Skip to content

Commit dbe918a

Browse files
cevhericevheri
committed
added business Rule, everyone can create and update only their post and blog
1 parent 3a2e981 commit dbe918a

File tree

3 files changed

+63
-8
lines changed

3 files changed

+63
-8
lines changed

‎src/main/java/com/cevheri/blog/repository/PostRepository.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,6 @@ default Page<Post> findAllWithEagerRelationships(Pageable pageable) {
4343

4444
@Query("select post from Post post left join fetch post.user left join fetch post.blog where post.id =:id")
4545
Optional<Post> findOneWithToOneRelationships(@Param("id") Long id);
46+
47+
Page<Post> findByBlogUserLoginOrderByCreatedDateDesc(String currentUserLogin, Pageable pageable);
4648
}

‎src/main/java/com/cevheri/blog/web/rest/BlogResource.java

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.cevheri.blog.web.rest;
22

33
import com.cevheri.blog.repository.BlogRepository;
4+
import com.cevheri.blog.security.SecurityUtils;
45
import com.cevheri.blog.service.BlogService;
56
import com.cevheri.blog.service.dto.BlogDTO;
67
import com.cevheri.blog.web.rest.errors.BadRequestAlertException;
@@ -56,12 +57,18 @@ public BlogResource(BlogService blogService, BlogRepository blogRepository) {
5657
* @throws URISyntaxException if the Location URI syntax is incorrect.
5758
*/
5859
@PostMapping("/blogs")
59-
public ResponseEntity<BlogDTO> createBlog(@Valid @RequestBody BlogDTO blogDTO) throws URISyntaxException {
60+
public ResponseEntity<?> createBlog(@Valid @RequestBody BlogDTO blogDTO) throws URISyntaxException {
6061
log.debug("REST request to save Blog : {}", blogDTO);
6162
if (blogDTO.getId() != null) {
6263
throw new BadRequestAlertException("A new blog cannot already have an ID", ENTITY_NAME, "idexists");
6364
}
65+
66+
if (!blogDTO.getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
67+
return new ResponseEntity<>("error.http.403", HttpStatus.FORBIDDEN);
68+
}
69+
6470
BlogDTO result = blogService.save(blogDTO);
71+
6572
return ResponseEntity
6673
.created(new URI("/api/blogs/" + result.getId()))
6774
.headers(HeaderUtil.createEntityCreationAlert(applicationName, true, ENTITY_NAME, result.getId().toString()))
@@ -79,7 +86,7 @@ public ResponseEntity<BlogDTO> createBlog(@Valid @RequestBody BlogDTO blogDTO) t
7986
* @throws URISyntaxException if the Location URI syntax is incorrect.
8087
*/
8188
@PutMapping("/blogs/{id}")
82-
public ResponseEntity<BlogDTO> updateBlog(
89+
public ResponseEntity<?> updateBlog(
8390
@PathVariable(value = "id", required = false) final Long id,
8491
@Valid @RequestBody BlogDTO blogDTO
8592
) throws URISyntaxException {
@@ -95,6 +102,11 @@ public ResponseEntity<BlogDTO> updateBlog(
95102
throw new BadRequestAlertException("Entity not found", ENTITY_NAME, "idnotfound");
96103
}
97104

105+
if (blogDTO.getUser() != null &&
106+
!blogDTO.getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
107+
return new ResponseEntity<>("error.http.403", HttpStatus.FORBIDDEN);
108+
}
109+
98110
BlogDTO result = blogService.update(blogDTO);
99111
return ResponseEntity
100112
.ok()
@@ -168,9 +180,14 @@ public ResponseEntity<List<BlogDTO>> getAllBlogs(
168180
* @return the {@link ResponseEntity} with status {@code 200 (OK)} and with body the blogDTO, or with status {@code 404 (Not Found)}.
169181
*/
170182
@GetMapping("/blogs/{id}")
171-
public ResponseEntity<BlogDTO> getBlog(@PathVariable Long id) {
183+
public ResponseEntity<?> getBlog(@PathVariable Long id) {
172184
log.debug("REST request to get Blog : {}", id);
173185
Optional<BlogDTO> blogDTO = blogService.findOne(id);
186+
187+
// if (blogDTO.isPresent() && blogDTO.get().getUser() != null &&
188+
// !blogDTO.get().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
189+
// return new ResponseEntity<>("error.http.403", HttpStatus.FORBIDDEN);
190+
// }
174191
return ResponseUtil.wrapOrNotFound(blogDTO);
175192
}
176193

@@ -181,8 +198,16 @@ public ResponseEntity<BlogDTO> getBlog(@PathVariable Long id) {
181198
* @return the {@link ResponseEntity} with status {@code 204 (NO_CONTENT)}.
182199
*/
183200
@DeleteMapping("/blogs/{id}")
184-
public ResponseEntity<Void> deleteBlog(@PathVariable Long id) {
201+
public ResponseEntity<?> deleteBlog(@PathVariable Long id) {
185202
log.debug("REST request to delete Blog : {}", id);
203+
204+
//BusinessRule!!! Everyone can only delete their own blog.
205+
Optional<BlogDTO> blogDTO = blogService.findOne(id);
206+
if (blogDTO.isPresent() && blogDTO.get().getUser() != null &&
207+
!blogDTO.get().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
208+
return new ResponseEntity<>("error.http.403", HttpStatus.FORBIDDEN);
209+
}
210+
186211
blogService.delete(id);
187212
return ResponseEntity
188213
.noContent()

‎src/main/java/com/cevheri/blog/web/rest/PostResource.java

Lines changed: 32 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package com.cevheri.blog.web.rest;
22

3+
import com.cevheri.blog.domain.Post;
34
import com.cevheri.blog.repository.PostRepository;
5+
import com.cevheri.blog.security.SecurityUtils;
46
import com.cevheri.blog.service.PostService;
57
import com.cevheri.blog.service.dto.PostDTO;
68
import com.cevheri.blog.web.rest.errors.BadRequestAlertException;
@@ -56,12 +58,17 @@ public PostResource(PostService postService, PostRepository postRepository) {
5658
* @throws URISyntaxException if the Location URI syntax is incorrect.
5759
*/
5860
@PostMapping("/posts")
59-
public ResponseEntity<PostDTO> createPost(@Valid @RequestBody PostDTO postDTO) throws URISyntaxException {
61+
public ResponseEntity<?> createPost(@Valid @RequestBody PostDTO postDTO) throws URISyntaxException {
6062
log.debug("REST request to save Post : {}", postDTO);
6163
if (postDTO.getId() != null) {
6264
throw new BadRequestAlertException("A new post cannot already have an ID", ENTITY_NAME, "idexists");
6365
}
6466
PostDTO result = postService.save(postDTO);
67+
68+
if (postDTO.getBlog() != null &&
69+
!postDTO.getBlog().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
70+
return new ResponseEntity<>("Unauthorized", HttpStatus.UNAUTHORIZED);
71+
}
6572
return ResponseEntity
6673
.created(new URI("/api/posts/" + result.getId()))
6774
.headers(HeaderUtil.createEntityCreationAlert(applicationName, true, ENTITY_NAME, result.getId().toString()))
@@ -79,7 +86,7 @@ public ResponseEntity<PostDTO> createPost(@Valid @RequestBody PostDTO postDTO) t
7986
* @throws URISyntaxException if the Location URI syntax is incorrect.
8087
*/
8188
@PutMapping("/posts/{id}")
82-
public ResponseEntity<PostDTO> updatePost(
89+
public ResponseEntity<?> updatePost(
8390
@PathVariable(value = "id", required = false) final Long id,
8491
@Valid @RequestBody PostDTO postDTO
8592
) throws URISyntaxException {
@@ -95,6 +102,13 @@ public ResponseEntity<PostDTO> updatePost(
95102
throw new BadRequestAlertException("Entity not found", ENTITY_NAME, "idnotfound");
96103
}
97104

105+
106+
if (postDTO.getBlog() != null &&
107+
!postDTO.getBlog().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
108+
return new ResponseEntity<>("Unauthorized", HttpStatus.UNAUTHORIZED);
109+
}
110+
111+
98112
PostDTO result = postService.update(postDTO);
99113
return ResponseEntity
100114
.ok()
@@ -168,9 +182,15 @@ public ResponseEntity<List<PostDTO>> getAllPosts(
168182
* @return the {@link ResponseEntity} with status {@code 200 (OK)} and with body the postDTO, or with status {@code 404 (Not Found)}.
169183
*/
170184
@GetMapping("/posts/{id}")
171-
public ResponseEntity<PostDTO> getPost(@PathVariable Long id) {
185+
public ResponseEntity<?> getPost(@PathVariable Long id) {
172186
log.debug("REST request to get Post : {}", id);
173187
Optional<PostDTO> postDTO = postService.findOne(id);
188+
189+
// if (postDTO.isPresent() && postDTO.get().getBlog() != null &&
190+
// !postDTO.get().getBlog().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
191+
// return new ResponseEntity<>("Unauthorized", HttpStatus.UNAUTHORIZED);
192+
// }
193+
174194
return ResponseUtil.wrapOrNotFound(postDTO);
175195
}
176196

@@ -181,8 +201,16 @@ public ResponseEntity<PostDTO> getPost(@PathVariable Long id) {
181201
* @return the {@link ResponseEntity} with status {@code 204 (NO_CONTENT)}.
182202
*/
183203
@DeleteMapping("/posts/{id}")
184-
public ResponseEntity<Void> deletePost(@PathVariable Long id) {
204+
public ResponseEntity<?> deletePost(@PathVariable Long id) {
185205
log.debug("REST request to delete Post : {}", id);
206+
207+
//BusinessRule!!! Everyone can only delete their own Post.
208+
Optional<Post> result = postRepository.findOneWithEagerRelationships(id);
209+
if (result.isPresent() && result.get().getBlog() != null &&
210+
!result.get().getBlog().getUser().getLogin().equals(SecurityUtils.getCurrentUserLogin().orElse(""))) {
211+
return new ResponseEntity<>("Unauthorized", HttpStatus.UNAUTHORIZED);
212+
}
213+
186214
postService.delete(id);
187215
return ResponseEntity
188216
.noContent()

0 commit comments

Comments
 (0)