From fb21813a3e3bc914654fd9bf0580bfa1387f62e4 Mon Sep 17 00:00:00 2001 From: Linda Eskilsson Date: Fri, 3 Apr 2026 16:43:12 +0200 Subject: [PATCH 1/4] feat: implement AdminPolicy for role-based access control --- .../org/example/vet1177/policy/AdminPolicy.java | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 src/main/java/org/example/vet1177/policy/AdminPolicy.java diff --git a/src/main/java/org/example/vet1177/policy/AdminPolicy.java b/src/main/java/org/example/vet1177/policy/AdminPolicy.java new file mode 100644 index 00000000..16e7fcba --- /dev/null +++ b/src/main/java/org/example/vet1177/policy/AdminPolicy.java @@ -0,0 +1,16 @@ +package org.example.vet1177.policy; + +import org.example.vet1177.entities.Role; +import org.example.vet1177.entities.User; +import org.example.vet1177.exception.ForbiddenException; +import org.springframework.stereotype.Component; + +@Component +public class AdminPolicy { + + public void requireAdmin(User user){ + if (user.getRole() != Role.ADMIN) { + throw new ForbiddenException("Åtkomst nekad: Endast administratörer har behörighet"); + } + } +} From 4f92b80747d2dbbc52ee69d444b5be7c8ea647eb Mon Sep 17 00:00:00 2001 From: Linda Eskilsson Date: Sat, 4 Apr 2026 12:48:22 +0200 Subject: [PATCH 2/4] feat: AdminPolicy --- src/main/java/org/example/vet1177/policy/AdminPolicy.java | 1 - 1 file changed, 1 deletion(-) diff --git a/src/main/java/org/example/vet1177/policy/AdminPolicy.java b/src/main/java/org/example/vet1177/policy/AdminPolicy.java index 16e7fcba..36bd1cbf 100644 --- a/src/main/java/org/example/vet1177/policy/AdminPolicy.java +++ b/src/main/java/org/example/vet1177/policy/AdminPolicy.java @@ -7,7 +7,6 @@ @Component public class AdminPolicy { - public void requireAdmin(User user){ if (user.getRole() != Role.ADMIN) { throw new ForbiddenException("Åtkomst nekad: Endast administratörer har behörighet"); From fab496a7bb81277ead82ef2e888f348744457a62 Mon Sep 17 00:00:00 2001 From: Linda Eskilsson Date: Sat, 4 Apr 2026 13:13:56 +0200 Subject: [PATCH 3/4] feat: integrate AdminPolicy in VetController for createVet endpoint --- .../example/vet1177/controller/VetController.java | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/example/vet1177/controller/VetController.java b/src/main/java/org/example/vet1177/controller/VetController.java index 7d039c05..b73aa76c 100644 --- a/src/main/java/org/example/vet1177/controller/VetController.java +++ b/src/main/java/org/example/vet1177/controller/VetController.java @@ -4,9 +4,12 @@ import jakarta.validation.Valid; import org.example.vet1177.dto.request.vet.VetRequest; import org.example.vet1177.dto.response.vet.VetResponse; +import org.example.vet1177.entities.User; +import org.example.vet1177.policy.AdminPolicy; import org.example.vet1177.services.VetService; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; +import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import java.util.List; @@ -17,13 +20,18 @@ public class VetController { private final VetService vetService; + private final AdminPolicy adminPolicy; - public VetController(VetService vetService) { + public VetController(VetService vetService, AdminPolicy adminPolicy) { this.vetService = vetService; + this.adminPolicy = adminPolicy; } @PostMapping - public ResponseEntity createVet(@Valid @RequestBody VetRequest request) { + public ResponseEntity createVet( + @AuthenticationPrincipal User user, + @Valid @RequestBody VetRequest request) { + adminPolicy.requireAdmin(user); VetResponse response = vetService.createVet(request); return new ResponseEntity<>(response, HttpStatus.CREATED); } From 4bd07a6f1521677d5adff7f290ac2862d4117580 Mon Sep 17 00:00:00 2001 From: Linda Eskilsson Date: Sun, 5 Apr 2026 15:16:01 +0200 Subject: [PATCH 4/4] fix: handle null user in AdminPolicy requireAdmin --- src/main/java/org/example/vet1177/policy/AdminPolicy.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/org/example/vet1177/policy/AdminPolicy.java b/src/main/java/org/example/vet1177/policy/AdminPolicy.java index 36bd1cbf..2054f10b 100644 --- a/src/main/java/org/example/vet1177/policy/AdminPolicy.java +++ b/src/main/java/org/example/vet1177/policy/AdminPolicy.java @@ -8,7 +8,7 @@ @Component public class AdminPolicy { public void requireAdmin(User user){ - if (user.getRole() != Role.ADMIN) { + if (user == null || user.getRole() != Role.ADMIN){ throw new ForbiddenException("Åtkomst nekad: Endast administratörer har behörighet"); } }