TP3 - Gestión de Roles y Permisos

Objetivos del TP

En este TP, usted va a:

1. ✅ Implementar un sistema RBAC (Role-Based Access Control)
2. ✅ Crear permisos granulares
3. ✅ Utilizar @PreAuthorize con expresiones avanzadas
4. ✅ Gestionar una jerarquía de roles
5. ✅ Probar los accesos con diferentes usuarios

Duración estimada: 1h30

---

Contexto

Usted gestiona una aplicación empresarial con:

• ADMIN : Acceso total
• MANAGER : Gestiona los usuarios de su equipo
• USER : Acceso limitado a sus propios datos

---

Parte 1: Modelo de Datos

Entidad Permission

@Entity
@Table(name = "permissions")
@Data
@NoArgsConstructor
public class Permission {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    private String description;

    public Permission(String name, String description) {
        this.name = name;
        this.description = description;
    }
}

Entidad Role con Permisos

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "role_permissions",
        joinColumns = @JoinColumn(name = "role_id"),
        inverseJoinColumns = @JoinColumn(name = "permission_id"))
    private Set<Permission> permissions = new HashSet<>();

    public Role(String name) {
        this.name = name;
    }
}

Entidad User

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    private String email;
    private boolean enabled = true;

    @ManyToOne
    @JoinColumn(name = "manager_id")
    private User manager;  // Para la jerarquía

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Parte 2: UserDetails con Permisos

public class CustomUserDetails implements UserDetails {
    private final User user;

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Set<GrantedAuthority> authorities = new HashSet<>();
        
        for (Role role : user.getRoles()) {
            // Añadir el rol (ej: ROLE_ADMIN)
            authorities.add(new SimpleGrantedAuthority(role.getName()));
            
            // Añadir los permisos del rol
            for (Permission permission : role.getPermissions()) {
                authorities.add(new SimpleGrantedAuthority(permission.getName()));
            }
        }
        
        return authorities;
    }

    @Override
    public String getPassword() { return user.getPassword(); }

    @Override
    public String getUsername() { return user.getUsername(); }

    @Override
    public boolean isEnabled() { return user.isEnabled(); }

    @Override
    public boolean isAccountNonExpired() { return true; }

    @Override
    public boolean isAccountNonLocked() { return true; }

    @Override
    public boolean isCredentialsNonExpired() { return true; }

    public User getUser() { return user; }
    
    public Long getId() { return user.getId(); }
}

---

Parte 3: Inicialización de Datos

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final PermissionRepository permissionRepository;
    private final RoleRepository roleRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    @Transactional
    public void run(String... args) {
        // Permisos
        Permission readUsers = createPermission("READ_USERS", "Ver los usuarios");
        Permission writeUsers = createPermission("WRITE_USERS", "Modificar los usuarios");
        Permission deleteUsers = createPermission("DELETE_USERS", "Eliminar los usuarios");
        Permission readReports = createPermission("READ_REPORTS", "Ver los reportes");
        Permission writeReports = createPermission("WRITE_REPORTS", "Crear reportes");

        // Roles con permisos
        Role adminRole = createRole("ROLE_ADMIN", 
            Set.of(readUsers, writeUsers, deleteUsers, readReports, writeReports));
        Role managerRole = createRole("ROLE_MANAGER", 
            Set.of(readUsers, writeUsers, readReports, writeReports));
        Role userRole = createRole("ROLE_USER", 
            Set.of(readReports));

        // Usuarios
        User admin = createUser("admin", "admin@test.com", "admin123", Set.of(adminRole));
        User manager = createUser("manager", "manager@test.com", "manager123", Set.of(managerRole));
        User user1 = createUser("user1", "user1@test.com", "user123", Set.of(userRole));
        User user2 = createUser("user2", "user2@test.com", "user123", Set.of(userRole));

        // Jerarquía: manager gestiona a user1 y user2
        user1.setManager(manager);
        user2.setManager(manager);
        userRepository.saveAll(List.of(user1, user2));
    }

    private Permission createPermission(String name, String description) {
        return permissionRepository.findByName(name)
            .orElseGet(() -> permissionRepository.save(new Permission(name, description)));
    }

    private Role createRole(String name, Set<Permission> permissions) {
        return roleRepository.findByName(name)
            .orElseGet(() -> {
                Role role = new Role(name);
                role.setPermissions(permissions);
                return roleRepository.save(role);
            });
    }

    private User createUser(String username, String email, String password, Set<Role> roles) {
        return userRepository.findByUsername(username)
            .orElseGet(() -> {
                User user = new User();
                user.setUsername(username);
                user.setEmail(email);
                user.setPassword(passwordEncoder.encode(password));
                user.setRoles(roles);
                return userRepository.save(user);
            });
    }
}

---

Parte 4: Controllers con @PreAuthorize

UserController

@RestController
@RequestMapping("/api/users")
@RequiredArgsConstructor
public class UserController {

    private final UserRepository userRepository;

    // Solo Admin
    @GetMapping
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userRepository.findAll();
    }

    // Admin o Manager que gestiona a este usuario
    @GetMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.isManagerOf(#id)")
    public User getUser(@PathVariable Long id) {
        return userRepository.findById(id).orElseThrow();
    }

    // Permiso específico
    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_USERS')")
    public User createUser(@RequestBody User user) {
        return userRepository.save(user);
    }

    // Solo Admin
    @DeleteMapping("/{id}")
    @PreAuthorize("hasAuthority('DELETE_USERS')")
    public void deleteUser(@PathVariable Long id) {
        userRepository.deleteById(id);
    }

    // El propio usuario o su manager o admin
    @PutMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id or @userSecurity.isManagerOf(#id)")
    public User updateUser(@PathVariable Long id, @RequestBody User user) {
        User existing = userRepository.findById(id).orElseThrow();
        existing.setEmail(user.getEmail());
        return userRepository.save(existing);
    }
}

ReportController

@RestController
@RequestMapping("/api/reports")
@RequiredArgsConstructor
public class ReportController {

    @GetMapping
    @PreAuthorize("hasAuthority('READ_REPORTS')")
    public List<String> getReports() {
        return List.of("Reporte 1", "Reporte 2", "Reporte 3");
    }

    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_REPORTS')")
    public String createReport(@RequestBody String report) {
        return "Reporte creado: " + report;
    }

    // Combinación: rol Y permiso
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') and hasAuthority('DELETE_REPORTS')")
    public void deleteReport(@PathVariable Long id) {
        // ...
    }
}

---

Parte 5: Servicio de Seguridad Personalizado

@Service("userSecurity")
@RequiredArgsConstructor
public class UserSecurityService {

    private final UserRepository userRepository;

    public boolean isManagerOf(Long userId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }

        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        User targetUser = userRepository.findById(userId).orElse(null);

        if (targetUser == null || targetUser.getManager() == null) {
            return false;
        }

        return targetUser.getManager().getId().equals(currentUser.getId());
    }

    public boolean isOwner(Long resourceOwnerId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }
        
        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        return currentUser.getId().equals(resourceOwnerId);
    }
}

---

Parte 6: Pruebas

Prueba con diferentes usuarios

# Login admin
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}'
# → Recuperar ADMIN_TOKEN

# Login manager
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"manager","password":"manager123"}'
# → Recuperar MANAGER_TOKEN

# Login user1
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"user1","password":"user123"}'
# → Recuperar USER_TOKEN

Pruebas de acceso

# Admin: GET todos los users → OK
curl http://localhost:8080/api/users -H "Authorization: Bearer ADMIN_TOKEN"

# Manager: GET todos los users → 403
curl http://localhost:8080/api/users -H "Authorization: Bearer MANAGER_TOKEN"

# Manager: GET user de su equipo → OK
curl http://localhost:8080/api/users/3 -H "Authorization: Bearer MANAGER_TOKEN"

# User: GET reports → OK
curl http://localhost:8080/api/reports -H "Authorization: Bearer USER_TOKEN"

# User: POST reports → 403
curl -X POST http://localhost:8080/api/reports \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '"Mi reporte"'

---

Matriz de Accesos

Endpoint	ADMIN	MANAGER	USER
GET /api/users	✅	❌	❌
GET /api/users/{id}	✅	⚠️ su equipo	❌
POST /api/users	✅	✅	❌
DELETE /api/users/{id}	✅	❌	❌
GET /api/reports	✅	✅	✅
POST /api/reports	✅	✅	❌

---

Checklist

• Admin puede hacer todo
• Manager solo puede ver/modificar su equipo
• User solo puede leer los reportes
• Los permisos se verifican correctamente
• @userSecurity.isManagerOf funciona

---

🎯 Próximo Paso

➡️ TP8.4: Login Social con Google

---

⬅️ Volver al Módulo 8