TP3 - Gestão de Papéis e Permissões

Objetivos do TP

Neste TP, você irá:

1. ✅ Implementar um sistema RBAC (Role-Based Access Control)
2. ✅ Criar permissões granulares
3. ✅ Utilizar @PreAuthorize com expressões avançadas
4. ✅ Gerenciar uma hierarquia de papéis
5. ✅ Testar os acessos com diferentes usuários

Duração estimada: 1h30

---

Contexto

Você gerencia uma aplicação corporativa com:

• ADMIN : Acesso total
• MANAGER : Gerencia os usuários de sua equipe
• USER : Acesso limitado aos seus próprios dados

---

Parte 1: Modelo de Dados

Entidade Permission

@Entity
@Table(name = "permissions")
@Data
@NoArgsConstructor
public class Permission {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    private String description;

    public Permission(String name, String description) {
        this.name = name;
        this.description = description;
    }
}

Entidade Role com Permissões

@Entity
@Table(name = "roles")
@Data
@NoArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String name;

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "role_permissions",
        joinColumns = @JoinColumn(name = "role_id"),
        inverseJoinColumns = @JoinColumn(name = "permission_id"))
    private Set<Permission> permissions = new HashSet<>();

    public Role(String name) {
        this.name = name;
    }
}

Entidade User

@Entity
@Table(name = "users")
@Data
@NoArgsConstructor
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Column(unique = true, nullable = false)
    private String username;

    @Column(nullable = false)
    private String password;

    private String email;
    private boolean enabled = true;

    @ManyToOne
    @JoinColumn(name = "manager_id")
    private User manager;  // Para a hierarquia

    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id"))
    private Set<Role> roles = new HashSet<>();
}

---

Parte 2: UserDetails com Permissões

public class CustomUserDetails implements UserDetails {
    private final User user;

    public CustomUserDetails(User user) {
        this.user = user;
    }

    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        Set<GrantedAuthority> authorities = new HashSet<>();
        
        for (Role role : user.getRoles()) {
            // Adicionar o papel (ex: ROLE_ADMIN)
            authorities.add(new SimpleGrantedAuthority(role.getName()));
            
            // Adicionar as permissões do papel
            for (Permission permission : role.getPermissions()) {
                authorities.add(new SimpleGrantedAuthority(permission.getName()));
            }
        }
        
        return authorities;
    }

    @Override
    public String getPassword() { return user.getPassword(); }

    @Override
    public String getUsername() { return user.getUsername(); }

    @Override
    public boolean isEnabled() { return user.isEnabled(); }

    @Override
    public boolean isAccountNonExpired() { return true; }

    @Override
    public boolean isAccountNonLocked() { return true; }

    @Override
    public boolean isCredentialsNonExpired() { return true; }

    public User getUser() { return user; }
    
    public Long getId() { return user.getId(); }
}

---

Parte 3: Inicialização dos Dados

@Component
@RequiredArgsConstructor
public class DataInitializer implements CommandLineRunner {

    private final PermissionRepository permissionRepository;
    private final RoleRepository roleRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    @Override
    @Transactional
    public void run(String... args) {
        // Permissões
        Permission readUsers = createPermission("READ_USERS", "Visualizar usuários");
        Permission writeUsers = createPermission("WRITE_USERS", "Modificar usuários");
        Permission deleteUsers = createPermission("DELETE_USERS", "Excluir usuários");
        Permission readReports = createPermission("READ_REPORTS", "Visualizar relatórios");
        Permission writeReports = createPermission("WRITE_REPORTS", "Criar relatórios");

        // Papéis com permissões
        Role adminRole = createRole("ROLE_ADMIN", 
            Set.of(readUsers, writeUsers, deleteUsers, readReports, writeReports));
        Role managerRole = createRole("ROLE_MANAGER", 
            Set.of(readUsers, writeUsers, readReports, writeReports));
        Role userRole = createRole("ROLE_USER", 
            Set.of(readReports));

        // Usuários
        User admin = createUser("admin", "admin@test.com", "admin123", Set.of(adminRole));
        User manager = createUser("manager", "manager@test.com", "manager123", Set.of(managerRole));
        User user1 = createUser("user1", "user1@test.com", "user123", Set.of(userRole));
        User user2 = createUser("user2", "user2@test.com", "user123", Set.of(userRole));

        // Hierarquia: manager gerencia user1 e user2
        user1.setManager(manager);
        user2.setManager(manager);
        userRepository.saveAll(List.of(user1, user2));
    }

    private Permission createPermission(String name, String description) {
        return permissionRepository.findByName(name)
            .orElseGet(() -> permissionRepository.save(new Permission(name, description)));
    }

    private Role createRole(String name, Set<Permission> permissions) {
        return roleRepository.findByName(name)
            .orElseGet(() -> {
                Role role = new Role(name);
                role.setPermissions(permissions);
                return roleRepository.save(role);
            });
    }

    private User createUser(String username, String email, String password, Set<Role> roles) {
        return userRepository.findByUsername(username)
            .orElseGet(() -> {
                User user = new User();
                user.setUsername(username);
                user.setEmail(email);
                user.setPassword(passwordEncoder.encode(password));
                user.setRoles(roles);
                return userRepository.save(user);
            });
    }
}

---

Parte 4: Controllers com @PreAuthorize

UserController

@RestController
@RequestMapping("/api/users")
@RequiredArgsConstructor
public class UserController {

    private final UserRepository userRepository;

    // Apenas Admin
    @GetMapping
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userRepository.findAll();
    }

    // Admin ou Manager que gerencia este usuário
    @GetMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.isManagerOf(#id)")
    public User getUser(@PathVariable Long id) {
        return userRepository.findById(id).orElseThrow();
    }

    // Permissão específica
    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_USERS')")
    public User createUser(@RequestBody User user) {
        return userRepository.save(user);
    }

    // Apenas Admin
    @DeleteMapping("/{id}")
    @PreAuthorize("hasAuthority('DELETE_USERS')")
    public void deleteUser(@PathVariable Long id) {
        userRepository.deleteById(id);
    }

    // O próprio usuário ou seu manager ou admin
    @PutMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') or #id == authentication.principal.id or @userSecurity.isManagerOf(#id)")
    public User updateUser(@PathVariable Long id, @RequestBody User user) {
        User existing = userRepository.findById(id).orElseThrow();
        existing.setEmail(user.getEmail());
        return userRepository.save(existing);
    }
}

ReportController

@RestController
@RequestMapping("/api/reports")
@RequiredArgsConstructor
public class ReportController {

    @GetMapping
    @PreAuthorize("hasAuthority('READ_REPORTS')")
    public List<String> getReports() {
        return List.of("Relatório 1", "Relatório 2", "Relatório 3");
    }

    @PostMapping
    @PreAuthorize("hasAuthority('WRITE_REPORTS')")
    public String createReport(@RequestBody String report) {
        return "Relatório criado: " + report;
    }

    // Combinação: papel E permissão
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN') and hasAuthority('DELETE_REPORTS')")
    public void deleteReport(@PathVariable Long id) {
        // ...
    }
}

---

Parte 5: Serviço de Segurança Personalizado

@Service("userSecurity")
@RequiredArgsConstructor
public class UserSecurityService {

    private final UserRepository userRepository;

    public boolean isManagerOf(Long userId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }

        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        User targetUser = userRepository.findById(userId).orElse(null);

        if (targetUser == null || targetUser.getManager() == null) {
            return false;
        }

        return targetUser.getManager().getId().equals(currentUser.getId());
    }

    public boolean isOwner(Long resourceOwnerId) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth == null || !(auth.getPrincipal() instanceof CustomUserDetails)) {
            return false;
        }
        
        CustomUserDetails currentUser = (CustomUserDetails) auth.getPrincipal();
        return currentUser.getId().equals(resourceOwnerId);
    }
}

---

Parte 6: Testes

Teste com diferentes usuários

# Login admin
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin123"}'
# → Recuperar ADMIN_TOKEN

# Login manager
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"manager","password":"manager123"}'
# → Recuperar MANAGER_TOKEN

# Login user1
curl -X POST http://localhost:8080/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"user1","password":"user123"}'
# → Recuperar USER_TOKEN

Testes de acesso

# Admin: GET todos os users → OK
curl http://localhost:8080/api/users -H "Authorization: Bearer ADMIN_TOKEN"

# Manager: GET todos os users → 403
curl http://localhost:8080/api/users -H "Authorization: Bearer MANAGER_TOKEN"

# Manager: GET user de sua equipe → OK
curl http://localhost:8080/api/users/3 -H "Authorization: Bearer MANAGER_TOKEN"

# User: GET reports → OK
curl http://localhost:8080/api/reports -H "Authorization: Bearer USER_TOKEN"

# User: POST reports → 403
curl -X POST http://localhost:8080/api/reports \
  -H "Authorization: Bearer USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '"Meu relatório"'

---

Matriz de Acesso

Endpoint	ADMIN	MANAGER	USER
GET /api/users	✅	❌	❌
GET /api/users/{id}	✅	⚠️ sua equipe	❌
POST /api/users	✅	✅	❌
DELETE /api/users/{id}	✅	❌	❌
GET /api/reports	✅	✅	✅
POST /api/reports	✅	✅	❌

---

Checklist

• Admin pode fazer tudo
• Manager pode ver/modificar apenas sua equipe
• User só pode ler relatórios
• As permissões são verificadas corretamente
• @userSecurity.isManagerOf funciona

---

🎯 Próximo Passo

➡️ TP8.4: Login Social com Google

---

⬅️ Voltar ao Módulo 8