@Test @WithMockUser(username = ADMIN_USERNAME, roles = ROLE_ADMIN) void updateUserDetailsWillDelegate_WhenRequestingUserIsAdmin() throws Exception { when(usersReadService.getById(ORG_2_USER_1.getId())).thenReturn(ORG_2_USER_1); mockMvc.perform(put("/api/users/{userId}", ORG_2_USER_1.getId()) .contentType(APPLICATION_JSON) .content(objectMapper.writeValueAsString(new UpdateUserRequest("display-name-change", "email-change", "password-change")))) .andExpect(status().isOk()); verify(usersService).updateUser(ADMIN_USER.getId(), ORG_2_USER_1.getId(), "email-change", "display-name-change", "password-change"); }
@PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") public void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request) { usersService.updateUser(requestingUser.getId(), userId, request.getEmail(), request.getDisplayName(), request.getPassword()); }
UsersController { @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") public void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request) { usersService.updateUser(requestingUser.getId(), userId, request.getEmail(), request.getDisplayName(), request.getPassword()); } }
UsersController { @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") public void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request) { usersService.updateUser(requestingUser.getId(), userId, request.getEmail(), request.getDisplayName(), request.getPassword()); } @Autowired  UsersController(DtoConverter dtoConverter,
                           UsersService usersService,
                           UsersReadService usersReadService); }
UsersController { @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") public void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request) { usersService.updateUser(requestingUser.getId(), userId, request.getEmail(), request.getDisplayName(), request.getPassword()); } @Autowired  UsersController(DtoConverter dtoConverter,
                           UsersService usersService,
                           UsersReadService usersReadService); @GetMapping @ApiOperation(produces = APPLICATION_JSON_VALUE, value = "Retrieves entire user list for all organisations") @AdminOnly List<UserResponse> getAllUsers(); @GetMapping("/{userId}") @ApiOperation(produces = APPLICATION_JSON_VALUE, value = "Retrieves user details") @PostAuthorize("hasRole('ADMIN') or returnObject.organizationId == #requestingUser.organizationId") UserResponse getUser(User requestingUser, @PathVariable UUID userId); @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request); }
UsersController { @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") public void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request) { usersService.updateUser(requestingUser.getId(), userId, request.getEmail(), request.getDisplayName(), request.getPassword()); } @Autowired  UsersController(DtoConverter dtoConverter,
                           UsersService usersService,
                           UsersReadService usersReadService); @GetMapping @ApiOperation(produces = APPLICATION_JSON_VALUE, value = "Retrieves entire user list for all organisations") @AdminOnly List<UserResponse> getAllUsers(); @GetMapping("/{userId}") @ApiOperation(produces = APPLICATION_JSON_VALUE, value = "Retrieves user details") @PostAuthorize("hasRole('ADMIN') or returnObject.organizationId == #requestingUser.organizationId") UserResponse getUser(User requestingUser, @PathVariable UUID userId); @PutMapping("/{userId}") @ApiOperation("Update an organization user's details") @PreAuthorize("#requestingUser.id == #userId or hasPermission(#userId, 'User', 'update')") void updateUser(User requestingUser, @PathVariable UUID userId, @RequestBody @Valid UpdateUserRequest request);  }