Codiki/codiki-old
Archived
1
0
Fork 0
Code Issues 7 Pull Requests Releases Wiki Activity

Add spring security configuration.

Browse Source
This commit is contained in:
florian
2019-01-23 22:02:12 +01:00
parent fc15b504ba
commit bcf1489cfe
20 changed files with 275 additions and 615 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/org/codiki/account/AccountController.java
+23 -38
View File
@@ -1,7 +1,7 @@
package org.codiki.account;
import java.io.IOException;
import java.util.Optional;
import java.security.Principal;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@@ -9,8 +9,11 @@ import javax.servlet.http.HttpServletResponse;
import org.codiki.core.entities.dto.PasswordWrapperDTO;
import org.codiki.core.entities.dto.UserDTO;
import org.codiki.core.entities.persistence.User;
import org.codiki.core.security.TokenService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.PutMapping;
@@ -21,40 +24,20 @@ import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/api/account")
public class AccountController {
private static final String HEADER_TOKEN = "token";
@Autowired
private AccountService accountService;
@Autowired
private TokenService tokenService;
/**
* Log in the user in request body.
*
* @param pUser
* The user to connect.
* @param response
* The reponse injected by Spring.
* @return The connected user object.
* @throws IOException
* If credentials are bad.
*/
@PostMapping("/login")
public UserDTO login(@RequestBody UserDTO pUser, HttpServletResponse response) throws IOException {
return accountService.checkCredentials(response, pUser);
public UserDTO login(@RequestBody final User pUser) throws BadCredentialsException {
return new UserDTO(accountService.authenticate(pUser));
}
/**
* Log out the user.
*
* @param pRequest
* The request injected by Spring.
*/
@GetMapping("/logout")
public void logout(HttpServletRequest pRequest) {
tokenService.removeUser(pRequest.getHeader(HEADER_TOKEN));
public void logout(final HttpServletRequest request, final HttpServletResponse response) {
final Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if(auth != null) {
new SecurityContextLogoutHandler().logout(request, response, auth);
}
}
/**
@@ -74,13 +57,15 @@ public class AccountController {
@PutMapping("/changePassword")
public void changePassword(@RequestBody final PasswordWrapperDTO pPasswordWrapper,
final HttpServletRequest pRequest,
final HttpServletResponse pResponse) throws IOException {
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
if(connectedUser.isPresent()) {
accountService.changePassword(connectedUser.get(), pPasswordWrapper, pResponse);
} else {
pResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
final HttpServletResponse pResponse,
final Principal pPrincipal) throws IOException {
// final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
// if(connectedUser.isPresent()) {
// accountService.changePassword(connectedUser.get(), pPasswordWrapper, pResponse);
// } else {
// pResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
// }
}
@PostMapping("/signin")
@@ -90,7 +75,7 @@ public class AccountController {
@PutMapping("/")
public void update(@RequestBody final UserDTO pUser, final HttpServletRequest pRequest,
final HttpServletResponse pResponse) throws IOException {
accountService.updateUser(pUser, pRequest, pResponse);
final HttpServletResponse pResponse, final Principal pPrincipal) throws IOException {
accountService.updateUser(pUser, pRequest, pResponse, pPrincipal);
}
}
src/main/java/org/codiki/account/AccountService.java
+23 -34
View File
@@ -1,13 +1,13 @@
package org.codiki.account;
import java.io.IOException;
import java.security.Principal;
import java.util.Date;
import java.util.LinkedList;
import java.util.List;
import java.util.Optional;
import java.util.stream.Collectors;
import javax.naming.AuthenticationException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@@ -17,53 +17,41 @@ import org.codiki.core.entities.dto.UserDTO;
import org.codiki.core.entities.persistence.User;
import org.codiki.core.repositories.ImageRepository;
import org.codiki.core.repositories.UserRepository;
import org.codiki.core.security.TokenService;
import org.codiki.core.security.CustomAuthenticationProvider;
import org.codiki.core.services.FileUploadService;
import org.codiki.core.services.UserService;
import org.codiki.core.utils.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.Resource;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.stereotype.Service;
import org.springframework.web.multipart.MultipartFile;
@Service
public class AccountService {
@Autowired
private CustomAuthenticationProvider authenticationProvider;
@Autowired
private UserService userService;
@Autowired
private UserRepository userRepository;
@Autowired
private TokenService tokenService;
@Autowired
private FileUploadService fileUploadService;
@Autowired
private ImageRepository imageRepository;
/**
* Check the user credentials and generate him a token if they are correct.
*
* @param pUser
* The user sent from client.
* @return The user populated with the generated token.
* @throws IOException
* If the credentials are bad.
* @throws AuthenticationException
* If the credentials are wrong.
*/
public UserDTO checkCredentials(HttpServletResponse pResponse, UserDTO pUser) throws IOException {
UserDTO result = null;
public User authenticate(final User pUser) throws BadCredentialsException {
final User user = userService.checkCredentials(pUser.getEmail(), pUser.getPassword());
Optional<User> user = userRepository.findByEmail(pUser.getEmail());
authenticationProvider.authenticate(new UsernamePasswordAuthenticationToken(user.getEmail(), user.getPassword()));
if(user.isPresent() && StringUtils.compareHash(pUser.getPassword(), user.get().getPassword())) {
tokenService.addUser(user.get());
result = new UserDTO(user.get(), true);
} else {
pResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
}
return result;
return user;
}
public void changePassword(final User pUser, final PasswordWrapperDTO pPasswordWrapper,
@@ -85,11 +73,11 @@ public class AccountService {
}
}
public String uploadFile(final MultipartFile pFile,
final HttpServletRequest pRequest, final HttpServletResponse pResponse) throws IOException {
public String uploadFile(final MultipartFile pFile, final HttpServletRequest pRequest,
final HttpServletResponse pResponse, final Principal pPrincipal) throws IOException {
final String avatarFileName = fileUploadService.uploadProfileImage(pFile);
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
final Optional<User> connectedUser = userService.getUserByPrincipal(pPrincipal);
if(connectedUser.isPresent()) {
final Optional<User> userFromDb = userRepository.findById(connectedUser.get().getId());
if(userFromDb.isPresent()) {
@@ -109,10 +97,11 @@ public class AccountService {
return fileUploadService.loadAvatar(pAvatarFileName);
}
public List<ImageDTO> getUserImages(final HttpServletRequest pRequest, final HttpServletResponse pResponse) throws IOException {
public List<ImageDTO> getUserImages(final HttpServletRequest pRequest, final HttpServletResponse pResponse,
final Principal pPrincipal) throws IOException {
List<ImageDTO> result = new LinkedList<>();
final Optional<User> connectedUser = tokenService.getAuthenticatedUserByToken(pRequest);
final Optional<User> connectedUser = userService.getUserByPrincipal(pPrincipal);
if(connectedUser.isPresent()) {
result = imageRepository.getByUserId(connectedUser.get().getId())
.stream().map(ImageDTO::new).collect(Collectors.toList());
@@ -142,8 +131,8 @@ public class AccountService {
}
public void updateUser(final UserDTO pUser, final HttpServletRequest pRequest,
final HttpServletResponse pResponse) throws IOException {
final Optional<User> connectedUserOpt = tokenService.getAuthenticatedUserByToken(pRequest);
final HttpServletResponse pResponse, final Principal pPrincipal) throws IOException {
final Optional<User> connectedUserOpt = userService.getUserByPrincipal(pPrincipal);
if(connectedUserOpt.isPresent()) {
final User connectedUser = connectedUserOpt.get();