diff --git a/backend/ipLab/data.mv.db b/backend/ipLab/data.mv.db index d358ec9..beb5caa 100644 Binary files a/backend/ipLab/data.mv.db and b/backend/ipLab/data.mv.db differ diff --git a/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Configurations/SecurityConfiguration.java b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Configurations/SecurityConfiguration.java index 992e0d2..6aefd06 100644 --- a/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Configurations/SecurityConfiguration.java +++ b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Configurations/SecurityConfiguration.java @@ -63,6 +63,10 @@ public class SecurityConfiguration { .requestMatchers(HttpMethod.DELETE, "/api/**").hasRole("ADMIN") .requestMatchers(HttpMethod.PUT, "/api/**").hasRole("ADMIN") .requestMatchers(HttpMethod.POST, "/api/**").hasRole("ADMIN") + .requestMatchers(HttpMethod.GET, "/api/customer/**").hasRole("ADMIN") + .requestMatchers(HttpMethod.GET, "/api/store/addStore/**").hasRole("ADMIN") + .requestMatchers(HttpMethod.GET, "/customer/**").hasRole("ADMIN") + .requestMatchers(HttpMethod.GET, "/store/addToStore/**").hasRole("ADMIN") .requestMatchers("/api/**").authenticated() .requestMatchers(HttpMethod.POST, UserController.URL_LOGIN).permitAll() .requestMatchers(HttpMethod.GET, "/img/**").permitAll()) diff --git a/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Controllers/CustomerController.java b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Controllers/CustomerController.java index a1c9c23..30ef893 100644 --- a/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Controllers/CustomerController.java +++ b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Controllers/CustomerController.java @@ -1,10 +1,14 @@ package com.example.ipLab.StoreDataBase.Controllers; import com.example.ipLab.StoreDataBase.DTO.CustomerDTO; +import com.example.ipLab.StoreDataBase.Exceptions.ForbiddenException; +import com.example.ipLab.StoreDataBase.Model.CustomUser; import com.example.ipLab.StoreDataBase.Model.Customer; +import com.example.ipLab.StoreDataBase.Model.UserRole; import com.example.ipLab.StoreDataBase.Service.CustomerService; import com.example.ipLab.WebConfiguration; import jakarta.validation.Valid; +import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.web.bind.annotation.*; import java.util.List; @@ -24,7 +28,7 @@ public class CustomerController { } @GetMapping - public List getCustomers(){ + public List getCustomers(@AuthenticationPrincipal CustomUser user){ return customerService.getAllCustomers().stream() .map(CustomerDTO::new) .toList(); diff --git a/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Exceptions/ForbiddenException.java b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Exceptions/ForbiddenException.java new file mode 100644 index 0000000..580c4b2 --- /dev/null +++ b/backend/ipLab/src/main/java/com/example/ipLab/StoreDataBase/Exceptions/ForbiddenException.java @@ -0,0 +1,8 @@ +package com.example.ipLab.StoreDataBase.Exceptions; + +import org.springframework.http.HttpStatus; +import org.springframework.web.bind.annotation.ResponseStatus; + +@ResponseStatus(HttpStatus.FORBIDDEN) +public class ForbiddenException extends RuntimeException { +} diff --git a/backend/ipLab/src/main/resources/templates/customer.html b/backend/ipLab/src/main/resources/templates/customer.html index 352bbed..f69045e 100644 --- a/backend/ipLab/src/main/resources/templates/customer.html +++ b/backend/ipLab/src/main/resources/templates/customer.html @@ -5,52 +5,60 @@ -
-
- - Добавить - +
+
+ +
+ + + + + + + + + + + + + + + + +
#IDФамилияИмяОтчество
+ + + + + +
+ + Изменить + + +
+
+ +
+
+
-
- - - - - - - - - - - - - - - - -
#IDФамилияИмяОтчество
- - - - - -
- - Изменить - - -
-
- -
-
+
+
+

Forbidden

+ На главную +
diff --git a/frontend/src/App.jsx b/frontend/src/App.jsx index fc8eb73..106c6ba 100644 --- a/frontend/src/App.jsx +++ b/frontend/src/App.jsx @@ -8,6 +8,7 @@ import OrderPage from './components/pages/orderPage'; import AddToStorePage from './components/pages/addToStorePage'; import LoginPage from './components/pages/loginPage'; import Logout from './components/pages/logout'; +import ForbiddenPage from './components/pages/forbiddenPage' import './styleSite.css'; function Router(props) { @@ -18,10 +19,12 @@ export default function App() { const routes = [ { index: true, element: }, localStorage.getItem("role") === "ADMIN" && { path: 'customer', element: , label:'Покупатели'}, + localStorage.getItem("role") !== "ADMIN" && { path: 'customer', element: }, { path: 'store', element: , label: 'Магазины' }, { path: 'product', element: , label: 'Товары' }, { path: 'order', element: , label: 'Заказы'}, localStorage.getItem("role") === "ADMIN" && { path: 'addToStore', element: , label: 'Доставка'}, + localStorage.getItem("role") !== "ADMIN" && { path: 'addToStore', element: }, { path: '/login', element: }, { path: '/logout', element: } ]; diff --git a/frontend/src/components/pages/customerPage.jsx b/frontend/src/components/pages/customerPage.jsx index 3d5885f..d819984 100644 --- a/frontend/src/components/pages/customerPage.jsx +++ b/frontend/src/components/pages/customerPage.jsx @@ -28,7 +28,7 @@ function CustomerPage(){ } return(
- Отчество
- + } + {localStorage.getItem("role") !== "ADMIN" && +
+

Forbidden

+ На главную +
} ) } diff --git a/frontend/src/components/pages/forbiddenPage.jsx b/frontend/src/components/pages/forbiddenPage.jsx new file mode 100644 index 0000000..01982a7 --- /dev/null +++ b/frontend/src/components/pages/forbiddenPage.jsx @@ -0,0 +1,8 @@ +export default function ForbiddenPage(){ + return( +
+

Forbidden

+ На главную +
+ ) +} \ No newline at end of file