From a0bb8c7001146d8a8d1e7640bd66c324bd0839a0 Mon Sep 17 00:00:00 2001
From: Tilman Liero <tliero@gmx.net>
Date: Tue, 24 Nov 2015 18:11:40 +0100
Subject: [PATCH] pt. 2 - Security

---
 pom.xml                                       |  4 +++
 .../com/bayer/burp/SecurityConfiguration.java | 34 +++++++++++++++++++
 .../bayer/burp/repository/BurpRepository.java |  9 +++--
 .../bayer/burp/repository/TagRepository.java  |  2 ++
 .../bayer/burp/repository/UserRepository.java | 11 ++++++
 5 files changed, 55 insertions(+), 5 deletions(-)
 create mode 100644 src/main/java/com/bayer/burp/SecurityConfiguration.java

diff --git a/pom.xml b/pom.xml
index b7942a5..16cd463 100644
--- a/pom.xml
+++ b/pom.xml
@@ -25,6 +25,10 @@
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 	</dependencies>
 
 	<properties>
diff --git a/src/main/java/com/bayer/burp/SecurityConfiguration.java b/src/main/java/com/bayer/burp/SecurityConfiguration.java
new file mode 100644
index 0000000..cf32b5a
--- /dev/null
+++ b/src/main/java/com/bayer/burp/SecurityConfiguration.java
@@ -0,0 +1,34 @@
+package com.bayer.burp;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+@EnableWebSecurity
+public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+			.withUser("Adam").password("test").roles("USER", "ADMIN").and()
+			.withUser("Betty").password("test").roles("USER");
+	}
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		// Basis-Schutz: Nur autorisierte Zugriffe (feingranulare Steuerung über Assertions)
+		http.authorizeRequests()
+			//.antMatchers(HttpMethod.GET, "/public/**").permitAll()
+			.anyRequest().authenticated();
+		
+		http.httpBasic();
+		//http.formLogin();
+		
+		http.csrf().disable();
+	}
+}
diff --git a/src/main/java/com/bayer/burp/repository/BurpRepository.java b/src/main/java/com/bayer/burp/repository/BurpRepository.java
index 030c54e..fb3937c 100644
--- a/src/main/java/com/bayer/burp/repository/BurpRepository.java
+++ b/src/main/java/com/bayer/burp/repository/BurpRepository.java
@@ -3,15 +3,14 @@ package com.bayer.burp.repository;
 import java.util.Collection;
 import java.util.List;
 
-import org.springframework.data.domain.Page;
-import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.PagingAndSortingRepository;
 import org.springframework.data.repository.query.Param;
-import org.springframework.data.rest.core.annotation.RestResource;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.Burp;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface BurpRepository extends PagingAndSortingRepository<Burp, Long> {
 	
 	// http://localhost:8080/burps/search/findByUserName?username=Adam
@@ -24,8 +23,8 @@ public interface BurpRepository extends PagingAndSortingRepository<Burp, Long> {
 	@Query("select b from Burp b where b.text like :prefix%")
 	List<Burp> searchBurpsStartingWith(@Param("prefix") String prefix);
 	
-	// http://localhost:8080/burps/search/findFirst3ByOrderByTimestampDesc
-	List<Burp> findFirst3ByOrderByTimestampDesc();
+	// http://localhost:8080/burps/search/findFirst8ByOrderByTimestampDesc
+	List<Burp> findFirst8ByOrderByTimestampDesc();
 	
 //	@RestResource(exported = false)
 //	Page<Burp> findAll(Pageable pageable);
diff --git a/src/main/java/com/bayer/burp/repository/TagRepository.java b/src/main/java/com/bayer/burp/repository/TagRepository.java
index aa2587b..4918212 100644
--- a/src/main/java/com/bayer/burp/repository/TagRepository.java
+++ b/src/main/java/com/bayer/burp/repository/TagRepository.java
@@ -1,8 +1,10 @@
 package com.bayer.burp.repository;
 
 import org.springframework.data.repository.PagingAndSortingRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.Tag;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface TagRepository extends PagingAndSortingRepository<Tag, Long> {
 }
diff --git a/src/main/java/com/bayer/burp/repository/UserRepository.java b/src/main/java/com/bayer/burp/repository/UserRepository.java
index ed47540..536999d 100644
--- a/src/main/java/com/bayer/burp/repository/UserRepository.java
+++ b/src/main/java/com/bayer/burp/repository/UserRepository.java
@@ -1,8 +1,19 @@
 package com.bayer.burp.repository;
 
 import org.springframework.data.repository.PagingAndSortingRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.User;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface UserRepository extends PagingAndSortingRepository<User, Long> {
+
+	@PreAuthorize("hasRole('ROLE_ADMIN')")
+	@Override
+	User save(User user);
+
+	@PreAuthorize("hasRole('ROLE_ADMIN')")
+	@Override
+	void delete(User user);
+
 }