make GameAuthorizationRule high priority to make sure it isn't overshadowed by normal auth

Author: bristermitten

src/main/java/org/developerden/codosseum/auth/GameAuthorizationRule.java

@@ -35,6 +35,11 @@ protected GameAuthorizationRule(RolesFinder rolesFinder) {
     super(rolesFinder);
   }
 
+  @Override
+  public int getOrder() {
+    return Integer.MIN_VALUE + 100;
+  }
+
   @Override
   public Publisher<SecurityRuleResult> check(@Nullable HttpRequest<?> request,
                                              @Nullable Authentication authentication) {
@@ -64,6 +69,8 @@ public Publisher<SecurityRuleResult> check(@Nullable HttpRequest<?> request,
   }
 
   private boolean matchesGameId(Authentication authentication, String gameId) {
-    return gameId.equals(authentication.getAttributes().get("activeGameId"));
+    return gameId.equals(
+        String.valueOf(authentication.getAttributes().get(PlayerAuthentication.ACTIVE_GAME_ID))
+    );
   }
 }

src/main/java/org/developerden/codosseum/auth/GameAuthorized.java

@@ -19,6 +19,11 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
+/**
+ * Annotation to specify that a route requires the user to have one of the specified roles in a game.
+ * If the user does not have one of the specified roles, a 403 Forbidden response will be returned.
+ *
+ */
 @Retention(RetentionPolicy.RUNTIME)
 @Target(ElementType.METHOD)
 public @interface GameAuthorized {

src/main/java/org/developerden/codosseum/controller/UserController.java

@@ -22,8 +22,6 @@
 import io.micronaut.security.rules.SecurityRule;
 import io.micronaut.validation.Validated;
 import jakarta.inject.Inject;
-import org.developerden.codosseum.auth.GameAuthorized;
-import org.developerden.codosseum.auth.GameRole;
 import org.developerden.codosseum.dto.PlayersMapper;
 import org.developerden.codosseum.dto.user.User;
 import org.developerden.codosseum.model.player.UserMapper;
@@ -50,7 +48,6 @@ public class UserController {
   }
 
   @Get("/@self")
-  @GameAuthorized(GameRole.PLAYER)
   public HttpResponse<User> getSelf(Authentication principal) {
     return authService.getUserInfoFromAuth(principal)
         .map(userMapper::toDto)