43 add security compatibility

pom.xml

@@ -4,8 +4,8 @@
 	<modelVersion>4.0.0</modelVersion>
 
 	<groupId>com.revature</groupId>
-	<artifactId>interview-evaluations</artifactId>
-	<version>0.0.1-SNAPSHOT</version>
+                    <artifactId>interview-evaluations</artifactId>     
+                    <version>0.0.1-SNAPSHOT</version>
 	<packaging>jar</packaging>
 
 	<name>interview-evaluations</name>
@@ -75,10 +75,6 @@
 		</dependency>
 
     	<!-- Spring Boot -->
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-web</artifactId>
-		</dependency>
         <dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-test</artifactId>
@@ -113,7 +109,44 @@
             <artifactId>spring-boot-devtools</artifactId>
             <optional>true</optional>
         </dependency>
-
+	 <dependency>
+	  <groupId>org.springframework.mobile</groupId>
+	  <artifactId>spring-mobile-device</artifactId>
+	  <version>1.1.5.RELEASE</version>
+	  <type>jar</type>
+	 </dependency>
+	 <dependency>
+	  <groupId>org.springframework.security</groupId>
+	  <artifactId>spring-security-core</artifactId>
+	  <version>4.2.1.RELEASE</version>
+	  <type>jar</type>
+	 </dependency>
+	 <dependency>
+	  <groupId>org.springframework.security</groupId>
+	  <artifactId>spring-security-web</artifactId>
+	  <version>4.2.1.RELEASE</version>
+	  <type>jar</type>
+	 </dependency>
+	 <dependency>
+	  <groupId>io.jsonwebtoken</groupId>
+	  <artifactId>jjwt</artifactId>
+	  <version>0.7.0</version>
+	  <type>jar</type>
+	 </dependency>
+	 <dependency>
+	  <groupId>org.springframework.security</groupId>
+	  <artifactId>spring-security-config</artifactId>
+	  <version>4.2.1.RELEASE</version>
+	  <type>jar</type>
+	 </dependency>
+ <!--        
+                    <dependency>
+                        <groupId>com.revsecurity</groupId>
+                        <artifactId>RevatureSecurity</artifactId>
+                        <version>1.0-SNAPSHOT</version>
+                        <scope>compile</scope>
+                    </dependency>
+                        -->
 	</dependencies>
 
 
@@ -138,6 +171,10 @@
             <name>JBoss Maven Release Repository</name>
             <url>https://repository.jboss.org/nexus/content/repositories/releases</url>
         </repository>
+
+
+
+
     </repositories>
 
     <pluginRepositories>

src/main/java/com/revature/InterviewEvaluationsApplication.java

@@ -10,9 +10,7 @@
 @SpringBootApplication
 public class InterviewEvaluationsApplication {
 
-	public static void main(String[] args) {
-		SpringApplication.run(InterviewEvaluationsApplication.class, args);
-
-	}
-
+    public static void main(String[] args) {
+        SpringApplication.run(InterviewEvaluationsApplication.class, args);
+    }
 }

src/main/java/com/revature/DataSourceConfig.java → src/main/java/com/revature/config/DataSourceConfig.java

@@ -1,4 +1,4 @@
-package com.revature;
+package com.revature.config;
 
 import javax.activation.DataSource;
 

src/main/java/com/revature/WebConfig.java → src/main/java/com/revature/config/WebConfig.java

@@ -1,4 +1,4 @@
-package com.revature;
+package com.revature.config;
 
 import java.time.LocalDate;
 import org.springframework.context.annotation.Configuration;

src/main/java/com/revature/config/WebSecurityConfig.java

@@ -0,0 +1,86 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.config;
+
+import com.revature.security.JwtAuthenticationEntryPoint;
+import com.revature.security.extra.JwtAuthenticationFilter;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+
+/**
+ *
+ * @author FayeRedd
+ */
+
+@SuppressWarnings("SpringJavaAutowiringInspection")
+@Configuration
+@EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true)
+public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
+
+    @Autowired
+    private JwtAuthenticationEntryPoint unauthorizedHandler;
+
+    @Autowired
+    private UserDetailsService userDetailsService;
+
+    @Autowired
+    public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception{
+        authenticationManagerBuilder
+                .userDetailsService(this.userDetailsService)
+                .passwordEncoder(passwordEncoder());
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+
+    @Bean
+    public JwtAuthenticationFilter authenticationFilterBean(){
+        return new JwtAuthenticationFilter();
+    }
+
+    @Override
+    protected void configure(HttpSecurity httpSecurity) throws Exception{
+        httpSecurity
+                    .csrf().disable()
+                    .exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
+                .and()
+                    .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+                .and()
+                    .authorizeRequests()
+                    .antMatchers(
+                            HttpMethod.GET,
+                            "/",
+                            "/*.html",
+                            "/favicon.ico",
+                            "/**/*.html",
+                            "/**/*.css",
+                            "/**/*.js"
+                    ).permitAll()
+                    .antMatchers("/auth/**").permitAll()
+                    .anyRequest().authenticated();
+
+        httpSecurity
+                    .addFilterBefore(authenticationFilterBean(), UsernamePasswordAuthenticationFilter.class);
+
+        httpSecurity.headers().cacheControl();
+
+    }
+}

src/main/java/com/revature/controllers/BatchController.java

@@ -6,6 +6,7 @@
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.CrossOrigin;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -16,6 +17,7 @@
 @CrossOrigin
 @RestController
 @RequestMapping(value = "/api/v1/")
+@PreAuthorize("hasRole('ADMIN')")
 public class BatchController {
 
 	@Autowired

src/main/java/com/revature/repositories/extra/UserRepository.java

@@ -0,0 +1,22 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.repositories.extra;
+
+import com.revature.security.extra.model.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+/**
+ *
+ * @author FayeRedd
+ */
+
+@Repository
+public interface UserRepository extends JpaRepository<User, Long> {
+
+    User findByUsername(String username);
+
+}

src/main/java/com/revature/security/JwtAuthenticationEntryPoint.java

@@ -0,0 +1,29 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.security;
+
+import java.io.IOException;
+import java.io.Serializable;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.security.core.AuthenticationException;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.stereotype.Component;
+
+/**
+ *
+ * @author FayeRedd
+ */
+@Component
+public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint, Serializable{
+
+    private static final long serialVersionUID = -8970718410437077606L;
+
+    @Override
+    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
+        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
+    }    
+}

src/main/java/com/revature/security/JwtAuthenticationRequest.java

@@ -0,0 +1,45 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.security;
+
+import java.io.Serializable;
+
+/**
+ *
+ * @author FayeRedd
+ */
+public class  JwtAuthenticationRequest implements Serializable {
+
+    private static final long serialVersionUID = -8445943548965154778L;
+
+    private String username;
+    private String password;
+
+    public JwtAuthenticationRequest() {
+        super();
+    }
+
+    public JwtAuthenticationRequest(String username, String password) {
+        this.setUsername(username);
+        this.setPassword(password);
+    }
+
+    public String getUsername() {
+        return this.username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return this.password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+}

src/main/java/com/revature/security/exceptions/JwtTokenMissingException.java

@@ -0,0 +1,19 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.security.exceptions;
+
+/**
+ *
+ * @author FayeRedd
+ */
+public class JwtTokenMissingException extends RuntimeException{
+
+    public JwtTokenMissingException(){}
+
+    public JwtTokenMissingException(String message){
+        super(message);
+    }
+}

src/main/java/com/revature/security/extra/JwtAuthenticationFilter.java

@@ -0,0 +1,59 @@
+/*
+ * To change this license header, choose License Headers in Project Properties.
+ * To change this template file, choose Tools | Templates
+ * and open the template in the editor.
+ */
+package com.revature.security.extra;
+
+import com.revature.security.extra.JwtTokenUtil;
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+/**
+ *
+ * @author FayeRedd
+ */
+public class JwtAuthenticationFilter extends OncePerRequestFilter {
+
+    @Autowired
+    private UserDetailsService userDetailsService;
+
+    @Autowired
+    private JwtTokenUtil jwtTokenUtil;
+
+    @Value("${jwt.header}")
+    private String tokenHeader;
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
+        String authToken = request.getHeader(this.tokenHeader);
+
+        String username = jwtTokenUtil.getUsernameFromToken(authToken);
+
+        if(username != null && SecurityContextHolder.getContext().getAuthentication() == null){
+            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
+
+            if(jwtTokenUtil.validateToken(authToken, userDetails)){
+                UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
+
+                authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
+
+                SecurityContextHolder.getContext().setAuthentication(authentication);
+            }
+        }
+        chain.doFilter(request, response);
+    }
+}