From 9371e5ca06b69bc37da1caee34614323b380529c Mon Sep 17 00:00:00 2001
From: Justiks <dubkovmacsim@yandex.ru>
Date: Wed, 19 Feb 2025 11:36:05 +0300
Subject: [PATCH] setup web security

---
 .idea/workspace.xml                           | 62 ++++++++++++++-----
 pom.xml                                       | 16 ++++-
 .../nto/controller/EmployeeController.java    |  6 +-
 .../java/com/example/nto/entity/Employee.java | 40 ++++++++++--
 .../nto/websecurity/CustomUserDetails.java    | 53 ++++++++++++++++
 .../websecurity/UserDetailsServiceImpl.java   | 21 +++++++
 .../nto/websecurity/WebSecurityConfig.java    | 48 ++++++++++++++
 src/main/resources/application.yml            |  9 ++-
 8 files changed, 225 insertions(+), 30 deletions(-)
 create mode 100644 src/main/java/com/example/nto/websecurity/CustomUserDetails.java
 create mode 100644 src/main/java/com/example/nto/websecurity/UserDetailsServiceImpl.java
 create mode 100644 src/main/java/com/example/nto/websecurity/WebSecurityConfig.java

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 1bcd102..6461633 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -5,18 +5,27 @@
   </component>
   <component name="ChangeListManager">
     <list default="true" id="067ac1f0-be04-4fe4-85c6-f870334053b8" name="Changes" comment="bugfix and write last endpoint">
-      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/App.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/App.java" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/websecurity/CustomUserDetails.java" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/websecurity/UserDetailsServiceImpl.java" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/websecurity/WebSecurityConfig.java" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/.idea/workspace.xml" beforeDir="false" afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/pom.xml" beforeDir="false" afterPath="$PROJECT_DIR$/pom.xml" afterDir="false" />
       <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/controller/EmployeeController.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/controller/EmployeeController.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/repository/CodeRepository.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/repository/CodeRepository.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/repository/EmployeeRepository.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/repository/EmployeeRepository.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/service/EmployeeService.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/service/EmployeeService.java" afterDir="false" />
-      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/service/impl/EmployeeServiceImpl.java" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/src/main/java/com/example/nto/entity/Employee.java" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/java/com/example/nto/entity/Employee.java" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/src/main/resources/application.yml" beforeDir="false" afterPath="$PROJECT_DIR$/src/main/resources/application.yml" afterDir="false" />
     </list>
     <option name="SHOW_DIALOG" value="false" />
     <option name="HIGHLIGHT_CONFLICTS" value="true" />
     <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
     <option name="LAST_RESOLUTION" value="IGNORE" />
   </component>
+  <component name="FileTemplateManagerImpl">
+    <option name="RECENT_TEMPLATES">
+      <list>
+        <option value="Class" />
+      </list>
+    </option>
+  </component>
   <component name="Git.Settings">
     <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
   </component>
@@ -29,18 +38,19 @@
     <option name="hideEmptyMiddlePackages" value="true" />
     <option name="showLibraryContents" value="true" />
   </component>
-  <component name="PropertiesComponent"><![CDATA[{
-  "keyToString": {
-    "Application.App.executor": "Run",
-    "RunOnceActivity.ShowReadmeOnStart": "true",
-    "RunOnceActivity.git.unshallow": "true",
-    "git-widget-placeholder": "main",
-    "kotlin-language-version-configured": "true",
-    "settings.editor.selected.configurable": "MavenSettings"
+  <component name="PropertiesComponent">{
+  &quot;keyToString&quot;: {
+    &quot;Application.App.executor&quot;: &quot;Run&quot;,
+    &quot;RunOnceActivity.ShowReadmeOnStart&quot;: &quot;true&quot;,
+    &quot;RunOnceActivity.git.unshallow&quot;: &quot;true&quot;,
+    &quot;git-widget-placeholder&quot;: &quot;main&quot;,
+    &quot;kotlin-language-version-configured&quot;: &quot;true&quot;,
+    &quot;last_opened_file_path&quot;: &quot;C:/Users/User/Desktop/NTO-2024-Backend&quot;,
+    &quot;settings.editor.selected.configurable&quot;: &quot;MavenSettings&quot;
   }
-}]]></component>
+}</component>
   <component name="RunManager">
-    <configuration name="App" type="Application" factoryName="Application" temporary="true" nameIsGenerated="true">
+    <configuration name="App" type="Application" factoryName="Application" temporary="true">
       <option name="MAIN_CLASS_NAME" value="com.example.nto.App" />
       <module name="NTO-2024" />
       <extension name="coverage">
@@ -103,4 +113,26 @@
     <MESSAGE value="bugfix and write last endpoint" />
     <option name="LAST_COMMIT_MESSAGE" value="bugfix and write last endpoint" />
   </component>
+  <component name="XDebuggerManager">
+    <breakpoint-manager>
+      <breakpoints>
+        <line-breakpoint enabled="true" type="java-field">
+          <url>file://$PROJECT_DIR$/src/main/java/com/example/nto/entity/Code.java</url>
+          <line>20</line>
+          <properties field="id" class="com.example.nto.entity.Code" />
+          <option name="timeStamp" value="4" />
+        </line-breakpoint>
+        <line-breakpoint enabled="true" type="java-line">
+          <url>file://$PROJECT_DIR$/src/main/java/com/example/nto/controller/EmployeeController.java</url>
+          <line>29</line>
+          <option name="timeStamp" value="6" />
+        </line-breakpoint>
+        <line-breakpoint enabled="true" type="java-line">
+          <url>file://$PROJECT_DIR$/src/main/java/com/example/nto/controller/EmployeeController.java</url>
+          <line>12</line>
+          <option name="timeStamp" value="7" />
+        </line-breakpoint>
+      </breakpoints>
+    </breakpoint-manager>
+  </component>
 </project>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 88282ee..7310309 100644
--- a/pom.xml
+++ b/pom.xml
@@ -25,18 +25,30 @@
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.postgresql</groupId>
+            <artifactId>postgresql</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.thymeleaf.extras</groupId>
+            <artifactId>thymeleaf-extras-springsecurity6</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
         <dependency>
-            <groupId>com.h2database</groupId>
-            <artifactId>h2</artifactId>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-test</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springdoc</groupId>
             <artifactId>springdoc-openapi-ui</artifactId>
diff --git a/src/main/java/com/example/nto/controller/EmployeeController.java b/src/main/java/com/example/nto/controller/EmployeeController.java
index b9d8f74..3562a9c 100644
--- a/src/main/java/com/example/nto/controller/EmployeeController.java
+++ b/src/main/java/com/example/nto/controller/EmployeeController.java
@@ -5,13 +5,11 @@ import com.example.nto.repository.CodeRepository;
 import com.example.nto.service.EmployeeService;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PatchMapping;
-import org.springframework.web.bind.annotation.PathVariable;
-import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.*;
 
 import java.util.Optional;
 
+@RestController
 public class EmployeeController {
     private final EmployeeService employeeService;
     private final CodeRepository codeRepository;
diff --git a/src/main/java/com/example/nto/entity/Employee.java b/src/main/java/com/example/nto/entity/Employee.java
index 2d230ad..fd4102d 100644
--- a/src/main/java/com/example/nto/entity/Employee.java
+++ b/src/main/java/com/example/nto/entity/Employee.java
@@ -4,12 +4,14 @@ import lombok.AllArgsConstructor;
 import lombok.Builder;
 import lombok.Data;
 import lombok.NoArgsConstructor;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
 
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
+import javax.persistence.*;
 import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
 
 @Entity
 @Data
@@ -23,10 +25,16 @@ public class Employee {
 
     private String login;
     private String name;
+    private String password;
+    private String role;
     private String photo;
     private String position;
     private LocalDateTime lastVisit;
 
+
+//    @OneToMany(mappedBy = "employee")
+//    private List<AdminsEmployee> adminsEmployees = new ArrayList<>();
+
     public long getId() {
         return id;
     }
@@ -74,4 +82,28 @@ public class Employee {
     public void setLastVisit(LocalDateTime lastVisit) {
         this.lastVisit = lastVisit;
     }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    public void setRole(String role) {
+        this.role = role;
+    }
+
+//    public List<AdminsEmployee> getAdminsEmployees() {
+//        return adminsEmployees;
+//    }
+//
+//    public void setAdminsEmployees(List<AdminsEmployee> adminsEmployees) {
+//        this.adminsEmployees = adminsEmployees;
+//    }
 }
diff --git a/src/main/java/com/example/nto/websecurity/CustomUserDetails.java b/src/main/java/com/example/nto/websecurity/CustomUserDetails.java
new file mode 100644
index 0000000..42e81a8
--- /dev/null
+++ b/src/main/java/com/example/nto/websecurity/CustomUserDetails.java
@@ -0,0 +1,53 @@
+package com.example.nto.websecurity;
+
+import com.example.nto.entity.Employee;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+
+import java.util.Collection;
+import java.util.List;
+
+
+public class CustomUserDetails implements UserDetails {
+
+    private Employee employee;
+
+    public CustomUserDetails(Employee employee) {
+        this.employee = employee;
+    }
+
+    @Override
+    public Collection<? extends GrantedAuthority> getAuthorities() {
+        return List.of();
+    }
+
+    @Override
+    public String getPassword() {
+        return employee.getPassword();
+    }
+
+    @Override
+    public String getUsername() {
+        return employee.getLogin();
+    }
+
+    @Override
+    public boolean isAccountNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isAccountNonLocked() {
+        return true;
+    }
+
+    @Override
+    public boolean isCredentialsNonExpired() {
+        return true;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return true;
+    }
+}
diff --git a/src/main/java/com/example/nto/websecurity/UserDetailsServiceImpl.java b/src/main/java/com/example/nto/websecurity/UserDetailsServiceImpl.java
new file mode 100644
index 0000000..f8b3bb6
--- /dev/null
+++ b/src/main/java/com/example/nto/websecurity/UserDetailsServiceImpl.java
@@ -0,0 +1,21 @@
+package com.example.nto.websecurity;
+
+import com.example.nto.entity.Employee;
+import com.example.nto.repository.EmployeeRepository;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+
+public class UserDetailsServiceImpl implements UserDetailsService {
+
+
+    @Autowired
+    private EmployeeRepository repository;
+
+    @Override
+    public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
+        Employee employee = repository.findByLogin(s).orElseThrow(() -> new UsernameNotFoundException(s));
+        return new CustomUserDetails(employee);
+    }
+}
diff --git a/src/main/java/com/example/nto/websecurity/WebSecurityConfig.java b/src/main/java/com/example/nto/websecurity/WebSecurityConfig.java
new file mode 100644
index 0000000..fa58cba
--- /dev/null
+++ b/src/main/java/com/example/nto/websecurity/WebSecurityConfig.java
@@ -0,0 +1,48 @@
+package com.example.nto.websecurity;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+
+@Configuration
+@EnableWebSecurity
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+    @Bean
+    public UserDetailsService userDetailsService() {
+        return new UserDetailsServiceImpl();
+    }
+
+    @Bean
+    public BCryptPasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+    @Bean
+    public DaoAuthenticationProvider authenticationProvider() {
+        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
+        authProvider.setUserDetailsService(userDetailsService());
+        authProvider.setPasswordEncoder(passwordEncoder());
+
+        return authProvider;
+    }
+
+    @Override
+    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+        auth.authenticationProvider(authenticationProvider());
+    }
+
+    @Override
+    protected void configure(HttpSecurity http) throws Exception {
+        http.authorizeRequests()
+                .anyRequest().authenticated()
+                .and()
+                .formLogin().permitAll()
+                .and()
+                .logout().permitAll();
+    }
+}
diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml
index c6bfd72..e2d20e2 100644
--- a/src/main/resources/application.yml
+++ b/src/main/resources/application.yml
@@ -1,12 +1,11 @@
 spring:
 
   datasource:
-    url: jdbc:h2:mem:testdb
+    url: jdbc:postgresql://localhost:5432/postgres
+    username: postgres
+    password: MobileDev
+    driver-class-name: org.postgresql.Driver
 
-  h2:
-    console:
-      #enabled: false
-      enabled: true
 
   jpa:
     #generate-ddl: false