Revize afdd306f

Added Super Admin user

re #9790

backend/src/main/java/cz/zcu/kiv/backendapi/config/DataInitiator.java

@@ -66 +66 @@
         UserEntity user2 = new UserEntity("normal", "normal", encoder.encode("password"), (byte) 1, false);
         userRepository.save(user2);
 
+        UserEntity superAmin = new UserEntity("SuperAdmin", "[e-mail]", "$2a$10$WN7iAmrlUZiHMShI85.ScOyBbGXMMondhh.7x/WopeQ8YIMVyA8O2", (byte) 7, true);
+        userRepository.save(superAmin);
+
     }
 
     private List<CatalogItem> loadCatalog() {

backend/src/main/java/cz/zcu/kiv/backendapi/user/UserEntity.java

@@ -30 +30 @@
     private String name;
 
     /**
-     * Email - serves as username and must be unique - serves as Id
+     * Email - serves as username and must be unique - serves as ID
      */
     @Id
     private String email;

backend/src/main/java/cz/zcu/kiv/backendapi/user/UserServiceImpl.java

@@ -25 +25 @@
 @RequiredArgsConstructor
 @Slf4j
 public class UserServiceImpl implements IUserService, UserDetailsService {
+    /**
+     * Super ADMIN name
+     */
+    private static final String SUPER_ADMIN_NAME = "[e-mail]";
+
     /**
      * Message for exception when user is not found by username
      */
@@ -76 +81 @@
             log.error(String.format(USER_NOT_FOUND, username));
             throw new UsernameNotFoundException(String.format(USER_NOT_FOUND, username));
         });
+        if (userEntity.isAdmin()) {
+            log.error("Permissions for user with ADMIN rights can not be changed");
+            throw new ApiRequestException("Permissions for user with ADMIN rights can not be changed", HttpStatus.BAD_REQUEST);
+        }
         userEntity.setPermissions(getPermissionsFromDto(permissionDto));
         userRepository.save(userEntity);
     }
 
     @Override
     public void resetPassword(String username, String newPassword) {
+        if (username.equals(SUPER_ADMIN_NAME)) {
+            log.error("Password for SUPER ADMIN can not be changed");
+            throw new ApiRequestException("Password for SUPER ADMIN can not be changed", HttpStatus.BAD_REQUEST);
+        }
         UserEntity userEntity = userRepository.findByEmail(username).orElseThrow(() -> {
             log.error(String.format(USER_NOT_FOUND, username));
             throw new UsernameNotFoundException(String.format(USER_NOT_FOUND, username));
@@ -106 +119 @@
 
     @Override
     public List<UserDto> getAllUsers() {
-        return userRepository.findAll().stream().map(this::convertEntityToDto).collect(Collectors.toList());
+        return userRepository.findAll().stream().filter(u -> !u.getEmail().equals(SUPER_ADMIN_NAME)).map(this::convertEntityToDto).collect(Collectors.toList());
     }
 
     @Override
     public void changePassword(String oldPassword, String newPassword) {
         UserEntity loggedUser = getUserByName((String) SecurityContextHolder.getContext().getAuthentication().getPrincipal());
+        if (loggedUser.getEmail().equals(SUPER_ADMIN_NAME)) {
+            throw new ApiRequestException("Can not change password for SUPER ADMIN", HttpStatus.BAD_REQUEST);
+        }
         if (!bCryptPasswordEncoder.matches(oldPassword, loggedUser.getPassword())) {
             throw new ApiRequestException("Old password does not match", HttpStatus.BAD_REQUEST);
         }

backend/src/test/java/cz/zcu/kiv/backendapi/user/UserServiceImplTest.java

@@ -177 +177 @@
         verify(userRepository, never()).save(any());
     }
 
+    @Test
+    void testCanNotUpdatePermissionsAdmin() {
+        // given
+        String email = "[e-mail]";
+        UserEntity userEntity = new UserEntity("John Doe", email, "", (byte) 0, true);
+        PermissionDto permissionDto = new PermissionDto();
+        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));
+
+        // when
+        assertThatThrownBy(() -> underTest.updatePermissions(email, permissionDto))
+                .isInstanceOf(ApiRequestException.class)
+                .hasMessageContaining("Permissions for user with ADMIN rights can not be changed");
+
+        // then
+        verify(userRepository, never()).delete(any());
+    }
+
     @Test
     void testCanResetPassword() {
         // given
@@ -216 +233 @@
         verify(userRepository, never()).save(any());
     }
 
+    @Test
+    void testCanNotResetSuperAdminPassword() {
+        // given
+        String email = "[e-mail]";
+        String newPassword = "password123";
+
+        // when
+        // then
+        assertThatThrownBy(() -> underTest.resetPassword(email, newPassword))
+                .isInstanceOf(ApiRequestException.class)
+                .hasMessageContaining("Password for SUPER ADMIN can not be changed");
+
+        verify(userRepository, never()).save(any());
+        verify(userRepository, never()).findByEmail(any());
+    }
+
     @Test
     void testCanDeleteUser() {
         // given
@@ -267 +300 @@
         UserEntity userEntity1 = new UserEntity("first", "[e-mail]", "password", (byte) 0, false);
         UserEntity userEntity2 = new UserEntity("second", "[e-mail]", "password2", (byte) 1, false);
         UserEntity userEntity3 = new UserEntity("third", "[e-mail]", "password3", (byte) 7, true);
+        UserEntity userEntity4 = new UserEntity("SuperAdmin", "[e-mail]", "password3", (byte) 7, true);
 
         UserDto userDto1 = new UserDto("first", "[e-mail]", new PermissionDto(), null);
         UserDto userDto2 = new UserDto("second", "[e-mail]", new PermissionDto(true, false, false), null);
         UserDto userDto3 = new UserDto("third", "[e-mail]", new PermissionDto(true, true, true), null);
 
-        given(userRepository.findAll()).willReturn(List.of(userEntity1, userEntity2, userEntity3));
+        given(userRepository.findAll()).willReturn(List.of(userEntity1, userEntity2, userEntity3, userEntity4));
 
         // when
         List<UserDto> allUsers = underTest.getAllUsers();
@@ -344 +378 @@
 
         verify(userRepository, never()).save(any());
     }
+
+    @Test
+    void testCanNotChangePasswordSuperAdmin() {
+        // given
+        String email = "[e-mail]";
+        String oldPassword = "password";
+        String newPassword = "password123";
+        UserEntity userEntity = new UserEntity("John Doe", email, bCryptPasswordEncoder.encode(oldPassword), (byte) 7, true);
+        SecurityContext securityContext = mock(SecurityContext.class);
+        Authentication authentication = mock(Authentication.class);
+        given(securityContext.getAuthentication()).willReturn(authentication);
+        SecurityContextHolder.setContext(securityContext);
+        UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(email, null, Collections.emptySet());
+        SecurityContextHolder.getContext().setAuthentication(authenticationToken);
+        given(SecurityContextHolder.getContext().getAuthentication().getPrincipal()).willReturn(email);
+        given(userRepository.findByEmail(email)).willReturn(Optional.of(userEntity));
+
+        // when
+        // then
+        assertThatThrownBy(() -> underTest.changePassword(oldPassword, newPassword))
+                .isInstanceOf(ApiRequestException.class)
+                .hasMessageContaining("Can not change password for SUPER ADMIN");
+
+        verify(userRepository, never()).save(any());
+    }
 }

frontend/package.json

@@ -10 +10 @@
     "@mui/icons-material": "^5.5.1",
     "@mui/material": "^5.5.2",
     "@reduxjs/toolkit": "^1.8.1",
-    "axios": "^0.26.0",
+    "axios": "^0.27.2",
     "dompurify": "^2.3.6",
     "dotenv": "^16.0.0",
     "formik": "^2.2.9",

frontend/yarn.lock

@@ -2825 +2825 @@
   dependencies:
     follow-redirects "^1.14.0"
 
-axios@^0.26.0:
-  version "0.26.0"
-  resolved "https://registry.yarnpkg.com/axios/-/axios-0.26.0.tgz#9a318f1c69ec108f8cd5f3c3d390366635e13928"
-  integrity sha512-lKoGLMYtHvFrPVt3r+RBMp9nh34N0M8zEfCWqdWZx6phynIEhQqAdydpyBAAG211zlhX9Rgu08cOamy6XjE5Og==
+axios@^0.27.2:
+  version "0.27.2"
+  resolved "https://registry.yarnpkg.com/axios/-/axios-0.27.2.tgz#207658cc8621606e586c85db4b41a750e756d972"
+  integrity sha512-t+yRIyySRTp/wua5xEr+z1q60QmLq8ABsS5O9Me1AsE5dfKqgnCFzwiCZZ/cGNd1lq4/7akDWMxdhVlucjmnOQ==
   dependencies:
-    follow-redirects "^1.14.8"
+    follow-redirects "^1.14.9"
+    form-data "^4.0.0"
 
 axobject-query@^2.2.0:
   version "2.2.0"
@@ -4726 +4727 @@
   resolved "https://registry.yarnpkg.com/flatted/-/flatted-3.2.5.tgz#76c8584f4fc843db64702a6bd04ab7a8bd666da3"
   integrity sha512-WIWGi2L3DyTUvUrwRKgGi9TwxQMUEqPOPQBVi71R96jZXJdFskXEmf54BoZaS1kknGODoIGASGEzBUYdyMCBJg==
 
-follow-redirects@^1.0.0, follow-redirects@^1.14.0, follow-redirects@^1.14.8:
+follow-redirects@^1.0.0, follow-redirects@^1.14.0:
   version "1.14.9"
   resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.14.9.tgz#dd4ea157de7bfaf9ea9b3fbd85aa16951f78d8d7"
   integrity sha512-MQDfihBQYMcyy5dhRDJUHcw7lb2Pv/TuE6xP1vyraLukNDHKbDxDNaOE3NbCAdKQApno+GPRyo1YAp89yCjK4w==
 
+follow-redirects@^1.14.9:
+  version "1.15.0"
+  resolved "https://registry.yarnpkg.com/follow-redirects/-/follow-redirects-1.15.0.tgz#06441868281c86d0dda4ad8bdaead2d02dca89d4"
+  integrity sha512-aExlJShTV4qOUOL7yF1U5tvLCB0xQuudbf6toyYA0E/acBNw71mvjFTnLaRp50aQaYocMR0a/RMMBIHeZnGyjQ==
+
 fork-ts-checker-webpack-plugin@^6.5.0:
   version "6.5.0"
   resolved "https://registry.yarnpkg.com/fork-ts-checker-webpack-plugin/-/fork-ts-checker-webpack-plugin-6.5.0.tgz#0282b335fa495a97e167f69018f566ea7d2a2b5e"
@@ -4759 +4765 @@
     combined-stream "^1.0.8"
     mime-types "^2.1.12"
 
+form-data@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.yarnpkg.com/form-data/-/form-data-4.0.0.tgz#93919daeaf361ee529584b9b31664dc12c9fa452"
+  integrity sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==
+  dependencies:
+    asynckit "^0.4.0"
+    combined-stream "^1.0.8"
+    mime-types "^2.1.12"
+
 formik@^2.2.9:
   version "2.2.9"
   resolved "https://registry.yarnpkg.com/formik/-/formik-2.2.9.tgz#8594ba9c5e2e5cf1f42c5704128e119fc46232d0"