feat: fixed 403 errors

2025-05-07 10:45:38 +02:00
parent 13845394e3
commit 1f0f9196c4
5 changed files with 2652 additions and 7 deletions
--- a/MyINPulse-back/src/main/java/enseirb/myinpulse/config/WebSecurityCustomConfiguration.java
+++ b/MyINPulse-back/src/main/java/enseirb/myinpulse/config/WebSecurityCustomConfiguration.java
@ -56,12 +56,18 @@ public class WebSecurityCustomConfiguration {
        http.authorizeHttpRequests(
                        authorize ->
                                authorize
-                                        .requestMatchers("/entrepreneur/**", "/shared/**")
+                                        .requestMatchers("/entrepreneur/**")
                                        .access(hasRole("REALM_MyINPulse-entrepreneur"))
-                                        .requestMatchers("/admin/**", "/shared/**")
+                                        .requestMatchers("/admin/**")
                                        .access(hasRole("REALM_MyINPulse-admin"))
+                                        .requestMatchers("/shared/**")
+                                        .hasAnyRole(
+                                                "REALM_MyINPulse-admin",
+                                                "REALM_MyINPulse-entrepreneur")
                                        .requestMatchers("/unauth/**")
-                                        .authenticated())
+                                        .authenticated()
+                                        .anyRequest()
+                                        .denyAll())
                .oauth2ResourceServer(
                        oauth2 ->
                                oauth2.jwt(