1. To begin, we will update the security configuration file so that we can access the permissions pages. The additional entry is highlighted in the code below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 | package com.dtr.oas.config;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.context.annotation.Configuration;import org.springframework.context.annotation.ComponentScan;import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;import org.springframework.security.config.annotation.web.builders.HttpSecurity;import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;import org.springframework.security.core.userdetails.UserDetailsService;import com.dtr.oas.exception.AccessDeniedExceptionHandler;@Configuration@EnableWebMvcSecurity@ComponentScan(basePackageClasses=com.dtr.oas.service.UserServiceImpl.class)@EnableGlobalMethodSecurity(prePostEnabled=true)public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired public void configureGlobal(UserDetailsService userDetailsService, AuthenticationManagerBuilder auth) throws Exception { auth .userDetailsService(userDetailsService); } @Autowired AccessDeniedExceptionHandler accessDeniedExceptionHandler; @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/resources/**").permitAll() .antMatchers("/error/**").permitAll() .antMatchers("/strategy/**").hasRole("ADMIN") .antMatchers("/user/**").hasRole("ADMIN") .antMatchers("/role/**").hasRole("ADMIN") .antMatchers("/permission/**").hasRole("ADMIN") .anyRequest().authenticated() .and() .formLogin() .loginPage("/login") .defaultSuccessUrl("/") .permitAll() .and() .logout() .permitAll() .and() .exceptionHandling() .accessDeniedHandler(accessDeniedExceptionHandler); }} |
2. As with the User CRUD pages, we will need a DTO to transfer state to the controller. This is required because Permission objects holds references to one or more Role objects. Since Java objects cannot be returned from the browser, we will use a Permission DTO that will hold references to Role Id numbers, which can be returned from a browser. The DTO is shown below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 | package com.dtr.oas.controller;import java.io.Serializable;import java.util.List;import javax.validation.constraints.NotNull;import javax.validation.constraints.Size;import org.hibernate.validator.constraints.NotEmpty;import org.slf4j.Logger;import org.slf4j.LoggerFactory;import com.google.common.base.Objects;public class PermissionDTO implements Serializable { private static final long serialVersionUID = -2707641174043923410L; static Logger logger = LoggerFactory.getLogger(PermissionDTO.class); private int id; @NotNull(message = "{error.permission.permissionname.null}") @NotEmpty(message = "{error.permission.permissionname.empty}") @Size(max = 50, message = "{permission.permissionname.role.max}") private String permissionname; private List<Integer> permRoles; public int getId() { return id; } public void setId(int id) { this.id = id; } public String getPermissionname() { return permissionname; } public void setPermissionname(String permissionname) { this.permissionname = permissionname; } public List<Integer> getPermRoles() { return permRoles; } public void setPermRoles(List<Integer> permRoles) { this.permRoles = permRoles; } @Override public String toString() { return String.format("%s(id=%d, permissionname='%s')", this.getClass().getSimpleName(), this.getId(), this.getPermissionname()); } @Override public boolean equals(Object o) { if (this == o) return true; if (o == null) return false; if (o instanceof PermissionDTO) { final PermissionDTO other = (PermissionDTO) o; return Objects.equal(getId(), other.getId()) && Objects.equal(getPermissionname(), other.getPermissionname()); } return false; } @Override public int hashCode() { return Objects.hashCode(getId(), getPermissionname()); }} |
3. The last Java file that we will create is the controller for the Permission object. The controller is shown below, with some of the more important details described after the code.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 | package com.dtr.oas.controller;import java.util.ArrayList;import java.util.HashSet;import java.util.List;import java.util.Locale;import java.util.Set;import javax.validation.Valid;import org.slf4j.Logger;import org.slf4j.LoggerFactory;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.context.MessageSource;import org.springframework.security.access.prepost.PreAuthorize;import org.springframework.stereotype.Controller;import org.springframework.ui.Model;import org.springframework.validation.BindingResult;import org.springframework.web.bind.annotation.ModelAttribute;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestMethod;import org.springframework.web.bind.annotation.RequestParam;import org.springframework.web.servlet.mvc.support.RedirectAttributes;import com.dtr.oas.exception.DuplicatePermissionException;import com.dtr.oas.exception.PermissionNotFoundException;import com.dtr.oas.exception.RoleNotFoundException;import com.dtr.oas.model.Permission;import com.dtr.oas.model.Role;import com.dtr.oas.service.PermissionService;import com.dtr.oas.service.RoleService;@Controller@RequestMapping(value = "/permission")@PreAuthorize("denyAll")public class PermissionController { static Logger logger = LoggerFactory.getLogger(PermissionController.class); static String businessObject = "permission"; //used in RedirectAttributes messages @Autowired private RoleService roleService; @Autowired private PermissionService permissionService; @Autowired private MessageSource messageSource; @ModelAttribute("allRoles") @PreAuthorize("hasAnyRole('CTRL_PERM_LIST_GET','CTRL_PERM_EDIT_GET')") public List<Role> getAllRoles() { return roleService.getRoles(); } @RequestMapping(value = {"/", "/list"}, method = RequestMethod.GET) @PreAuthorize("hasRole('CTRL_PERM_LIST_GET')") public String listPermissions(Model model) { logger.debug("IN: Permission/list-GET"); List<Permission> permissions = permissionService.getPermissions(); model.addAttribute("permissions", permissions); // if there was an error in /add, we do not want to overwrite // the existing user object containing the errors. if (!model.containsAttribute("permissionDTO")) { logger.debug("Adding PermissionDTO object to model"); PermissionDTO permissionDTO = new PermissionDTO(); model.addAttribute("permissionDTO", permissionDTO); } return "permission-list"; } @RequestMapping(value = "/add", method = RequestMethod.POST) @PreAuthorize("hasRole('CTRL_PERM_ADD_POST')") public String addPermission(@Valid @ModelAttribute PermissionDTO permissionDTO, BindingResult result, RedirectAttributes redirectAttrs) { logger.debug("IN: Permission/add-POST"); logger.debug(" DTO: " + permissionDTO.toString()); if (result.hasErrors()) { logger.debug("PermissionDTO add error: " + result.toString()); redirectAttrs.addFlashAttribute("org.springframework.validation.BindingResult.permissionDTO", result); redirectAttrs.addFlashAttribute("permissionDTO", permissionDTO); return "redirect:/permission/list"; } else { Permission perm = new Permission(); try { perm = getPermission(permissionDTO); permissionService.addPermission(perm); String message = messageSource.getMessage("ctrl.message.success.add", new Object[] {businessObject, perm.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("message", message); return "redirect:/permission/list"; } catch (DuplicatePermissionException e) { String message = messageSource.getMessage("ctrl.message.error.duplicate", new Object[] {businessObject, permissionDTO.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } catch (RoleNotFoundException e) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {"role ids", permissionDTO.getPermRoles().toString()}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } } } @RequestMapping(value = "/edit", method = RequestMethod.POST) @PreAuthorize("hasRole('CTRL_PERM_EDIT_POST')") public String editPermission(@Valid @ModelAttribute PermissionDTO permissionDTO, BindingResult result, RedirectAttributes redirectAttrs, @RequestParam(value = "action", required = true) String action) { logger.debug("IN: Permission/edit-POST: " + action); if (action.equals(messageSource.getMessage("button.action.cancel", null, Locale.US))) { String message = messageSource.getMessage("ctrl.message.success.cancel", new Object[] {"Edit", businessObject, permissionDTO.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("message", message); } else if (result.hasErrors()) { logger.debug("Permission-edit error: " + result.toString()); redirectAttrs.addFlashAttribute("org.springframework.validation.BindingResult.permissionDTO", result); redirectAttrs.addFlashAttribute("permissionDTO", permissionDTO); return "redirect:/permission/edit?id=" + permissionDTO.getId(); } else if (action.equals(messageSource.getMessage("button.action.save", null, Locale.US))) { logger.debug("Permission/edit-POST: " + permissionDTO.toString()); try { Permission permission = getPermission(permissionDTO); permissionService.updatePermission(permission); String message = messageSource.getMessage("ctrl.message.success.update", new Object[] {businessObject, permissionDTO.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("message", message); } catch (DuplicatePermissionException unf) { String message = messageSource.getMessage("ctrl.message.error.duplicate", new Object[] {businessObject, permissionDTO.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } catch (PermissionNotFoundException unf) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {businessObject, permissionDTO.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } catch (RoleNotFoundException unf) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {"role ids", permissionDTO.getPermRoles().toString()}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } } return "redirect:/permission/list"; } @RequestMapping(value = "/edit", method = RequestMethod.GET) @PreAuthorize("hasRole('CTRL_PERM_EDIT_GET')") public String editPermissionPage(@RequestParam(value = "id", required = true) Integer id, Model model, RedirectAttributes redirectAttrs) { logger.debug("IN: Permission/edit-GET: ID to query = " + id); try { if (!model.containsAttribute("permissionDTO")) { logger.debug("Adding permissionDTO object to model"); Permission perm = permissionService.getPermission(id); PermissionDTO permissionDTO = getPermissionDTO(perm); logger.debug("Permission/edit-GET: " + permissionDTO.toString()); model.addAttribute("permissionDTO", permissionDTO); } return "permission-edit"; } catch (PermissionNotFoundException e) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {"user id", id}, Locale.US); model.addAttribute("error", message); return "redirect:/permission/list"; } } @RequestMapping(value = "/delete", method = RequestMethod.GET) @PreAuthorize("hasRole('CTRL_PERM_DELETE_GET')") public String deletePermission( @RequestParam(value = "id", required = true) Integer id, @RequestParam(value = "phase", required = true) String phase, Model model, RedirectAttributes redirectAttrs) { Permission permission; try { permission = permissionService.getPermission(id); } catch (PermissionNotFoundException e) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {"permission id", id}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } logger.debug("IN: Permission/delete-GET | id = " + id + " | phase = " + phase + " | " + permission.toString()); if (phase.equals(messageSource.getMessage("button.action.cancel", null, Locale.US))) { String message = messageSource.getMessage("ctrl.message.success.cancel", new Object[] {"Delete", businessObject, permission.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("message", message); return "redirect:/permission/list"; } else if (phase.equals(messageSource.getMessage("button.action.stage", null, Locale.US))) { logger.debug(" deleting permission : " + permission.toString()); model.addAttribute("permission", permission); return "permission-delete"; } else if (phase.equals(messageSource.getMessage("button.action.delete", null, Locale.US))) { try { permissionService.deletePermission(permission.getId()); String message = messageSource.getMessage("ctrl.message.success.delete", new Object[] {businessObject, permission.getPermissionname()}, Locale.US); redirectAttrs.addFlashAttribute("message", message); return "redirect:/permission/list"; } catch (PermissionNotFoundException e) { String message = messageSource.getMessage("ctrl.message.error.notfound", new Object[] {"permission id", id}, Locale.US); redirectAttrs.addFlashAttribute("error", message); return "redirect:/permission/list"; } } return "redirect:/permission/list"; } @PreAuthorize("hasAnyRole('CTRL_PERM_EDIT_GET','CTRL_PERM_DELETE_GET')") public PermissionDTO getPermissionDTO(Permission perm) { List<Integer> roleIdList = new ArrayList<Integer>(); PermissionDTO permDTO = new PermissionDTO(); permDTO.setId(perm.getId()); permDTO.setPermissionname(perm.getPermissionname()); for (Role role : perm.getPermRoles()) { roleIdList.add(role.getId()); } permDTO.setPermRoles(roleIdList); return permDTO; } @PreAuthorize("hasAnyRole('CTRL_PERM_ADD_POST','CTRL_PERM_EDIT_POST')") public Permission getPermission(PermissionDTO permissionDTO) throws RoleNotFoundException { Set<Role> roleList = new HashSet<Role>(); Permission perm = new Permission(); Role role = new Role(); perm.setId(permissionDTO.getId()); perm.setPermissionname(permissionDTO.getPermissionname()); if (permissionDTO.getPermRoles() != null) { for (Integer roleId : permissionDTO.getPermRoles()) { role = roleService.getRole(roleId); logger.debug(" ROLE: " + role.toString()); roleList.add(role); } perm.setPermRoles(roleList); } logger.debug(" PERM: " + perm.toString()); return perm; }} |
The list, add, edit, and delete methods look nearly identical to the same methods on the User controller, and were discussed in the User CRUD posts. Note that the Permission add and edit pages have to handle an exception thrown if a role is not found...not very likely, but it needs to be handled.
At the bottom of the conroller code are methods to convert DTOs to Entities, and Entities to DTOs. The functionality to notice is the handling of the Permission objects associations with Role objects.
In part 2, we will create the three Thymeleaf pages and show some screenshots of the Permissions CRUD pages.
No comments:
Post a Comment