Merge pull request #335 from esuomi/fix_authorization_for_graphql_fet…

…chers replace old style role checks with delegation to userContextService
entur · Jun 6, 2024 · ed7b9aa · ed7b9aa
2 parents 44610e2 + 1e1ecbe
commit ed7b9aa
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 7 deletions.
diff --git a/src/main/java/no/entur/uttu/graphql/fetchers/CodespaceUpdater.java b/src/main/java/no/entur/uttu/graphql/fetchers/CodespaceUpdater.java
@@ -15,15 +15,15 @@
 
 package no.entur.uttu.graphql.fetchers;
 
-import static no.entur.uttu.graphql.GraphQLNames.*;
-import static org.rutebanken.helper.organisation.AuthorizationConstants.ROLE_ROUTE_DATA_ADMIN;
+import static no.entur.uttu.graphql.GraphQLNames.FIELD_INPUT;
+import static no.entur.uttu.graphql.GraphQLNames.FIELD_XMLNS;
+import static no.entur.uttu.graphql.GraphQLNames.FIELD_XMLNS_URL;
 
 import graphql.schema.DataFetcher;
 import graphql.schema.DataFetchingEnvironment;
 import no.entur.uttu.graphql.ArgumentWrapper;
 import no.entur.uttu.model.Codespace;
 import no.entur.uttu.repository.CodespaceRepository;
-import no.entur.uttu.util.Preconditions;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Component;
@@ -37,7 +37,7 @@ public class CodespaceUpdater implements DataFetcher<Codespace> {
   private CodespaceRepository repository;
 
   @Override
-  @PreAuthorize("hasRole('" + ROLE_ROUTE_DATA_ADMIN + "')")
+  @PreAuthorize("@userContextService.isAdmin()")
   public Codespace get(DataFetchingEnvironment env) {
     ArgumentWrapper input = new ArgumentWrapper(env.getArgument(FIELD_INPUT));
     String codespaceXmlns = input.get(FIELD_XMLNS);

diff --git a/src/main/java/no/entur/uttu/graphql/fetchers/ProviderUpdater.java b/src/main/java/no/entur/uttu/graphql/fetchers/ProviderUpdater.java
@@ -17,10 +17,8 @@
 
 import static no.entur.uttu.graphql.GraphQLNames.FIELD_CODE;
 import static no.entur.uttu.graphql.GraphQLNames.FIELD_CODE_SPACE_XMLNS;
-import static no.entur.uttu.graphql.GraphQLNames.FIELD_ID;
 import static no.entur.uttu.graphql.GraphQLNames.FIELD_INPUT;
 import static no.entur.uttu.graphql.GraphQLNames.FIELD_NAME;
-import static org.rutebanken.helper.organisation.AuthorizationConstants.ROLE_ROUTE_DATA_ADMIN;
 
 import graphql.schema.DataFetcher;
 import graphql.schema.DataFetchingEnvironment;
@@ -46,7 +44,7 @@ public class ProviderUpdater implements DataFetcher<Provider> {
   private CodespaceRepository codespaceRepository;
 
   @Override
-  @PreAuthorize("hasRole('" + ROLE_ROUTE_DATA_ADMIN + "')")
+  @PreAuthorize("@userContextService.isAdmin()")
   public Provider get(DataFetchingEnvironment env) {
     ArgumentWrapper input = new ArgumentWrapper(env.getArgument(FIELD_INPUT));
     String code = input.get(FIELD_CODE);