Release

pom.xml

@@ -58,7 +58,21 @@
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
         </dependency>
-
+
+        <!-- PDFBox -->
+        <dependency>
+            <groupId>org.apache.pdfbox</groupId>
+            <artifactId>pdfbox</artifactId>
+            <version>2.0.30</version>
+        </dependency>
+
+        <!-- Apache POI para Excel -->
+        <dependency>
+            <groupId>org.apache.poi</groupId>
+            <artifactId>poi-ooxml</artifactId>
+            <version>5.2.3</version>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-security</artifactId>
@@ -171,8 +185,10 @@
             <artifactId>dotenv-java</artifactId>
             <version>2.3.1</version>
         </dependency>
-
-
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
     </dependencies>
 
     <dependencyManagement>

src/main/java/edu/eci/cvds/prometeo/config/CorsConfig.java

@@ -6,13 +6,12 @@
 
 @Configuration  
 public class CorsConfig implements WebMvcConfigurer {
-
     @Override
-    public void addCorsMappings(@SuppressWarnings("null") CorsRegistry registry) {
+    public void addCorsMappings(CorsRegistry registry) {
         registry.addMapping("/**")
-                .allowedOrigins("*") // Cambiar el origen al necesario                
-                .allowedMethods("GET", "POST", "PUT", "PATCH", "DELETE")
+                .allowedOrigins("http://localhost:3000")
+                .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
                 .allowedHeaders("*")
-                .allowCredentials(false);   
+                .allowCredentials(true);
     }
 }

src/main/java/edu/eci/cvds/prometeo/config/JwtRequestFilter.java

@@ -0,0 +1,80 @@
+package edu.eci.cvds.prometeo.config;
+
+import edu.eci.cvds.prometeo.util.JwtUtil;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+import java.util.List;
+
+@Component
+public class JwtRequestFilter extends OncePerRequestFilter {
+
+    private final JwtUtil jwtUtil;
+
+    public JwtRequestFilter(JwtUtil jwtUtil) {
+        this.jwtUtil = jwtUtil;
+    }
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain chain)
+            throws ServletException, IOException {
+        if ("OPTIONS".equalsIgnoreCase(request.getMethod())) {
+            response.setStatus(HttpServletResponse.SC_OK);
+            return;
+        }
+
+        final String authHeader = request.getHeader("Authorization");
+
+        System.out.println("🔍 Checking Authorization header...");
+        if (authHeader != null && authHeader.startsWith("Bearer ")) {
+            System.out.println("✅ Authorization header found: " + authHeader);
+
+            try {
+                var claims = jwtUtil.extractClaims(authHeader);
+
+                String username = claims.get("userName", String.class);
+                String role = claims.get("role", String.class).toUpperCase();
+                String name = claims.get("name", String.class);
+                String idCard = claims.get("id", String.class);
+
+                // Log extracted claims
+                System.out.println("✅ JWT Claims extracted:");
+                System.out.println("username = " + username);
+                System.out.println("role = " + role);
+                System.out.println("name = " + name);
+                System.out.println("idCard = " + idCard);
+
+                // Save attributes in the request
+                request.setAttribute("username", username);
+                request.setAttribute("role", role);
+                request.setAttribute("name", name);
+                request.setAttribute("institutionalId", idCard);
+
+                // Set authentication in SecurityContext
+                var authorities = List.of(new SimpleGrantedAuthority("ROLE_" + role));
+                var auth = new UsernamePasswordAuthenticationToken(username, null, authorities);
+                SecurityContextHolder.getContext().setAuthentication(auth);
+
+            } catch (Exception e) {
+                System.out.println("❌ Error extracting JWT claims: " + e.getMessage());
+                response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
+                return;
+            }
+        } else {
+            System.out.println("⚠️ Authorization header is missing or does not start with 'Bearer '");
+        }
+
+        chain.doFilter(request, response);
+        System.out.println("🔍 Post-filter role: " + request.getAttribute("role"));
+    }
+}

src/main/java/edu/eci/cvds/prometeo/config/LoggingFilter.java

@@ -0,0 +1,24 @@
+package edu.eci.cvds.prometeo.config;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import java.io.IOException;
+
+public class LoggingFilter extends OncePerRequestFilter {
+    @Override
+    protected void doFilterInternal(HttpServletRequest request,
+                                    HttpServletResponse response,
+                                    FilterChain filterChain)
+            throws ServletException, IOException {
+        System.out.println("🔍 Request URI: " + request.getRequestURI());
+        System.out.println("🔍 Method: " + request.getMethod());
+        System.out.println("🔍 All Attributes: ");
+        request.getAttributeNames().asIterator().forEachRemaining(attr ->
+            System.out.println(attr + " = " + request.getAttribute(attr))
+        );
+        filterChain.doFilter(request, response);
+    }
+}

src/main/java/edu/eci/cvds/prometeo/config/SecurityConfig.java

@@ -1,26 +1,57 @@
 package edu.eci.cvds.prometeo.config;
 
+import lombok.extern.slf4j.Slf4j;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
 
+import java.util.List;
+
+@Slf4j
 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {
-
+
+    private final JwtRequestFilter jwtRequestFilter;
+
+    public SecurityConfig(JwtRequestFilter jwtRequestFilter) {
+        this.jwtRequestFilter = jwtRequestFilter;
+    }
+
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-        // Configuración que desactiva toda la seguridad
         http
-            .csrf(csrf -> csrf.disable())
-            .authorizeHttpRequests(authorize -> authorize
-                .requestMatchers("/**").permitAll()
-            )
-            .formLogin(form -> form.disable())
-            .httpBasic(basic -> basic.disable());
-
+                .cors(cors -> {})
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .requestMatchers("/api/users/create").authenticated()
+                        .requestMatchers("/api/users/trainer/sessions").hasAnyRole("STUDENT", "TRAINER")
+                        .requestMatchers("/api/users/trainer/**").hasRole("TRAINER")
+                        .anyRequest().hasAnyRole("TRAINER", "STUDENT", "ADMIN")
+                )
+                .formLogin(form -> form.disable())
+                .httpBasic(basic -> basic.disable())
+                .addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class)
+                .addFilterBefore(new LoggingFilter(), JwtRequestFilter.class);
         return http.build();
     }
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowedOrigins(List.of("http://localhost:3000"));
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setAllowCredentials(true);
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
 }