src/main/java/ru/soune/nocopy/adminpanel/controller/AdminController.java

@@ -1,5 +1,6 @@
 package ru.soune.nocopy.adminpanel.controller;
 
+import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.ResponseEntity;
@@ -10,7 +11,9 @@ import org.springframework.web.bind.annotation.RestController;
 import ru.soune.nocopy.adminpanel.client.DashBoardAppClient;
 import ru.soune.nocopy.adminpanel.dto.BaseRequest;
 import ru.soune.nocopy.adminpanel.dto.BaseResponse;
+import ru.soune.nocopy.adminpanel.entity.AdminSection;
 import ru.soune.nocopy.adminpanel.handler.RequestHandler;
+import ru.soune.nocopy.adminpanel.service.AdminSectionPermissionService;
 import ru.soune.nocopy.adminpanel.util.MessageCode;
 
 import java.util.Map;
@@ -25,6 +28,10 @@ public class AdminController {
 
     private final DashBoardAppClient dashBoardAppClient;
 
+    private final AdminSectionPermissionService adminSectionPermissionService;
+
+    private final HttpServletRequest httpServletRequest;
+
     @PostMapping
     public ResponseEntity<BaseResponse> handleRequest(@RequestBody BaseRequest request) {
         log.info("Received request: msg_id={}, version={}", request.getMsgId(), request.getVersion());
@@ -61,6 +68,17 @@ public class AdminController {
 
     @PostMapping("/info")
     public ResponseEntity<BaseResponse> handleInfo(@RequestBody BaseRequest request) {
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+        if (!adminSectionPermissionService.canRead(currentUserId,
+                AdminSection.USERS)) {
+            return ResponseEntity.ok(BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc("You can't reads")
+                    .build());
+        }
+
         Map<String, Object> response = dashBoardAppClient.getUsersWithPagination(request);
 
         return ResponseEntity.ok(
@@ -74,6 +92,17 @@ public class AdminController {
 
     @PostMapping("/control")
     public ResponseEntity<BaseResponse> handleControl(@RequestBody BaseRequest request) {
+        Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+        if (!adminSectionPermissionService.canWrite(currentUserId,
+                AdminSection.USERS)) {
+            return ResponseEntity.ok(BaseResponse.builder()
+                    .msgId(request.getMsgId())
+                    .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                    .messageDesc("You can't control")
+                    .build());
+        }
+
         Map<String, Object> response = dashBoardAppClient.getUsersWithPagination(request);
 
         return ResponseEntity.ok(