Fix user service

kbss-cvut · Jan 2, 2024 · e71cf1f · e71cf1f
1 parent b0ffb4c
commit e71cf1f
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 41 deletions.
diff --git a/src/main/java/cz/cvut/kbss/analysis/service/UserRepositoryService.java b/src/main/java/cz/cvut/kbss/analysis/service/UserRepositoryService.java
@@ -60,7 +60,7 @@ public URI register(User user) {
     public void updateCurrent(UserUpdateDTO userUpdate) {
         log.info("> updateCurrent - {}", userUpdate.getUsername());
 
-        User currentUser = SecurityUtils.currentUser();
+        User currentUser = getCurrentUser();
         if (!currentUser.getUri().equals(userUpdate.getUri())) {
             log.warn("< updateCurrent - URIs do not match! {} != {}", currentUser.getUri(), userUpdate.getUri());
             throw new LogicViolationException("User update uri does not match current user!");

diff --git a/src/main/java/cz/cvut/kbss/analysis/service/security/SecurityUtils.java b/src/main/java/cz/cvut/kbss/analysis/service/security/SecurityUtils.java
@@ -2,9 +2,8 @@
 
 import cz.cvut.kbss.analysis.config.conf.SecurityConf;
 import cz.cvut.kbss.analysis.dao.UserDao;
+import cz.cvut.kbss.analysis.exception.EntityNotFoundException;
 import cz.cvut.kbss.analysis.model.User;
-import cz.cvut.kbss.analysis.util.OidcGrantedAuthoritiesExtractor;
-import lombok.AllArgsConstructor;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.context.SecurityContext;
@@ -15,33 +14,22 @@
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.stereotype.Service;
 
-import java.util.List;
-
 /**
  * Handle user session-related functions.
  */
 @Service
-@AllArgsConstructor
 public class SecurityUtils {
 
     private final UserDao userDao;
 
     private final SecurityConf config;
 
-//    public SecurityUtils() {
-//        // Ensures security context is propagated to additionally spun threads, e.g., used
-//        // by @Async methods
-//        SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL);
-//    }
-
-    /**
-     * <p>It allows to access the currently logged-in user without injecting {@code SecurityUtils}
-     * as a bean.
-     *
-     * @return Currently logged-in user
-     */
-    public static User currentUser() {
-        return (User) SecurityContextHolder.getContext().getAuthentication().getPrincipal();
+    public SecurityUtils(UserDao userDao, SecurityConf config) {
+        this.userDao = userDao;
+        this.config = config;
+        // Ensures security context is propagated to additionally spun threads, e.g., used
+        // by @Async methods
+        SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL); // TODO check what it does
     }
 
     /**
@@ -59,36 +47,21 @@ public User getCurrentUser() {
             return resolveAccountFromOAuthPrincipal((Jwt) principal);
         } else {
             final String username = context.getAuthentication().getName();
-            final User user = userDao.findByUsername(username).orElseThrow().copy();
             //TODO impersonalization?
-//            if (context.getAuthentication().getAuthorities().stream().anyMatch(a -> a.getAuthority().equals(
-//                    SwitchUserWebFilter.ROLE_PREVIOUS_ADMINISTRATOR))) {
-//                user.addType(Vocabulary.s_c_impersonator);
-//            }
-            return user;
+            return userDao.findByUsername(username).orElseThrow().copy();
         }
     }
 
+//    TODO map role, but I am not sure which changes in the model when be required if I add addRole method to User
     private User resolveAccountFromOAuthPrincipal(Jwt principal) {
         final OidcUserInfo userInfo = new OidcUserInfo(principal.getClaims());
-        final List<String> roles = new OidcGrantedAuthoritiesExtractor(config).extractRoles(principal);
-        final User user = userDao.findByUsername(userInfo.getPreferredUsername()).orElseThrow(); // TODO throw EntityNotFoundException
-//        TODO resolve role
-//        roles.stream().map(Role::forName).filter(Optional::isPresent).forEach(r -> user.addType(r.get().getType()));
-        return user;
+//        final List<String> roles = new OidcGrantedAuthoritiesExtractor(config).extractRoles(principal);
+//        var user = userDao.findByUsername(userInfo.getPreferredUsername());
+//        roles.stream().map(r -> "ROLE_" + r).forEach(user::addRole);
+        return userDao.findByUsername(userInfo.getPreferredUsername()).orElseThrow(() -> EntityNotFoundException.create("User", userInfo.getPreferredUsername()));
     }
 
 
-//    /**
-//     * Sets authentication to the current thread's security context.
-//     *
-//     * @param authentication Currently logged-in user's authentication
-//     */
-//    public static void setCurrentUser(Authentication authentication) {
-//        final SecurityContext context = new SecurityContextImpl();
-//        context.setAuthentication(authentication);
-//        SecurityContextHolder.setContext(context);
-//    }
     /**
      * Sets the current security context to the user represented by the provided user details.
      * <p>