marcel/familienarchiv
1
0
Fork 0
Code Issues 114 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat(persons): add @RequirePermission(WRITE_ALL) to write endpoints

Browse Source 
POST /api/persons, PUT /api/persons/{id}, POST /api/persons/{id}/merge
now return 403 for READ_ALL-only users.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Marcel
2026-03-29 19:34:35 +02:00
parent 9f73c2ee4a
commit 93107e7c59
2 changed files with 45 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
backend/src/main/java/org/raddatz/familienarchiv/controller/PersonController.java
View File

@@ -7,6 +7,8 @@ import java.util.UUID;
import org.raddatz.familienarchiv.dto.PersonUpdateDTO;
import org.raddatz.familienarchiv.model.Document;
import org.raddatz.familienarchiv.model.Person;
import org.raddatz.familienarchiv.security.Permission;
import org.raddatz.familienarchiv.security.RequirePermission;
import org.raddatz.familienarchiv.service.DocumentService;
import org.raddatz.familienarchiv.service.PersonService;
import org.springframework.http.HttpStatus;
@@ -52,6 +54,7 @@ public class PersonController {
}
@PostMapping
@RequirePermission(Permission.WRITE_ALL)
public ResponseEntity<Person> createPerson(@RequestBody Map<String, String> body) {
String firstName = body.get("firstName");
String lastName = body.get("lastName");
@@ -62,6 +65,7 @@ public class PersonController {
}
@PutMapping("/{id}")
@RequirePermission(Permission.WRITE_ALL)
public ResponseEntity<Person> updatePerson(@PathVariable UUID id, @RequestBody PersonUpdateDTO dto) {
if (dto.getFirstName() == null || dto.getFirstName().isBlank()
|| dto.getLastName() == null || dto.getLastName().isBlank()) {
@@ -74,6 +78,7 @@ public class PersonController {
@PostMapping("/{id}/merge")
@ResponseStatus(HttpStatus.NO_CONTENT)
@RequirePermission(Permission.WRITE_ALL)
public void mergePerson(@PathVariable UUID id, @RequestBody Map<String, String> body) {
String targetIdStr = body.get("targetPersonId");
if (targetIdStr == null || targetIdStr.isBlank()) {