * <li>employer - typically can edit all records</li>
+ * <li>data owner - employee can edit only his records</li>
+ * </ul>
+ * <p>
+ * In this case, the protected method needs to take <b>userId</b> parameter which represents the "userId" value and
+ * is compared to principal id.
+ */
+@Target({ElementType.METHOD, ElementType.TYPE})
+@Retention(RetentionPolicy.RUNTIME)
+@Inherited
+@Documented
+@PreAuthorize("hasAuthority('EMPLOYER') or #userId == authentication.principal.id")
+public @interface IsOwner {
+}
diff --git a/server/src/main/java/org/danekja/ymanager/business/impl/DefaultUserManager.java b/server/src/main/java/org/danekja/ymanager/business/impl/DefaultUserManager.java
index d1e6983..fbd539c 100644
--- a/server/src/main/java/org/danekja/ymanager/business/impl/DefaultUserManager.java
+++ b/server/src/main/java/org/danekja/ymanager/business/impl/DefaultUserManager.java
@@ -1,8 +1,8 @@
 package org.danekja.ymanager.business.impl;
 
 import org.danekja.ymanager.business.UserManager;
-import org.danekja.ymanager.business.auth.AuthExpressions;
 import org.danekja.ymanager.business.auth.anot.IsEmployer;
+import org.danekja.ymanager.business.auth.anot.IsOwner;
 import org.danekja.ymanager.domain.Status;
 import org.danekja.ymanager.domain.User;
 import org.danekja.ymanager.dto.BasicProfileUser;
@@ -13,7 +13,6 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.dao.DataAccessException;
-import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
@@ -42,7 +41,7 @@ public class DefaultUserManager implements UserManager, UserDetailsService {
     }
 
     @Override
-    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
+    @IsOwner
     public User getUser(Long userId) {
         return userRepository.getUser(userId);
     }
