Admin ska kunna skapa och tilldela behörigheter till andra användare

[MartinStenhagen]

T.ex. skapa en ny användare som är handläggare och ge den behörigheter att skapa ärenden till sig själv i ett visst diarium/registry eller ändra behörigheter för befintliga användare.

[coderabbitai]

⚠️ Possible Duplicate Issue(s)

• Fler användartyper #44

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Summary

• Introduce a registry_access table and associated JPA entity/repository/services following the established CaseFileAccess pattern for per-registry user permissions
• Extend UserService and AdminController to support user creation with role assignment and role updates from the admin panel
• Create a new admin UI section for managing which users can create cases in which registries
• Add authorization enforcement to CaseRecordController so only permitted users (or ADMINs) can create cases in a given registry

Design Choices

Design Choice 1: Should a new "HANDLER" role be introduced, or should registry access be permission-based?

Options Considered:

1. Add a new HANDLER role to UserRole enum and associate handlers with registries
2. Keep existing USER/ADMIN roles and add a per-registry permission table (similar to CaseFileAccess)

Chosen Option: 2

Rationale: Per-registry permissions allow fine-grained control without proliferating roles—a USER with registry permission effectively becomes a handler for that registry, following the existing CaseFileAccess pattern.

Design Choice 2: What permissions should the registry access grant initially?

Options Considered:

1. Single boolean flag canCreateCases
2. Multiple flags (canCreateCases, canViewCases, canCloseCases, etc.)

Chosen Option: 1

Rationale: Start with canCreateCases only to satisfy the ticket scope; the schema can be extended later if needed.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Registry Permission Domain Layer

Establish the backend foundation for per-registry user permissions, following the existing CaseFileAccess pattern for consistency.

Task 1: Create Registry Access Database Migration

Add a new table to store user permissions per registry.

• Create src/main/resources/db/migration/V19__registry_access.sql
• Define registry_access table with BIGSERIAL PRIMARY KEY, foreign keys to registry(id) and user_entities(id)
• Include can_create_cases BOOLEAN NOT NULL permission flag
• Add unique constraint on (registry_id, user_id) to prevent duplicate grants

Task 2: Create RegistryAccess Entity

JPA entity mapping to the new table.

• Create src/main/java/backendlab/team4you/registry/access/RegistryAccess.java
• Define @ManyToOne relationships to Registry and UserEntity with LAZY fetch
• Add canCreateCases boolean field
• Include @Table unique constraint matching the database schema

Task 3: Create RegistryAccess Repository

Spring Data JPA repository with permission-check queries.

• Create src/main/java/backendlab/team4you/registry/access/RegistryAccessRepository.java
• Add existsByRegistryIdAndUserIdAndCanCreateCasesTrue(Long registryId, String userId) for authorization checks
• Add findByRegistryIdAndUserId(Long registryId, String userId) for upsert pattern
• Add findByUserId(String userId) to list a user's registry permissions

Task 4: Create RegistryAccess Services

Services for permission checking and admin management operations.

• Create src/main/java/backendlab/team4you/registry/access/RegistryAccessService.java for authorization checks
  • Method canCreateCasesInRegistry(String userId, Long registryId) returns true if ADMIN or has explicit permission
• Create src/main/java/backendlab/team4you/registry/access/RegistryAccessAdminService.java for grant/revoke
  • Method grantCaseCreationAccess(Long registryId, String userId) using upsert pattern from CaseFileAccessAdminService
  • Method revokeCaseCreationAccess(Long registryId, String userId) with soft-revoke (set flag to false)
  • Method getRegistryPermissionsForUser(String userId) to list permissions

🤖 Prompt for AI agents

Implement the backend domain layer for per-registry user permissions, mirroring
the existing `CaseFileAccess` pattern.

**Database Migration**
- Create `src/main/resources/db/migration/V19__registry_access.sql`
- Define a `registry_access` table with a `BIGSERIAL PRIMARY KEY`, foreign keys
referencing `registry(id)` and `user_entities(id)`, a `can_create_cases BOOLEAN
NOT NULL` column, and a unique constraint on `(registry_id, user_id)`

**JPA Entity**
- Create `src/main/java/backendlab/team4you/registry/access/RegistryAccess.java`
- Map `@ManyToOne(fetch = LAZY)` relationships to `Registry` and `UserEntity`
- Add a `canCreateCases` boolean field
- Include an `@Table` unique constraint matching the database schema

**Repository**
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessRepository.java`
as a Spring Data JPA repository
- Add derived query methods:
- `existsByRegistryIdAndUserIdAndCanCreateCasesTrue(Long registryId, String
userId)` — for authorization checks
- `findByRegistryIdAndUserId(Long registryId, String userId)` — for the upsert
pattern
  - `findByUserId(String userId)` — to list a user's registry permissions

**Services**
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessService.java`
- Implement `canCreateCasesInRegistry(String userId, Long registryId)` returning
`true` if the user is ADMIN or has an explicit `canCreateCases` permission via
the repository
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessAdminService.java`
- Implement `grantCaseCreationAccess(Long registryId, String userId)` using an
upsert pattern (find-or-create, then set flag to true), following
`CaseFileAccessAdminService`
- Implement `revokeCaseCreationAccess(Long registryId, String userId)` as a
soft-revoke (set `canCreateCases` to false)
- Implement `getRegistryPermissionsForUser(String userId)` returning the list of
`RegistryAccess` records for that user

Phase 2: Admin User Management

Extend admin capabilities to create users and manage their roles.

Task 1: Extend UserService for Role Management

Add service method for updating user roles.

• Update src/main/java/backendlab/team4you/user/UserService.java
• Add updateRole(String userId, UserRole role) method that fetches user, validates existence, updates role, and saves
• Ensure method is callable only by admin (enforced at controller level)

Task 2: Add Admin User Creation Capability

Allow admins to create new users with pre-assigned roles.

• Create src/main/java/backendlab/team4you/dto/AdminUserCreateDTO.java with fields: email, name, firstName, lastName, phoneNumber, password, role
• Update src/main/java/backendlab/team4you/user/UserService.java to add createUserAsAdmin(AdminUserCreateDTO dto) method that creates user with the specified role (not hardcoded to USER)

Task 3: Add Admin Controller Endpoints for User Management

REST/form endpoints for role updates and user creation.

• Update src/main/java/backendlab/team4you/controller/AdminController.java
• Add POST /admin/users/create endpoint to create a new user using AdminUserCreateDTO
• Add POST /admin/users/{id}/role endpoint accepting a role parameter to update user role
• Both endpoints return appropriate Thymeleaf fragments for HTMX updates

Task 4: Update Admin Users UI Template

Add role editing and user creation forms to the admin interface.

• Update src/main/resources/templates/fragments/admin-users.html
  • Add role selector (dropdown with USER/ADMIN) per user row with HTMX post to update role
  • Add "Create User" button that reveals or navigates to user creation form
• Create src/main/resources/templates/fragments/admin-user-form.html for new user creation form
• Include validation feedback display

🤖 Prompt for AI agents

Extend admin capabilities to support creating users with roles and updating
roles for existing users.

**UserService Updates**
(`src/main/java/backendlab/team4you/user/UserService.java`)
- Add `updateRole(String userId, UserRole role)`: fetch the user by ID, validate
existence, update the role field, and save
- Add `createUserAsAdmin(AdminUserCreateDTO dto)`: create a new user using all
fields from the DTO, assigning the specified role (not hardcoded to USER)

**New DTO**
- Create `src/main/java/backendlab/team4you/dto/AdminUserCreateDTO.java` with
fields: `email`, `name`, `firstName`, `lastName`, `phoneNumber`, `password`,
`role`

**AdminController Updates**
(`src/main/java/backendlab/team4you/controller/AdminController.java`)
- Add `POST /admin/users/create` endpoint that binds `AdminUserCreateDTO` and
delegates to `createUserAsAdmin()`
- Add `POST /admin/users/{id}/role` endpoint accepting a `role` parameter and
delegating to `updateRole()`
- Both endpoints should return appropriate Thymeleaf fragments suitable for HTMX
partial updates
- Authorization is enforced at the controller level (admin only)

**Thymeleaf UI Templates**
- Update `src/main/resources/templates/fragments/admin-users.html`:
- Add a role selector dropdown (USER/ADMIN options) per user row, wired with
HTMX POST to `/admin/users/{id}/role`
- Add a "Create User" button that reveals or navigates to the user creation form
- Create `src/main/resources/templates/fragments/admin-user-form.html` with a
form for all `AdminUserCreateDTO` fields and validation feedback display

Phase 3: Registry Permission Management and Case Authorization

Complete the feature with admin UI for permission management and enforce authorization on case creation.

Task 1: Add Admin Registry Permission Endpoints

Controller endpoints for viewing and managing registry permissions.

• Create src/main/java/backendlab/team4you/controller/AdminRegistryAccessController.java with @PreAuthorize("hasRole('ADMIN')")
• Add GET /admin/registry-access to list all users with their registry permissions
• Add GET /admin/registry-access/user/{userId} to get permissions for a specific user
• Add POST /admin/registry-access/grant accepting registryId and userId to grant access
• Add POST /admin/registry-access/revoke accepting registryId and userId to revoke access
• Return Thymeleaf fragments for HTMX partial updates

Task 2: Create Admin Registry Permission UI

Thymeleaf templates for managing registry permissions.

• Update src/main/resources/templates/fragments/admin-sidenav.html to add "Registry Permissions" navigation link
• Create src/main/resources/templates/fragments/admin-registry-access.html with:
  • User selector/search
  • List of registries with checkboxes or toggles for canCreateCases per registry
  • HTMX-powered grant/revoke actions
• Follow existing admin fragment patterns for consistency

Task 3: Enforce Authorization on Case Creation

Add permission checks to the case record creation endpoint.

• Update src/main/java/backendlab/team4you/caserecord/CaseRecordController.java
  • Inject RegistryAccessService and the current Principal/Authentication
  • Before creating a case, verify the authenticated user has permission via canCreateCasesInRegistry()
  • Return 403 Forbidden if the user lacks permission
• ADMINs bypass the check (consistent with existing authorization patterns)
• Ensure the endpoint requires authentication (@PreAuthorize("isAuthenticated()") or via SecurityConfig)

Task 4: Add RegistryAccessException and Handle Authorization Errors

Proper error handling for permission denied scenarios.

• Create src/main/java/backendlab/team4you/exceptions/RegistryAccessDeniedException.java extending RuntimeException
• Update src/main/java/backendlab/team4you/exceptions/ global exception handler to return 403 for this exception
• Ensure meaningful error messages are returned to the client

🤖 Prompt for AI agents

Complete the feature by wiring up admin UI for registry permission management
and enforcing authorization on case creation.

**Admin Registry Access Controller**
- Create
`src/main/java/backendlab/team4you/controller/AdminRegistryAccessController.java`
annotated with `@PreAuthorize("hasRole('ADMIN')")`
- Add the following endpoints, all returning Thymeleaf fragments for HTMX
partial updates:
- `GET /admin/registry-access` — list all users with their registry permissions
- `GET /admin/registry-access/user/{userId}` — get permissions for a specific
user
- `POST /admin/registry-access/grant` — accept `registryId` and `userId`,
delegate to `RegistryAccessAdminService.grantCaseCreationAccess()`
- `POST /admin/registry-access/revoke` — accept `registryId` and `userId`,
delegate to `RegistryAccessAdminService.revokeCaseCreationAccess()`

**Admin Registry Permission UI**
- Update `src/main/resources/templates/fragments/admin-sidenav.html` to add a
"Registry Permissions" navigation link
- Create `src/main/resources/templates/fragments/admin-registry-access.html`
following existing admin fragment patterns, including:
  - A user selector/search component
- A list of registries with checkboxes or toggles for `canCreateCases` per
registry
  - HTMX-powered grant/revoke actions wired to the controller endpoints

**Case Creation Authorization**
(`src/main/java/backendlab/team4you/caserecord/CaseRecordController.java`)
- Inject `RegistryAccessService` and the current `Principal`/`Authentication`
- Before creating a case, call `canCreateCasesInRegistry(userId, registryId)`;
throw `RegistryAccessDeniedException` (or return 403) if the check fails
- ADMINs bypass the permission check, consistent with existing authorization
patterns
- Ensure the endpoint requires authentication via
`@PreAuthorize("isAuthenticated()")` or SecurityConfig

**Exception Handling**
- Create
`src/main/java/backendlab/team4you/exceptions/RegistryAccessDeniedException.java`
extending `RuntimeException`
- Update the global exception handler in
`src/main/java/backendlab/team4you/exceptions/` to map this exception to HTTP
403 with a meaningful error message

Research

This is a Spring Boot MVC application using Thymeleaf, HTMX, and Spring Security with form login and WebAuthn. The domain centers around Registry (diarium) and CaseRecord (ärende) entities, with UserEntity having a simple two-value UserRole enum (USER/ADMIN). The existing CaseFileAccess entity provides a blueprint for per-entity permission grants. Currently, there is no per-registry permission model, no admin UI for editing users or changing roles, and CaseRecordController lacks authorization checks—any authenticated user can create cases in any registry.

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Implement the backend domain layer for per-registry user permissions, mirroring
the existing `CaseFileAccess` pattern.

**Database Migration**
- Create `src/main/resources/db/migration/V19__registry_access.sql`
- Define a `registry_access` table with a `BIGSERIAL PRIMARY KEY`, foreign keys
referencing `registry(id)` and `user_entities(id)`, a `can_create_cases BOOLEAN
NOT NULL` column, and a unique constraint on `(registry_id, user_id)`

**JPA Entity**
- Create `src/main/java/backendlab/team4you/registry/access/RegistryAccess.java`
- Map `@ManyToOne(fetch = LAZY)` relationships to `Registry` and `UserEntity`
- Add a `canCreateCases` boolean field
- Include an `@Table` unique constraint matching the database schema

**Repository**
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessRepository.java`
as a Spring Data JPA repository
- Add derived query methods:
- `existsByRegistryIdAndUserIdAndCanCreateCasesTrue(Long registryId, String
userId)` — for authorization checks
- `findByRegistryIdAndUserId(Long registryId, String userId)` — for the upsert
pattern
  - `findByUserId(String userId)` — to list a user's registry permissions

**Services**
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessService.java`
- Implement `canCreateCasesInRegistry(String userId, Long registryId)` returning
`true` if the user is ADMIN or has an explicit `canCreateCases` permission via
the repository
- Create
`src/main/java/backendlab/team4you/registry/access/RegistryAccessAdminService.java`
- Implement `grantCaseCreationAccess(Long registryId, String userId)` using an
upsert pattern (find-or-create, then set flag to true), following
`CaseFileAccessAdminService`
- Implement `revokeCaseCreationAccess(Long registryId, String userId)` as a
soft-revoke (set `canCreateCases` to false)
- Implement `getRegistryPermissionsForUser(String userId)` returning the list of
`RegistryAccess` records for that user
===============================================================================

Task: 2

Extend admin capabilities to support creating users with roles and updating
roles for existing users.

**UserService Updates**
(`src/main/java/backendlab/team4you/user/UserService.java`)
- Add `updateRole(String userId, UserRole role)`: fetch the user by ID, validate
existence, update the role field, and save
- Add `createUserAsAdmin(AdminUserCreateDTO dto)`: create a new user using all
fields from the DTO, assigning the specified role (not hardcoded to USER)

**New DTO**
- Create `src/main/java/backendlab/team4you/dto/AdminUserCreateDTO.java` with
fields: `email`, `name`, `firstName`, `lastName`, `phoneNumber`, `password`,
`role`

**AdminController Updates**
(`src/main/java/backendlab/team4you/controller/AdminController.java`)
- Add `POST /admin/users/create` endpoint that binds `AdminUserCreateDTO` and
delegates to `createUserAsAdmin()`
- Add `POST /admin/users/{id}/role` endpoint accepting a `role` parameter and
delegating to `updateRole()`
- Both endpoints should return appropriate Thymeleaf fragments suitable for HTMX
partial updates
- Authorization is enforced at the controller level (admin only)

**Thymeleaf UI Templates**
- Update `src/main/resources/templates/fragments/admin-users.html`:
- Add a role selector dropdown (USER/ADMIN options) per user row, wired with
HTMX POST to `/admin/users/{id}/role`
- Add a "Create User" button that reveals or navigates to the user creation form
- Create `src/main/resources/templates/fragments/admin-user-form.html` with a
form for all `AdminUserCreateDTO` fields and validation feedback display
===============================================================================

Task: 3

Complete the feature by wiring up admin UI for registry permission management
and enforcing authorization on case creation.

**Admin Registry Access Controller**
- Create
`src/main/java/backendlab/team4you/controller/AdminRegistryAccessController.java`
annotated with `@PreAuthorize("hasRole('ADMIN')")`
- Add the following endpoints, all returning Thymeleaf fragments for HTMX
partial updates:
- `GET /admin/registry-access` — list all users with their registry permissions
- `GET /admin/registry-access/user/{userId}` — get permissions for a specific
user
- `POST /admin/registry-access/grant` — accept `registryId` and `userId`,
delegate to `RegistryAccessAdminService.grantCaseCreationAccess()`
- `POST /admin/registry-access/revoke` — accept `registryId` and `userId`,
delegate to `RegistryAccessAdminService.revokeCaseCreationAccess()`

**Admin Registry Permission UI**
- Update `src/main/resources/templates/fragments/admin-sidenav.html` to add a
"Registry Permissions" navigation link
- Create `src/main/resources/templates/fragments/admin-registry-access.html`
following existing admin fragment patterns, including:
  - A user selector/search component
- A list of registries with checkboxes or toggles for `canCreateCases` per
registry
  - HTMX-powered grant/revoke actions wired to the controller endpoints

**Case Creation Authorization**
(`src/main/java/backendlab/team4you/caserecord/CaseRecordController.java`)
- Inject `RegistryAccessService` and the current `Principal`/`Authentication`
- Before creating a case, call `canCreateCasesInRegistry(userId, registryId)`;
throw `RegistryAccessDeniedException` (or return 403) if the check fails
- ADMINs bypass the permission check, consistent with existing authorization
patterns
- Ensure the endpoint requires authentication via
`@PreAuthorize("isAuthenticated()")` or SecurityConfig

**Exception Handling**
- Create
`src/main/java/backendlab/team4you/exceptions/RegistryAccessDeniedException.java`
extending `RuntimeException`
- Update the global exception handler in
`src/main/java/backendlab/team4you/exceptions/` to map this exception to HTTP
403 with a meaningful error message

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- `@coderabbitai` You can skip phase 3. Add a simple unit test case for phase 2.
- `@coderabbitai` For design choice 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!