marcel/familienarchiv
1
0
Fork 0
Code Issues 105 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

docs(stammbaum): document intentional auth design on RelationshipController GET endpoints

Browse Source 
Addresses @markus/@nora suggestion: makes explicit that the missing
@RequirePermission on read endpoints is intentional — all authenticated
family members may read the family graph; unauthenticated access is still
blocked by Spring Security's anyRequest().authenticated() rule.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-04-28 11:38:28 +02:00
committed by marcel
parent b6253cb023
commit 6074ac396f
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
backend/src/main/java/org/raddatz/familienarchiv/relationship/RelationshipController.java
View File

@@ -34,6 +34,9 @@ public class RelationshipController {
private final RelationshipService relationshipService; private final RelationshipService relationshipService;
// READ endpoints carry no @RequirePermission: all authenticated users may read the family graph.
// Unauthenticated requests are rejected by Spring Security's anyRequest().authenticated() rule.
@GetMapping("/api/network") @GetMapping("/api/network")
public NetworkDTO getNetwork() { public NetworkDTO getNetwork() {
return relationshipService.getFamilyNetwork(); return relationshipService.getFamilyNetwork();