From bfeea41ee19743f2ff65a368d65c737083ead27a Mon Sep 17 00:00:00 2001
From: backdev-1 <backdev-1@xxxxxxxxx.su>
Date: Fri, 22 May 2026 13:59:55 +0700
Subject: [PATCH] add entity and controller for templates admin create

---
 .../adminpanel/handler/AdminUserHandler.java  | 40 +++++++++++++++----
 1 file changed, 33 insertions(+), 7 deletions(-)

diff --git a/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java b/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
index 7ab2268..5f0f639 100644
--- a/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
+++ b/src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
@@ -56,7 +56,7 @@ public class AdminUserHandler implements RequestHandler {
             case "toggle_active" -> handleToggleActive(request, adminRequest);
             case "delete" -> handleDelete(request, adminRequest);
             case "get_permissions_by_id" -> handleGetPermissionsById(request, adminRequest);
-            case "get_permissions_by_token" -> handleGetPermissionsByToken(request);
+            case "get_permissions_by_token" -> handleGetPermissionsByToken(request, adminRequest);
             case "update_permissions" -> handleUpdatePermissions(request, adminRequest);
             default -> handleInvalidAction(request, action);
         };
@@ -184,7 +184,7 @@ public class AdminUserHandler implements RequestHandler {
             return BaseResponse.builder()
                     .msgId(request.getMsgId())
                     .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                    .messageDesc("You can't update profile")
+                    .messageDesc("You can't reads")
                     .build();
         }
 
@@ -211,7 +211,7 @@ public class AdminUserHandler implements RequestHandler {
                     return BaseResponse.builder()
                             .msgId(request.getMsgId())
                             .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                            .messageDesc("You can't update profile")
+                            .messageDesc("You can't read")
                             .build();
                 }
             }
@@ -289,7 +289,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't update profile")
                         .build();
             }
 
@@ -370,7 +370,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't delete profile")
                         .build();
             }
 
@@ -410,6 +410,19 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleGetPermissionsById(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canRead(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             Long userId = adminRequest.getAdminId();
             AdminUser admin = adminUserService.findById(userId);
 
@@ -444,8 +457,21 @@ public class AdminUserHandler implements RequestHandler {
         }
     }
 
-    private BaseResponse handleGetPermissionsByToken(BaseRequest request) {
+    private BaseResponse handleGetPermissionsByToken(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canRead(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             String token = request.getToken();
             if (token == null || token.isEmpty()) {
                 return BaseResponse.builder()
@@ -497,7 +523,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't update profile")
                         .build();
             }