implement /internal/applications endpoint #600
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- add new `InternalSecurityConfig` filter chain (defined as order: 2) - created DELETE/POST/GET methods for /internal/session - move some models from vip-api to vip-core - create specific class for `CurrentUserProvider` service
- add a new `SessionAuthenticationProvider` with associated Filter/Token - refractor `ApikeyAuthenticationProvider` and `SessionAuthenticationProvider` into `AbstractAuthenticationProvider` - POST /internal/session now return Session object as valid response - rename `SpringApiUser` to `SpringPrincipalUser`
- make COOKIES_SESSION and COOKIES_USER `httpOnly` -- adapt GWT code to support httpOnly on server implementation - cookies will set as `secure` only if *apache.sslport* != 80 - edit sign-in.js/home.js endpoints from */rest/session* to */internal/session* for sign-in and retrieving current session instead of cookies (due to **httpOnly**)
- VIPRemoval and VIPCheckRemoval created annotations
- all unsafe methods are concerned under /internal/** except for /internal/session (which creates the token)
- refactor `SessionControler` to handle http/cookie related objects instead of `SessionBusiness` - make signIn define SecurityContextHolder
- new method `setAdminContext` to define user context in "simple business" calls - prepare others tests for ApplicationBusiness next update
- CommonBusiness will be used in the backend refactoring - new CorePermission class to handle basic permissions (role checking..) - SessionAuthenticationProvider fill user groups in SpringSecurityContext
- new `PageBuilder` that can generate `PrecisePage` objects for pagination
- update ApplicationBusiness to handle permissions - add IT related - new `VIPExternalSafe` annotation to precise method that can safely be used inside a controller
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request depends on /internal/session pull request.
What's new !
Business Logic Changes
Implementation of the new "base" class of business components:
CommonBusiness.This class is supposed to be inherited from every business (the change will be progressive when will implement other endpoints). However, this class contain
ConfigurationBusiness, for the moment that's the only "exception". (=ConfigurationBusiness cannot inherit CommonBusiness due to circular problem)Permissions
The new
CorePermissions(present in CommonBusiness) class implement few methods to check user roles and matching of privates users groups.Annotations
Implementation of the
VipExternalSafeannotation to mark methods that are considered "safe" to be used inside controller (=they perform permissions checks on returned values).Application Controller
This new controller implement all of this methods:
The
GET /applicationssupport basic pagination and filtering usinggroup,offsetandlimitquery parameters. The implementation of pagination is made by the newPageBuilderandPrecisePageclasses.Related tests are also presents in
ApplicationControllerIT.Application permissions