added securing methods of services,

fix creation of user -- user have one role, ROLE_USER

Author: MrChebik

pom.xml

@@ -56,6 +56,11 @@
             <artifactId>joda-time-hibernate</artifactId>
             <version>1.4</version>
         </dependency>
+        <dependency>
+            <groupId>com.google.guava</groupId>
+            <artifactId>guava</artifactId>
+            <version>19.0</version>
+        </dependency>
         <!-- SMTP -->
         <dependency>
             <groupId>com.sun.mail</groupId>
@@ -120,6 +125,11 @@
             <artifactId>spring-security-web</artifactId>
             <version>4.2.1.RELEASE</version>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-taglibs</artifactId>
+            <version>4.2.1.RELEASE</version>
+        </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-test</artifactId>

src/main/java/ru/mrchebik/service/CategoryService.java

@@ -1,5 +1,6 @@
 package ru.mrchebik.service;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import ru.mrchebik.model.Category;
 
 import java.util.List;
@@ -8,12 +9,24 @@
  * Created by mrchebik on 14.01.17.
  */
 public interface CategoryService {
+    @PreAuthorize("hasRole('ROLE_USER')")
     void add(Category category);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void edit(String name, long categoryId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     Category findById(long id);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     Category findByParentIdThroughCategoryId(long parentId, long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Category> findByParentId(long parentId, long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Category> findAll(long userId);
-    long findMaxLevel(long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void remove(long id);
 }

src/main/java/ru/mrchebik/service/CommentService.java

@@ -1,5 +1,6 @@
 package ru.mrchebik.service;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import ru.mrchebik.model.Comment;
 
 import java.util.List;
@@ -8,9 +9,18 @@
  * Created by mrchebik on 14.01.17.
  */
 public interface CommentService {
+    @PreAuthorize("hasRole('ROLE_USER')")
     Comment addComment(Comment comment);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void editComment(Comment comment);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     Comment findComment(long id);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Comment> findComments(long id);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void removeComment(long id);
 }

src/main/java/ru/mrchebik/service/PostService.java

@@ -1,5 +1,6 @@
 package ru.mrchebik.service;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import ru.mrchebik.model.Post;
 
 import java.util.List;
@@ -8,9 +9,18 @@
  * Created by mrchebik on 14.01.17.
  */
 public interface PostService {
+    @PreAuthorize("hasRole('ROLE_USER')")
     Post add(Post post);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     long findLastPostId(long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Post> findPosts(long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     Post findPost(long postId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void remove(long id);
 }

src/main/java/ru/mrchebik/service/ReaderService.java

@@ -1,5 +1,6 @@
 package ru.mrchebik.service;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import ru.mrchebik.model.Reader;
 
 import java.util.List;
@@ -8,9 +9,18 @@
  * Created by mrchebik on 03.02.17.
  */
 public interface ReaderService {
+    @PreAuthorize("hasRole('ROLE_USER')")
     void add(Reader reader);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     Reader findOne(long userIdMain, long userIdFollower);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Reader> findAllMain(long userIdMain);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     List<Reader> findAllFollower(long userIdMain);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void delete(long id);
 }

src/main/java/ru/mrchebik/service/SecurityService.java

@@ -4,6 +4,5 @@
  * Created by mrchebik on 15.01.17.
  */
 public interface SecurityService {
-    String findLoggedInUsername();
     void autologin(final String username, final String password);
 }

src/main/java/ru/mrchebik/service/UserService.java

@@ -1,20 +1,32 @@
 package ru.mrchebik.service;
 
+import org.springframework.security.access.prepost.PreAuthorize;
 import ru.mrchebik.model.User;
 
-import java.util.List;
-
 /**
  * Created by mrchebik on 14.01.17.
  */
 public interface UserService {
     User add(User user);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void changeUsername(String email, String username);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void changePassword(String email, String password);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void changeEmail(String email, String newEmail);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     User findOne(long userId);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     User findByEmail(String email);
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     User findByUsername(String username);
-    List<User> findUsers();
+
+    @PreAuthorize("hasRole('ROLE_USER')")
     void remove(long id);
 }

src/main/java/ru/mrchebik/service/impl/CategoryServiceImpl.java

@@ -50,11 +50,6 @@ public List<Category> findAll(long userId) {
         return categoryRepository.findAll(userId);
     }
 
-    @Override
-    public long findMaxLevel(long userId) {
-        return (long) categoryRepository.findMaxLevel(userId);
-    }
-
     @Override
     public void remove(long id) {
         categoryRepository.delete(id);

src/main/java/ru/mrchebik/service/impl/SecurityServiceImpl.java

@@ -4,7 +4,6 @@
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Service;
 import ru.mrchebik.service.SecurityService;
 
@@ -18,16 +17,6 @@ public class SecurityServiceImpl implements SecurityService {
     @Resource
     private AuthenticationManager authenticationManager;
 
-    @Override
-    public String findLoggedInUsername() {
-        Object userDetails = SecurityContextHolder.getContext().getAuthentication().getDetails();
-        if (userDetails instanceof UserDetails) {
-            return ((UserDetails)userDetails).getUsername();
-        }
-
-        return null;
-    }
-
     @Override
     public void autologin(final String username, final String password) {
         UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(username, password);

src/main/java/ru/mrchebik/service/impl/UserServiceImpl.java

@@ -1,6 +1,6 @@
 package ru.mrchebik.service.impl;
 
-import org.springframework.security.access.prepost.PreAuthorize;
+import com.google.common.collect.Sets;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.stereotype.Repository;
 import org.springframework.stereotype.Service;
@@ -11,8 +11,6 @@
 import ru.mrchebik.service.UserService;
 
 import javax.annotation.Resource;
-import java.util.HashSet;
-import java.util.List;
 
 /**
  * Created by mrchebik on 14.01.17.
@@ -31,7 +29,7 @@ public class UserServiceImpl implements UserService {
     @Override
     public User add(User user) {
         user.setPassword(bCryptPasswordEncoder.encode(user.getPassword()));
-        user.setRoles(new HashSet<>(roleRepository.findAll()));
+        user.setRoles(Sets.newHashSet(roleRepository.findOne(1L)));
         return userRepository.saveAndFlush(user);
     }
 
@@ -68,12 +66,6 @@ public User findByEmail(String email) {
     }
 
     @Override
-    public List<User> findUsers() {
-        return userRepository.findAll();
-    }
-
-    @Override
-    @PreAuthorize("hasRole('ROLE_ADMIN')")
     public void remove(long id) {
         userRepository.delete(id);
     }