src/main/java/ru/soune/nocopy/adminpanel/handler/AdminUserHandler.java

@@ -56,7 +56,7 @@ public class AdminUserHandler implements RequestHandler {
             case "toggle_active" -> handleToggleActive(request, adminRequest);
             case "delete" -> handleDelete(request, adminRequest);
             case "get_permissions_by_id" -> handleGetPermissionsById(request, adminRequest);
-            case "get_permissions_by_token" -> handleGetPermissionsByToken(request);
+            case "get_permissions_by_token" -> handleGetPermissionsByToken(request, adminRequest);
             case "update_permissions" -> handleUpdatePermissions(request, adminRequest);
             default -> handleInvalidAction(request, action);
         };
@@ -184,7 +184,7 @@ public class AdminUserHandler implements RequestHandler {
             return BaseResponse.builder()
                     .msgId(request.getMsgId())
                     .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                    .messageDesc("You can't update profile")
+                    .messageDesc("You can't reads")
                     .build();
         }
 
@@ -211,7 +211,7 @@ public class AdminUserHandler implements RequestHandler {
                     return BaseResponse.builder()
                             .msgId(request.getMsgId())
                             .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                            .messageDesc("You can't update profile")
+                            .messageDesc("You can't read")
                             .build();
                 }
             }
@@ -289,7 +289,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't update profile")
                         .build();
             }
 
@@ -370,7 +370,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't delete profile")
                         .build();
             }
 
@@ -410,6 +410,19 @@ public class AdminUserHandler implements RequestHandler {
 
     private BaseResponse handleGetPermissionsById(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canRead(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             Long userId = adminRequest.getAdminId();
             AdminUser admin = adminUserService.findById(userId);
 
@@ -444,8 +457,21 @@ public class AdminUserHandler implements RequestHandler {
         }
     }
 
-    private BaseResponse handleGetPermissionsByToken(BaseRequest request) {
+    private BaseResponse handleGetPermissionsByToken(BaseRequest request, AdminUserRequest adminRequest) {
         try {
+            Long currentUserId = (Long) httpServletRequest.getAttribute("userId");
+
+            if (!currentUserId.equals(adminRequest.getAdminId())) {
+                if (!adminSectionPermissionService.canRead(currentUserId,
+                        AdminSection.USERS)) {
+                    return BaseResponse.builder()
+                            .msgId(request.getMsgId())
+                            .messageCode(MessageCode.PERMISSION_DENIED.getCode())
+                            .messageDesc("You can't update profile")
+                            .build();
+                }
+            }
+
             String token = request.getToken();
             if (token == null || token.isEmpty()) {
                 return BaseResponse.builder()
@@ -497,7 +523,7 @@ public class AdminUserHandler implements RequestHandler {
                 return BaseResponse.builder()
                         .msgId(request.getMsgId())
                         .messageCode(MessageCode.PERMISSION_DENIED.getCode())
-                        .messageDesc("You can't create profile")
+                        .messageDesc("You can't update profile")
                         .build();
             }