Revize 97f0fa4e

re #37 protect "edit vacation request" process

server/src/main/java/org/danekja/ymanager/business/ApiManager.java

@@ -207 +207 @@
     }
 
     @Override
+    @PreAuthorize(AuthExpressions.MASTER_SELF_ID_PARAM)
     public void changeVacation(Long userId, VacationDay vacationDay) throws RESTFullException {
         try {
             Optional<Vacation> vacation = vacationRepository.getVacationDay(vacationDay.getId());

server/src/main/java/org/danekja/ymanager/ws/rest/ApiController.java

@@ -139 +139 @@
     @RequestMapping(value = "/user/calendar/edit", method=PUT)
     public ResponseEntity userCalendarEdit(
             @RequestParam(value = "lang", required = false) String lang,
-            @RequestBody VacationDay vacationDay)
+            @RequestBody VacationDay vacationDay,
+            Authentication auth)
     {
+        //TODO make api endpoint contain userId in path as part of #39, also drop the edit part of path
+        //TODO drop the auth parameter afterwards
         return handle(Language.getLanguage(lang), () ->
-                manager.changeVacation(getUserId("me"), vacationDay)
+                manager.changeVacation(((User) auth.getPrincipal()).getId(), vacationDay)
         );
     }