Authorization system by carojeandat · Pull Request #210 · gridsuite/explore-server

carojeandat · 2026-08-28T08:55:01Z

PR Summary

For nested objects, for now we only check whether the user has the required permissions on the parent object itself. Permissions on nested/sub-level objects are not checked yet.

coderabbitai · 2026-08-28T08:55:10Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2f3bcda5-5c86-422a-a10d-c9fcf9b3a259

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sonarqubecloud · 2026-08-28T08:58:57Z

Quality Gate failed

Failed conditions
63.6% Coverage on New Code (required ≥ 80%)
D Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

Copilot

🟡 Changes recommended

Compilation failures and multiple authorization and request-handling defects currently block safe integration.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Introduces Spring Security method authorization, derives user identity from the security context, and automatically propagates identity headers to downstream services.

Changes:

Adds authentication filtering and centralized authorization helpers.
Applies permission annotations to controller endpoints.
Removes explicit user IDs from service APIs and updates tests.

File summaries

File	Description
`WorkspaceTest.java`	Updates directory-service expectations.
`UserIdentityTest.java`	Updates identity lookup mocks.
`SupervisionTest.java`	Updates deletion signatures.
`SingleLineDiagramTest.java`	Updates authorization expectations.
`NetworkConversionServiceTest.java`	Updates conversion signature.
`DirectoryServiceTest.java`	Updates search signature.
`MonitorTest.java`	Updates directory operation expectations.
`ExploreTest.java`	Adapts integration tests to authentication changes.
`ExploreServiceExceptionTest.java`	Updates rollback tests.
`EndpointSecurityTest.java`	Adds endpoint annotation coverage.
`DynamicMappingTest.java`	Updates permission and directory mocks.
`NetworkConversionControllerTest.java`	Updates controller signature tests.
`RestTemplateConfigTest.java`	Tests identity-header propagation.
`UserAuthentication.java`	Adds Spring Security authentication representation.
`WorkspaceService.java`	Removes explicit user propagation.
`SupervisionService.java`	Removes user IDs from deletion flow.
`StudyService.java`	Relies on centralized header propagation.
`SpreadsheetConfigService.java`	Updates deletion API.
`SpreadsheetConfigCollectionService.java`	Updates deletion API.
`SingleLineDiagramService.java`	Updates deletion API.
`ParametersService.java`	Removes explicit user headers.
`NotificationService.java`	Reads users from the security context.
`NetworkModificationService.java`	Updates deletion API.
`NetworkConversionService.java`	Removes explicit user argument.
`MonitorService.java`	Updates directory-element interface.
`IDirectoryElementsService.java`	Simplifies deletion contract.
`FilterService.java`	Removes explicit user propagation.
`ExploreService.java`	Refactors operations around security context.
`DynamicMappingService.java`	Updates deletion contract.
`DirectoryService.java`	Centralizes permission calls and header handling.
`ContingencyListService.java`	Removes explicit user headers.
`CaseService.java`	Updates deletion contract.
`AuthorizationService.java`	Adds permission-oriented authorization methods.
`ElementAttributes.java`	Derives owners from authentication.
`SupervisionController.java`	Restricts supervision to administrators.
`NetworkConversionController.java`	Adds conversion authorization.
`FilterController.java`	Adds filter read authorization.
`ExploreController.java`	Applies method-level authorization broadly.
`CaseController.java`	Marks unresolved endpoint policies.
`ActionsController.java`	Adds contingency-list read authorization.
`SpringSecurityConfig.java`	Configures the security filter chain.
`SecurityFilter.java`	Builds authentication from request headers.
`RestTemplateConfig.java`	Forwards authenticated user and roles.
`pom.xml`	Adds Spring Security test support.

Review details

Suppressed comments (2)

src/main/java/org/gridsuite/explore/server/dto/ElementAttributes.java:71

This constructor has the same compilation error: this(...) must be its first statement. Inline the owner lookup into the delegated constructor call.

    public ElementAttributes(UUID elementUuid, String elementName, String type, long subdirectoriesCount, String description, DirectoryElementStatus status) {
        String owner = ((UserAuthentication) SecurityContextHolder.getContext().getAuthentication()).getUserId();
        this(elementUuid, elementName, type, owner, subdirectoriesCount, description, null, null, status, null, null);

src/main/java/org/gridsuite/explore/server/config/RestTemplateConfig.java:72

With anyRequest().permitAll(), Spring can install an AnonymousAuthenticationToken for requests without a user header. This unconditional cast then throws for otherwise-public endpoints making outgoing REST calls. Only forward headers when the authentication is a UserAuthentication.

Files reviewed: 44/44 changed files
Comments generated: 9
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+    @PreAuthorize("@authorizationService.canDelete(#elementsUuids)") // ça ne peut pas contenir de subDirectories, car ils n'apparaissent que dans l'arbre
+    public ResponseEntity<Void> deleteElements(@RequestParam("elementsUuids") List<UUID> elementsUuids,


+    public ElementAttributes(UUID elementUuid, String elementName, String type, long subdirectoriesCount, String description) {
+        String owner = ((UserAuthentication) SecurityContextHolder.getContext().getAuthentication()).getUserId();
+        this(elementUuid, elementName, type, owner, subdirectoriesCount, description, null, null, null, null, null);
+    }


+            if (!hasSecurityAnnotation(method, controller)) {
+                unsecuredEndpoints.add(
+                        controller.getSimpleName() + "#" + method.getName()
+                );
+            }
+        });
+
+        assertThat(unsecuredEndpoints).isEmpty();


    @GetMapping(value = "/download-file/{exportUuid}")
+    @PreAuthorize("@authorizationService.canRead(#exportUuid)")
    public ResponseEntity<Resource> downloadFile(@PathVariable("exportUuid") UUID exportUuid) {


 @RestController
 @RequestMapping(value = "/" + ExploreApi.API_VERSION + "/supervision")
 @Tag(name = "Explore server - Supervision")
+@PreAuthorize("hasRole('ADMIN')")


+    private HttpEntity<String> getHttpEntityWithUserHeader(String content) {

+        // TODO: HttpHeaders
        HttpHeaders headers = new HttpHeaders();


        String path = UriComponentsBuilder.fromPath(ELEMENTS_SERVER_ROOT_PATH + "/authorized")
-            .queryParam(PARAM_ACCESS_TYPE, permissionType)
-            .queryParam(PARAM_IDS, ids)
-            .queryParam(PARAM_TARGET_DIRECTORY_UUID, targetDirectoryUuid)
-            .queryParam(PARAM_RECURSIVE_CHECK, recursiveCheck)
-            .buildAndExpand()
-            .toUriString();
+                .queryParam(PARAM_ACCESS_TYPE, permissionType)
+                .queryParam(PARAM_IDS, elementUuids)
+                .queryParam(PARAM_TARGET_DIRECTORY_UUID, targetDirectoryUuid)


# Conflicts: # src/main/java/org/gridsuite/explore/server/services/DirectoryService.java # src/main/java/org/gridsuite/explore/server/services/ExploreService.java # src/test/java/org/gridsuite/explore/server/DynamicMappingTest.java # src/test/java/org/gridsuite/explore/server/ExploreServiceExceptionTest.java # src/test/java/org/gridsuite/explore/server/MonitorTest.java # src/test/java/org/gridsuite/explore/server/SingleLineDiagramTest.java # src/test/java/org/gridsuite/explore/server/WorkspaceTest.java

implement Spring Security Context

cfdbf8d

carojeandat added 8 commits August 31, 2026 16:53

add rest template interceptor for headers

2cda0d3

implement new permission service on some methods

0ec2641

add test to verify that all endpoints are secured

a2b5954

add custom UserAuthentication

5cc2903

add PreAuthorize to all endpoints

d8fa8c3

add PreAuthorize to all endpoints

2e1a190

remove all userId

fc44439

move userId definition to ElementAttributes constructor

65b4ce1

antoinebhs requested a balanced review from Copilot September 8, 2026 12:46

Copilot started reviewing on behalf of antoinebhs September 8, 2026 12:46 View session

Copilot AI reviewed Sep 8, 2026

View reviewed changes

carojeandat added 4 commits September 8, 2026 15:45

clean HttpHeaders

2b3d926

simplify UserAuthentication constructor

3ef38f8

copilot review

efac4a1

Navigation Menu

Uh oh!

Authorization system - #210

Authorization system#210
carojeandat wants to merge 13 commits into
mainfrom
caroline/authorization-system

carojeandat commented Aug 28, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

sonarqubecloud Bot commented Aug 28, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@PreAuthorize("@authorizationService.canDelete(#elementsUuids)") // ça ne peut pas contenir de subDirectories, car ils n'apparaissent que dans l'arbre
		public ResponseEntity<Void> deleteElements(@RequestParam("elementsUuids") List<UUID> elementsUuids,

Uh oh!

Conversation

carojeandat commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

coderabbitai Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud Bot commented Aug 28, 2026

Quality Gate failed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Suppressed comments (2)

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

carojeandat commented Aug 28, 2026 •

edited

Loading

coderabbitai Bot commented Aug 28, 2026 •

edited

Loading