finalizando tópicos em informática

Author: AbnerErnaniADSFatec

README.md

@@ -106,12 +106,14 @@ POST localhost:4040/users/sign-up
 
 ~~~json
 {
-  "username" : "fulano",
-  "password" : "123"
+    "username": "fulano",
+    "password": "123",
+    "authorizations": [
+    	{ "type": "ROLE_USER" }
+    ]
 }
 ~~~
 
-
 > **Listagem:** lista todas as imagens cadastradas no banco de dados PostgreSQL por método GET, onde todos os usuários podem acessar a lista de imagens:
 
 ```

db/create-tables.sql

@@ -11,9 +11,9 @@ CREATE USER api_restful WITH PASSWORD 'api_spring_restful';
 CREATE TABLE public.users
 (
     id bigint NOT NULL GENERATED BY DEFAULT AS IDENTITY ( INCREMENT 1 START 1 MINVALUE 1 MAXVALUE 9223372036854775807 CACHE 1 ),
-    username character varying(255) COLLATE pg_catalog."default",
     password character varying(255) COLLATE pg_catalog."default",
-    admin BOOLEAN NOT NULL
+    username character varying(255) COLLATE pg_catalog."default",
+    CONSTRAINT users_pkey PRIMARY KEY (id)
 )
 WITH (
     OIDS = FALSE
@@ -23,9 +23,31 @@ TABLESPACE pg_default;
 ALTER TABLE public.users
     OWNER to api_restful;
 
+-- Criação da tabela para o controle de autorizações
+
+CREATE TABLE public.user_authorizations
+(
+    id bigint NOT NULL GENERATED BY DEFAULT AS IDENTITY ( INCREMENT 1 START 1 MINVALUE 1 MAXVALUE 9223372036854775807 CACHE 1 ),
+    type character varying(255) COLLATE pg_catalog."default",
+    user_id bigint,
+    CONSTRAINT user_authorizations_pkey PRIMARY KEY (id),
+    CONSTRAINT fkgek2c3qxjc3g29pk0gaqkythi FOREIGN KEY (user_id)
+        REFERENCES public.users (id) MATCH SIMPLE
+        ON UPDATE NO ACTION
+        ON DELETE NO ACTION
+)
+WITH (
+    OIDS = FALSE
+)
+TABLESPACE pg_default;
+
+ALTER TABLE public.user_authorizations
+    OWNER to api_restful;
+
 -- Copiando os dados do usuário admin para o banco de dados a partir de um arquivo em csv
 
 \COPY public.users FROM 'csv/users.csv' DELIMITER ';' CSV HEADER;
+\COPY public.authorization FROM 'csv/user_authorizations.csv' DELIMITER ';' CSV HEADER;
 
 -- Criação da tabela para o cadastro de municípios
 

db/csv/user_authorizations.csv

@@ -0,0 +1,4 @@
+id;type;users_id
+1;ROLE_ADMIN;1
+2;ROLE_USER;1
+3;ROLE_USER;2

db/csv/users.csv

@@ -1,2 +1,3 @@
-id;username;password;admin
-1;admin;$2a$10$Iy9nZ.bPRh87DKMJfipQSur5zLO8TZXeDzd/57mE5KCt2IPAPiqp.;true
+id;username;password
+1;admin;$2a$10$Iy9nZ.bPRh87DKMJfipQSur5zLO8TZXeDzd/57mE5KCt2IPAPiqp.
+2;user;$2a$10$Iy9nZ.bPRh87DKMJfipQSur5zLO8TZXeDzd/57mE5KCt2IPAPiqp.

docs/assets/db-model.png

@@ -0,0 +1,7 @@
+{
+    "username": "fulano",
+    "password": "123",
+    "authorizations": [
+    	{ "type": "ROLE_USER" }
+    ]
+}

docs/examples/users_signup_request.json

@@ -7,28 +7,26 @@
 import org.springframework.web.bind.annotation.RequestMethod;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.server.ResponseStatusException;
+import org.springframework.beans.factory.annotation.Autowired;
 
 import api.restful.model.user.AuthUser;
-import api.restful.model.user.AuthUserRepository;
 import api.restful.handler.CustomMessage;
+import api.restful.services.AuthorizationServiceImpl;
 
 @RestController
 @RequestMapping("/users")
 public class UserController {
+	@Autowired
+	private AuthorizationServiceImpl authorizationServiceImpl;
 
-    private AuthUserRepository userRepository;
+	@Autowired
     private BCryptPasswordEncoder bCryptPasswordEncoder;
 
-    public UserController(AuthUserRepository applicationUserRepository, BCryptPasswordEncoder bCryptPasswordEncoder) {
-        this.userRepository = applicationUserRepository;
-        this.bCryptPasswordEncoder = bCryptPasswordEncoder;
-    }
-
     @RequestMapping(value = "/sign-up", method = RequestMethod.POST, produces = "application/json")
 	public CustomMessage signUp(@RequestBody AuthUser user) {
 		try {
 			user.setPassword(bCryptPasswordEncoder.encode(user.getPassword()));
-			userRepository.save(user);
+			this.authorizationServiceImpl.createUser(user);
 			return new CustomMessage(200, "Saved");
 		}  catch (Exception e) {
 			throw new ResponseStatusException(HttpStatus.NOT_FOUND, "User not found", e);

src/main/java/api/restful/controller/UserController.java

@@ -2,7 +2,12 @@
 
 import com.auth0.jwt.JWT;
 import api.restful.model.user.AuthUser;
+import api.restful.model.views.UserCache;
+import api.restful.model.user.Authorization;
+import api.restful.model.user.AuthorizationRepository;
 import api.restful.model.views.ResponseToken;
+import api.restful.services.AuthorizationServiceImpl;
+
 import com.google.gson.Gson;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.security.authentication.AuthenticationManager;
@@ -12,6 +17,9 @@
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
 
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
@@ -20,6 +28,8 @@
 import java.io.PrintWriter;
 import java.util.ArrayList;
 import java.util.Date;
+import java.util.List;
+import java.util.Collection;
 
 import static com.auth0.jwt.algorithms.Algorithm.HMAC512;
 import static api.restful.controller.security.SecurityConstants.EXPIRATION_TIME;
@@ -37,11 +47,13 @@ public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
     public Authentication attemptAuthentication(HttpServletRequest req, HttpServletResponse res) throws AuthenticationException {
         try {
             AuthUser creds = new ObjectMapper().readValue(req.getInputStream(), AuthUser.class);
+            List<GrantedAuthority> updatedAuthorities = new ArrayList<>();
+            updatedAuthorities.add(new SimpleGrantedAuthority("ROLE_USER"));
             return authenticationManager.authenticate(
                 new UsernamePasswordAuthenticationToken(
                     creds.getUsername(),
                     creds.getPassword(),
-                    new ArrayList<>()
+                    updatedAuthorities
                 )
             );
         } catch (IOException e) {
@@ -51,11 +63,20 @@ public Authentication attemptAuthentication(HttpServletRequest req, HttpServletR
 
     @Override
     protected void successfulAuthentication(HttpServletRequest req, HttpServletResponse res, FilterChain chain, Authentication auth) throws IOException, ServletException {
+        List<Authorization> authorizations = (List<Authorization>) auth.getAuthorities();
+        List<String> aut = new ArrayList<String>();
+        for (Authorization autho : authorizations) {
+            aut.add(autho.getAuthority());
+        }
+        String username = ((User) auth.getPrincipal()).getUsername();
+        String password = ((User) auth.getPrincipal()).getPassword();
+        UserCache user = new UserCache(username, password, aut);
+        String jsonUser = new Gson().toJson(user);
         String token = JWT.create()
-            .withSubject(((User) auth.getPrincipal()).getUsername())
+            .withSubject(jsonUser)
                 .withExpiresAt(new Date(System.currentTimeMillis() + EXPIRATION_TIME))
                     .sign(HMAC512(SECRET.getBytes()));
-        ResponseToken response = new ResponseToken(200, token, true, "Use this token to API CRUD options");
+        ResponseToken response = new ResponseToken(200, token, user, "Use this token to API CRUD options");
         String jsonString = new Gson().toJson(response);
         PrintWriter out = res.getWriter();
         res.addHeader(HEADER_STRING, token);

src/main/java/api/restful/controller/jwt/JWTAuthenticationFilter.java

@@ -2,18 +2,27 @@
 
 import com.auth0.jwt.JWT;
 import com.auth0.jwt.algorithms.Algorithm;
+import com.google.gson.Gson;
 
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+
+import api.restful.model.user.AuthUser;
+import api.restful.model.user.Authorization;
+import api.restful.model.views.UserCache;
 
 import javax.servlet.FilterChain;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.List;
+import java.util.Collection;
 
 import static api.restful.controller.security.SecurityConstants.HEADER_STRING;
 import static api.restful.controller.security.SecurityConstants.SECRET;
@@ -26,23 +35,27 @@ public JWTAuthorizationFilter(AuthenticationManager authManager) {
 
     @Override
     protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) throws IOException, ServletException {
-        UsernamePasswordAuthenticationToken authentication = getAuthentication(req);
-        SecurityContextHolder.getContext().setAuthentication(authentication);
+        this.getAuthentication(req);
         chain.doFilter(req, res);
     }
 
-    private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
+    private void getAuthentication(HttpServletRequest request) {
         String token = request.getHeader(HEADER_STRING);
         if (token != null) {
-            String user = JWT.require(Algorithm.HMAC512(SECRET.getBytes()))
+            String jsonUser = JWT.require(Algorithm.HMAC512(SECRET.getBytes()))
                 .build()
                     .verify(token)
                         .getSubject();
+            UserCache user = new Gson().fromJson(jsonUser, UserCache.class);
+            List<GrantedAuthority> updatedAuthorities = new ArrayList<>();
+            for (String role : user.getRole()) {
+                updatedAuthorities.add(new SimpleGrantedAuthority(role));
+            }
             if (user != null) {
-                return new UsernamePasswordAuthenticationToken(user, null, new ArrayList<>());
+                UsernamePasswordAuthenticationToken authentication =
+                    new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword(), updatedAuthorities);
+                SecurityContextHolder.getContext().setAuthentication(authentication);
             }
-            return null;
         }
-        return null;
     }
 }

src/main/java/api/restful/controller/jwt/JWTAuthorizationFilter.java

@@ -10,10 +10,13 @@
 import org.springframework.web.cors.CorsConfiguration;
 import org.springframework.web.cors.CorsConfigurationSource;
 import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 
 import api.restful.services.UserDetailsServiceImpl;
 import api.restful.controller.jwt.JWTAuthorizationFilter;
 import api.restful.model.user.AuthUser;
+import api.restful.model.user.AuthorizationRepository;
 import api.restful.controller.jwt.JWTAuthenticationFilter;
 
 import org.springframework.context.annotation.Bean;
@@ -24,6 +27,7 @@
 
 @Configuration
 @EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
 public class WebSecurity extends WebSecurityConfigurerAdapter {
   @Autowired
   private UserDetailsServiceImpl userDetailsService;
@@ -38,14 +42,14 @@ public WebSecurity(UserDetailsServiceImpl userDetailsService, BCryptPasswordEnco
 
   @Override
   protected void configure(HttpSecurity http) throws Exception {
-    http.cors().and().csrf().disable().authorizeRequests()
-      .antMatchers(HttpMethod.POST, "/users/sign-up").permitAll()
-      .antMatchers(HttpMethod.GET, "/catalog/list").permitAll()
-        .anyRequest().authenticated()
-          .and()
-            .addFilter(new JWTAuthenticationFilter(authenticationManager()))
-            .addFilter(new JWTAuthorizationFilter(authenticationManager()))
-              .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
+    http.cors().and().csrf().disable()
+      .addFilterBefore(new JWTAuthorizationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class)
+      .addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class)
+        .authorizeRequests()
+          .antMatchers(HttpMethod.GET, "/catalog/list").permitAll()
+            .anyRequest().authenticated()
+              .and()
+                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
   }
 
   @Override

src/main/java/api/restful/controller/security/WebSecurity.java

@@ -12,7 +12,7 @@
 import api.restful.model.views.Views;
 
 @Entity
-@Table(name="coordinate")
+@Table(name = "coordinate")
 public class Coordinate {
     @Id
     @JsonView(Views.Internal.class)
@@ -30,7 +30,7 @@ public class Coordinate {
 
     @ManyToOne
     @JsonView(Views.Internal.class)
-    @JoinColumn(name="catalog_id")
+    @JoinColumn(name = "catalog_id")
     private Catalog catalog;
 
     public Coordinate() {}