diff --git a/build.gradle b/build.gradle index 92f3afb..7a7209b 100644 --- a/build.gradle +++ b/build.gradle @@ -25,6 +25,10 @@ dependencies { implementation 'org.springframework.boot:spring-boot-starter-data-jpa' implementation 'com.h2database:h2:2.1.210' + implementation 'org.springframework.boot:spring-boot-starter-security' + implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6' + implementation 'com.auth0:java-jwt:4.4.0' + implementation 'org.hibernate.validator:hibernate-validator' implementation 'org.springdoc:springdoc-openapi-ui:1.6.5' diff --git a/src/main/java/com/example/springip/WebConfiguration.java b/src/main/java/com/example/springip/WebConfiguration.java index d425367..31257d6 100644 --- a/src/main/java/com/example/springip/WebConfiguration.java +++ b/src/main/java/com/example/springip/WebConfiguration.java @@ -8,6 +8,12 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; public class WebConfiguration implements WebMvcConfigurer { public static final String REST_API = "/api"; + @Override + public void addViewControllers(ViewControllerRegistry registry) { + WebMvcConfigurer.super.addViewControllers(registry); + registry.addViewController("login"); + } + @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping("/**").allowedMethods("*"); diff --git a/src/main/java/com/example/springip/lab3/configuration/PasswordEncoderConfiguration.java b/src/main/java/com/example/springip/lab3/configuration/PasswordEncoderConfiguration.java new file mode 100644 index 0000000..2efb1fa --- /dev/null +++ b/src/main/java/com/example/springip/lab3/configuration/PasswordEncoderConfiguration.java @@ -0,0 +1,14 @@ +package com.example.springip.lab3.configuration; + +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; +import org.springframework.security.crypto.password.PasswordEncoder; + +@Configuration +public class PasswordEncoderConfiguration { + @Bean + public PasswordEncoder createPasswordEncoder() { + return new BCryptPasswordEncoder(); + } +} diff --git a/src/main/java/com/example/springip/lab3/configuration/SecurityConfiguration.java b/src/main/java/com/example/springip/lab3/configuration/SecurityConfiguration.java new file mode 100644 index 0000000..79700d0 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/configuration/SecurityConfiguration.java @@ -0,0 +1,61 @@ +package com.example.springip.lab3.configuration; + +import com.example.springip.lab3.user.controller.UserSignupMvcController; +import com.example.springip.lab3.user.model.UserRole; +import com.example.springip.lab3.user.service.UserService; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; +import org.springframework.security.web.SecurityFilterChain; + + +@Configuration +@EnableWebSecurity +@EnableMethodSecurity(securedEnabled = true) +public class SecurityConfiguration { + private final Logger log = LoggerFactory.getLogger(SecurityConfiguration.class); + private static final String LOGIN_URL = "/login"; + private UserService userService; + + public SecurityConfiguration(UserService userService) { + this.userService = userService; + createAdminOnStartup(); + } + + private void createAdminOnStartup() { + final String admin = "admin"; + if (userService.findByLogin(admin) == null) { + log.info("Admin user successfully created"); + userService.createUser(admin, admin, admin, UserRole.ADMIN); + } + } + + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { + http.headers().frameOptions().sameOrigin().and() + .cors().and() + .csrf().disable() + .authorizeHttpRequests((a) -> + a.requestMatchers(LOGIN_URL, UserSignupMvcController.SIGNUP_URL) + .permitAll().anyRequest().authenticated()) + .formLogin() + .loginPage(LOGIN_URL).permitAll() + .and() + .logout().permitAll() + .logoutSuccessUrl("/") + .and() + .userDetailsService(userService); + + return http.build(); + } + + @Bean + public WebSecurityCustomizer webSecurityCustomizer() { + return (web) -> web.ignoring().requestMatchers("/css/**", "/js/**", "/templates/**", "/webjars/**"); + } +} \ No newline at end of file diff --git a/src/main/java/com/example/springip/lab3/user/controller/UserMvcController.java b/src/main/java/com/example/springip/lab3/user/controller/UserMvcController.java new file mode 100644 index 0000000..ad32709 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/controller/UserMvcController.java @@ -0,0 +1,44 @@ +package com.example.springip.lab3.user.controller; + +import com.example.springip.lab3.user.model.User; +import com.example.springip.lab3.user.model.UserDto; +import com.example.springip.lab3.user.model.UserRole; +import com.example.springip.lab3.user.service.UserService; +import org.springframework.data.domain.Page; +import org.springframework.security.access.annotation.Secured; +import org.springframework.stereotype.Controller; +import org.springframework.ui.Model; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.RequestMapping; +import org.springframework.web.bind.annotation.RequestParam; + + +import java.util.List; +import java.util.stream.IntStream; + +@Controller +@RequestMapping("/users") +public class UserMvcController { + private final UserService userService; + + public UserMvcController(UserService userService) { + this.userService = userService; + } + + @GetMapping + @Secured({UserRole.AsString.ADMIN}) + public String getUsers(@RequestParam(defaultValue = "1") int page, + @RequestParam(defaultValue = "5") int size, + Model model) { + final Page users = userService.findAllPages(page, size) + .map(UserDto::new); + model.addAttribute("users", users); + final int totalPages = users.getTotalPages(); + final List pageNumbers = IntStream.rangeClosed(1, totalPages) + .boxed() + .toList(); + model.addAttribute("pages", pageNumbers); + model.addAttribute("totalPages", totalPages); + return "users"; + } +} diff --git a/src/main/java/com/example/springip/lab3/user/controller/UserSignupMvcController.java b/src/main/java/com/example/springip/lab3/user/controller/UserSignupMvcController.java new file mode 100644 index 0000000..1995f72 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/controller/UserSignupMvcController.java @@ -0,0 +1,50 @@ +package com.example.springip.lab3.user.controller; + +import com.example.springip.lab3.user.model.User; +import com.example.springip.lab3.user.model.UserSignupDto; +import com.example.springip.lab3.user.service.UserService; +import com.example.springip.lab3.util.validation.ValidationException; +import jakarta.validation.Valid; +import org.springframework.stereotype.Controller; +import org.springframework.ui.Model; +import org.springframework.validation.BindingResult; +import org.springframework.web.bind.annotation.GetMapping; +import org.springframework.web.bind.annotation.ModelAttribute; +import org.springframework.web.bind.annotation.PostMapping; +import org.springframework.web.bind.annotation.RequestMapping; + +@Controller +@RequestMapping(UserSignupMvcController.SIGNUP_URL) +public class UserSignupMvcController { + public static final String SIGNUP_URL = "/signup"; + + private final UserService userService; + + public UserSignupMvcController(UserService userService) { + this.userService = userService; + } + + @GetMapping + public String showSignupForm(Model model) { + model.addAttribute("userDto", new UserSignupDto()); + return "signup"; + } + + @PostMapping + public String signup(@ModelAttribute("userDto") @Valid UserSignupDto userSignupDto, + BindingResult bindingResult, + Model model) { + if (bindingResult.hasErrors()) { + model.addAttribute("errors", bindingResult.getAllErrors()); + return "signup"; + } + try { + final User user = userService.createUser( + userSignupDto.getLogin(), userSignupDto.getPassword(), userSignupDto.getPasswordConfirm()); + return "redirect:/login?created=" + user.getLogin(); + } catch (ValidationException e) { + model.addAttribute("errors", e.getMessage()); + return "signup"; + } + } +} diff --git a/src/main/java/com/example/springip/lab3/user/model/User.java b/src/main/java/com/example/springip/lab3/user/model/User.java new file mode 100644 index 0000000..0eefe73 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/model/User.java @@ -0,0 +1,75 @@ +package com.example.springip.lab3.user.model; + +import jakarta.persistence.*; +import jakarta.validation.constraints.NotBlank; +import jakarta.validation.constraints.Size; + + +import java.util.Objects; + +@Entity +@Table(name = "users") +public class User { + @Id + @GeneratedValue(strategy = GenerationType.AUTO) + private Long id; + @Column(nullable = false, unique = true, length = 64) + @NotBlank + @Size(min = 3, max = 64) + private String login; + @Column(nullable = false, length = 64) + @NotBlank + @Size(min = 6, max = 64) + private String password; + private UserRole role; + + public User() { + } + + public User(String login, String password) { + this(login, password, UserRole.USER); + } + + public User(String login, String password, UserRole role) { + this.login = login; + this.password = password; + this.role = role; + } + + public Long getId() { + return id; + } + + public String getLogin() { + return login; + } + + public void setLogin(String login) { + this.login = login; + } + + public String getPassword() { + return password; + } + + public void setPassword(String password) { + this.password = password; + } + + public UserRole getRole() { + return role; + } + + @Override + public boolean equals(Object o) { + if (this == o) return true; + if (o == null || getClass() != o.getClass()) return false; + User user = (User) o; + return Objects.equals(id, user.id) && Objects.equals(login, user.login); + } + + @Override + public int hashCode() { + return Objects.hash(id, login); + } +} diff --git a/src/main/java/com/example/springip/lab3/user/model/UserDto.java b/src/main/java/com/example/springip/lab3/user/model/UserDto.java new file mode 100644 index 0000000..ae4e8fe --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/model/UserDto.java @@ -0,0 +1,31 @@ +package com.example.springip.lab3.user.model; + +public class UserDto { + private final long id; + private final String login; + private final UserRole role; + private final String password; + + public UserDto(User user) { + this.id = user.getId(); + this.login = user.getLogin(); + this.role = user.getRole(); + this.password = user.getPassword(); + } + + public long getId() { + return id; + } + + public String getLogin() { + return login; + } + + public UserRole getRole() { + return role; + } + + public String getPassword() { + return password; + } +} diff --git a/src/main/java/com/example/springip/lab3/user/model/UserRole.java b/src/main/java/com/example/springip/lab3/user/model/UserRole.java new file mode 100644 index 0000000..740e849 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/model/UserRole.java @@ -0,0 +1,20 @@ +package com.example.springip.lab3.user.model; + +import org.springframework.security.core.GrantedAuthority; + +public enum UserRole implements GrantedAuthority { + ADMIN, + USER; + + private static final String PREFIX = "ROLE_"; + + @Override + public String getAuthority() { + return PREFIX + this.name(); + } + + public static final class AsString { + public static final String ADMIN = PREFIX + "ADMIN"; + public static final String USER = PREFIX + "USER"; + } +} diff --git a/src/main/java/com/example/springip/lab3/user/model/UserSignupDto.java b/src/main/java/com/example/springip/lab3/user/model/UserSignupDto.java new file mode 100644 index 0000000..56e4b30 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/model/UserSignupDto.java @@ -0,0 +1,41 @@ +package com.example.springip.lab3.user.model; + +import jakarta.validation.constraints.NotBlank; +import jakarta.validation.constraints.Size; + + +public class UserSignupDto { + @NotBlank + @Size(min = 3, max = 64) + private String login; + @NotBlank + @Size(min = 6, max = 64) + private String password; + @NotBlank + @Size(min = 6, max = 64) + private String passwordConfirm; + + public String getLogin() { + return login; + } + + public void setLogin(String login) { + this.login = login; + } + + public String getPassword() { + return password; + } + + public void setPassword(String password) { + this.password = password; + } + + public String getPasswordConfirm() { + return passwordConfirm; + } + + public void setPasswordConfirm(String passwordConfirm) { + this.passwordConfirm = passwordConfirm; + } +} diff --git a/src/main/java/com/example/springip/lab3/user/repository/UserRepository.java b/src/main/java/com/example/springip/lab3/user/repository/UserRepository.java new file mode 100644 index 0000000..09b0feb --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/repository/UserRepository.java @@ -0,0 +1,8 @@ +package com.example.springip.lab3.user.repository; + +import com.example.springip.lab3.user.model.User; +import org.springframework.data.jpa.repository.JpaRepository; + +public interface UserRepository extends JpaRepository { + User findOneByLoginIgnoreCase(String login); +} diff --git a/src/main/java/com/example/springip/lab3/user/service/UserService.java b/src/main/java/com/example/springip/lab3/user/service/UserService.java new file mode 100644 index 0000000..70428bb --- /dev/null +++ b/src/main/java/com/example/springip/lab3/user/service/UserService.java @@ -0,0 +1,74 @@ +package com.example.springip.lab3.user.service; + +import com.example.springip.lab3.configuration.jwt.JwtException; +import com.example.springip.lab3.configuration.jwt.JwtProvider; +import com.example.springip.lab3.user.model.User; +import com.example.springip.lab3.user.model.UserDto; +import com.example.springip.lab3.user.model.UserRole; +import com.example.springip.lab3.user.repository.UserRepository; +import com.example.springip.lab3.util.validation.ValidationException; +import com.example.springip.lab3.util.validation.ValidatorUtil; +import org.springframework.data.domain.Page; +import org.springframework.data.domain.PageRequest; +import org.springframework.data.domain.Sort; +import org.springframework.security.core.userdetails.UserDetails; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.core.userdetails.UsernameNotFoundException; +import org.springframework.security.crypto.password.PasswordEncoder; +import org.springframework.stereotype.Service; + + +import java.util.Collections; +import java.util.Objects; + +@Service +public class UserService implements UserDetailsService { + private final UserRepository userRepository; + private final PasswordEncoder passwordEncoder; + private final ValidatorUtil validatorUtil; + private final JwtProvider jwtProvider; + + public UserService(UserRepository userRepository, + PasswordEncoder passwordEncoder, + ValidatorUtil validatorUtil, + JwtProvider jwtProvider) { + this.userRepository = userRepository; + this.passwordEncoder = passwordEncoder; + this.validatorUtil = validatorUtil; + this.jwtProvider = jwtProvider; + } + + public Page findAllPages(int page, int size) { + return userRepository.findAll(PageRequest.of(page - 1, size, Sort.by("id").ascending())); + } + + public User findByLogin(String login) { + return userRepository.findOneByLoginIgnoreCase(login); + } + + public User createUser(String login, String password, String passwordConfirm) { + return createUser(login, password, passwordConfirm, UserRole.USER); + } + + public User createUser(String login, String password, String passwordConfirm, UserRole role) { + if (findByLogin(login) != null) { + throw new ValidationException(String.format("User '%s' already exists", login)); + } + final User user = new User(login, passwordEncoder.encode(password), role); + validatorUtil.validate(user); + if (!Objects.equals(password, passwordConfirm)) { + throw new ValidationException("Passwords not equals"); + } + return userRepository.save(user); + } + + @Override + public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { + final User userEntity = findByLogin(username); + if (userEntity == null) { + throw new UsernameNotFoundException(username); + } + return new org.springframework.security.core.userdetails.User( + userEntity.getLogin(), userEntity.getPassword(), Collections.singleton(userEntity.getRole())); + } +} diff --git a/src/main/java/com/example/springip/lab3/util/error/AdviceController.java b/src/main/java/com/example/springip/lab3/util/error/AdviceController.java new file mode 100644 index 0000000..fc106a3 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/util/error/AdviceController.java @@ -0,0 +1,38 @@ +package com.example.springip.lab3.util.error; + +import com.example.springip.lab3.util.validation.ValidationException; +import org.springframework.context.support.DefaultMessageSourceResolvable; +import org.springframework.http.HttpStatus; +import org.springframework.http.ResponseEntity; +import org.springframework.web.bind.MethodArgumentNotValidException; +import org.springframework.web.bind.annotation.ControllerAdvice; +import org.springframework.web.bind.annotation.ExceptionHandler; +import org.springframework.web.bind.annotation.RestController; + + +import java.util.stream.Collectors; + +@ControllerAdvice(annotations = RestController.class) +public class AdviceController { + @ExceptionHandler({ + ValidationException.class + }) + public ResponseEntity handleException(Throwable e) { + return new ResponseEntity<>(e.getMessage(), HttpStatus.BAD_REQUEST); + } + + @ExceptionHandler(MethodArgumentNotValidException.class) + public ResponseEntity handleBindException(MethodArgumentNotValidException e) { + final ValidationException validationException = new ValidationException( + e.getBindingResult().getAllErrors().stream() + .map(DefaultMessageSourceResolvable::getDefaultMessage) + .collect(Collectors.toSet())); + return handleException(validationException); + } + + @ExceptionHandler(Exception.class) + public ResponseEntity handleUnknownException(Throwable e) { + e.printStackTrace(); + return new ResponseEntity<>(e.getMessage(), HttpStatus.INTERNAL_SERVER_ERROR); + } +} diff --git a/src/main/java/com/example/springip/lab3/util/validation/ValidationException.java b/src/main/java/com/example/springip/lab3/util/validation/ValidationException.java new file mode 100644 index 0000000..7c597ac --- /dev/null +++ b/src/main/java/com/example/springip/lab3/util/validation/ValidationException.java @@ -0,0 +1,13 @@ +package com.example.springip.lab3.util.validation; + +import java.util.Set; + +public class ValidationException extends RuntimeException { + public ValidationException(Set errors) { + super(String.join("\n", errors)); + } + + public ValidationException(String error) { + super(error); + } +} diff --git a/src/main/java/com/example/springip/lab3/util/validation/ValidatorUtil.java b/src/main/java/com/example/springip/lab3/util/validation/ValidatorUtil.java new file mode 100644 index 0000000..b734dc3 --- /dev/null +++ b/src/main/java/com/example/springip/lab3/util/validation/ValidatorUtil.java @@ -0,0 +1,27 @@ +package com.example.springip.lab3.util.validation; + +import jakarta.validation.ConstraintViolation; +import jakarta.validation.Validation; +import jakarta.validation.Validator; +import org.springframework.stereotype.Component; + +import java.util.Set; +import java.util.stream.Collectors; + +@Component +public class ValidatorUtil { + private final Validator validator; + + public ValidatorUtil() { + this.validator = Validation.buildDefaultValidatorFactory().getValidator(); + } + + public void validate(T object) { + final Set> errors = validator.validate(object); + if (!errors.isEmpty()) { + throw new ValidationException(errors.stream() + .map(ConstraintViolation::getMessage) + .collect(Collectors.toSet())); + } + } +} diff --git a/src/main/resources/templates/login.html b/src/main/resources/templates/login.html new file mode 100644 index 0000000..5c9f583 --- /dev/null +++ b/src/main/resources/templates/login.html @@ -0,0 +1,30 @@ + + + +
+
+ Пользователь не найден или пароль указан не верно +
+
+ Выход успешно произведен +
+
+ Пользователь '' успешно создан +
+
+
+ +
+
+ +
+ + Регистрация +
+
+ + \ No newline at end of file diff --git a/src/main/resources/templates/signup.html b/src/main/resources/templates/signup.html new file mode 100644 index 0000000..8cd75f5 --- /dev/null +++ b/src/main/resources/templates/signup.html @@ -0,0 +1,28 @@ + + + +
+
+
+
+ +
+
+ +
+
+ +
+
+ + Назад +
+
+
+ + \ No newline at end of file diff --git a/src/main/resources/templates/users.html b/src/main/resources/templates/users.html new file mode 100644 index 0000000..0fef22a --- /dev/null +++ b/src/main/resources/templates/users.html @@ -0,0 +1,37 @@ + + + +
+
+ + + + + + + + + + + + + + + + + +
#IDЛогинРоль
+
+ +
+ + \ No newline at end of file