micord/ervu-lkrp-ul
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'origin/develop' into feature/SUPPORT-9509_fix_mchd

Browse source
This commit is contained in:
Eduard Tihomiorv 2025-10-28 10:43:40 +03:00
commit 56a682bdeb
19 changed files with 1200 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

4
backend/src/main/java/ervu_lkrp_ul/ervu_lkrp_ul/db_beans/public_/Keys.java
View file

@ -6,9 +6,11 @@ package ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Databasechangeloglock;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OkopfRecords;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OrganizationAllowed;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Shedlock;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records.DatabasechangeloglockRecord;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records.OkopfRecordsRecord;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records.OrganizationAllowedRecord;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records.ShedlockRecord;
import org.jooq.TableField;
@ -30,5 +32,7 @@ public class Keys {
public static final UniqueKey<DatabasechangeloglockRecord> DATABASECHANGELOGLOCK_PKEY = Internal.createUniqueKey(Databasechangeloglock.DATABASECHANGELOGLOCK, DSL.name("databasechangeloglock_pkey"), new TableField[] { Databasechangeloglock.DATABASECHANGELOGLOCK.ID }, true);
public static final UniqueKey<OkopfRecordsRecord> OKOPF_RECORDS_PKEY = Internal.createUniqueKey(OkopfRecords.OKOPF_RECORDS, DSL.name("okopf_records_pkey"), new TableField[] { OkopfRecords.OKOPF_RECORDS.OKOPF_RECORDS_ID }, true);
public static final UniqueKey<OrganizationAllowedRecord> PK_ORGANIZATION_ALLOWED = Internal.createUniqueKey(OrganizationAllowed.ORGANIZATION_ALLOWED, DSL.name("pk_organization_allowed"), new TableField[] { OrganizationAllowed.ORGANIZATION_ALLOWED.ID }, true);
public static final UniqueKey<OrganizationAllowedRecord> UNI_ORGANIZATION_ALLOWED_OGRN = Internal.createUniqueKey(OrganizationAllowed.ORGANIZATION_ALLOWED, DSL.name("uni_organization_allowed_ogrn"), new TableField[] { OrganizationAllowed.ORGANIZATION_ALLOWED.OGRN }, true);
public static final UniqueKey<ShedlockRecord> SHEDLOCK_PK = Internal.createUniqueKey(Shedlock.SHEDLOCK, DSL.name("shedlock_pk"), new TableField[] { Shedlock.SHEDLOCK.NAME }, true);
}

7
backend/src/main/java/ervu_lkrp_ul/ervu_lkrp_ul/db_beans/public_/Public.java
View file

@ -9,6 +9,7 @@ import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Databasechangelog;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Databasechangeloglock;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.InteractionLog;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OkopfRecords;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OrganizationAllowed;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Shedlock;
import java.util.Arrays;
@ -52,6 +53,11 @@ public class Public extends SchemaImpl {
*/
public final OkopfRecords OKOPF_RECORDS = OkopfRecords.OKOPF_RECORDS;
/**
* The table <code>public.organization_allowed</code>.
*/
public final OrganizationAllowed ORGANIZATION_ALLOWED = OrganizationAllowed.ORGANIZATION_ALLOWED;
/**
* The table <code>public.shedlock</code>.
*/
@ -77,6 +83,7 @@ public class Public extends SchemaImpl {
Databasechangeloglock.DATABASECHANGELOGLOCK,
InteractionLog.INTERACTION_LOG,
OkopfRecords.OKOPF_RECORDS,
OrganizationAllowed.ORGANIZATION_ALLOWED,
Shedlock.SHEDLOCK
);
}

6
backend/src/main/java/ervu_lkrp_ul/ervu_lkrp_ul/db_beans/public_/Tables.java
View file

@ -8,6 +8,7 @@ import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Databasechangelog;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Databasechangeloglock;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.InteractionLog;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OkopfRecords;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OrganizationAllowed;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.Shedlock;
@ -37,6 +38,11 @@ public class Tables {
*/
public static final OkopfRecords OKOPF_RECORDS = OkopfRecords.OKOPF_RECORDS;
/**
* The table <code>public.organization_allowed</code>.
*/
public static final OrganizationAllowed ORGANIZATION_ALLOWED = OrganizationAllowed.ORGANIZATION_ALLOWED;
/**
* The table <code>public.shedlock</code>.
*/

238
backend/src/main/java/ervu_lkrp_ul/ervu_lkrp_ul/db_beans/public_/tables/OrganizationAllowed.java Normal file
View file

@ -0,0 +1,238 @@
/*
* This file is generated by jOOQ.
*/
package ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.Keys;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.Public;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records.OrganizationAllowedRecord;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import org.jooq.Condition;
import org.jooq.Field;
import org.jooq.Identity;
import org.jooq.Name;
import org.jooq.PlainSQL;
import org.jooq.QueryPart;
import org.jooq.SQL;
import org.jooq.Schema;
import org.jooq.Select;
import org.jooq.Stringly;
import org.jooq.Table;
import org.jooq.TableField;
import org.jooq.TableOptions;
import org.jooq.UniqueKey;
import org.jooq.impl.DSL;
import org.jooq.impl.SQLDataType;
import org.jooq.impl.TableImpl;
/**
* This class is generated by jOOQ.
*/
@SuppressWarnings({ "all", "unchecked", "rawtypes" })
public class OrganizationAllowed extends TableImpl<OrganizationAllowedRecord> {
private static final long serialVersionUID = 1L;
/**
* The reference instance of <code>public.organization_allowed</code>
*/
public static final OrganizationAllowed ORGANIZATION_ALLOWED = new OrganizationAllowed();
/**
* The class holding records for this type
*/
@Override
public Class<OrganizationAllowedRecord> getRecordType() {
return OrganizationAllowedRecord.class;
}
/**
* The column <code>public.organization_allowed.id</code>.
*/
public final TableField<OrganizationAllowedRecord, Long> ID = createField(DSL.name("id"), SQLDataType.BIGINT.nullable(false).identity(true), this, "");
/**
* The column <code>public.organization_allowed.ogrn</code>.
*/
public final TableField<OrganizationAllowedRecord, String> OGRN = createField(DSL.name("ogrn"), SQLDataType.VARCHAR(15).nullable(false), this, "");
private OrganizationAllowed(Name alias, Table<OrganizationAllowedRecord> aliased) {
this(alias, aliased, (Field<?>[]) null, null);
}
private OrganizationAllowed(Name alias, Table<OrganizationAllowedRecord> aliased, Field<?>[] parameters, Condition where) {
super(alias, null, aliased, parameters, DSL.comment(""), TableOptions.table(), where);
}
/**
* Create an aliased <code>public.organization_allowed</code> table
* reference
*/
public OrganizationAllowed(String alias) {
this(DSL.name(alias), ORGANIZATION_ALLOWED);
}
/**
* Create an aliased <code>public.organization_allowed</code> table
* reference
*/
public OrganizationAllowed(Name alias) {
this(alias, ORGANIZATION_ALLOWED);
}
/**
* Create a <code>public.organization_allowed</code> table reference
*/
public OrganizationAllowed() {
this(DSL.name("organization_allowed"), null);
}
@Override
public Schema getSchema() {
return aliased() ? null : Public.PUBLIC;
}
@Override
public Identity<OrganizationAllowedRecord, Long> getIdentity() {
return (Identity<OrganizationAllowedRecord, Long>) super.getIdentity();
}
@Override
public UniqueKey<OrganizationAllowedRecord> getPrimaryKey() {
return Keys.PK_ORGANIZATION_ALLOWED;
}
@Override
public List<UniqueKey<OrganizationAllowedRecord>> getUniqueKeys() {
return Arrays.asList(Keys.UNI_ORGANIZATION_ALLOWED_OGRN);
}
@Override
public OrganizationAllowed as(String alias) {
return new OrganizationAllowed(DSL.name(alias), this);
}
@Override
public OrganizationAllowed as(Name alias) {
return new OrganizationAllowed(alias, this);
}
@Override
public OrganizationAllowed as(Table<?> alias) {
return new OrganizationAllowed(alias.getQualifiedName(), this);
}
/**
* Rename this table
*/
@Override
public OrganizationAllowed rename(String name) {
return new OrganizationAllowed(DSL.name(name), null);
}
/**
* Rename this table
*/
@Override
public OrganizationAllowed rename(Name name) {
return new OrganizationAllowed(name, null);
}
/**
* Rename this table
*/
@Override
public OrganizationAllowed rename(Table<?> name) {
return new OrganizationAllowed(name.getQualifiedName(), null);
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed where(Condition condition) {
return new OrganizationAllowed(getQualifiedName(), aliased() ? this : null, null, condition);
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed where(Collection<? extends Condition> conditions) {
return where(DSL.and(conditions));
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed where(Condition... conditions) {
return where(DSL.and(conditions));
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed where(Field<Boolean> condition) {
return where(DSL.condition(condition));
}
/**
* Create an inline derived table from this table
*/
@Override
@PlainSQL
public OrganizationAllowed where(SQL condition) {
return where(DSL.condition(condition));
}
/**
* Create an inline derived table from this table
*/
@Override
@PlainSQL
public OrganizationAllowed where(@Stringly.SQL String condition) {
return where(DSL.condition(condition));
}
/**
* Create an inline derived table from this table
*/
@Override
@PlainSQL
public OrganizationAllowed where(@Stringly.SQL String condition, Object... binds) {
return where(DSL.condition(condition, binds));
}
/**
* Create an inline derived table from this table
*/
@Override
@PlainSQL
public OrganizationAllowed where(@Stringly.SQL String condition, QueryPart... parts) {
return where(DSL.condition(condition, parts));
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed whereExists(Select<?> select) {
return where(DSL.exists(select));
}
/**
* Create an inline derived table from this table
*/
@Override
public OrganizationAllowed whereNotExists(Select<?> select) {
return where(DSL.notExists(select));
}
}

79
backend/src/main/java/ervu_lkrp_ul/ervu_lkrp_ul/db_beans/public_/tables/records/OrganizationAllowedRecord.java Normal file
View file

@ -0,0 +1,79 @@
/*
* This file is generated by jOOQ.
*/
package ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.records;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OrganizationAllowed;
import org.jooq.Record1;
import org.jooq.impl.UpdatableRecordImpl;
/**
* This class is generated by jOOQ.
*/
@SuppressWarnings({ "all", "unchecked", "rawtypes" })
public class OrganizationAllowedRecord extends UpdatableRecordImpl<OrganizationAllowedRecord> {
private static final long serialVersionUID = 1L;
/**
* Setter for <code>public.organization_allowed.id</code>.
*/
public void setId(Long value) {
set(0, value);
}
/**
* Getter for <code>public.organization_allowed.id</code>.
*/
public Long getId() {
return (Long) get(0);
}
/**
* Setter for <code>public.organization_allowed.ogrn</code>.
*/
public void setOgrn(String value) {
set(1, value);
}
/**
* Getter for <code>public.organization_allowed.ogrn</code>.
*/
public String getOgrn() {
return (String) get(1);
}
// -------------------------------------------------------------------------
// Primary key information
// -------------------------------------------------------------------------
@Override
public Record1<Long> key() {
return (Record1) super.key();
}
// -------------------------------------------------------------------------
// Constructors
// -------------------------------------------------------------------------
/**
* Create a detached OrganizationAllowedRecord
*/
public OrganizationAllowedRecord() {
super(OrganizationAllowed.ORGANIZATION_ALLOWED);
}
/**
* Create a detached, initialised OrganizationAllowedRecord
*/
public OrganizationAllowedRecord(Long id, String ogrn) {
super(OrganizationAllowed.ORGANIZATION_ALLOWED);
setId(id);
setOgrn(ogrn);
resetChangedOnNotNull();
}
}

25
backend/src/main/java/ru/micord/ervu/dao/OrganizationAccessDao.java Normal file
View file

@ -0,0 +1,25 @@
package ru.micord.ervu.dao;
import ervu_lkrp_ul.ervu_lkrp_ul.db_beans.public_.tables.OrganizationAllowed;
import org.jooq.DSLContext;
import org.springframework.stereotype.Repository;
/**
* @author Adel Kalimullin
*/
@Repository
public class OrganizationAccessDao {
private final DSLContext dsl;
public OrganizationAccessDao(DSLContext dsl) {
this.dsl = dsl;
}
public boolean existsByOgrn(String ogrn) {
return dsl.fetchExists(
dsl.selectFrom(OrganizationAllowed.ORGANIZATION_ALLOWED)
.where(OrganizationAllowed.ORGANIZATION_ALLOWED.OGRN.eq(ogrn))
);
}
}

2
backend/src/main/java/ru/micord/ervu/security/SecurityConstants.java
View file

@ -6,4 +6,6 @@ public class SecurityConstants {
public static final String AUTH_MARKER = "webbpm.ervu-lkrp-ul";
public static final String PRNS_UUID = "prns_uuid_ul";
public static final String STICKY_SESSION = "stickysession";
public static final String UPLOAD_ALLOWED_MARKER = "upload_allowed";
public static final String EMPLOYEE_DOCUMENT_PATH = "/employee/document";
}

16
backend/src/main/java/ru/micord/ervu/security/esia/service/EsiaAuthService.java
View file

@ -62,6 +62,7 @@ import ru.micord.ervu.security.webbpm.jwt.JwtAuthentication;
import ru.micord.ervu.security.webbpm.jwt.helper.SecurityHelper;
import ru.micord.ervu.security.webbpm.jwt.service.JwtTokenService;
import ru.micord.ervu.security.webbpm.jwt.model.Token;
import ru.micord.ervu.service.UploadAccessService;
import ru.cg.webbpm.modules.core.runtime.api.LocalizedException;
import ru.cg.webbpm.modules.core.runtime.api.MessageBundleUtils;
@ -93,6 +94,8 @@ public class EsiaAuthService {
private SecurityHelper securityHelper;
@Autowired
private AuditService auditService;
@Autowired
private UploadAccessService uploadAccessService;
@Value("${ervu.kafka.org.reply.topic}")
private String requestReplyTopic;
@ -191,6 +194,7 @@ public class EsiaAuthService {
String prnOid = null;
Long expiresIn = null;
boolean hasRole = false;
boolean fileUploadAllowed = false;
long timeSignSecret = 0, timeRequestAccessToken = 0, timeVerifySecret = 0;
verifyStateFromCookie(request, state, response);
try {
@ -280,6 +284,7 @@ public class EsiaAuthService {
try {
orgInfo = getOrgInfo(esiaAccessTokenStr);
hasRole = ulDataService.checkRole(esiaAccessTokenStr);
fileUploadAllowed = uploadAccessService.canUploadFiles(orgInfo.getOgrn());
ervuId = getErvuId(prnOid, orgInfo);
if (!hasRole) {
LOGGER.error("The user with id = " + prnOid + " does not have the required role");
@ -298,7 +303,7 @@ public class EsiaAuthService {
auditService.processAuthEvent(request, orgInfo, prnOid, status,
AuditConstants.LOGIN_EVENT_TYPE);
}
createTokenAndAddCookie(response, prnOid, ervuId, hasRole , expiresIn);
createTokenAndAddCookie(response, prnOid, ervuId, hasRole, fileUploadAllowed, expiresIn);
}
}
@ -371,8 +376,9 @@ public class EsiaAuthService {
EsiaAuthInfoStore.addAccessToken(prnOid, esiaAccessTokenStr, expiresIn);
EsiaAuthInfoStore.addRefreshToken(prnOid, esiaNewRefreshToken, expiresIn);
OrgInfo orgInfo = getOrgInfo(esiaAccessTokenStr);
boolean fileUploadAllowed = uploadAccessService.canUploadFiles(orgInfo.getOgrn());
String ervuId = getErvuId(prnOid, orgInfo);
createTokenAndAddCookie(response, esiaAccessToken.getSbjId(), ervuId, true, expiresIn);
createTokenAndAddCookie(response, esiaAccessToken.getSbjId(), ervuId, true, fileUploadAllowed, expiresIn);
}
catch (EsiaException | IOException | InterruptedException e) {
throw new EsiaException(e);
@ -548,9 +554,9 @@ public class EsiaAuthService {
}
private void createTokenAndAddCookie(HttpServletResponse response, String userId, String ervuId,
Boolean hasRole, Long expiresIn) {
Token token = jwtTokenService.createAccessToken(userId, expiresIn, ervuId, hasRole);
securityHelper.addAccessCookies(response, token.getValue(), expiresIn.intValue());
Boolean hasRole, Boolean fileUploadAllowed, Long expiresIn) {
Token token = jwtTokenService.createAccessToken(userId, expiresIn, ervuId, hasRole, fileUploadAllowed);
securityHelper.addAccessCookies(response, token.getValue(), expiresIn.intValue(), fileUploadAllowed);
UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken =
new UsernamePasswordAuthenticationToken(token.getUserAccountId(), null);
SecurityContext context = SecurityContextHolder.createEmptyContext();

9
backend/src/main/java/ru/micord/ervu/security/webbpm/jwt/JwtAuthenticationProvider.java
View file

@ -6,6 +6,7 @@ import javax.servlet.http.HttpServletRequest;
import io.jsonwebtoken.ExpiredJwtException;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.authentication.CredentialsExpiredException;
@ -19,10 +20,10 @@ import ru.micord.ervu.security.webbpm.jwt.model.Token;
import ru.micord.ervu.security.webbpm.jwt.service.JwtTokenService;
import static org.springframework.web.context.request.RequestAttributes.REFERENCE_REQUEST;
import static ru.micord.ervu.security.SecurityConstants.EMPLOYEE_DOCUMENT_PATH;
@Component
public class JwtAuthenticationProvider implements AuthenticationProvider {
private final JwtTokenService jwtTokenService;
@Autowired
@ -56,6 +57,12 @@ public class JwtAuthenticationProvider implements AuthenticationProvider {
}
if (jwtTokenService.isValid(token) && token.getHasRole()) {
String requestPath = request.getRequestURI();
if (EMPLOYEE_DOCUMENT_PATH.equals(requestPath) &&
Boolean.FALSE.equals(token.isFileUploadAllowed())) {
throw new AccessDeniedException("File upload is not allowed for this organization");
}
UsernamePasswordAuthenticationToken pwdToken =
UsernamePasswordAuthenticationToken.authenticated(token.getUserAccountId(), null,
Collections.emptyList()

21
backend/src/main/java/ru/micord/ervu/security/webbpm/jwt/helper/SecurityHelper.java
View file

@ -17,6 +17,7 @@ import static org.springframework.web.context.request.RequestAttributes.REFERENC
import static ru.micord.ervu.security.SecurityConstants.AUTH_MARKER;
import static ru.micord.ervu.security.SecurityConstants.AUTH_TOKEN;
import static ru.micord.ervu.security.SecurityConstants.PRNS_UUID;
import static ru.micord.ervu.security.SecurityConstants.UPLOAD_ALLOWED_MARKER;
public final class SecurityHelper {
@Value("${cookie.path:#{null}}")
@ -45,6 +46,14 @@ public final class SecurityHelper {
.httpOnly(false)
.build();
addResponseCookie(response, emptyAuthMarker);
ResponseCookie emptyUploadAllowed = createCookie(UPLOAD_ALLOWED_MARKER, null, "/")
.maxAge(0)
.secure(false)
.httpOnly(false)
.build();
addResponseCookie(response, emptyUploadAllowed);
clearCookie(response, PRNS_UUID, accessCookiePath);
}
@ -52,7 +61,8 @@ public final class SecurityHelper {
response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
}
public void addAccessCookies(HttpServletResponse response, String cookieValue, int expiry) {
public void addAccessCookies(HttpServletResponse response, String cookieValue, int expiry,
Boolean fileUploadAllowed) {
ResponseCookie authTokenCookie = createCookie(AUTH_TOKEN, cookieValue, accessCookiePath)
.maxAge(expiry)
.build();
@ -64,6 +74,15 @@ public final class SecurityHelper {
.httpOnly(false)
.build();
addResponseCookie(response, authMarker);
if (fileUploadAllowed) {
ResponseCookie uploadAllowedCookie = createCookie(UPLOAD_ALLOWED_MARKER, "true", "/")
.maxAge(expiry)
.secure(false)
.httpOnly(false)
.build();
addResponseCookie(response, uploadAllowedCookie);
}
}
public ResponseCookie.ResponseCookieBuilder createCookie(String name, String value, String path) {

9
backend/src/main/java/ru/micord/ervu/security/webbpm/jwt/model/Token.java
View file

@ -8,13 +8,16 @@ public class Token {
private final Date expirationDate;
private final String value;
private final Boolean hasRole;
private final Boolean fileUploadAllowed;
public Token(String userAccountId, String issuer, Date expirationDate, String value, Boolean hasRole) {
public Token(String userAccountId, String issuer, Date expirationDate, String value, Boolean hasRole,
Boolean fileUploadAllowed) {
this.userAccountId = userAccountId;
this.issuer = issuer;
this.expirationDate = expirationDate;
this.value = value;
this.hasRole = hasRole;
this.fileUploadAllowed = fileUploadAllowed;
}
public String getUserAccountId() {
@ -40,4 +43,8 @@ public class Token {
public Boolean getHasRole() {
return hasRole;
}
public Boolean isFileUploadAllowed() {
return fileUploadAllowed;
}
}

12
backend/src/main/java/ru/micord/ervu/security/webbpm/jwt/service/JwtTokenService.java
View file

@ -43,8 +43,7 @@ public class JwtTokenService {
this.signingKey = Keys.hmacShaKeyFor(encodedKey);
}
public Token createAccessToken(String userAccountId, Long expiresIn, String ervuId, Boolean hasRole) {
public Token createAccessToken(String userAccountId, Long expiresIn, String ervuId, Boolean hasRole, Boolean fileUploadAllowed) {
Date expirationDate = new Date(System.currentTimeMillis() + 1000L * expiresIn);
String value = Jwts.builder()
.setSubject(userAccountId + ":" + ervuId)
@ -52,9 +51,12 @@ public class JwtTokenService {
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(expirationDate)
.claim("hasRole", hasRole)
.claim("fileUploadAllowed", fileUploadAllowed)
.signWith(signingKey)
.compact();
return new Token(userAccountId + ":" + ervuId, tokenIssuerName, expirationDate, value, hasRole);
return new Token(userAccountId + ":" + ervuId, tokenIssuerName, expirationDate, value, hasRole,
fileUploadAllowed
);
}
public boolean isValid(Token token) {
@ -77,7 +79,9 @@ public class JwtTokenService {
.parseClaimsJws(token)
.getBody();
return new Token(claims.getSubject(), claims.getIssuer(), claims.getExpiration(), token, claims.get("hasRole", Boolean.class));
return new Token(claims.getSubject(), claims.getIssuer(), claims.getExpiration(), token,
claims.get("hasRole", Boolean.class), claims.get("fileUploadAllowed", Boolean.class)
);
}
public String getAccessToken(HttpServletRequest request) {

32
backend/src/main/java/ru/micord/ervu/service/UploadAccessService.java Normal file
View file

@ -0,0 +1,32 @@
package ru.micord.ervu.service;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Service;
import org.springframework.util.StringUtils;
import ru.micord.ervu.dao.OrganizationAccessDao;
/**
* @author Adel Kalimullin
*/
@Service
public class UploadAccessService {
private final OrganizationAccessDao organizationAccessDao;
private final boolean ogrnCheckEnabled;
public UploadAccessService(
OrganizationAccessDao organizationAccessDao,
@Value("${ervu.file.upload.ogrn.check.enabled:false}") boolean ogrnCheckEnabled
) {
this.organizationAccessDao = organizationAccessDao;
this.ogrnCheckEnabled = ogrnCheckEnabled;
}
public boolean canUploadFiles(String ogrn) {
if (!ogrnCheckEnabled) {
return true;
}
return StringUtils.hasText(ogrn) && organizationAccessDao.existsByOgrn(ogrn);
}
}

15
backend/src/main/resources/config/v_1.0/2025-10-24-add-org-allowed-table.xml Normal file
View file

@ -0,0 +1,15 @@
<?xml version="1.0" encoding="UTF-8"?>
<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog" xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog-ext http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd http://www.liquibase.org/xml/ns/dbchangelog http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.5.xsd">
<changeSet id="create-table-organization_allowed" author="adel.ka">
<comment>Create table for organizations allowed to upload files</comment>
<createTable tableName="organization_allowed">
<column name="id" type="bigint" autoIncrement="true">
<constraints primaryKey="true" primaryKeyName="pk_organization_allowed"/>
</column>
<column name="ogrn" type="varchar(15)">
<constraints nullable="false" unique="true" uniqueConstraintName="uni_organization_allowed_ogrn"/>
</column>
</createTable>
</changeSet>
</databaseChangeLog>

2
backend/src/main/resources/config/v_1.0/changelog-v_1.0.xml
View file

@ -9,6 +9,6 @@
<include file="2024-09-11--01-create-table-interaction-log.xml" relativeToChangelogFile="true"/>
<include file="2024-09-18--02-add-shedlock-table.xml" relativeToChangelogFile="true"/>
<include file="2025-10-20-create-offset-column.xml" relativeToChangelogFile="true"/>
<include file="2025-10-24-add-org-allowed-table.xml" relativeToChangelogFile="true"/>
</databaseChangeLog>