Juraj Paluba authored May 07, 2023 and Juraj Paluba committed May 07, 2023

Created new docker-compose file to run services with security disabled.

Execute: docker compose --file docker-compose-insecure.yml up -d

TODO: Fix request body and reponses!

TODO: Do not create Person, but get the information about User from core
service.

Juraj Paluba authored May 06, 2023 and Juraj Paluba committed May 07, 2023

Yet with basic authentication.

Log in to the core service. Copy TOKEN from console to the swagger of
discussion. Call endpoints.

For local development change hockey.core.url to http://localhost:8080

To enable security run it in secure profile

To build service images use either `docker compose build` or in the
service folder `docker build -t <my-name> -f Dockerfile ../`

Create a new secure profile which configures authorization servers
(github and MUNI) as well as secures API endpoints.

By default the application is started in insecure mode. Meaning that no
login is required (good for scenario) and all API endpoints do not
require any authentication whatsoever.

To secure the application you must activate the 'secure' profile.
For example run the following:
`mvn spring-boot:run -Dspring-boot.profiles=secure`

or when running as jar:
`java -Dspring.profiles.active=secure -jar my-epic-jar-file.jar`

And generalized AuthUserService classes.

Updated tests. Only those that needed admin persmissions.

Created new application property that takes list of emails. If user is
logged in using any of these emails, it will assing admin privileges to
him.

Had to allow actuator endpoint in core service.
The application properties were using deprecated key for enabling.
No need to specify special version for org.springframework.org
dependencies as they are defined in parent pom.

Juraj Paluba authored May 03, 2023 and Juraj Paluba committed May 03, 2023

Had to add spring security test dependency as well as WithMockUser
annotation (for rest controllers --> performing requests with given
user) and MockedBeand for client registration.

It is not the optimal solution, but honestly the only one I was able to
produce. The main problem is the securityFilterChain in App class
besides main(). Because the App class is executed during each test.