Revize fdf6c32d

Administation page finished
re #9818

backend/src/main/java/cz/zcu/kiv/backendapi/security/SecurityConfig.java

@@ -21 +21 @@
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
+import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -63 +65 @@
         PERMITTED_ENDPOINTS.put("/catalog-items", HttpMethod.GET);
         PERMITTED_ENDPOINTS.put("/catalog-items/**", HttpMethod.GET);
         PERMITTED_ENDPOINTS.put("/title-page", HttpMethod.GET);
-        PERMITTED_ENDPOINTS.put("/sources", HttpMethod.GET);
     }
 
     /**
@@ -72 +73 @@
      * @param http http security
      * @throws Exception exception
      */
+    // TODO configure and check rights
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.csrf().disable()
@@ -84 +86 @@
                 .authorizeRequests()
                 .antMatchers(HttpMethod.GET, PERMITTED_ENDPOINTS.keySet().stream().filter(k -> PERMITTED_ENDPOINTS.get(k).equals(HttpMethod.GET)).toArray(String[]::new)).permitAll()
                 .antMatchers(HttpMethod.POST, "/login").permitAll()
-                .antMatchers(HttpMethod.POST, "/users", "/external-catalog-items").hasRole(Role.ADMIN.name())
+                .antMatchers("/external-catalog-items").hasRole(Role.ADMIN.name())
                 .antMatchers(HttpMethod.PATCH, "/users/*/permissions", "/users/*/password").hasRole(Role.ADMIN.name())
                 .antMatchers(HttpMethod.DELETE, "/users/**").hasRole(Role.ADMIN.name())
                 .antMatchers(HttpMethod.GET, "/users").hasRole(Role.ADMIN.name())
-                .antMatchers(HttpMethod.GET, "/path", "/external-catalog-items").hasAuthority(Permission.READ.name())
+                .antMatchers(HttpMethod.GET, "/path").hasAuthority(Permission.READ.name())
                 .antMatchers(HttpMethod.POST, "/catalog-items").hasAuthority(Permission.WRITE.name())
                 .antMatchers(HttpMethod.PUT, "/catalog-items/*").hasAuthority(Permission.WRITE.name())
                 .antMatchers(HttpMethod.DELETE, "/catalog-items/*").hasAuthority(Permission.DELETE.name())
-                .antMatchers(HttpMethod.POST, "/title-page", "/sources").hasRole(Role.ADMIN.name())
+                .antMatchers(HttpMethod.POST, "/title-page").hasRole(Role.ADMIN.name())
                 .anyRequest()
                 .authenticated();
     }
@@ -115 +117 @@
      */
     @Bean
     public DaoAuthenticationProvider authenticationProvider() {
-        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+        final DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
         provider.setUserDetailsService(userDetailsService);
         provider.setPasswordEncoder(bCryptPasswordEncoder);
         return provider;
@@ -123 +125 @@
 
     @Bean
     CorsConfigurationSource corsConfigurationSource() {
-        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
-        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
+        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        CorsConfiguration corsConfiguration = new CorsConfiguration().applyPermitDefaultValues();
+        corsConfiguration.setAllowedMethods(java.util.List.of(HttpMethod.GET.name(), HttpMethod.HEAD.name(), HttpMethod.POST.name(), HttpMethod.DELETE.name(), HttpMethod.PATCH.name(), HttpMethod.PUT.name()));
+        source.registerCorsConfiguration("/**", corsConfiguration);
         return source;
     }
 }