TP3 - Role and Permission Management

Objectives of the TP

In this TP, you will:

1. ✅ Implement an RBAC (Role-Based Access Control) system
2. ✅ Create granular permissions
3. ✅ Use @PreAuthorize with advanced expressions
4. ✅ Manage a role hierarchy
5. ✅ Test access with different users

Estimated duration: 1h30

---

Context

You manage a business application with:

• ADMIN: Full access
• MANAGER: Manages users in their team
• USER: Limited access to their own data

---

Part 1: Data Model

Permission Entity

@Entity
@Table(name = "permissions")
@Data
@NoArgsConstructor
public class Permission {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    private String description;

    public Permission(String name, String description) {
        this.name = name;
        this.description = description;
    }
}

Role Entity with Permissions

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "role_permissions",
        joinColumns = @JoinColumn(name = "role_id"),
        inverseJoinColumns = @JoinColumn(name = "permission_id"))
    private Set<Permission> permissions = new HashSet<>();

    public Role(String name) {
        this.name = name;
    }
}

User Entity

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    private String email;
    private boolean enabled = true;

    @ManyToOne
    @JoinColumn(name = "manager_id")
    private User manager;  // For hierarchy

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Part 2: UserDetails with Permissions

public class CustomUserDetails implements UserDetails {
    private final User user;

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Set<GrantedAuthority> authorities = new HashSet<>();
        
        for (Role role : user.getRoles()) {
            // Add the role (e.g., ROLE_ADMIN)
            authorities.add(new SimpleGrantedAuthority(role.getName()));
            
            // Add the role's permissions
            for (Permission permission : role.getPermissions()) {
                authorities.add(new SimpleGrantedAuthority(permission.getName()));
            }
        }
        
        return authorities;
    }

    @Override
    public String getPassword() { return user.getPassword(); }

    @Override
    public String getUsername() { return user.getUsername(); }

    @Override
    public boolean isEnabled() { return user.isEnabled(); }

    @Override
    public boolean isAccountNonExpired() { return true; }

    @Override
    public boolean isAccountNonLocked() { return true; }

    @Override
    public boolean isCredentialsNonExpired() { return true; }

    public User getUser() { return user; }
    
    public Long getId() { return user.getId(); }
}

---

Part 3: Data Initialization

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final PermissionRepository permissionRepository;
    private final RoleRepository roleRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    @Transactional
    public void run(String... args) {
        // Permissions
        Permission readUsers = createPermission("READ_USERS", "View users");
        Permission writeUsers = createPermission("WRITE_USERS", "Modify users");
        Permission deleteUsers = createPermission("DELETE_USERS", "Delete users");
        Permission readReports = createPermission("READ_REPORTS", "View reports");
        Permission writeReports = createPermission("WRITE_REPORTS", "Create reports");

        // Roles with permissions
        Role adminRole = createRole("ROLE_ADMIN", 
            Set.of(readUsers, writeUsers, deleteUsers, readReports, writeReports));
        Role managerRole = createRole("ROLE_MANAGER", 
            Set.of(readUsers, writeUsers, readReports, writeReports));
        Role userRole = createRole("ROLE_USER", 
            Set.of(readReports));

        // Users
        User admin = createUser("admin", "admin@test.com", "admin123", Set.of(adminRole));
        User manager = createUser("manager", "manager@test.com", "manager123", Set.of(managerRole));
        User user1 = createUser("user1", "user1@test.com", "user123", Set.of(userRole));
        User user2 = createUser("user2", "user2@test.com", "user123", Set.of(userRole));

        // Hierarchy: manager manages user1 and user2
        user1.setManager(manager);
        user2.setManager(manager);
        userRepository.saveAll(List.of(user1, user2));
    }

    private Permission createPermission(String name, String description) {
        return permissionRepository.findByName(name)
            .orElseGet(() -> permissionRepository.save(new Permission(name, description)));
    }

    private Role createRole(String name, Set<Permission> permissions) {
        return roleRepository.findByName(name)
            .orElseGet(() -> {
                Role role = new Role(name);
                role.setPermissions(permissions);
                return roleRepository.save(role);
            });
    }

    private User createUser(String username, String email, String password, Set<Role> roles) {
        return userRepository.findByUsername(username)
            .orElseGet(() -> {
                User user = new User();
                user.setUsername(username);
                user.setEmail(email);
                user.setPassword(passwordEncoder.encode(password));
                user.setRoles(roles);
                return userRepository.save(user);
            });
    }
}

---

Part 4: Controllers with @PreAuthorize

UserController

@RestController
@RequestMapping("/api/users")
@RequiredArgsConstructor
public class UserController {

    private final UserRepository userRepository;

    // Admin only
    @GetMapping
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userRepository.findAll();
    }

    // Admin or Manager who manages this user
    @GetMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.isManagerOf(#id)")
    public User getUser(@PathVariable Long id) {
        return userRepository.findById(id).orElseThrow();
    }

    // Specific permission
    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_USERS')")
    public User createUser(@RequestBody User user) {
        return userRepository.save(user);
    }

    // Admin only
    @DeleteMapping("/{id}")
    @PreAuthorize("hasAuthority('DELETE_USERS')")
    public void deleteUser(@PathVariable Long id) {
        userRepository.deleteById(id);
    }

    // The user themselves or their manager or admin
    @PutMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id or @userSecurity.isManagerOf(#id)")
    public User updateUser(@PathVariable Long id, @RequestBody User user) {
        User existing = userRepository.findById(id).orElseThrow();
        existing.setEmail(user.getEmail());
        return userRepository.save(existing);
    }
}

ReportController

@RestController
@RequestMapping("/api/reports")
@RequiredArgsConstructor
public class ReportController {

    @GetMapping
    @PreAuthorize("hasAuthority('READ_REPORTS')")
    public List<String> getReports() {
        return List.of("Report 1", "Report 2", "Report 3");
    }

    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_REPORTS')")
    public String createReport(@RequestBody String report) {
        return "Report created: " + report;
    }

    // Combination: role AND permission
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') and hasAuthority('DELETE_REPORTS')")
    public void deleteReport(@PathVariable Long id) {
        // ...
    }
}

---

Part 5: Custom Security Service

@Service("userSecurity")
@RequiredArgsConstructor
public class UserSecurityService {

    private final UserRepository userRepository;

    public boolean isManagerOf(Long userId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }

        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        User targetUser = userRepository.findById(userId).orElse(null);

        if (targetUser == null || targetUser.getManager() == null) {
            return false;
        }

        return targetUser.getManager().getId().equals(currentUser.getId());
    }

    public boolean isOwner(Long resourceOwnerId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }
        
        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        return currentUser.getId().equals(resourceOwnerId);
    }
}

---

Part 6: Tests

Test with different users

# Login admin
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}'
# → Retrieve ADMIN_TOKEN

# Login manager
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"manager","password":"manager123"}'
# → Retrieve MANAGER_TOKEN

# Login user1
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"user1","password":"user123"}'
# → Retrieve USER_TOKEN

Access tests

# Admin: GET all users → OK
curl http://localhost:8080/api/users -H "Authorization: Bearer ADMIN_TOKEN"

# Manager: GET all users → 403
curl http://localhost:8080/api/users -H "Authorization: Bearer MANAGER_TOKEN"

# Manager: GET user from their team → OK
curl http://localhost:8080/api/users/3 -H "Authorization: Bearer MANAGER_TOKEN"

# User: GET reports → OK
curl http://localhost:8080/api/reports -H "Authorization: Bearer USER_TOKEN"

# User: POST reports → 403
curl -X POST http://localhost:8080/api/reports \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '"My report"'

---

Access Matrix

Endpoint	ADMIN	MANAGER	USER
GET /api/users	✅	❌	❌
GET /api/users/{id}	✅	⚠️ their team	❌
POST /api/users	✅	✅	❌
DELETE /api/users/{id}	✅	❌	❌
GET /api/reports	✅	✅	✅
POST /api/reports	✅	✅	❌

---

Checklist

• Admin can do everything
• Manager can only view/modify their team
• User can only read reports
• Permissions are correctly checked
• @userSecurity.isManagerOf works

---

🎯 Next Step

➡️ TP8.4: Social Login with Google

---

⬅️ Back to Module 8