Fixed issue creating accounts

Author: hirokiterashima

src/main/java/org/wise/portal/presentation/web/controllers/student/StudentAPIController.java

@@ -84,7 +84,6 @@
  */
 @RestController
 @RequestMapping("/api/student")
-@Secured({ "ROLE_STUDENT" })
 public class StudentAPIController extends UserAPIController {
 
   @Autowired
@@ -112,6 +111,7 @@ List<HashMap<String, Object>> getRuns(Authentication authentication) {
     return runList;
   }
 
+  @Secured({ "ROLE_STUDENT" })
   @PostMapping("/run/launch")
   HashMap<String, Object> launchRun(Authentication auth, @RequestParam Long runId,
       @RequestParam(required = false) Long workgroupId, @RequestParam String presentUserIds,
@@ -220,6 +220,7 @@ private Set<User> getUsers(String[] userIds) throws ObjectNotFoundException {
    *         information about the run. If the student is not successfully added to the run, we will
    *         return a map containing an error field with an error string.
    */
+  @Secured({ "ROLE_STUDENT" })
   @PostMapping("/run/register")
   HashMap<String, Object> addStudentToRun(Authentication auth, @RequestParam String runCode,
       @RequestParam String period) {
@@ -361,6 +362,7 @@ List<HashMap<String, String>> getSecurityQuestions() {
     return questions;
   }
 
+  @Secured({ "ROLE_STUDENT" })
   @PostMapping("/profile/update")
   SimpleResponse updateProfile(Authentication auth, @RequestParam String language) {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -370,6 +372,7 @@ SimpleResponse updateProfile(Authentication auth, @RequestParam String language)
     return new SimpleResponse("success", "profileUpdated");
   }
 
+  @Secured({ "ROLE_STUDENT" })
   @GetMapping("/teacher-list")
   Set<HashMap<String, String>> getAssociatedTeachers(Authentication auth) {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -385,6 +388,7 @@ Set<HashMap<String, String>> getAssociatedTeachers(Authentication auth) {
     return teachers;
   }
 
+  @Secured({ "ROLE_STUDENT" })
   @GetMapping("/can-be-added-to-workgroup")
   HashMap<String, Object> canBeAddedToWorkgroup(Authentication auth, @RequestParam Long runId,
       @RequestParam(required = false) Long workgroupId, @RequestParam Long userId)

src/main/java/org/wise/portal/presentation/web/controllers/teacher/TeacherAPIController.java

@@ -15,7 +15,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.ResponseEntity;
-import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.core.Authentication;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -50,7 +50,6 @@
  */
 @RestController
 @RequestMapping("/api/teacher")
-@Secured({ "ROLE_TEACHER" })
 public class TeacherAPIController extends UserAPIController {
 
   @Autowired
@@ -66,6 +65,7 @@ public class TeacherAPIController extends UserAPIController {
   private String googleClientSecret;
 
   @GetMapping("/runs")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   List<HashMap<String, Object>> getRuns(Authentication auth,
       @RequestParam(required = false) Integer max) {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -90,6 +90,7 @@ private List<HashMap<String, Object>> getRunsList(User user, List<Run> runs) {
   }
 
   @GetMapping("/run/{runId}")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> getRun(Authentication auth, @PathVariable Long runId)
       throws ObjectNotFoundException {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -111,6 +112,7 @@ protected HashMap<String, Object> getRunMap(User user, Run run) {
   }
 
   @GetMapping("/projectlastrun/{projectId}")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> getProjectLastRun(Authentication auth, @PathVariable Long projectId) {
     User user = userService.retrieveUserByUsername(auth.getName());
     List<Run> runsOfProject = runService.getProjectRuns(projectId);
@@ -124,12 +126,13 @@ HashMap<String, Object> getProjectLastRun(Authentication auth, @PathVariable Lon
   }
 
   @GetMapping("/usernames")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   List<String> getAllTeacherUsernames() {
     return userDetailsService.retrieveAllTeacherUsernames();
   }
 
   @PostMapping("/register")
-  @Secured({ "ROLE_ANONYMOUS" })
+  @PreAuthorize("permitAll()")
   ResponseEntity<Map<String, Object>> createTeacherAccount(
       @RequestBody Map<String, String> teacherFields, HttpServletRequest request)
       throws DuplicateUsernameException, InvalidNameException {
@@ -252,6 +255,7 @@ private List<Integer> getSharedOwnerPermissionsList(Run run, User user) {
   }
 
   @PostMapping("/run/create")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> createRun(Authentication auth, HttpServletRequest request,
       @RequestParam Long projectId, @RequestParam String periods, @RequestParam boolean isSurvey,
       @RequestParam Integer maxStudentsPerTeam, @RequestParam Long startDate,
@@ -275,6 +279,7 @@ private Set<String> createPeriodNamesSet(String periodsString) {
   }
 
   @PostMapping("/profile/update")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   SimpleResponse updateProfile(Authentication auth, @RequestParam String displayName,
       @RequestParam String email, @RequestParam String city, @RequestParam String state,
       @RequestParam String country, @RequestParam String schoolName,
@@ -294,6 +299,7 @@ SimpleResponse updateProfile(Authentication auth, @RequestParam String displayNa
   }
 
   @PostMapping("/run/add/period")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> addPeriodToRun(Authentication auth, @RequestParam Long runId,
       @RequestParam String periodName) throws ObjectNotFoundException {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -318,6 +324,7 @@ HashMap<String, Object> addPeriodToRun(Authentication auth, @RequestParam Long r
   }
 
   @PostMapping("/run/delete/period")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> deletePeriodFromRun(Authentication auth, @RequestParam Long runId,
       @RequestParam String periodName) throws ObjectNotFoundException, PeriodNotFoundException {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -341,6 +348,7 @@ HashMap<String, Object> deletePeriodFromRun(Authentication auth, @RequestParam L
   }
 
   @PostMapping("/run/update/studentsperteam")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> editRunStudentsPerTeam(Authentication auth, @RequestParam Long runId,
       @RequestParam("maxStudentsPerTeam") Integer newMax) throws ObjectNotFoundException {
     User user = userService.retrieveUserByUsername(auth.getName());
@@ -363,6 +371,7 @@ HashMap<String, Object> editRunStudentsPerTeam(Authentication auth, @RequestPara
   }
 
   @PostMapping("/run/update/starttime")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> editRunStartTime(Authentication authentication, @RequestParam Long runId,
       @RequestParam Long startTime) throws ObjectNotFoundException {
     User user = userService.retrieveUserByUsername(authentication.getName());
@@ -386,6 +395,7 @@ HashMap<String, Object> editRunStartTime(Authentication authentication, @Request
   }
 
   @PostMapping("/run/update/endtime")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> editRunEndTime(Authentication authentication, @RequestParam Long runId,
       @RequestParam(required = false) Long endTime) throws ObjectNotFoundException {
     User user = userService.retrieveUserByUsername(authentication.getName());
@@ -408,6 +418,7 @@ HashMap<String, Object> editRunEndTime(Authentication authentication, @RequestPa
   }
 
   @PostMapping("/run/update/islockedafterenddate")
+  @PreAuthorize("hasRole('ROLE_TEACHER')")
   HashMap<String, Object> editRunIsLockedAfterEndDate(Authentication authentication,
       @RequestParam Long runId, @RequestParam Boolean isLockedAfterEndDate)
       throws ObjectNotFoundException {

src/main/java/org/wise/portal/presentation/web/controllers/user/UserAPIController.java

@@ -19,6 +19,7 @@
 import org.springframework.security.access.annotation.Secured;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.oauth2.client.authentication.OAuth2AuthenticationToken;
 import org.springframework.security.web.authentication.switchuser.SwitchUserFilter;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
@@ -97,7 +98,7 @@ public class UserAPIController {
   HashMap<String, Object> getUserInfo(Authentication auth,
       @RequestParam(required = false) String username) {
     HashMap<String, Object> info = new HashMap<String, Object>();
-    if (auth != null) {
+    if (auth != null && !(auth instanceof OAuth2AuthenticationToken)) {
       User user = userService.retrieveUserByUsername(auth.getName());
       info.put("id", user.getId());
       MutableUserDetails ud = user.getUserDetails();

src/main/java/org/wise/portal/spring/impl/WebSecurityConfig.java

@@ -109,7 +109,9 @@ public SecurityFilterChain filterChain(HttpSecurity http,
                 .requestMatchers(new AntPathRequestMatcher("/oauth2/**")).permitAll()
                 .requestMatchers(new AntPathRequestMatcher("/login/oauth2/**")).permitAll()
                 .requestMatchers(new AntPathRequestMatcher("/api/google-login")).permitAll()
-                .requestMatchers(new AntPathRequestMatcher("/api/*/register")).permitAll()
+                .requestMatchers(new AntPathRequestMatcher("/api/teacher/register")).permitAll()
+                .requestMatchers(new AntPathRequestMatcher("/api/student/register")).permitAll()
+                .requestMatchers(new AntPathRequestMatcher("/api/*/register/**")).permitAll()
                 .requestMatchers(new AntPathRequestMatcher("/api/teacher/**")).hasAnyRole("TEACHER")
                 .requestMatchers(new AntPathRequestMatcher("/sso/discourse"))
                 .hasAnyRole("TEACHER", "STUDENT")