jessebrault/meals-made-easy-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor security configurations.

Browse Source
This commit is contained in:
Jesse Brault 2026-01-24 14:39:07 -06:00
parent f272db9bdd
commit f43751ab4f
14 changed files with 149 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/integrationTest/java/app/mealsmadeeasy/api/recipe/RecipeDraftsControllerIntegrationTests.java
View File

@ -86,8 +86,7 @@ public class RecipeDraftsControllerIntegrationTests {
this.mockMvc.perform(
get("/recipe-drafts/{fakeId}", UUID.randomUUID().toString())
)
.andExpect(status().isUnauthorized())
.andExpect(jsonPath("$.message", is(notNullValue())));
.andExpect(status().isUnauthorized());
}
@Test

14
src/main/java/app/mealsmadeeasy/api/GreetingController.java
View File

@ -1,5 +1,9 @@
package app.mealsmadeeasy.api;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@ -7,6 +11,16 @@ import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public final class GreetingController {
@Component
public static class GreetingEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers("/greeting").permitAll();
}
}
@GetMapping("/greeting")
@ResponseBody
public String get() {

16
src/main/java/app/mealsmadeeasy/api/auth/AuthEndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,16 @@
package app.mealsmadeeasy.api.auth;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
@Component
public class AuthEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers("/auth/**").permitAll();
}
}

9
src/main/java/app/mealsmadeeasy/api/image/ImageController.java
View File

@ -91,9 +91,6 @@ public class ImageController {
@RequestParam(required = false) Set<String> viewers,
@AuthenticationPrincipal User principal
) throws IOException, ImageException {
if (principal == null) {
throw new AccessDeniedException("Must be logged in.");
}
final var specBuilder = ImageCreateSpec.builder()
.alt(alt)
.caption(caption)
@ -119,9 +116,6 @@ public class ImageController {
@PathVariable String filename,
@RequestBody ImageUpdateBody body
) {
if (principal == null) {
throw new AccessDeniedException("Must be logged in.");
}
final User owner = this.userService.getUser(username);
final Image image = this.imageService.getByOwnerAndFilename(owner, filename, principal);
final Image updated = this.imageService.update(image, principal, this.getImageUpdateSpec(body));
@ -134,9 +128,6 @@ public class ImageController {
@PathVariable String username,
@PathVariable String filename
) throws IOException {
if (principal == null) {
throw new AccessDeniedException("Must be logged in.");
}
final User owner = this.userService.getUser(username);
final Image image = this.imageService.getByOwnerAndFilename(owner, filename, principal);
this.imageService.deleteImage(image, principal);

20
src/main/java/app/mealsmadeeasy/api/image/ImageEndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,20 @@
package app.mealsmadeeasy.api.image;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
@Component
public class ImageEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers(HttpMethod.GET, "/images/**").permitAll();
registry.requestMatchers(HttpMethod.POST, "/images/**").authenticated();
registry.requestMatchers(HttpMethod.PUT, "/images/**").authenticated();
registry.requestMatchers(HttpMethod.DELETE, "/images/**").authenticated();
}
}

22
src/main/java/app/mealsmadeeasy/api/recipe/RecipeDraftsController.java
View File

@ -10,7 +10,6 @@ import app.mealsmadeeasy.api.recipe.spec.RecipeDraftUpdateSpec;
import app.mealsmadeeasy.api.recipe.view.FullRecipeView;
import app.mealsmadeeasy.api.recipe.view.RecipeDraftView;
import app.mealsmadeeasy.api.user.User;
import app.mealsmadeeasy.api.util.MustBeLoggedInException;
import lombok.RequiredArgsConstructor;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
@ -35,9 +34,6 @@ public class RecipeDraftsController {
@GetMapping
public ResponseEntity<List<RecipeDraftView>> getAllDraftsForUser(@AuthenticationPrincipal User user) {
if (user == null) {
throw new MustBeLoggedInException();
}
final List<RecipeDraft> recipeDrafts = this.recipeService.getDrafts(user);
return ResponseEntity.ok(recipeDrafts.stream()
.map(recipeDraft -> this.draftToViewConverter.convert(recipeDraft, user))
@ -50,18 +46,12 @@ public class RecipeDraftsController {
@PathVariable UUID id,
@AuthenticationPrincipal User viewer
) {
if (viewer == null) {
throw new MustBeLoggedInException();
}
final RecipeDraft recipeDraft = this.recipeService.getDraftByIdWithViewer(id, viewer);
return ResponseEntity.ok(this.draftToViewConverter.convert(recipeDraft, viewer));
}
@PostMapping("/manual")
public ResponseEntity<RecipeDraftView> createManualDraft(@AuthenticationPrincipal User owner) {
if (owner == null) {
throw new MustBeLoggedInException();
}
final RecipeDraft recipeDraft = this.recipeService.createDraft(owner);
return ResponseEntity.status(HttpStatus.CREATED).body(this.draftToViewConverter.convert(recipeDraft, owner));
}
@ -72,9 +62,6 @@ public class RecipeDraftsController {
@RequestParam MultipartFile sourceFile,
@RequestParam String sourceFileName
) throws IOException {
if (owner == null) {
throw new MustBeLoggedInException();
}
final File file = this.fileService.create(
sourceFile.getInputStream(),
sourceFileName,
@ -91,9 +78,6 @@ public class RecipeDraftsController {
@PathVariable UUID id,
@RequestBody RecipeDraftUpdateBody updateBody
) {
if (modifier == null) {
throw new MustBeLoggedInException();
}
final RecipeDraftUpdateSpec spec = this.updateBodyToSpecConverter.convert(updateBody, modifier);
final RecipeDraft updated = this.recipeService.updateDraft(id, spec, modifier);
return ResponseEntity.ok(this.draftToViewConverter.convert(updated, modifier));
@ -104,9 +88,6 @@ public class RecipeDraftsController {
@AuthenticationPrincipal User modifier,
@PathVariable UUID id
) {
if (modifier == null) {
throw new MustBeLoggedInException();
}
this.recipeService.deleteDraft(id, modifier);
return ResponseEntity.noContent().build();
}
@ -116,9 +97,6 @@ public class RecipeDraftsController {
@AuthenticationPrincipal User modifier,
@PathVariable UUID id
) {
if (modifier == null) {
throw new MustBeLoggedInException();
}
final Recipe recipe = this.recipeService.publishDraft(id, modifier);
final FullRecipeView view = this.recipeToFullViewConverter.convert(recipe, false, modifier);
return ResponseEntity.status(HttpStatus.CREATED).body(view);

16
src/main/java/app/mealsmadeeasy/api/recipe/RecipeDraftsEndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,16 @@
package app.mealsmadeeasy.api.recipe;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
@Component
public class RecipeDraftsEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers("/recipe-drafts/**").authenticated();
}
}

13
src/main/java/app/mealsmadeeasy/api/recipe/RecipesController.java
View File

@ -23,7 +23,6 @@ import org.springframework.data.domain.Pageable;
import org.springframework.data.domain.Slice;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.web.bind.annotation.*;
@ -124,9 +123,6 @@ public class RecipesController {
@PathVariable String slug,
@Nullable @AuthenticationPrincipal User principal
) {
if (principal == null) {
throw new AccessDeniedException("Must be logged in to star a recipe.");
}
return ResponseEntity.status(HttpStatus.CREATED).body(this.recipeStarService.create(username, slug, principal));
}
@ -136,9 +132,6 @@ public class RecipesController {
@PathVariable String slug,
@Nullable @AuthenticationPrincipal User principal
) {
if (principal == null) {
throw new AccessDeniedException("Must be logged in to get a recipe star.");
}
final @Nullable RecipeStar star = this.recipeStarService.find(username, slug, principal).orElse(null);
if (star != null) {
return ResponseEntity.ok(Map.of("isStarred", true, "star", star));
@ -153,9 +146,6 @@ public class RecipesController {
@PathVariable String slug,
@Nullable @AuthenticationPrincipal User principal
) {
if (principal == null) {
throw new AccessDeniedException("Must be logged in to delete a recipe star.");
}
this.recipeStarService.delete(username, slug, principal);
return ResponseEntity.noContent().build();
}
@ -183,9 +173,6 @@ public class RecipesController {
@RequestBody RecipeCommentCreateBody body,
@Nullable @AuthenticationPrincipal User principal
) {
if (principal == null) {
throw new AccessDeniedException("Must be logged in to comment on a recipe.");
}
final RecipeComment comment = this.recipeCommentService.create(username, slug, principal, body);
return ResponseEntity.ok(RecipeCommentView.from(comment, false));
}

20
src/main/java/app/mealsmadeeasy/api/recipe/RecipesEndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,20 @@
package app.mealsmadeeasy.api.recipe;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
@Component
public class RecipesEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers(HttpMethod.GET, "/recipes/**").permitAll();
registry.requestMatchers(HttpMethod.POST, "/recipes/**").authenticated();
registry.requestMatchers(HttpMethod.PUT, "/recipes/**").authenticated();
registry.requestMatchers(HttpMethod.DELETE, "/recipes/**").authenticated();
}
}

8
src/main/java/app/mealsmadeeasy/api/security/EndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,8 @@
package app.mealsmadeeasy.api.security;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
public interface EndpointAuthConfigurator {
void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry);
}

16
src/main/java/app/mealsmadeeasy/api/security/SecurityConfiguration.java
View File

@ -19,6 +19,8 @@ import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import java.util.List;
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@ -26,15 +28,25 @@ public class SecurityConfiguration {
private final JpaUserDetailsService jpaUserDetailsService;
private final BeanFactory beanFactory;
private final List<EndpointAuthConfigurator> endpointAuthConfigurators;
public SecurityConfiguration(JpaUserDetailsService jpaUserDetailsService, BeanFactory beanFactory) {
public SecurityConfiguration(
JpaUserDetailsService jpaUserDetailsService,
BeanFactory beanFactory,
List<EndpointAuthConfigurator> endpointAuthConfigurators
) {
this.jpaUserDetailsService = jpaUserDetailsService;
this.beanFactory = beanFactory;
this.endpointAuthConfigurators = endpointAuthConfigurators;
}
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
httpSecurity.authorizeHttpRequests(requests -> requests.anyRequest().permitAll());
httpSecurity.authorizeHttpRequests(requests -> {
this.endpointAuthConfigurators.forEach(endpointAuthConfigurator -> {
endpointAuthConfigurator.configure(requests);
});
});
httpSecurity.csrf(AbstractHttpConfigurer::disable);
httpSecurity.cors(Customizer.withDefaults());
httpSecurity.sessionManagement(sessionManagement -> sessionManagement.sessionCreationPolicy(

16
src/main/java/app/mealsmadeeasy/api/signup/SignUpEndpointAuthConfigurator.java Normal file
View File

@ -0,0 +1,16 @@
package app.mealsmadeeasy.api.signup;
import app.mealsmadeeasy.api.security.EndpointAuthConfigurator;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer;
import org.springframework.stereotype.Component;
@Component
public class SignUpEndpointAuthConfigurator implements EndpointAuthConfigurator {
@Override
public void configure(AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry registry) {
registry.requestMatchers("/sign-up/**").permitAll();
}
}

34
src/main/java/app/mealsmadeeasy/api/util/ExceptionHandlers.java
View File

@ -22,16 +22,6 @@ public class ExceptionHandlers {
));
}
public record MustBeLoggedInExceptionView(String message) {}
@ExceptionHandler(MustBeLoggedInException.class)
public ResponseEntity<MustBeLoggedInExceptionView> handleMustBeLoggedInException(
MustBeLoggedInException e
) {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
.body(new MustBeLoggedInExceptionView(e.getMessage()));
}
public record NoSuchEntityWithUsernameAndSlugExceptionView(
String entityName,
String username,
@ -56,4 +46,28 @@ public class ExceptionHandlers {
));
}
public record NoSuchEntityWithUsernameAndFilenameExceptionView(
String entityName,
String username,
String filename,
String message
) {}
@ExceptionHandler(NoSuchEntityWithUsernameAndFilenameException.class)
public ResponseEntity<NoSuchEntityWithUsernameAndFilenameExceptionView> handleNoSuchEntityWithUsernameAndFilename(
NoSuchEntityWithUsernameAndFilenameException e
) {
return ResponseEntity.status(HttpStatus.NOT_FOUND).body(new NoSuchEntityWithUsernameAndFilenameExceptionView(
e.getEntityType().getSimpleName(),
e.getUsername(),
e.getFilename(),
String.format(
"No such entity %s for username %s and filename %s",
e.getEntityType().getSimpleName(),
e.getUsername(),
e.getFilename()
)
));
}
}

13
src/main/java/app/mealsmadeeasy/api/util/MustBeLoggedInException.java
View File

@ -1,13 +0,0 @@
package app.mealsmadeeasy.api.util;
public class MustBeLoggedInException extends RuntimeException {
public MustBeLoggedInException() {
super("Must be logged in to perform the requested operation.");
}
public MustBeLoggedInException(String message) {
super(message);
}
}