Skip to content

Commit f6fd2ec

Browse files
php-coderphp-coder
committed
refactor: propagate @CurrentSecurityContext
1 parent 7c1f191 commit f6fd2ec

File tree

2 files changed

+53
-26
lines changed

2 files changed

+53
-26
lines changed

‎src/main/java/ru/mystamps/web/feature/series/SeriesController.java

Lines changed: 48 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@
2525
import org.springframework.http.HttpStatus;
2626
import org.springframework.http.MediaType;
2727
import org.springframework.http.ResponseEntity;
28+
import org.springframework.security.core.Authentication;
2829
import org.springframework.security.core.annotation.AuthenticationPrincipal;
30+
import org.springframework.security.core.annotation.CurrentSecurityContext;
2931
import org.springframework.stereotype.Controller;
3032
import org.springframework.ui.Model;
3133
import org.springframework.validation.BindingResult;
@@ -203,6 +205,7 @@ public String showInfo(
203205
@PathVariable("id") Integer seriesId,
204206
Model model,
205207
@AuthenticationPrincipal CustomUserDetails currentUser,
208+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
206209
Locale userLocale,
207210
HttpServletResponse response)
208211
throws IOException {
@@ -214,6 +217,7 @@ public String showInfo(
214217

215218
String lang = LocaleUtils.getLanguageOrNull(userLocale);
216219
boolean userCanSeeHiddenImages = SecurityContextUtils.hasAuthority(
220+
authentication,
217221
Authority.VIEW_HIDDEN_IMAGES
218222
);
219223
Integer currentUserId = currentUser == null ? null : currentUser.getUserId();
@@ -228,10 +232,11 @@ public String showInfo(
228232
return null;
229233
}
230234

231-
Map<String, ?> commonAttrs = prepareCommonAttrsForSeriesInfo(series, currentUserId, lang);
235+
Map<String, ?> commonAttrs =
236+
prepareCommonAttrsForSeriesInfo(series, currentUserId, authentication, lang);
232237
model.addAllAttributes(commonAttrs);
233238

234-
addSeriesSalesFormToModel(model);
239+
addSeriesSalesFormToModel(authentication, model);
235240
addImageFormToModel(model);
236241
addStampsToCollectionForm(model, series);
237242

@@ -304,6 +309,7 @@ public String replaceImageWithImageUrl(
304309
@PathVariable("id") Integer seriesId,
305310
Model model,
306311
@AuthenticationPrincipal CustomUserDetails currentUser,
312+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
307313
Locale userLocale,
308314
HttpServletRequest request,
309315
HttpServletResponse response)
@@ -315,6 +321,7 @@ public String replaceImageWithImageUrl(
315321
seriesId,
316322
model,
317323
currentUser,
324+
authentication,
318325
userLocale,
319326
request,
320327
response
@@ -332,6 +339,7 @@ public String processImageWithImageUrl(
332339
@PathVariable("id") Integer seriesId,
333340
Model model,
334341
@AuthenticationPrincipal CustomUserDetails currentUser,
342+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
335343
Locale userLocale,
336344
HttpServletRequest request,
337345
HttpServletResponse response)
@@ -343,6 +351,7 @@ public String processImageWithImageUrl(
343351
seriesId,
344352
model,
345353
currentUser,
354+
authentication,
346355
userLocale,
347356
request,
348357
response
@@ -364,6 +373,7 @@ public String processImage(
364373
@PathVariable("id") Integer seriesId,
365374
Model model,
366375
@AuthenticationPrincipal CustomUserDetails currentUser,
376+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
367377
Locale userLocale,
368378
HttpServletRequest request,
369379
HttpServletResponse response)
@@ -376,6 +386,7 @@ public String processImage(
376386

377387
String lang = LocaleUtils.getLanguageOrNull(userLocale);
378388
boolean userCanSeeHiddenImages = SecurityContextUtils.hasAuthority(
389+
authentication,
379390
Authority.VIEW_HIDDEN_IMAGES
380391
);
381392
Integer currentUserId = currentUser.getUserId();
@@ -392,15 +403,16 @@ public String processImage(
392403

393404
loadErrorsFromDownloadInterceptor(form, result, request);
394405

395-
boolean maxQuantityOfImagesExceeded = !isAdmin() && !isAllowedToAddingImages(series);
406+
boolean maxQuantityOfImagesExceeded = !isAdmin(authentication)
407+
&& !isAllowedToAddingImages(series);
396408
model.addAttribute("maxQuantityOfImagesExceeded", maxQuantityOfImagesExceeded);
397409

398410
if (result.hasErrors() || maxQuantityOfImagesExceeded) {
399411
Map<String, ?> commonAttrs =
400-
prepareCommonAttrsForSeriesInfo(series, currentUserId, lang);
412+
prepareCommonAttrsForSeriesInfo(series, currentUserId, authentication, lang);
401413
model.addAllAttributes(commonAttrs);
402414

403-
addSeriesSalesFormToModel(model);
415+
addSeriesSalesFormToModel(authentication, model);
404416
addStampsToCollectionForm(model, series);
405417

406418
// don't try to re-display file upload field
@@ -427,6 +439,7 @@ public String addToCollection(
427439
BindingResult result,
428440
@PathVariable("id") Integer seriesId,
429441
@AuthenticationPrincipal CustomUserDetails currentUserDetails,
442+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
430443
Locale userLocale,
431444
RedirectAttributes redirectAttributes,
432445
HttpServletResponse response,
@@ -456,6 +469,7 @@ public String addToCollection(
456469
if (result.hasErrors()) {
457470
String lang = LocaleUtils.getLanguageOrNull(userLocale);
458471
boolean userCanSeeHiddenImages = SecurityContextUtils.hasAuthority(
472+
authentication,
459473
Authority.VIEW_HIDDEN_IMAGES
460474
);
461475
SeriesDto series = seriesService.findFullInfoById(
@@ -470,10 +484,10 @@ public String addToCollection(
470484
}
471485

472486
// CheckStyle: ignore LineLength for next 1 line
473-
Map<String, ?> commonAttrs = prepareCommonAttrsForSeriesInfo(series, currentUserId, lang);
487+
Map<String, ?> commonAttrs = prepareCommonAttrsForSeriesInfo(series, currentUserId, authentication, lang);
474488
model.addAllAttributes(commonAttrs);
475489

476-
addSeriesSalesFormToModel(model);
490+
addSeriesSalesFormToModel(authentication, model);
477491
addImageFormToModel(model);
478492
addStampsToCollectionForm(model, series);
479493

@@ -523,14 +537,16 @@ public String removeFromCollection(
523537
String collectionSlug = currentUserDetails.getUserCollectionSlug();
524538
return redirectTo(CollectionUrl.INFO_COLLECTION_PAGE, collectionSlug);
525539
}
526-
540+
541+
@SuppressWarnings("checkstyle:parameternumber")
527542
@PostMapping(SeriesUrl.ADD_SERIES_ASK_PAGE)
528543
public String processAskForm(
529544
@Validated({ Default.class, AddSeriesSalesForm.UrlChecks.class }) AddSeriesSalesForm form,
530545
BindingResult result,
531546
@PathVariable("id") Integer seriesId,
532547
Model model,
533548
@AuthenticationPrincipal CustomUserDetails currentUser,
549+
@CurrentSecurityContext(expression = "authentication") Authentication authentication,
534550
Locale userLocale,
535551
HttpServletResponse response)
536552
throws IOException {
@@ -542,6 +558,7 @@ public String processAskForm(
542558

543559
String lang = LocaleUtils.getLanguageOrNull(userLocale);
544560
boolean userCanSeeHiddenImages = SecurityContextUtils.hasAuthority(
561+
authentication,
545562
Authority.VIEW_HIDDEN_IMAGES
546563
);
547564
Integer currentUserId = currentUser.getUserId();
@@ -556,15 +573,16 @@ public String processAskForm(
556573
return null;
557574
}
558575

559-
boolean maxQuantityOfImagesExceeded = !isAdmin() && !isAllowedToAddingImages(series);
576+
boolean maxQuantityOfImagesExceeded = !isAdmin(authentication)
577+
&& !isAllowedToAddingImages(series);
560578
model.addAttribute("maxQuantityOfImagesExceeded", maxQuantityOfImagesExceeded);
561579

562580
if (result.hasErrors() || maxQuantityOfImagesExceeded) {
563581
Map<String, ?> commonAttrs =
564-
prepareCommonAttrsForSeriesInfo(series, currentUserId, lang);
582+
prepareCommonAttrsForSeriesInfo(series, currentUserId, authentication, lang);
565583
model.addAllAttributes(commonAttrs);
566584

567-
addSeriesSalesFormToModel(model);
585+
addSeriesSalesFormToModel(authentication, model);
568586
addImageFormToModel(model);
569587
addStampsToCollectionForm(model, series);
570588

@@ -729,6 +747,7 @@ public static void loadErrorsFromDownloadInterceptor(
729747
private Map<String, ?> prepareCommonAttrsForSeriesInfo(
730748
SeriesDto series,
731749
Integer currentUserId,
750+
Authentication authentication,
732751
String lang) {
733752

734753
Map<String, Object> model = new HashMap<>();
@@ -752,38 +771,39 @@ public static void loadErrorsFromDownloadInterceptor(
752771
model.put("solovyovNumbers", solovyovNumbers);
753772
model.put("zagorskiNumbers", zagorskiNumbers);
754773

755-
boolean userCanAddImagesToSeries = isUserCanAddImagesToSeries(currentUserId, series);
774+
boolean userCanAddImagesToSeries =
775+
isUserCanAddImagesToSeries(authentication, currentUserId, series);
756776
model.put("allowAddingImages", userCanAddImagesToSeries);
757777

758778
// we require DOWNLOAD_IMAGE and ADD_IMAGES_TO_SERIES in order to reduce
759779
// a number of the possible cases to maintain
760780
boolean userCanReplaceImages =
761-
SecurityContextUtils.hasAuthority(Authority.REPLACE_IMAGE)
762-
&& SecurityContextUtils.hasAuthority(Authority.DOWNLOAD_IMAGE)
763-
&& SecurityContextUtils.hasAuthority(Authority.ADD_IMAGES_TO_SERIES);
781+
SecurityContextUtils.hasAuthority(authentication, Authority.REPLACE_IMAGE)
782+
&& SecurityContextUtils.hasAuthority(authentication, Authority.DOWNLOAD_IMAGE)
783+
&& SecurityContextUtils.hasAuthority(authentication, Authority.ADD_IMAGES_TO_SERIES);
764784
model.put("allowReplacingImages", userCanReplaceImages);
765785

766-
if (SecurityContextUtils.hasAuthority(Authority.UPDATE_COLLECTION)) {
786+
if (SecurityContextUtils.hasAuthority(authentication, Authority.UPDATE_COLLECTION)) {
767787
Map<Integer, Integer> seriesInstances =
768788
collectionService.findSeriesInstances(currentUserId, seriesId);
769789
model.put("seriesInstances", seriesInstances);
770790
}
771791

772-
if (SecurityContextUtils.hasAuthority(Authority.VIEW_SERIES_SALES)) {
792+
if (SecurityContextUtils.hasAuthority(authentication, Authority.VIEW_SERIES_SALES)) {
773793
List<SeriesSaleDto> seriesSales = seriesSalesService.findSales(seriesId);
774794
model.put("seriesSales", seriesSales);
775795
}
776796

777-
if (SecurityContextUtils.hasAuthority(Authority.IMPORT_SERIES)) {
797+
if (SecurityContextUtils.hasAuthority(authentication, Authority.IMPORT_SERIES)) {
778798
ImportRequestInfo importInfo = seriesImportService.findRequestInfo(seriesId);
779799
model.put("importInfo", importInfo);
780800
}
781801

782802
return model;
783803
}
784804

785-
private void addSeriesSalesFormToModel(Model model) {
786-
if (!SecurityContextUtils.hasAuthority(Authority.ADD_SERIES_SALES)) {
805+
private void addSeriesSalesFormToModel(Authentication authentication, Model model) {
806+
if (!SecurityContextUtils.hasAuthority(authentication, Authority.ADD_SERIES_SALES)) {
787807
return;
788808
}
789809

@@ -820,13 +840,17 @@ private static boolean isAllowedToAddingImages(SeriesDto series) {
820840

821841
// I like these parentheses and also ErrorProne suggests to have an explicit order
822842
@SuppressWarnings("PMD.UselessParentheses")
823-
private static boolean isUserCanAddImagesToSeries(Integer userId, SeriesDto series) {
824-
return isAdmin()
843+
private static boolean isUserCanAddImagesToSeries(
844+
Authentication authentication,
845+
Integer userId,
846+
SeriesDto series
847+
) {
848+
return isAdmin(authentication)
825849
|| (isOwner(userId, series) && isAllowedToAddingImages(series));
826850
}
827851

828-
private static boolean isAdmin() {
829-
return SecurityContextUtils.hasAuthority(Authority.ADD_IMAGES_TO_SERIES);
852+
private static boolean isAdmin(Authentication authentication) {
853+
return SecurityContextUtils.hasAuthority(authentication, Authority.ADD_IMAGES_TO_SERIES);
830854
}
831855

832856
@SuppressWarnings("PMD.UnusedNullCheckInEquals")

‎src/main/java/ru/mystamps/web/support/spring/security/SecurityContextUtils.java

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,11 @@ private SecurityContextUtils() {
3333
* @author Sergey Chechenev
3434
*/
3535
public static boolean hasAuthority(GrantedAuthority authority) {
36-
return Optional
37-
.ofNullable(SecurityContextHolder.getContext().getAuthentication())
36+
return hasAuthority(SecurityContextHolder.getContext().getAuthentication(), authority);
37+
}
38+
39+
public static boolean hasAuthority(Authentication authentication, GrantedAuthority authority) {
40+
return Optional.ofNullable(authentication)
3841
.map(Authentication::getAuthorities)
3942
.orElse(Collections.emptyList())
4043
.contains(authority);

0 commit comments

Comments
 (0)