feat: Back office user role and auth

alexisszmundy · alexisszmundy · commit a9c6fd2740b6 · 2025-07-22T10:56:13.000+02:00
diff --git a/src/main/java/fr/insee/genesis/configuration/auth/security/ApplicationRole.java b/src/main/java/fr/insee/genesis/configuration/auth/security/ApplicationRole.java
@@ -6,6 +6,7 @@ public enum ApplicationRole {
     USER_PLATINE,
     COLLECT_PLATFORM,
     SCHEDULER,
-    READER
+    READER,
+    USER_BACK_OFFICE
 }
 
diff --git a/src/main/java/fr/insee/genesis/configuration/auth/security/RoleConfiguration.java b/src/main/java/fr/insee/genesis/configuration/auth/security/RoleConfiguration.java
@@ -31,6 +31,9 @@ public class RoleConfiguration {
     @Value("#{'${app.role.collect-platform.claims}'.split(',')}")
     private List<String> collectPlatformClaims;
 
+    @Value("#{'${app.role.user-back-office.claims}'.split(',')}")
+    private List<String> userBackOfficeClaims;
+
     @Value("#{'${app.role.scheduler.claims}'.split(',')}")
     private List<String> schedulerClaims;
 
@@ -50,10 +53,12 @@ static RoleHierarchy roleHierarchy() {
         return RoleHierarchyImpl.withDefaultRolePrefix()
                 .role(ApplicationRole.ADMIN.toString()).implies(ApplicationRole.USER_KRAFTWERK.toString())
                 .role(ApplicationRole.ADMIN.toString()).implies(ApplicationRole.USER_PLATINE.toString())
+                .role(ApplicationRole.ADMIN.toString()).implies(ApplicationRole.USER_BACK_OFFICE.toString())
                 .role(ApplicationRole.ADMIN.toString()).implies(ApplicationRole.COLLECT_PLATFORM.toString())
                 .role(ApplicationRole.ADMIN.toString()).implies(ApplicationRole.SCHEDULER.toString())
                 .role(ApplicationRole.USER_KRAFTWERK.toString()).implies(ApplicationRole.READER.toString())
                 .role(ApplicationRole.USER_PLATINE.toString()).implies(ApplicationRole.READER.toString())
+                .role(ApplicationRole.USER_BACK_OFFICE.toString()).implies(ApplicationRole.READER.toString())
                 .build();
     }
 
@@ -85,6 +90,11 @@ public void initialization() {
                 .computeIfAbsent(claim, k -> new ArrayList<>())
                 .add(String.valueOf(ApplicationRole.USER_PLATINE)));
 
+        // Ajout des claims pour le rôle USER_BACK_OFFICE
+        userBackOfficeClaims.forEach(claim -> rolesByClaim
+                .computeIfAbsent(claim, k -> new ArrayList<>())
+                .add(String.valueOf(ApplicationRole.USER_BACK_OFFICE)));
+
         // Add claims for the COLLECT_PLATFORM role
         collectPlatformClaims.forEach(claim -> rolesByClaim
                 .computeIfAbsent(claim, k -> new ArrayList<>())
@@ -102,5 +112,4 @@ public void initialization() {
 
         log.info("Roles configuration : {}", rolesByClaim);
     }
-
 }
diff --git a/src/main/java/fr/insee/genesis/controller/rest/DataProcessingContextController.java b/src/main/java/fr/insee/genesis/controller/rest/DataProcessingContextController.java
@@ -46,7 +46,7 @@ public class DataProcessingContextController {
 
     @Operation(summary = "Create or update a data processing context")
     @PutMapping(path = "/review")
-    @PreAuthorize("hasRole('ADMIN')")
+    @PreAuthorize("hasRole('USER_BACK_OFFICE')")
     public ResponseEntity<Object> saveContext(
             @Parameter(description = "Identifier of the partition", required = true) @RequestParam("partitionId") String partitionId,
             @Parameter(description = "Allow reviewing") @RequestParam(value = "withReview", defaultValue = "false") Boolean withReview
diff --git a/src/main/java/fr/insee/genesis/controller/rest/LunaticModelController.java b/src/main/java/fr/insee/genesis/controller/rest/LunaticModelController.java
@@ -31,7 +31,7 @@ public LunaticModelController(LunaticModelApiPort lunaticModelApiPort) {
 
     @Operation(summary = "Save lunatic json data from one interrogation in Genesis Database")
     @PutMapping(path = "/save")
-    @PreAuthorize("hasRole('ADMIN')")
+    @PreAuthorize("hasRole('USER_BACK_OFFICE')")
     public ResponseEntity<String> saveRawResponsesFromJsonBody(
             @RequestParam("questionnaireId") String questionnaireId,
             @RequestBody Map<String, Object> dataJson
diff --git a/src/main/java/fr/insee/genesis/controller/rest/responses/EditedResponseController.java b/src/main/java/fr/insee/genesis/controller/rest/responses/EditedResponseController.java
@@ -50,7 +50,7 @@ public ResponseEntity<Object> getEditedResponses(
 
     @Operation(summary = "Add edited previous json file")
     @PostMapping(path = "previous/json")
-    @PreAuthorize("hasAnyRole('USER_PLATINE','SCHEDULER')")
+    @PreAuthorize("hasAnyRole('USER_PLATINE','SCHEDULER','USER_BACK_OFFICE')")
     public ResponseEntity<Object> readEditedPreviousJson(
             @RequestParam("questionnaireId") String questionnaireId,
             @RequestParam("mode") Mode mode,
@@ -77,7 +77,7 @@ public ResponseEntity<Object> readEditedPreviousJson(
 
     @Operation(summary = "Add edited external json file")
     @PostMapping(path = "/external/json")
-    @PreAuthorize("hasAnyRole('USER_PLATINE','SCHEDULER')")
+    @PreAuthorize("hasAnyRole('USER_PLATINE','SCHEDULER','USER_BACK_OFFICE')")
     public ResponseEntity<Object> readEditedExternalJson(
             @RequestParam("questionnaireId") String questionnaireId,
             @RequestParam("mode") Mode mode,
diff --git a/src/main/resources/application-test-cucumber.properties b/src/main/resources/application-test-cucumber.properties
@@ -5,6 +5,7 @@ fr.insee.genesis.sourcefolder.specifications = /data/genesis
 app.role.admin.claims=administrateur_traiter
 app.role.user-kraftwerk.claims=utilisateur_Kraftwerk
 app.role.user-platine.claims=utilisateur_Platine
+app.role.user-back-office.claims=utilisateur_Back_Office
 app.role.reader.claims=lecteur_traiter
 app.role.collect-platform.claims=protools
 app.role.scheduler.claims=scheduler_traiter
diff --git a/src/main/resources/application-test.properties b/src/main/resources/application-test.properties
@@ -5,6 +5,7 @@ fr.insee.genesis.sourcefolder.specifications = /data/genesis
 app.role.admin.claims=administrateur_traiter
 app.role.user-kraftwerk.claims=utilisateur_Kraftwerk
 app.role.user-platine.claims=utilisateur_Platine
+app.role.user-back-office.claims=utilisateur_Back_Office
 app.role.reader.claims=lecteur_traiter
 app.role.collect-platform.claims=protools
 app.role.scheduler.claims=scheduler_traiter
diff --git a/src/test/java/fr/insee/genesis/controller/rest/ControllerAccessTest.java b/src/test/java/fr/insee/genesis/controller/rest/ControllerAccessTest.java
@@ -33,6 +33,7 @@
 import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 
 import java.util.Date;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Stream;
@@ -43,6 +44,7 @@
 import static org.mockito.Mockito.when;
 import static org.springframework.http.HttpMethod.GET;
 import static org.springframework.http.HttpMethod.POST;
+import static org.springframework.http.HttpMethod.PUT;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.delete;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
@@ -58,6 +60,7 @@ class ControllerAccessTest {
     // Constants for user roles
     private static final String USER_KRAFTWERK = "USER_KRAFTWERK";
     private static final String USER_PLATINE = "USER_PLATINE";
+    private static final String USER_BACK_OFFICE = "USER_BACK_OFFICE";
     private static final String ADMIN = "ADMIN";
     private static final String READER = "READER";
     // JWT claim properties loaded from application properties
@@ -115,9 +118,18 @@ private static Stream<Arguments> endpointsReader() {
     private static Stream<Arguments> responseEndpoint() {
         return Stream.of(
                 Arguments.of(GET,"/response/lunatic-json/get/unprocessed"),
-                Arguments.of(GET,"/response//lunatic-json/get/by-interrogation-mode-and-campaign"),
-                Arguments.of(POST,"/response//lunatic-json/process"),
-                Arguments.of(GET,"/response//lunatic-json/campaignId=TOTO")
+                Arguments.of(GET,"/response/lunatic-json/get/by-interrogation-mode-and-campaign"),
+                Arguments.of(POST,"/response/lunatic-json/process"),
+                Arguments.of(GET,"/response/lunatic-json/campaignId=TOTO")
+        );
+    }
+
+    private static Stream<Arguments> backOfficeEndpointProd() {
+        return Stream.of(
+                Arguments.of(PUT,"/lunatic-model/save?questionnaireId=TEST", new HashMap<>()),
+                Arguments.of(POST,"/edited/previous/json?questionnaireId=TEST&mode=WEB&jsonFileName=truc.json"),
+                Arguments.of(POST,"/edited/external/json?questionnaireId=TEST&mode=WEB&jsonFileName=truc.json"),
+                Arguments.of(PUT,"/context/review?partitionId=TEST")
         );
     }
 
@@ -160,6 +172,45 @@ void platine_users_should_access_reader_allowed_services(String endpointURI) thr
                 .andExpect(status().is(oneOf(200, 404)));
     }
 
+    /**
+     * Tests that users with the "USER_BACK_OFFICE" role can access read-only endpoints.
+     */
+    @ParameterizedTest
+    @MethodSource("backOfficeEndpointProd")
+    @DisplayName("Back office users should access prod services")
+    void back_office_users_should_access_prod_services(HttpMethod method, String endpointURI) throws Exception {
+        Jwt jwt = generateJwt(List.of("utilisateur_Back_Office"), USER_BACK_OFFICE);
+        when(jwtDecoder.decode(anyString())).thenReturn(jwt);
+        MockHttpServletRequestBuilder requestBuilder;
+        if (method == HttpMethod.GET) {
+            requestBuilder = get(endpointURI);
+        } else if (method == HttpMethod.POST) {
+            requestBuilder = post(endpointURI);
+        } else if (method == PUT) {
+            requestBuilder = put(endpointURI);
+        } else if (method == HttpMethod.DELETE) {
+            requestBuilder = delete(endpointURI);
+        } else {
+            throw new IllegalArgumentException("Unsupported HTTP method: " + method);
+        }
+
+        mockMvc.perform(requestBuilder.header("Authorization", "bearer token_blabla"))
+                .andExpect(status().is(oneOf(200, 400, 404)));
+    }
+
+    /**
+     * Tests that users with the "USER_BACK_OFFICE" role can access read-only endpoints.
+     */
+    @ParameterizedTest
+    @MethodSource("endpointsReader")
+    @DisplayName("Back office users should access reader-allowed services")
+    void back_office_users_should_access_reader_allowed_services(String endpointURI) throws Exception {
+        Jwt jwt = generateJwt(List.of("utilisateur_Back_Office"), USER_BACK_OFFICE);
+        when(jwtDecoder.decode(anyString())).thenReturn(jwt);
+        mockMvc.perform(get(endpointURI).header("Authorization", "bearer token_blabla"))
+                .andExpect(status().is(oneOf(200, 404)));
+    }
+
     /**
      * Tests that users with the "READER" role can access read-only endpoints.
      */
@@ -226,7 +277,7 @@ void reader_should_not_access_response_services(HttpMethod method,String endpoin
             requestBuilder = get(endpointURI);
         } else if (method == HttpMethod.POST) {
             requestBuilder = post(endpointURI);
-        } else if (method == HttpMethod.PUT) {
+        } else if (method == PUT) {
             requestBuilder = put(endpointURI);
         } else if (method == HttpMethod.DELETE) {
             requestBuilder = delete(endpointURI);

Original file line number	Diff line number	Diff line change
`@@ -6,6 +6,7 @@ public enum ApplicationRole {`
`6`	`6`	`USER_PLATINE,`
`7`	`7`	`COLLECT_PLATFORM,`
`8`	`8`	`SCHEDULER,`
`9`		`- READER`
	`9`	`+ READER,`
	`10`	`+ USER_BACK_OFFICE`
`10`	`11`	`}`
`11`	`12`