diff --git a/src/main/java/de/tilman/transactions/SecurityConfiguration.java b/src/main/java/de/tilman/transactions/SecurityConfiguration.java index 689528d..5d8bcde 100644 --- a/src/main/java/de/tilman/transactions/SecurityConfiguration.java +++ b/src/main/java/de/tilman/transactions/SecurityConfiguration.java @@ -15,8 +15,8 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.inMemoryAuthentication() - .withUser("Adam").password("test").roles("USER", "ADMIN").and() - .withUser("Betty").password("test").roles("USER"); + .withUser("adam@mail.com").password("test").roles("USER", "ADMIN").and() + .withUser("betty@mail.com").password("test").roles("USER"); } @Override diff --git a/src/main/java/de/tilman/transactions/domain/User.java b/src/main/java/de/tilman/transactions/domain/User.java index 968810f..0d667dd 100644 --- a/src/main/java/de/tilman/transactions/domain/User.java +++ b/src/main/java/de/tilman/transactions/domain/User.java @@ -18,6 +18,9 @@ public class User { private String name; + // links to the username in table USERS that is generated by Spring Security + private String username; + @ManyToMany @JoinTable(name = "account_user", joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id"), inverseJoinColumns = @JoinColumn(name = "account_id", referencedColumnName = "id")) private List accounts; @@ -35,6 +38,14 @@ public class User { this.name = name; } + public String getUsername() { + return username; + } + + public void setUsername(String username) { + this.username = username; + } + public List getAccounts() { return accounts; } diff --git a/src/main/java/de/tilman/transactions/repository/AccountRepository.java b/src/main/java/de/tilman/transactions/repository/AccountRepository.java index 2cf1250..166ca6e 100644 --- a/src/main/java/de/tilman/transactions/repository/AccountRepository.java +++ b/src/main/java/de/tilman/transactions/repository/AccountRepository.java @@ -2,7 +2,6 @@ package de.tilman.transactions.repository; import java.util.List; -import org.springframework.data.domain.Page; import org.springframework.data.jpa.repository.Query; import org.springframework.data.repository.CrudRepository; import org.springframework.data.repository.query.Param; @@ -12,13 +11,19 @@ import de.tilman.transactions.domain.Account; public interface AccountRepository extends CrudRepository { - // http://localhost:8080/accounts/search/findByUserName?username=Betty - @Query("SELECT a FROM Account a INNER JOIN a.users u WHERE u.name = :username") - @PreAuthorize("isFullyAuthenticated() && (#username == principal.username)") // http://stackoverflow.com/q/23640487/3761783 + // http://localhost:8080/accounts/search/findByUserName?username=betty@mail.com + @Query("SELECT a FROM Account a INNER JOIN a.users u WHERE u.username = :username") + @PreAuthorize("isFullyAuthenticated() && ((#username == principal.username) || hasRole('ROLE_ADMIN'))") // http://stackoverflow.com/q/23640487/3761783 //@PostFilter("filterObject.user.getId() == principal.id") // http://stackoverflow.com/a/30877376/3761783 List findByUserName(@Param("username") String username); - // TODO DELETE auf fremde Accounts möglich? + @PreAuthorize("hasRole('ROLE_ADMIN')") + @Override + Account save(Account account); + + @PreAuthorize("hasRole('ROLE_ADMIN')") + @Override + void delete(Account account); @PreAuthorize("hasRole('ROLE_ADMIN')") @Override diff --git a/src/main/java/de/tilman/transactions/repository/CategoryRepository.java b/src/main/java/de/tilman/transactions/repository/CategoryRepository.java index 932f08b..d8f6885 100644 --- a/src/main/java/de/tilman/transactions/repository/CategoryRepository.java +++ b/src/main/java/de/tilman/transactions/repository/CategoryRepository.java @@ -18,11 +18,11 @@ public interface CategoryRepository extends PagingAndSortingRepository { + + // TODO How to prevent loading transactions from other user's accounts? + // --> Solution? http://stackoverflow.com/a/21577081/3761783 + @PreAuthorize("isFullyAuthenticated() && (#username == principal.username)") + @Query("SELECT t FROM Transaction t INNER JOIN t.account a WHERE a.id = :accountId AND t.description like :prefix%") + List getDescriptions(@Param("accountId") Long accountId, @Param("prefix") String prefix); + + List findFirst10ByAccountIdOrderByDateDesc(@Param("accountId") Long accountId); @RestResource(exported = false) - @Override - Page findAll(); + Page findAll(Pageable pageable); } diff --git a/src/main/java/de/tilman/transactions/repository/UserRepository.java b/src/main/java/de/tilman/transactions/repository/UserRepository.java index 82d06c6..17997fc 100644 --- a/src/main/java/de/tilman/transactions/repository/UserRepository.java +++ b/src/main/java/de/tilman/transactions/repository/UserRepository.java @@ -2,13 +2,19 @@ package de.tilman.transactions.repository; import org.springframework.data.domain.Page; import org.springframework.data.domain.Pageable; +import org.springframework.data.jpa.repository.Query; import org.springframework.data.repository.PagingAndSortingRepository; +import org.springframework.data.repository.query.Param; import org.springframework.security.access.prepost.PreAuthorize; import de.tilman.transactions.domain.User; public interface UserRepository extends PagingAndSortingRepository { + @PreAuthorize("isFullyAuthenticated() && ((#username == principal.username) || hasRole('ROLE_ADMIN'))") + @Query("SELECT u FROM User u WHERE u.username = :username") + User getByUsername(@Param("username") String username); + @PreAuthorize("hasRole('ROLE_ADMIN')") @Override User save(User user); diff --git a/src/main/resources/data-h2.sql b/src/main/resources/data-h2.sql index 68a8cad..27d5e91 100644 --- a/src/main/resources/data-h2.sql +++ b/src/main/resources/data-h2.sql @@ -1,4 +1,4 @@ -INSERT INTO User (id, name) VALUES (1, 'Adam'), (2, 'Betty'); +INSERT INTO User (id, name, username) VALUES (1, 'Adam', 'adam@mail.com'), (2, 'Betty', 'betty@mail.com'); INSERT INTO Account (id, name, owner_id) VALUES (1, 'Gemeinschaftskonto', 1), (2, 'Konto Adam', 1); INSERT INTO Category (id, name, account_id, position) VALUES (1, 'Essen - Lebensmittel', 1, 2), (2, 'Einnahmen - Gehalt', 1, 1), (3, 'Essen - Arbeit', 1, 3), (4, 'Einnahmen - Gehalt', 2, 1), (5, 'Technik - Server und Hosting', 2, 2); @@ -6,7 +6,7 @@ INSERT INTO Category (id, name, account_id, position) VALUES (1, 'Essen - Lebens INSERT INTO Account_User (account_id, user_id) VALUES (1, 1), (1, 2), (2, 1); -/* + INSERT INTO Transaction (id, amount, account_id, category_id, date, description, creditor_id) VALUES (NULL, 1280.81, 1, 1, '2014-06-01', 'Gehalt', null), (NULL, -2.21, 1, 2, '2014-06-10', 'Brot', null), @@ -28,4 +28,3 @@ INSERT INTO Transaction (id, amount, account_id, category_id, date, description, INSERT INTO Transaction (id, amount, account_id, category_id, date, description, creditor_id) VALUES (NULL, -1.50, 1, 2, CURRENT_TIMESTAMP(), 'Transaction', null); Commit; INSERT INTO Transaction (id, amount, account_id, category_id, date, description, creditor_id) VALUES (NULL, -1.50, 1, 3, CURRENT_TIMESTAMP(), 'Transaction', null); Commit; INSERT INTO Transaction (id, amount, account_id, category_id, date, description, creditor_id) VALUES (NULL, 1.50, 1, 4, CURRENT_TIMESTAMP()+1, 'LAST Transaction', null); Commit; -*/ \ No newline at end of file