pt. 2 - Security

pom.xml

@@ -25,6 +25,10 @@
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
 		</dependency>
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 	</dependencies>
 
 	<properties>

src/main/java/com/bayer/burp/SecurityConfiguration.java

@@ -0,0 +1,34 @@
+package com.bayer.burp;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+@EnableWebSecurity
+public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+			.withUser("Adam").password("test").roles("USER", "ADMIN").and()
+			.withUser("Betty").password("test").roles("USER");
+	}
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		// Basis-Schutz: Nur autorisierte Zugriffe (feingranulare Steuerung über Assertions)
+		http.authorizeRequests()
+			//.antMatchers(HttpMethod.GET, "/public/**").permitAll()
+			.anyRequest().authenticated();
+		
+		http.httpBasic();
+		//http.formLogin();
+		
+		http.csrf().disable();
+	}
+}

src/main/java/com/bayer/burp/repository/BurpRepository.java

@@ -3,15 +3,14 @@ package com.bayer.burp.repository;
 import java.util.Collection;
 import java.util.List;
 
-import org.springframework.data.domain.Page;
-import org.springframework.data.domain.Pageable;
 import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.PagingAndSortingRepository;
 import org.springframework.data.repository.query.Param;
-import org.springframework.data.rest.core.annotation.RestResource;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.Burp;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface BurpRepository extends PagingAndSortingRepository<Burp, Long> {
 	
 	// http://localhost:8080/burps/search/findByUserName?username=Adam
@@ -24,8 +23,8 @@ public interface BurpRepository extends PagingAndSortingRepository<Burp, Long> {
 	@Query("select b from Burp b where b.text like :prefix%")
 	List<Burp> searchBurpsStartingWith(@Param("prefix") String prefix);
 	
-	// http://localhost:8080/burps/search/findFirst3ByOrderByTimestampDesc
+	// http://localhost:8080/burps/search/findFirst8ByOrderByTimestampDesc
-	List<Burp> findFirst3ByOrderByTimestampDesc();
+	List<Burp> findFirst8ByOrderByTimestampDesc();
 	
 //	@RestResource(exported = false)
 //	Page<Burp> findAll(Pageable pageable);

src/main/java/com/bayer/burp/repository/TagRepository.java

@@ -1,8 +1,10 @@
 package com.bayer.burp.repository;
 
 import org.springframework.data.repository.PagingAndSortingRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.Tag;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface TagRepository extends PagingAndSortingRepository<Tag, Long> {
 }

src/main/java/com/bayer/burp/repository/UserRepository.java

@@ -1,8 +1,19 @@
 package com.bayer.burp.repository;
 
 import org.springframework.data.repository.PagingAndSortingRepository;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 import com.bayer.burp.domain.User;
 
+@PreAuthorize("hasRole('ROLE_USER')")
 public interface UserRepository extends PagingAndSortingRepository<User, Long> {
+
+	@PreAuthorize("hasRole('ROLE_ADMIN')")
+	@Override
+	User save(User user);
+
+	@PreAuthorize("hasRole('ROLE_ADMIN')")
+	@Override
+	void delete(User user);
+
 }