Examples with RolesAllowed javax.annotation.security.RolesAllowed used on opensource projects

Example 46 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class Discounts method modify.

@PUT
@Transactional
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed({ ADMIN, STORE_ADMIN })
public Discount modify(@Context SecurityContext securityContext, Discount discount) {
    Discount originalDiscount = entityManager.find(Discount.class, discount.getId());
    checkNotNull(originalDiscount);
    if (isAdminUser(securityContext) || isOwner(securityContext, discount.getOwner())) {
        discount.setPresentationByLocale(originalDiscount.getPresentationByLocale());
        return entityManager.merge(discount);
    } else
        throw new WebApplicationException(Response.Status.FORBIDDEN);
}

Example 47 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class SKUs method findPresentationsLocales.

@GET
@Path("/{skuId}/presentationslocales")
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed({ ADMIN, STORE_ADMIN, ADMIN_READONLY })
public Set<String> findPresentationsLocales(@Context SecurityContext securityContext, @PathParam("skuId") @NotNull Long skuId) {
    SKU sku = entityManager.find(SKU.class, skuId);
    checkNotNull(sku);
    if (!isAdminUser(securityContext) && !isOwner(securityContext, sku.getOwner()))
        throw new WebApplicationException(Response.Status.FORBIDDEN);
    return sku.getPresentationByLocale().keySet();
}

Example 48 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class Medias method upload.

@POST
@Consumes("multipart/form-data")
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed(ADMIN)
@Path("/{type}/{id}/{locale}/upload")
public void upload(@Context HttpServletRequest request, @NotNull @PathParam("type") String itemType, @NotNull @PathParam("id") Long itemId, @NotNull @PathParam("locale") String locale) {
    try {
        ServletFileUpload upload = new ServletFileUpload();
        FileItemIterator iterator = upload.getItemIterator(request);
        while (iterator.hasNext()) {
            FileItemStream item = iterator.next();
            java.nio.file.Path itemBasePath = getBasePath().resolve(itemType).resolve(itemId.toString()).resolve(locale);
            if (!Files.exists(itemBasePath))
                Files.createDirectories(itemBasePath);
            java.nio.file.Path filePath = itemBasePath.resolve(item.getName());
            Files.copy(item.openStream(), filePath, StandardCopyOption.REPLACE_EXISTING);
            LOG.info("File written to " + filePath);
        }
    } catch (IOException | FileUploadException e) {
        LOG.error("Could not handle upload of file with type: " + itemType + " and id: " + itemId, e);
        throw new WebApplicationException(Response.Status.INTERNAL_SERVER_ERROR);
    }
}

Example 49 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class Orders method find.

@GET
@Path("/{orderId}")
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed({ ADMIN, ADMIN_READONLY, USER })
public Order find(@Context SecurityContext securityContext, @PathParam("orderId") @NotNull Long orderId, @QueryParam("enhanced") Boolean enhanced) {
    Order order = entityManager.find(Order.class, orderId);
    if (securityContext.isUserInRole(USER) && !securityContext.isUserInRole(ADMIN)) {
        User authenticatedUser = userFinder.findByLogin(securityContext.getUserPrincipal().getName());
        if (!order.getUser().equals(authenticatedUser)) {
            throw new WebApplicationException(Response.Status.UNAUTHORIZED);
        }
    }
    if (enhanced != null && enhanced) {
        orderFinder.enhanceOrder(order);
    }
    checkNotNull(order);
    return order;
}

Example 50 with RolesAllowed

use of javax.annotation.security.RolesAllowed in project jeeshop by remibantos.

the class MailTemplates method delete.

@DELETE
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
@RolesAllowed(ADMIN)
@Transactional
@Path("/{id}")
public void delete(@PathParam("id") Long id) {
    MailTemplate mailTemplate = entityManager.find(MailTemplate.class, id);
    checkNotNull(mailTemplate);
    entityManager.remove(mailTemplate);
}