backdev/admin-panel
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

dev #1

Open
backdev wants to merge 47 commits from dev into main
pull from: dev
merge into: :main
Conversation 0 Commits 47 Files Changed 44
+110 -2
1 changed files with 110 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 4b281dccbd - Show all commits
src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java
+110 -2
View File
@@ -1,6 +1,7 @@
package ru.soune.nocopy.adminpanel.handler;
import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.http.HttpServletRequest;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.stereotype.Component;
@@ -36,15 +37,28 @@ public class AdminUserHandler implements RequestHandler {
private final AdminSectionPermissionService permissionService;
private final HttpServletRequest httpServletRequest;
private final AdminSectionPermissionService adminSectionPermissionService;
@Override
public BaseResponse handle(BaseRequest request) throws Exception {
AdminUserRequest adminRequest = objectMapper.convertValue(request.getMessageBody(), AdminUserRequest.class);
String action = adminRequest.getAction();
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (currentUserId == null) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.INVALID_CREDENTIALS.getCode())
.messageDesc(MessageCode.INVALID_CREDENTIALS.getDescription())
.build();
}
return switch (action) {
case "login" -> handleLogin(request, adminRequest);
case "create" -> handleCreate(request, adminRequest);
case "get_all" -> handleGetAll(request);
case "get_all" -> handleGetAll(request, adminRequest);
case "get_by_id" -> handleGetById(request, adminRequest);
case "update" -> handleUpdate(request, adminRequest);
case "set_super_admin" -> handleSetSuperAdmin(request, adminRequest);
@@ -107,6 +121,17 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleCreate(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't create profile")
.build();
}
boolean superAdmin = adminRequest.getIsSuperAdmin() != null && adminRequest.getIsSuperAdmin();
boolean changePassword = adminRequest.getChangePassword() != null ? adminRequest.getChangePassword():
!superAdmin;
@@ -160,7 +185,18 @@ public class AdminUserHandler implements RequestHandler {
}
}
private BaseResponse handleGetAll(BaseRequest request) {
private BaseResponse handleGetAll(BaseRequest request, AdminUserRequest adminRequest) {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!adminSectionPermissionService.canRead(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't update profile")
.build();
}
List<AdminUserResponse> admins = adminUserService.findAll().stream()
.map(this::convertToResponse)
.collect(Collectors.toList());
@@ -176,6 +212,19 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleGetById(BaseRequest request, AdminUserRequest adminRequest) {
try {
AdminUser admin = adminUserService.findById(adminRequest.getAdminId());
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!currentUserId.equals(adminRequest.getAdminId())) {
if (!adminSectionPermissionService.canRead(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't update profile")
.build();
}
}
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.SUCCESS.getCode())
@@ -193,6 +242,19 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleUpdate(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!currentUserId.equals(adminRequest.getAdminId())) {
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't update profile")
.build();
}
}
AdminUser admin = adminUserService.update(
adminRequest.getAdminId(),
adminRequest.getFullName(),
@@ -229,6 +291,17 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleSetSuperAdmin(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't create profile")
.build();
}
AdminUser admin = adminUserService.setSuperAdmin(adminRequest.getAdminId(), adminRequest.getIsSuperAdmin());
Map<AdminSection, Integer> sectionPermissons = new HashMap<>();
@@ -266,6 +339,19 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleToggleActive(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!currentUserId.equals(adminRequest.getAdminId())) {
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't update profile")
.build();
}
}
adminUserService.toggleActive(adminRequest.getAdminId(), adminRequest.getIsActive());
AdminUser admin = adminUserService.findById(adminRequest.getAdminId());
@@ -286,6 +372,17 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleDelete(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't create profile")
.build();
}
adminUserService.delete(adminRequest.getAdminId());
return BaseResponse.builder()
@@ -402,6 +499,17 @@ public class AdminUserHandler implements RequestHandler {
private BaseResponse handleUpdatePermissions(BaseRequest request, AdminUserRequest adminRequest) {
try {
Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
if (!adminSectionPermissionService.canWrite(currentUserId,
AdminSection.USERS)) {
return BaseResponse.builder()
.msgId(request.getMsgId())
.messageCode(MessageCode.PERMISSION_DENIED.getCode())
.messageDesc("You can't create profile")
.build();
}
Long userId = adminRequest.getAdminId();
Map<String, Integer> permissionsMap = adminRequest.getPermissions();