feat: Add admin-only endpoint to search user by email #203
Conversation
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 55 minutes and 42 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThis pull request adds a new admin-only email search endpoint for users. The changes introduce a GET /api/users/search endpoint secured with Spring Security role-based authorization, enable method-level security checks in the configuration, and implement the corresponding service method to search users by email and return DTOs. Changes
Sequence DiagramsequenceDiagram
actor Admin as Admin User
participant Controller as UserController
participant Security as Spring Security
participant Service as UserService
participant Repo as UserRepository
Admin->>Controller: GET /api/users/search?email=...
Controller->>Security: Check `@PreAuthorize`("hasRole('ADMIN')")
alt User is Admin
Security-->>Controller: Authorization granted
Controller->>Service: searchByEmail(email)
Service->>Repo: findByEmail(email)
alt User found
Repo-->>Service: User entity
Service->>Service: mapToResponse(user)
Service-->>Controller: UserResponse DTO
Controller-->>Admin: HTTP 200 + UserResponse
else User not found
Repo-->>Service: Optional.empty()
Service-->>Controller: ResourceNotFoundException
Controller-->>Admin: HTTP 404
end
else User is not Admin
Security-->>Controller: Access denied
Controller-->>Admin: HTTP 403
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
src/main/java/org/example/vet1177/services/UserService.java (1)
75-79: Reuse existing lookup path to avoid logic duplication.Lines 77-78 duplicate
getByEmail(Lines 68-72). Prefer one source of truth for lookup + exception handling.♻️ Proposed refactor
public UserResponse searchByEmail(String email) { log.debug("Searching user by email={}", email); - User user = userRepository.findByEmail(email) - .orElseThrow(() -> new ResourceNotFoundException("User", email)); + User user = getByEmail(email); return mapToResponse(user); }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/main/java/org/example/vet1177/services/UserService.java` around lines 75 - 79, The searchByEmail method duplicates lookup and exception logic already implemented in getByEmail; change searchByEmail to reuse that single lookup path by calling getByEmail(email) and then mapping the returned User to UserResponse (or extract a private helper like findUserByEmail to be called by both getByEmail and searchByEmail) so exception handling is centralized in one place (update references to mapToResponse and ensure method names: searchByEmail, getByEmail, mapToResponse, and any helper you add).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@src/main/java/org/example/vet1177/controller/UserController.java`:
- Around line 49-51: The log in UserController.searchByEmail currently emits the
raw email (PII); change the logging to avoid sensitive data by either removing
the email from the log (log only the endpoint and request received) or log a
masked version of the email (e.g., replace local-part with asterisks) before
calling userService.searchByEmail; update the log statement in
UserController.searchByEmail accordingly and ensure any downstream logs or
exceptions do not reintroduce the raw email.
---
Nitpick comments:
In `@src/main/java/org/example/vet1177/services/UserService.java`:
- Around line 75-79: The searchByEmail method duplicates lookup and exception
logic already implemented in getByEmail; change searchByEmail to reuse that
single lookup path by calling getByEmail(email) and then mapping the returned
User to UserResponse (or extract a private helper like findUserByEmail to be
called by both getByEmail and searchByEmail) so exception handling is
centralized in one place (update references to mapToResponse and ensure method
names: searchByEmail, getByEmail, mapToResponse, and any helper you add).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2b570beb-1e0b-41d5-94d6-83c2d2f707da
📒 Files selected for processing (3)
src/main/java/org/example/vet1177/controller/UserController.javasrc/main/java/org/example/vet1177/security/SecurityConfig.javasrc/main/java/org/example/vet1177/services/UserService.java
2 participants
Implementerar GET /api/users/search?email= som endast admins kan använda, enligt issue #132.
Ändringar
UserController — lagt till GET /api/users/search?email= med @PreAuthorize("hasRole('ADMIN')")
UserService — lagt till searchByEmail(String email) som returnerar UserResponse (den befintliga getByEmail() används internt och returnerar entiteten)
SecurityConfig — lagt till @EnableMethodSecurity för att aktivera @PreAuthorize
Säkerhet
Endpointen är skyddad med @PreAuthorize("hasRole('ADMIN')") — anrop utan admin-token ger 403 Forbidden, anrop utan token ger 401 Unauthorized.
Notering
Manuellt test via Postman väntar på att AuthController (login-endpoint) implementeras. Alla 430 befintliga enhetstester passerar.
Closes #132
Summary by CodeRabbit
New Features
Security