src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java

@@ -1,6 +1,7 @@
 package ru.soune.nocopy.adminpanel.handler;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.stereotype.Component;
@@ -36,15 +37,28 @@ public class AdminUserHandler implements RequestHandler {
 
     private final AdminSectionPermissionService permissionService;
 
+    private final HttpServletRequest httpServletRequest;
+
+    private final AdminSectionPermissionService adminSectionPermissionService;
+
     @Override
     public BaseResponse handle(BaseRequest request) throws Exception {
         AdminUserRequest adminRequest = objectMapper.convertValue(request.getMessageBody(), AdminUserRequest.class);
         String action = adminRequest.getAction();
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+        if (currentUserId == null) {
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.INVALID_CREDENTIALS.getCode())
+                    .messageDesc(MessageCode.INVALID_CREDENTIALS.getDescription())
+                    .build();
+        }
 
         return switch (action) {
             case "login" -> handleLogin(request, adminRequest);
             case "create" -> handleCreate(request, adminRequest);
-            case "get_all" -> handleGetAll(request);
+            case "get_all" -> handleGetAll(request, adminRequest);
             case "get_by_id" -> handleGetById(request, adminRequest);
             case "update" -> handleUpdate(request, adminRequest);
             case "set_super_admin" -> handleSetSuperAdmin(request, adminRequest);
@@ -107,6 +121,17 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleCreate(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!adminSectionPermissionService.canWrite(currentUserId,
+                    AdminSection.USERS)) {
+                return BaseResponse.builder()
+                        .msgId(request.getMsgId())
+                        .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                        .messageDesc("You can't create profile")
+                        .build();
+            }
+
             boolean superAdmin = adminRequest.getIsSuperAdmin() != null && adminRequest.getIsSuperAdmin();
             boolean changePassword = adminRequest.getChangePassword() != null ? adminRequest.getChangePassword():
                     !superAdmin;
@@ -160,7 +185,18 @@ public class AdminUserHandler implements RequestHandler {
         }
     }
 
-    private BaseResponse handleGetAll(BaseRequest request) {
+    private BaseResponse handleGetAll(BaseRequest request, AdminUserRequest adminRequest) {
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+        if (!adminSectionPermissionService.canRead(currentUserId,
+                AdminSection.USERS)) {
+            return BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc("You can't update profile")
+                    .build();
+        }
+
         List<AdminUserResponse> admins = adminUserService.findAll().stream()
                 .map(this::convertToResponse)
                 .collect(Collectors.toList());
@@ -176,6 +212,19 @@ public class AdminUserHandler implements RequestHandler {
     private BaseResponse handleGetById(BaseRequest request, AdminUserRequest adminRequest) {
         try {
             AdminUser admin = adminUserService.findById(adminRequest.getAdminId());
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canRead(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             return BaseResponse.builder()
                     .msgId(request.getMsgId())
                     .messageCode(MessageCode.SUCCESS.getCode())
@@ -193,6 +242,19 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleUpdate(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canWrite(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             AdminUser admin = adminUserService.update(
                     adminRequest.getAdminId(),
                     adminRequest.getFullName(),
@@ -229,6 +291,17 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleSetSuperAdmin(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!adminSectionPermissionService.canWrite(currentUserId,
+                    AdminSection.USERS)) {
+                return BaseResponse.builder()
+                        .msgId(request.getMsgId())
+                        .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                        .messageDesc("You can't create profile")
+                        .build();
+            }
+
             AdminUser admin = adminUserService.setSuperAdmin(adminRequest.getAdminId(), adminRequest.getIsSuperAdmin());
 
             Map<AdminSection, Integer> sectionPermissons = new HashMap<>();
@@ -266,6 +339,19 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleToggleActive(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canWrite(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             adminUserService.toggleActive(adminRequest.getAdminId(), adminRequest.getIsActive());
             AdminUser admin = adminUserService.findById(adminRequest.getAdminId());
 
@@ -286,6 +372,17 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleDelete(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!adminSectionPermissionService.canWrite(currentUserId,
+                    AdminSection.USERS)) {
+                return BaseResponse.builder()
+                        .msgId(request.getMsgId())
+                        .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                        .messageDesc("You can't create profile")
+                        .build();
+            }
+
             adminUserService.delete(adminRequest.getAdminId());
 
             return BaseResponse.builder()
@@ -402,6 +499,17 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleUpdatePermissions(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!adminSectionPermissionService.canWrite(currentUserId,
+                    AdminSection.USERS)) {
+                return BaseResponse.builder()
+                        .msgId(request.getMsgId())
+                        .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                        .messageDesc("You can't create profile")
+                        .build();
+            }
+
             Long userId = adminRequest.getAdminId();
             Map<String, Integer> permissionsMap = adminRequest.getPermissions();