TP3 - Gestion des Rôles et Permissions

Objectifs du TP

Dans ce TP, vous allez:

1. ✅ Implémenter un système RBAC (Role-Based Access Control)
2. ✅ Créer des permissions granulaires
3. ✅ Utiliser @PreAuthorize avec des expressions avancées
4. ✅ Gérer une hiérarchie de rôles
5. ✅ Tester les accès avec différents utilisateurs

Durée estimée: 1h30

---

Contexte

Vous gérez une application d'entreprise avec:

• ADMIN : Accès total
• MANAGER : Gère les utilisateurs de son équipe
• USER : Accès limité à ses propres données

---

Partie 1: Modèle de Données

Permission Entity

@Entity
@Table(name = "permissions")
@Data
@NoArgsConstructor
public class Permission {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    private String description;

    public Permission(String name, String description) {
        this.name = name;
        this.description = description;
    }
}

Role Entity avec Permissions

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "role_permissions",
        joinColumns = @JoinColumn(name = "role_id"),
        inverseJoinColumns = @JoinColumn(name = "permission_id"))
    private Set<Permission> permissions = new HashSet<>();

    public Role(String name) {
        this.name = name;
    }
}

User Entity

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    private String email;
    private boolean enabled = true;

    @ManyToOne
    @JoinColumn(name = "manager_id")
    private User manager;  // Pour la hiérarchie

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Partie 2: UserDetails avec Permissions

public class CustomUserDetails implements UserDetails {
    private final User user;

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Set<GrantedAuthority> authorities = new HashSet<>();
        
        for (Role role : user.getRoles()) {
            // Ajouter le rôle (ex: ROLE_ADMIN)
            authorities.add(new SimpleGrantedAuthority(role.getName()));
            
            // Ajouter les permissions du rôle
            for (Permission permission : role.getPermissions()) {
                authorities.add(new SimpleGrantedAuthority(permission.getName()));
            }
        }
        
        return authorities;
    }

    @Override
    public String getPassword() { return user.getPassword(); }

    @Override
    public String getUsername() { return user.getUsername(); }

    @Override
    public boolean isEnabled() { return user.isEnabled(); }

    @Override
    public boolean isAccountNonExpired() { return true; }

    @Override
    public boolean isAccountNonLocked() { return true; }

    @Override
    public boolean isCredentialsNonExpired() { return true; }

    public User getUser() { return user; }
    
    public Long getId() { return user.getId(); }
}

---

Partie 3: Initialisation des Données

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final PermissionRepository permissionRepository;
    private final RoleRepository roleRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    @Transactional
    public void run(String... args) {
        // Permissions
        Permission readUsers = createPermission("READ_USERS", "Voir les utilisateurs");
        Permission writeUsers = createPermission("WRITE_USERS", "Modifier les utilisateurs");
        Permission deleteUsers = createPermission("DELETE_USERS", "Supprimer les utilisateurs");
        Permission readReports = createPermission("READ_REPORTS", "Voir les rapports");
        Permission writeReports = createPermission("WRITE_REPORTS", "Créer des rapports");

        // Rôles avec permissions
        Role adminRole = createRole("ROLE_ADMIN", 
            Set.of(readUsers, writeUsers, deleteUsers, readReports, writeReports));
        Role managerRole = createRole("ROLE_MANAGER", 
            Set.of(readUsers, writeUsers, readReports, writeReports));
        Role userRole = createRole("ROLE_USER", 
            Set.of(readReports));

        // Utilisateurs
        User admin = createUser("admin", "admin@test.com", "admin123", Set.of(adminRole));
        User manager = createUser("manager", "manager@test.com", "manager123", Set.of(managerRole));
        User user1 = createUser("user1", "user1@test.com", "user123", Set.of(userRole));
        User user2 = createUser("user2", "user2@test.com", "user123", Set.of(userRole));

        // Hiérarchie: manager gère user1 et user2
        user1.setManager(manager);
        user2.setManager(manager);
        userRepository.saveAll(List.of(user1, user2));
    }

    private Permission createPermission(String name, String description) {
        return permissionRepository.findByName(name)
            .orElseGet(() -> permissionRepository.save(new Permission(name, description)));
    }

    private Role createRole(String name, Set<Permission> permissions) {
        return roleRepository.findByName(name)
            .orElseGet(() -> {
                Role role = new Role(name);
                role.setPermissions(permissions);
                return roleRepository.save(role);
            });
    }

    private User createUser(String username, String email, String password, Set<Role> roles) {
        return userRepository.findByUsername(username)
            .orElseGet(() -> {
                User user = new User();
                user.setUsername(username);
                user.setEmail(email);
                user.setPassword(passwordEncoder.encode(password));
                user.setRoles(roles);
                return userRepository.save(user);
            });
    }
}

---

Partie 4: Controllers avec @PreAuthorize

UserController

@RestController
@RequestMapping("/api/users")
@RequiredArgsConstructor
public class UserController {

    private final UserRepository userRepository;

    // Admin seulement
    @GetMapping
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userRepository.findAll();
    }

    // Admin ou Manager qui gère cet utilisateur
    @GetMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.isManagerOf(#id)")
    public User getUser(@PathVariable Long id) {
        return userRepository.findById(id).orElseThrow();
    }

    // Permission spécifique
    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_USERS')")
    public User createUser(@RequestBody User user) {
        return userRepository.save(user);
    }

    // Admin seulement
    @DeleteMapping("/{id}")
    @PreAuthorize("hasAuthority('DELETE_USERS')")
    public void deleteUser(@PathVariable Long id) {
        userRepository.deleteById(id);
    }

    // L'utilisateur lui-même ou son manager ou admin
    @PutMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id or @userSecurity.isManagerOf(#id)")
    public User updateUser(@PathVariable Long id, @RequestBody User user) {
        User existing = userRepository.findById(id).orElseThrow();
        existing.setEmail(user.getEmail());
        return userRepository.save(existing);
    }
}

ReportController

@RestController
@RequestMapping("/api/reports")
@RequiredArgsConstructor
public class ReportController {

    @GetMapping
    @PreAuthorize("hasAuthority('READ_REPORTS')")
    public List<String> getReports() {
        return List.of("Rapport 1", "Rapport 2", "Rapport 3");
    }

    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_REPORTS')")
    public String createReport(@RequestBody String report) {
        return "Rapport créé: " + report;
    }

    // Combinaison: rôle ET permission
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') and hasAuthority('DELETE_REPORTS')")
    public void deleteReport(@PathVariable Long id) {
        // ...
    }
}

---

Partie 5: Service de Sécurité Personnalisé

@Service("userSecurity")
@RequiredArgsConstructor
public class UserSecurityService {

    private final UserRepository userRepository;

    public boolean isManagerOf(Long userId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }

        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        User targetUser = userRepository.findById(userId).orElse(null);

        if (targetUser == null || targetUser.getManager() == null) {
            return false;
        }

        return targetUser.getManager().getId().equals(currentUser.getId());
    }

    public boolean isOwner(Long resourceOwnerId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }
        
        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        return currentUser.getId().equals(resourceOwnerId);
    }
}

---

Partie 6: Tests

Test avec différents utilisateurs

# Login admin
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}'
# → Récupérer ADMIN_TOKEN

# Login manager
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"manager","password":"manager123"}'
# → Récupérer MANAGER_TOKEN

# Login user1
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"user1","password":"user123"}'
# → Récupérer USER_TOKEN

Tests d'accès

# Admin: GET tous les users → OK
curl http://localhost:8080/api/users -H "Authorization: Bearer ADMIN_TOKEN"

# Manager: GET tous les users → 403
curl http://localhost:8080/api/users -H "Authorization: Bearer MANAGER_TOKEN"

# Manager: GET user de son équipe → OK
curl http://localhost:8080/api/users/3 -H "Authorization: Bearer MANAGER_TOKEN"

# User: GET reports → OK
curl http://localhost:8080/api/reports -H "Authorization: Bearer USER_TOKEN"

# User: POST reports → 403
curl -X POST http://localhost:8080/api/reports \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '"Mon rapport"'

---

Matrice des Accès

Endpoint	ADMIN	MANAGER	USER
GET /api/users	✅	❌	❌
GET /api/users/{id}	✅	⚠️ son équipe	❌
POST /api/users	✅	✅	❌
DELETE /api/users/{id}	✅	❌	❌
GET /api/reports	✅	✅	✅
POST /api/reports	✅	✅	❌

---

Checklist

• Admin peut tout faire
• Manager peut voir/modifier son équipe seulement
• User ne peut que lire les rapports
• Les permissions sont vérifiées correctement
• @userSecurity.isManagerOf fonctionne

---

🎯 Prochaine Étape

➡️ TP8.4: Login Social avec Google

---

⬅️ Retour au Module 8