AMM-1239 : Role based broken access control

pom.xml

@@ -245,6 +245,10 @@
 			<version>0.12.6</version>
 			<scope>runtime</scope>
 		</dependency>
+		<dependency>
+    		<groupId>org.springframework.boot</groupId>
+    		<artifactId>spring-boot-starter-security</artifactId>
+		</dependency>
 	</dependencies>
 
 

src/main/java/com/iemr/ecd/controller/dataupload/DataUploadController.java

@@ -25,6 +25,7 @@
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -42,6 +43,7 @@
 
 @RestController
 @CrossOrigin()
+@PreAuthorize("hasRole('SUPERVISOR')")
 public class DataUploadController {
 
 	@Autowired

src/main/java/com/iemr/ecd/repository/masters/RoleRepo.java

@@ -23,7 +23,9 @@
 
 import java.util.List;
 
+import org.springframework.data.jpa.repository.Query;
 import org.springframework.data.repository.CrudRepository;
+import org.springframework.data.repository.query.Param;
 import org.springframework.stereotype.Repository;
 
 import com.iemr.ecd.dao.masters.Role;
@@ -32,5 +34,6 @@
 public interface RoleRepo extends CrudRepository<Role, Integer> {
 
 	List<Role> findByPsmIdAndDeleted(Integer psmId, Boolean deleted);
-
+	@Query(nativeQuery = true,value = "select rolename from m_role where roleid in (select roleid from m_userservicerolemapping where userid=:userID)")
+	String getRoleNamebyUserId(@Param("userID") Long userID);
 }

src/main/java/com/iemr/ecd/service/masters/MasterServiceImpl.java

@@ -228,6 +228,21 @@ public List<Frequency> getFrequency() {
 	public List<V_GetUserlangmapping> getLanguageByUserId(Integer userId) throws ECDException {
 		return v_GetUserlangmappingRepo.findByUserId(userId);
 	}
+
+	public String getUserRole(Long userId) {
+		if (null == userId || userId <= 0) {
+			throw new IllegalArgumentException("Invalid User ID : " + userId);
+		}
+		try {
+			String role = roleRepo.getRoleNamebyUserId(userId);
+			if (null == role || role.trim().isEmpty()) {
+				throw new ECDException("No role found for userId : " + userId);
+			}
+			return role;
+		} catch (Exception e) {
+			throw new ECDException("Failed to retrieverole for usedId : " + userId + " error : " + e.getMessage());
+		}
+	}
 
 
 	//gender master

src/main/java/com/iemr/ecd/utils/advice/exception_handler/CustomAccessDeniedHandler.java

@@ -0,0 +1,28 @@
+package com.iemr.ecd.utils.advice.exception_handler;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.security.web.access.AccessDeniedHandler;
+import org.springframework.stereotype.Component;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.io.IOException;
+import java.util.Map;
+
+@Component
+public class CustomAccessDeniedHandler implements AccessDeniedHandler {
+
+	private static final ObjectMapper mapper = new ObjectMapper();
+    @Override
+    public void handle(HttpServletRequest request,
+                       HttpServletResponse response,
+                       AccessDeniedException accessDeniedException) throws IOException {
+        response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403
+        response.setContentType("application/json");
+        Map<String, String> errorResponse = Map.of("error" , "Forbidden",
+        		"message","Access denied");
+        response.getWriter().write(mapper.writeValueAsString(errorResponse));
+    }
+}

src/main/java/com/iemr/ecd/utils/advice/exception_handler/CustomAuthenticationEntryPoint.java

@@ -0,0 +1,23 @@
+package com.iemr.ecd.utils.advice.exception_handler;
+
+import java.io.IOException;
+
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.stereotype.Component;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+
+@Component
+public class CustomAuthenticationEntryPoint implements AuthenticationEntryPoint {
+
+    @Override
+    public void commence(HttpServletRequest request,
+                         HttpServletResponse response,
+                         AuthenticationException authException) throws IOException {
+        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); // 401
+        response.setContentType("application/json");
+        response.getWriter().write("{\"error\": \"Unauthorized\", \"message\": \"" + authException.getMessage() + "\"}");
+    }
+}

src/main/java/com/iemr/ecd/utils/mapper/JwtUtil.java

@@ -59,7 +59,7 @@ public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
 		return claims != null ? claimsResolver.apply(claims) : null;
 	}
 
-	private Claims extractAllClaims(String token) {
+	public Claims extractAllClaims(String token) {
 		return Jwts.parser()
 			.verifyWith(getSigningKey())
 			.build()

src/main/java/com/iemr/ecd/utils/mapper/RoleAuthenticationFilter.java

@@ -0,0 +1,91 @@
+package com.iemr.ecd.utils.mapper;
+
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import com.iemr.ecd.service.masters.MasterServiceImpl;
+import com.iemr.ecd.utils.constants.Constants;
+import com.iemr.ecd.utils.redis.RedisStorage;
+
+import io.jsonwebtoken.Claims;
+import io.jsonwebtoken.io.IOException;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+@Component
+public class RoleAuthenticationFilter extends OncePerRequestFilter {
+	Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName());
+
+	@Autowired
+    private JwtUtil jwtUtil;
+
+    @Autowired
+    private RedisStorage redisService;
+
+    @Autowired
+    private MasterServiceImpl userService;
+
+	@Override
+	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
+			throws ServletException, IOException, java.io.IOException {
+		try {
+			String jwtFromCookie = getJwtTokenFromCookies(request);
+			String jwtFromHeader = request.getHeader(Constants.JWT_TOKEN);
+
+			String jwtToken = jwtFromCookie != null ? jwtFromCookie : jwtFromHeader;
+			if(null == jwtToken || jwtToken.trim().isEmpty()) {
+				filterChain.doFilter(request, response);
+				return;
+			}
+			Claims extractAllClaims = jwtUtil.extractAllClaims(jwtToken);
+			if(null == extractAllClaims) {
+				filterChain.doFilter(request, response);
+				return;
+			}
+			Object userIdObj = extractAllClaims.get("userId");
+			String userId = userIdObj != null ? userIdObj.toString() : null;
+
+			String authRole = redisService.getUserRoleFromCache(Long.valueOf(userId));
+			if (authRole == null) {
+				String role = userService.getUserRole(Long.valueOf(userId));
+				authRole = "ROLE_" + role.toUpperCase();
+				redisService.cacheUserRole(Long.valueOf(userId), authRole);
+			}
+
+			List<GrantedAuthority> authorities = List.of(new SimpleGrantedAuthority(authRole));
+
+			UsernamePasswordAuthenticationToken auth = new UsernamePasswordAuthenticationToken(userId, null,
+					authorities);
+			SecurityContextHolder.getContext().setAuthentication(auth);
+		} catch (Exception e) {
+			logger.error("Authentication filter error for request {}: {}", request.getRequestURI(), e.getMessage());
+			SecurityContextHolder.clearContext();
+		} finally {
+			filterChain.doFilter(request, response);
+		}
+
+	}
+    private String getJwtTokenFromCookies(HttpServletRequest request) {
+		Cookie[] cookies = request.getCookies();
+		if (cookies != null) {
+			for (Cookie cookie : cookies) {
+				if (cookie.getName().equalsIgnoreCase(Constants.JWT_TOKEN)) {
+					return cookie.getValue();
+				}
+			}
+		}
+		return null;
+	}
+
+}

src/main/java/com/iemr/ecd/utils/mapper/SecurityConfig.java

@@ -0,0 +1,48 @@
+package com.iemr.ecd.utils.mapper;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
+
+import com.iemr.ecd.utils.advice.exception_handler.CustomAccessDeniedHandler;
+import com.iemr.ecd.utils.advice.exception_handler.CustomAuthenticationEntryPoint;
+
+@Configuration
+@EnableMethodSecurity
+@EnableWebSecurity
+public class SecurityConfig {
+	private final RoleAuthenticationFilter roleAuthenticationFilter;
+	private final CustomAuthenticationEntryPoint customAuthenticationEntryPoint;
+	private final CustomAccessDeniedHandler customAccessDeniedHandler;
+
+	public SecurityConfig(RoleAuthenticationFilter roleAuthenticationFilter,
+	                      CustomAuthenticationEntryPoint customAuthenticationEntryPoint,
+	                      CustomAccessDeniedHandler customAccessDeniedHandler) {
+	    this.roleAuthenticationFilter = roleAuthenticationFilter;
+	    this.customAuthenticationEntryPoint = customAuthenticationEntryPoint;
+	    this.customAccessDeniedHandler = customAccessDeniedHandler;
+	}
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))
+            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+            .authorizeHttpRequests(auth -> auth
+                .requestMatchers("/user/*").permitAll()
+                .anyRequest().authenticated()
+            ).exceptionHandling(ex -> ex
+                    .authenticationEntryPoint(customAuthenticationEntryPoint)
+                    .accessDeniedHandler(customAccessDeniedHandler)
+                )
+            .addFilterBefore(roleAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
+
+        return http.build();
+    }
+}

src/main/java/com/iemr/ecd/utils/redis/RedisStorage.java

@@ -21,13 +21,16 @@
 */
 package com.iemr.ecd.utils.redis;
 
+import java.time.Duration;
+
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.data.redis.connection.RedisConnection;
 import org.springframework.data.redis.connection.RedisStringCommands.SetOption;
 import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
+import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.data.redis.core.types.Expiration;
 import org.springframework.stereotype.Component;
 
@@ -94,4 +97,24 @@ public void updateConcurrentSessionObject(String value) {
 
 		}
 	}
+	@Autowired
+    private RedisTemplate<String, String> redisTemplate;
+
+    public void cacheUserRole(Long userId, String role) {
+    	try {
+    		redisTemplate.opsForValue().set("role:" + userId, role, Duration.ofHours(1));
+    	}catch (Exception e) {
+    		logger.warn("Failed to cache role for user {} : {} ", userId, e.getMessage());
+		}
+
+    }
+
+	public String getUserRoleFromCache(Long userId) {
+		try {
+			return redisTemplate.opsForValue().get("role:" + userId);
+		} catch (Exception e) {
+			logger.warn("Failed to retrieve cached role for user {} : {} ", userId, e.getMessage());
+			return null;
+		}
+	}
 }