dev use authtoken

src/main/java/ru/soune/nocopy/controller/ApiController.java

@@ -23,14 +23,17 @@ import ru.soune.nocopy.dto.BaseResponse;
 import ru.soune.nocopy.dto.MessageCode;
 import ru.soune.nocopy.dto.file.*;
 import ru.soune.nocopy.dto.register.RegAnswer;
+import ru.soune.nocopy.entity.company.Company;
 import ru.soune.nocopy.entity.file.FileEntity;
 import ru.soune.nocopy.entity.file.FileStatus;
 import ru.soune.nocopy.entity.file.UploadStatus;
 import ru.soune.nocopy.entity.user.AuthToken;
+import ru.soune.nocopy.entity.user.User;
 import ru.soune.nocopy.exception.*;
 import ru.soune.nocopy.handler.*;
 import ru.soune.nocopy.repository.AuthTokenRepository;
 import ru.soune.nocopy.repository.FileEntityRepository;
+import ru.soune.nocopy.repository.UserRepository;
 import ru.soune.nocopy.service.FileSimilarityService;
 import ru.soune.nocopy.service.file.ProtectionsLimitService;
 import ru.soune.nocopy.service.register.AuthService;
@@ -69,6 +72,8 @@ public class ApiController {
 
     private final AuthTokenRepository authTokenRepository;
 
+    private final UserRepository userRepository;
+
     @PostMapping("/v{version}/data")
     public ResponseEntity<?> handlePostRequest(@RequestBody BaseRequest request,
                                                @PathVariable("version") int version) {
@@ -365,7 +370,19 @@ public class ApiController {
             Long userId = authService.useUserAuthToken(tokenHeader);
             FileEntityResponse entityResponse = fileEntityService.getById(fileId, version);
 
-            if (!entityResponse.getUserId().equals(userId)) {
+            User fileUser = userRepository.findById(entityResponse.getUserId()).orElseThrow();
+            User user = userRepository.findById(userId).orElseThrow();
+            Company companyUser = user.getCompany();
+
+            if (companyUser != null && !fileUser.getCompany().getId().equals(companyUser.getId())) {
+                Map<String, Object> errorData = new HashMap<>();
+                errorData.put("token", tokenHeader);
+
+                return ResponseEntity.ok().body(new BaseResponse(20004,
+                        MessageCode.USER_NOT_HAD_PERMISSION.getCode(),
+                        MessageCode.USER_NOT_HAD_PERMISSION.getDescription(),
+                        errorData));
+            } else if (!entityResponse.getUserId().equals(userId)) {
                 Map<String, Object> errorData = new HashMap<>();
                 errorData.put("token", tokenHeader);
 

src/main/java/ru/soune/nocopy/controller/FileController.java

@@ -100,7 +100,6 @@ public class FileController {
         try {
             return MediaType.parseMediaType(fileEntity.getMimeType());
         } catch (InvalidMediaTypeException e) {
-            // Если MIME тип некорректен, определяем по расширению
             String extension = fileEntity.getFileExtension().toLowerCase();
             switch (extension) {
                 case "jpg":