Backend/auth

backend/src/main/java/share/fare/backend/controller/ActivityController.java

@@ -14,37 +14,41 @@
 import share.fare.backend.dto.response.ActivityResponse;
 import share.fare.backend.entity.User;
 import share.fare.backend.service.ActivityService;
+import share.fare.backend.service.SecurityService;
 import share.fare.backend.util.PaginatedResponse;
 
 @RestController
 @RequestMapping("/api/v1/groups/{groupId}/activities")
 @RequiredArgsConstructor
 public class ActivityController {
     private final ActivityService activityService;
+    private final SecurityService securityService;
 
     @PostMapping
     public ResponseEntity<ActivityResponse> createActivity(
             @PathVariable Long groupId,
             @Valid @RequestBody ActivityRequest request,
             @AuthenticationPrincipal User user) {
-        ActivityResponse response = activityService.createActivity(request, user.getId(), groupId);
+        ActivityResponse response = activityService.createActivity(request, user, groupId);
         return ResponseEntity.status(HttpStatus.CREATED).body(response);
     }
 
     @PutMapping("/{activityId}")
     public ResponseEntity<ActivityResponse> updateActivity(
             @PathVariable Long groupId,
             @PathVariable Long activityId,
-            @Valid @RequestBody ActivityRequest request) {
-        ActivityResponse response = activityService.updateActivity(request, activityId);
+            @Valid @RequestBody ActivityRequest request,
+            @AuthenticationPrincipal User user) {
+        ActivityResponse response = activityService.updateActivity(request, activityId, user);
         return ResponseEntity.ok(response);
     }
 
     @DeleteMapping("/{activityId}")
     public ResponseEntity<Void> deleteActivity(
             @PathVariable Long groupId,
-            @PathVariable Long activityId) {
-        activityService.deleteActivity(activityId);
+            @PathVariable Long activityId,
+            @AuthenticationPrincipal User user) {
+        activityService.deleteActivity(activityId, user);
         return ResponseEntity.noContent().build();
     }
 

backend/src/main/java/share/fare/backend/controller/GroupController.java

@@ -61,13 +61,15 @@ public ResponseEntity<PaginatedResponse<GroupResponse>> getAllGroups(
     @PutMapping("/{groupId}")
     public ResponseEntity<GroupResponse> updateGroup(
             @PathVariable Long groupId,
-            @Valid @RequestBody GroupRequest groupRequest) {
-        return ResponseEntity.ok(groupService.updateGroup(groupId, groupRequest));
+            @Valid @RequestBody GroupRequest groupRequest,
+            @AuthenticationPrincipal User user) {
+        return ResponseEntity.ok(groupService.updateGroup(groupId, groupRequest, user));
     }
 
     @DeleteMapping("/{groupId}")
-    public ResponseEntity<Void> deleteGroup(@PathVariable Long groupId) {
-        groupService.deleteGroup(groupId);
+    public ResponseEntity<Void> deleteGroup(@PathVariable Long groupId,
+                                            @AuthenticationPrincipal User user) {
+        groupService.deleteGroup(groupId, user);
         return ResponseEntity.noContent().build();
     }
 }

backend/src/main/java/share/fare/backend/controller/GroupMembershipController.java

@@ -24,24 +24,26 @@ public ResponseEntity<GroupMembershipResponse> addMember(
             @RequestParam Long userId,
             @RequestParam(defaultValue = "MEMBER") GroupRole role,
             @AuthenticationPrincipal User currentUser) {
-        GroupMembershipResponse response = groupMembershipService.addMemberToGroup(groupId, userId, role, currentUser.getId());
+        GroupMembershipResponse response = groupMembershipService.addMemberToGroup(groupId, userId, role, currentUser);
         return ResponseEntity.status(HttpStatus.CREATED).body(response);
     }
 
     @DeleteMapping("/{userId}")
     public ResponseEntity<Void> removeMember(
             @PathVariable Long groupId,
-            @PathVariable Long userId) {
-        groupMembershipService.removeMemberFromGroup(groupId, userId);
+            @PathVariable Long userId,
+            @AuthenticationPrincipal User currentUser) {
+        groupMembershipService.removeMemberFromGroup(groupId, userId, currentUser);
         return ResponseEntity.noContent().build();
     }
 
     @PutMapping("/{userId}/role")
     public ResponseEntity<GroupMembershipResponse> updateMemberRole(
             @PathVariable Long groupId,
             @PathVariable Long userId,
-            @RequestParam GroupRole role) {
-        GroupMembershipResponse response = groupMembershipService.updateMemberRole(groupId, userId, role);
+            @RequestParam GroupRole role,
+            @AuthenticationPrincipal User currentUser) {
+        GroupMembershipResponse response = groupMembershipService.updateMemberRole(groupId, userId, role, currentUser);
         return ResponseEntity.ok(response);
     }
 

backend/src/main/java/share/fare/backend/controller/groupchat/GroupChatController.java

@@ -3,23 +3,37 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.web.bind.annotation.*;
 import share.fare.backend.entity.ChatMessage;
+import share.fare.backend.entity.Group;
+import share.fare.backend.entity.User;
+import share.fare.backend.exception.GroupNotFoundException;
 import share.fare.backend.repository.ChatMessageRepository;
+import share.fare.backend.repository.GroupRepository;
+import share.fare.backend.service.SecurityService;
 
 @RestController
 @RequestMapping("/api/v1/group")
 @RequiredArgsConstructor
 public class GroupChatController {
 
     private final ChatMessageRepository chatMessageRepository;
+    private final GroupRepository groupRepository;
+    private final SecurityService securityService;
 
     @GetMapping("/{groupId}/chat")
     public Page<ChatMessage> getRecentMessages(
             @PathVariable Long groupId,
             @RequestParam(defaultValue = "0") int page,
-            @RequestParam(defaultValue = "20") int size
+            @RequestParam(defaultValue = "20") int size,
+            @AuthenticationPrincipal User user
     ) {
+        Group group = groupRepository.findById(groupId)
+                .orElseThrow(() -> new GroupNotFoundException(groupId));
+
+        securityService.checkIfUserIsInGroup(user, group);
+
         return chatMessageRepository.findByGroupIdOrderByTimestampDesc(groupId, PageRequest.of(page, size));
     }
 }

backend/src/main/java/share/fare/backend/exception/FareShareResponseEntityExceptionHandler.java

@@ -72,6 +72,12 @@ public final ResponseEntity<ErrorDetails> userIsNotInGroupException(Exception ex
         return new ResponseEntity<>(errorDetails, HttpStatus.CONFLICT);
     }
 
+    @ExceptionHandler(UserIsNotGroupOwner.class)
+    public final ResponseEntity<ErrorDetails> userIsNotInGroupOwnerException(Exception ex, WebRequest request) {
+        ErrorDetails errorDetails = new ErrorDetails(LocalDateTime.now(), ex.getMessage(), request.getDescription(false), ex.getStackTrace().length);
+        return new ResponseEntity<>(errorDetails, HttpStatus.FORBIDDEN);
+    }
+
     @ExceptionHandler(OwnerDeletionException.class)
     public final ResponseEntity<ErrorDetails> ownerDeletionException(Exception ex, WebRequest request) {
         ErrorDetails errorDetails = new ErrorDetails(LocalDateTime.now(), ex.getMessage(), request.getDescription(false), ex.getStackTrace().length);

backend/src/main/java/share/fare/backend/exception/UserIsNotGroupOwner.java

@@ -0,0 +1,7 @@
+package share.fare.backend.exception;
+
+public class UserIsNotGroupOwner extends RuntimeException {
+    public UserIsNotGroupOwner(Long userId, Long groupId) {
+        super("User " + userId + " is not group owner of " + groupId);
+    }
+}

backend/src/main/java/share/fare/backend/service/ActivityService.java

@@ -11,20 +11,18 @@
 import share.fare.backend.entity.User;
 import share.fare.backend.exception.ActivityNotFoundException;
 import share.fare.backend.exception.GroupNotFoundException;
-import share.fare.backend.exception.UserNotFoundException;
 import share.fare.backend.mapper.ActivityMapper;
 import share.fare.backend.repository.ActivityRepository;
 import share.fare.backend.repository.GroupRepository;
-import share.fare.backend.repository.UserRepository;
 
 @Service
 @RequiredArgsConstructor
 public class ActivityService {
     private final ActivityRepository activityRepository;
     private final GroupRepository groupRepository;
-    private final UserRepository userRepository;
+    private final SecurityService securityService;
 
-    public ActivityResponse createActivity(ActivityRequest activityRequest, Long createdByUserId, Long groupId) {
+    public ActivityResponse createActivity(ActivityRequest activityRequest, User currentUser, Long groupId) {
         if (activityRequest.getStartDate() != null && activityRequest.getEndDate() != null) {
             if (activityRequest.getStartDate().isAfter(activityRequest.getEndDate())) {
                 throw new IllegalArgumentException("Start date must be before end date.");
@@ -35,28 +33,33 @@ public ActivityResponse createActivity(ActivityRequest activityRequest, Long cre
                 .findById(groupId)
                 .orElseThrow(() -> new GroupNotFoundException(groupId));
 
-        User user = userRepository
-                .findById(createdByUserId)
-                .orElseThrow(() -> new UserNotFoundException(createdByUserId));
+        securityService.checkIfUserIsInGroup(currentUser, group);
 
         Activity activity = ActivityMapper.toEntity(activityRequest, group);
 
         return ActivityMapper.toResponse(activityRepository.save(activity));
     }
 
-    public ActivityResponse updateActivity(ActivityRequest request, Long activityId) {
+    public ActivityResponse updateActivity(ActivityRequest request, Long activityId, User currentUser) {
         Activity activity = activityRepository
                 .findById(activityId)
                 .orElseThrow(() -> new ActivityNotFoundException("Activity with ID: " + activityId + " not found"));
 
+        securityService.checkIfUserIsInGroup(currentUser, activity.getGroup());
+
         activity.setName(request.getName());
         activity.setDescription(request.getDescription());
         activity.setLink(request.getLink());
 
         return ActivityMapper.toResponse(activityRepository.save(activity));
     }
 
-    public void deleteActivity(Long activityId) {
+    public void deleteActivity(Long activityId, User currentUser) {
+        Activity activity = activityRepository.findById(activityId)
+                .orElseThrow(() -> new ActivityNotFoundException("Activity with ID: " + activityId + " not found"));
+
+        securityService.checkIfUserIsInGroup(currentUser, activity.getGroup());
+
         activityRepository.deleteById(activityId);
     }
 

backend/src/main/java/share/fare/backend/service/GroupMembershipService.java

@@ -25,11 +25,14 @@ public class GroupMembershipService {
     private final GroupMembershipRepository groupMembershipRepository;
     private final GroupRepository groupRepository;
     private final UserRepository userRepository;
+    private final SecurityService securityService;
 
-    public GroupMembershipResponse addMemberToGroup(Long groupId, Long userId, GroupRole role, Long currentUserId) {
+    public GroupMembershipResponse addMemberToGroup(Long groupId, Long userId, GroupRole role, User currentUser) {
         Group group = groupRepository.findById(groupId)
                 .orElseThrow(() -> new GroupNotFoundException(groupId));
 
+        securityService.checkIfUserIsInGroup(currentUser, group);
+
         User user = userRepository.findById(userId)
                 .orElseThrow(() -> new UserNotFoundException(userId));
 
@@ -47,7 +50,7 @@ public GroupMembershipResponse addMemberToGroup(Long groupId, Long userId, Group
         return GroupMembershipMapper.toResponse(savedMembership);
     }
 
-    public void removeMemberFromGroup(Long groupId, Long userId) {
+    public void removeMemberFromGroup(Long groupId, Long userId, User currentUser) {
         Group group = groupRepository.findById(groupId)
                 .orElseThrow(() -> new GroupNotFoundException(groupId));
 
@@ -57,17 +60,21 @@ public void removeMemberFromGroup(Long groupId, Long userId) {
         GroupMembership membership = groupMembershipRepository.findByGroupAndUser(group, user)
                 .orElseThrow(() -> new UserIsNotInGroupException("User is not a member of the group"));
 
+        securityService.checkIfUserCanRemoveMember(currentUser, user, group);
+
         if (membership.getRole() == GroupRole.OWNER) {
             throw new IllegalArgumentException("Owner cannot be removed from the group");
         }
 
         groupMembershipRepository.delete(membership);
     }
 
-    public GroupMembershipResponse updateMemberRole(Long groupId, Long userId, GroupRole newRole) {
+    public GroupMembershipResponse updateMemberRole(Long groupId, Long userId, GroupRole newRole, User currentUser) {
         Group group = groupRepository.findById(groupId)
                 .orElseThrow(() -> new GroupNotFoundException(groupId));
 
+        securityService.checkIfUserIsGroupOwner(currentUser, group);
+
         User user = userRepository.findById(userId)
                 .orElseThrow(() -> new UserNotFoundException(userId));
 

backend/src/main/java/share/fare/backend/service/GroupService.java

@@ -22,6 +22,7 @@
 public class GroupService {
     private final GroupRepository groupRepository;
     private final UserRepository userRepository;
+    private final SecurityService securityService;
 
     public GroupResponse createGroup(GroupRequest groupRequest, Long createdByUserId) {
         validateTripDates(groupRequest.getTripStartDate(), groupRequest.getTripEndDate());
@@ -50,19 +51,21 @@ public Page<GroupResponse> getGroupsForUser(Long userId, Pageable pageable) {
         return groups.map(GroupMapper::toResponse);
     }
 
-    public void deleteGroup(Long groupId) {
-        if (!groupRepository.existsById(groupId)) {
-            throw new GroupNotFoundException(groupId);
-        }
+    public void deleteGroup(Long groupId, User currentUser) {
+        Group group = groupRepository.findById(groupId)
+                        .orElseThrow(() -> new GroupNotFoundException(groupId));
+        securityService.checkIfUserIsGroupOwner(currentUser, group);
         groupRepository.deleteById(groupId);
     }
 
-    public GroupResponse updateGroup(Long groupId, GroupRequest groupRequest) {
+    public GroupResponse updateGroup(Long groupId, GroupRequest groupRequest, User currentUser) {
         validateTripDates(groupRequest.getTripStartDate(), groupRequest.getTripEndDate());
 
         Group existingGroup = groupRepository.findById(groupId)
                 .orElseThrow(() -> new GroupNotFoundException(groupId));
 
+        securityService.checkIfUserIsGroupOwner(currentUser, existingGroup);
+
         updateGroupFields(existingGroup, groupRequest);
 
         Group updatedGroup = groupRepository.save(existingGroup);

backend/src/main/java/share/fare/backend/service/SecurityService.java

@@ -0,0 +1,42 @@
+package share.fare.backend.service;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import share.fare.backend.entity.Group;
+import share.fare.backend.entity.GroupMembership;
+import share.fare.backend.entity.GroupRole;
+import share.fare.backend.entity.User;
+import share.fare.backend.exception.UserIsNotGroupOwner;
+import share.fare.backend.exception.UserIsNotInGroupException;
+import share.fare.backend.repository.GroupMembershipRepository;
+
+@Service
+@RequiredArgsConstructor
+public class SecurityService {
+    private final GroupMembershipRepository membershipRepository;
+
+    public void checkIfUserIsInGroup(User user, Group group) {
+        findMembershipOrThrow(user, group);
+    }
+
+    public void checkIfUserIsGroupOwner(User user, Group group) {
+        GroupMembership membership = findMembershipOrThrow(user, group);
+
+        if (membership.getRole() != GroupRole.OWNER) {
+            throw new UserIsNotGroupOwner(user.getId(), group.getId());
+        }
+    }
+
+    public void checkIfUserCanRemoveMember(User currentUser, User userToRemove, Group group) {
+        GroupMembership membership = findMembershipOrThrow(currentUser, group);
+        if (membership.getRole() != GroupRole.OWNER && !currentUser.getId().equals(userToRemove.getId())) {
+            throw new UserIsNotGroupOwner(currentUser.getId(), group.getId());
+        }
+    }
+
+    private GroupMembership findMembershipOrThrow(User user, Group group) {
+        return membershipRepository.findByGroupAndUser(group, user)
+                .orElseThrow(() ->
+                        new UserIsNotInGroupException("User " + user.getId() + " is not in group " + group.getName()));
+    }
+}