-
Notifications
You must be signed in to change notification settings - Fork 2
feat: Add application owners #13
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,6 +2,7 @@ | |
|
|
||
| import com.github.wellch4n.oops.data.User; | ||
| import com.github.wellch4n.oops.enums.UserRole; | ||
| import com.github.wellch4n.oops.objects.AuthUserPrincipal; | ||
| import com.github.wellch4n.oops.objects.CreateUserRequest; | ||
| import com.github.wellch4n.oops.objects.Result; | ||
| import com.github.wellch4n.oops.objects.UpdateUserRequest; | ||
|
|
@@ -36,7 +37,8 @@ public Result<List<User>> listUsers() { | |
| @GetMapping("/me") | ||
| @PreAuthorize("isAuthenticated()") | ||
| public Result<User> me(org.springframework.security.core.Authentication authentication) { | ||
| return userService.findByUsername(authentication.getName()) | ||
| AuthUserPrincipal principal = (AuthUserPrincipal) authentication.getPrincipal(); | ||
| return userService.findById(principal.userId()) | ||
| .map(Result::success) | ||
| .orElse(Result.failure("用户不存在")); | ||
|
Comment on lines
39
to
43
|
||
| } | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| package com.github.wellch4n.oops.objects; | ||
|
|
||
| import com.github.wellch4n.oops.data.Application; | ||
| import java.time.LocalDateTime; | ||
|
|
||
| public record ApplicationResponse( | ||
| String id, | ||
| LocalDateTime createdTime, | ||
| String name, | ||
| String description, | ||
| String namespace, | ||
| String owner, | ||
| String ownerName | ||
| ) { | ||
| public static ApplicationResponse from(Application application, String ownerName) { | ||
| return new ApplicationResponse( | ||
| application.getId(), | ||
| application.getCreatedTime(), | ||
| application.getName(), | ||
| application.getDescription(), | ||
| application.getNamespace(), | ||
| application.getOwner(), | ||
| ownerName | ||
| ); | ||
| } | ||
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| package com.github.wellch4n.oops.objects; | ||
|
|
||
| import java.security.Principal; | ||
|
|
||
| public record AuthUserPrincipal(String userId, String username) implements Principal { | ||
|
|
||
| @Override | ||
| public String getName() { | ||
| return username; | ||
| } | ||
| } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
userIdcan still end upnullhere (e.g., legacy token withoutuserIdclaim + username not found). The filter still authenticates the request with anAuthUserPrincipal(null, username), which will later cause failures (e.g.,/api/users/mecallingfindById(null)throws) and may allow creating apps with an unverified owner. Consider treating the token as invalid whenuserIdcannot be resolved (skip setting authentication), or explicitly fail the request, rather than authenticating with a null userId.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@copilot apply changes based on this feedback