Skip to content

Commit 6bbed03

Browse files
ChrisS1512ChrisS1512
committed
PUB-2681 - Updated System Admin
1 parent d0361d9 commit 6bbed03

File tree

4 files changed

+32
-36
lines changed

4 files changed

+32
-36
lines changed

‎build.gradle

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,7 +221,7 @@ dependencies {
221221
implementation group: 'com.opencsv', name: 'opencsv', version: '5.9'
222222
implementation group: 'commons-validator', name: 'commons-validator', version: '1.9.0'
223223

224-
implementation group: 'com.github.hmcts', name: 'pip-data-models', version: '2.1.32', {
224+
implementation group: 'com.github.hmcts', name: 'pip-data-models', version: '2.1.34', {
225225
exclude group: 'org.springframework.boot', module: 'spring-boot-starter-data-jpa'
226226
}
227227
implementation group: 'io.hypersistence', name: 'hypersistence-utils-hibernate-63', version: '3.8.3'

‎src/main/java/uk/gov/hmcts/reform/pip/account/management/controllers/SystemAdminB2CAccountController.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
import io.swagger.v3.oas.annotations.tags.Tag;
66
import org.springframework.beans.factory.annotation.Autowired;
77
import org.springframework.http.ResponseEntity;
8+
import org.springframework.security.access.prepost.PreAuthorize;
89
import org.springframework.validation.annotation.Validated;
910
import org.springframework.web.bind.annotation.PostMapping;
1011
import org.springframework.web.bind.annotation.RequestBody;
@@ -48,6 +49,7 @@ public SystemAdminB2CAccountController(SystemAdminB2CAccountService systemAdminB
4849
@ApiResponse(responseCode = OK_CODE, description = PI_USER)
4950
@ApiResponse(responseCode = BAD_REQUEST_CODE, description = "{ErroredSystemAdminAccount}")
5051
@PostMapping("/add/system-admin")
52+
@PreAuthorize("@authorisationService.userCanCreateSystemAdmin(#issuerId)")
5153
public ResponseEntity<? extends PiUser> createSystemAdminAccount(//NOSONAR
5254
@RequestHeader(ISSUER_ID) String issuerId, @RequestBody SystemAdminAccount account) {
5355
return ResponseEntity.ok(systemAdminB2CAccountService.addSystemAdminAccount(account, issuerId));

‎src/main/java/uk/gov/hmcts/reform/pip/account/management/service/AuthorisationService.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import uk.gov.hmcts.reform.pip.model.account.UserProvenances;
1111

1212
import java.util.List;
13+
import java.util.Optional;
1314
import java.util.UUID;
1415

1516
import static uk.gov.hmcts.reform.pip.model.LogBuilder.writeLog;
@@ -70,6 +71,18 @@ public boolean userCanUpdateAccount(UUID userId, UUID adminUserId) {
7071
return isAuthorised;
7172
}
7273

74+
public boolean userCanCreateSystemAdmin(UUID userId) {
75+
Optional<PiUser> adminUser = userRepository.findByUserId(userId);
76+
boolean isSystemAdmin = adminUser.isPresent() && adminUser.get().getRoles().equals(Roles.SYSTEM_ADMIN);
77+
78+
if (!isSystemAdmin) {
79+
log.error(writeLog(
80+
String.format("User with ID %s is forbidden to create a B2C system admin", userId)
81+
));
82+
}
83+
return isSystemAdmin;
84+
}
85+
7386
private boolean isAuthorisedRole(UUID userId, UUID adminUserId) {
7487
PiUser user = getUser(userId);
7588
if (UserProvenances.SSO.equals(user.getUserProvenance())) {

‎src/main/java/uk/gov/hmcts/reform/pip/account/management/service/SystemAdminB2CAccountService.java

Lines changed: 16 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -38,20 +38,20 @@ public class SystemAdminB2CAccountService {
3838
private final AzureUserService azureUserService;
3939
private final UserRepository userRepository;
4040
private final PublicationService publicationService;
41-
private final AzureAccountService azureAccountService;
41+
private final AccountService accountService;
4242
private final Integer maxSystemAdminValue;
4343

4444
@Autowired
4545
public SystemAdminB2CAccountService(Validator validator, AzureUserService azureUserService,
4646
UserRepository userRepository, PublicationService publicationService,
4747
@Value("${admin.max-system-admin}")Integer maxSystemAdminValue,
48-
AzureAccountService azureAccountService) {
48+
AccountService accountService) {
4949
this.validator = validator;
5050
this.azureUserService = azureUserService;
5151
this.userRepository = userRepository;
5252
this.publicationService = publicationService;
5353
this.maxSystemAdminValue = maxSystemAdminValue;
54-
this.azureAccountService = azureAccountService;
54+
this.accountService = accountService;
5555
}
5656

5757
/**
@@ -61,18 +61,12 @@ public SystemAdminB2CAccountService(Validator validator, AzureUserService azureU
6161
* @return The PiUser of the created system admin account.
6262
*/
6363
public PiUser addSystemAdminAccount(SystemAdminAccount account, String issuerId) {
64-
65-
String displayName = "";
66-
String provenanceUserId = verifyAdminUser(issuerId);
67-
if (!provenanceUserId.isEmpty()) {
68-
displayName = azureAccountService.retrieveAzureAccount(provenanceUserId).getDisplayName();
69-
}
70-
71-
validateSystemAdminAccount(account, issuerId, displayName);
64+
PiUser piUser = accountService.getUserById(UUID.fromString(issuerId));
65+
validateSystemAdminAccount(account, issuerId, piUser.getEmail());
7266
try {
7367
User user = azureUserService.createUser(account.convertToAzureAccount(), false);
7468
PiUser createdUser = userRepository.save(account.convertToPiUser(user.getId()));
75-
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.SUCCEEDED, displayName);
69+
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.SUCCEEDED, piUser.getEmail());
7670

7771
publicationService.sendNotificationEmail(
7872
account.getEmail(),
@@ -83,19 +77,20 @@ public PiUser addSystemAdminAccount(SystemAdminAccount account, String issuerId)
8377
} catch (AzureCustomException e) {
8478
ErroredSystemAdminAccount erroredSystemAdminAccount = new ErroredSystemAdminAccount(account);
8579
erroredSystemAdminAccount.setErrorMessages(List.of(e.getLocalizedMessage()));
86-
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, displayName);
80+
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, piUser.getEmail());
8781
throw new SystemAdminAccountException(erroredSystemAdminAccount);
8882
}
83+
8984
}
9085

9186
/**
9287
* This method handles the logging and publishing that a new system admin account has been created.
9388
* @param systemAdminAccount The system admin account that has been created
9489
* @param adminId The ID of the admin user who is creating the account.
95-
* @param name The name of the admin user who is creating the account
90+
* @param email The email of the admin user who is creating the account
9691
*/
9792
public void handleNewSystemAdminAccountAction(SystemAdminAccount systemAdminAccount, String adminId,
98-
ActionResult result, String name) {
93+
ActionResult result, String email) {
9994
log.info(writeLog(UUID.fromString(adminId),
10095
"has attempted to create a System Admin account, which has: " + result.toString()));
10196

@@ -105,7 +100,7 @@ public void handleNewSystemAdminAccountAction(SystemAdminAccount systemAdminAcco
105100
CreateSystemAdminAction createSystemAdminAction = new CreateSystemAdminAction();
106101
createSystemAdminAction.setAccountEmail(systemAdminAccount.getEmail());
107102
createSystemAdminAction.setEmailList(existingAdminEmails);
108-
createSystemAdminAction.setRequesterName(name);
103+
createSystemAdminAction.setRequesterEmail(email);
109104
createSystemAdminAction.setActionResult(result);
110105

111106
publicationService.sendSystemAdminAccountAction(createSystemAdminAction);
@@ -115,9 +110,9 @@ public void handleNewSystemAdminAccountAction(SystemAdminAccount systemAdminAcco
115110
* A helper method which specifically handles validation failures on the system admin account.
116111
* @param account The system admin account to validate.
117112
* @param issuerId The ID of the admin user that is issuing the account.
118-
* @param name The name of the admin user requesting the account.
113+
* @param email The email of the admin user requesting the account.
119114
*/
120-
private void validateSystemAdminAccount(SystemAdminAccount account, String issuerId, String name) {
115+
private void validateSystemAdminAccount(SystemAdminAccount account, String issuerId, String email) {
121116
Set<ConstraintViolation<SystemAdminAccount>> constraintViolationSet = validator.validate(account);
122117

123118
if (!constraintViolationSet.isEmpty()) {
@@ -126,14 +121,14 @@ private void validateSystemAdminAccount(SystemAdminAccount account, String issue
126121
.stream().map(constraint -> constraint.getPropertyPath()
127122
+ ": " + constraint.getMessage()).toList());
128123

129-
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, name);
124+
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, email);
130125
throw new SystemAdminAccountException(erroredSystemAdminAccount);
131126
}
132127

133128
if (userRepository.findByEmailAndUserProvenance(account.getEmail(), UserProvenances.PI_AAD).isPresent()) {
134129
ErroredSystemAdminAccount erroredSystemAdminAccount = new ErroredSystemAdminAccount(account);
135130
erroredSystemAdminAccount.setDuplicate(true);
136-
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, name);
131+
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.FAILED, email);
137132
throw new SystemAdminAccountException(erroredSystemAdminAccount);
138133
}
139134

@@ -144,22 +139,8 @@ private void validateSystemAdminAccount(SystemAdminAccount account, String issue
144139
if (systemAdminUsers.size() >= maxSystemAdminValue) {
145140
ErroredSystemAdminAccount erroredSystemAdminAccount = new ErroredSystemAdminAccount(account);
146141
erroredSystemAdminAccount.setAboveMaxSystemAdmin(true);
147-
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.ATTEMPTED, name);
142+
handleNewSystemAdminAccountAction(account, issuerId, ActionResult.ATTEMPTED, email);
148143
throw new SystemAdminAccountException(erroredSystemAdminAccount);
149144
}
150145
}
151-
152-
/**
153-
* Method to find whether user is SYSTEM_ADMIN or not.
154-
* @param issuerId The ID of the admin user
155-
* @return Boolean user is SYSTEM_ADMIN or not
156-
*/
157-
private String verifyAdminUser(String issuerId) {
158-
Optional<PiUser> adminUser = userRepository.findByUserId(UUID.fromString(issuerId));
159-
if (adminUser.isPresent() && adminUser.get().getRoles().equals(Roles.SYSTEM_ADMIN)) {
160-
return adminUser.get().getProvenanceUserId();
161-
}
162-
163-
return "";
164-
}
165146
}

0 commit comments

Comments
 (0)