lionsdev/unionflow-server-impl-quarkus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): audit RBAC complet v3.0 — rôles normalisés, lifecycle, changement mdp mobile

Browse Source 
RBAC:
- HealthResource: @PermitAll
- RoleResource: @RolesAllowed ADMIN/SUPER_ADMIN/ADMIN_ORGANISATION class-level
- PropositionAideResource: @RolesAllowed MEMBRE/USER class-level
- AuthCallbackResource: @PermitAll
- EvenementResource: @PermitAll /publics et /test, count restreint
- BackupResource/LogsMonitoringResource/SystemResource: MODERATOR → MODERATEUR
- AnalyticsResource: MANAGER/MEMBER → ADMIN_ORGANISATION/MEMBRE
- RoleConstant.java: constantes de rôles centralisées

Cycle de vie membres:
- MemberLifecycleService: ajouterMembre()/retirerMembre() sur activation/radiation/archivage
- MembreResource: endpoint GET /numero/{numeroMembre}
- MembreService: méthode trouverParNumeroMembre()

Changement mot de passe:
- CompteAdherentResource: endpoint POST /auth/change-password (mobile)
- MembreKeycloakSyncService: changerMotDePasseDirectKeycloak() via API Admin Keycloak directe
- Fallback automatique si lions-user-manager indisponible

Workflow:
- Flyway V17-V23: rôles, types org, formules Option C, lifecycle columns, bareme cotisation
- Nouvelles classes: MemberLifecycleService, OrganisationModuleService, scheduler
- Security: OrganisationContextFilter, OrganisationContextHolder, ModuleAccessFilter
This commit is contained in:
dahoud
2026-04-07 20:52:26 +00:00
parent c74ae25ad6
commit a2dfae9a0b
78 changed files with 5637 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
src/test/java/dev/lions/unionflow/server/resource/OrganisationResourceMissingBranchesTest.java
View File

@@ -214,4 +214,50 @@ class OrganisationResourceMissingBranchesTest {
assertThat(result).isNotNull();
}
// =========================================================================
// Error cases
// =========================================================================
@Test
@TestSecurity(user = "membre@test.com", roles = {"MEMBRE"})
@DisplayName("listerMesOrganisations — service lève exception → exception propagée")
void listerMesOrganisations_serviceException_propagee() {
Principal principal = () -> "membre@test.com";
when(securityIdentity.getPrincipal()).thenReturn(principal);
when(organisationService.listerOrganisationsPourUtilisateur(anyString()))
.thenThrow(new RuntimeException("Erreur base de données"));
org.junit.jupiter.api.Assertions.assertThrows(RuntimeException.class,
() -> organisationResource.listerMesOrganisations());
}
@Test
@TestSecurity(user = "superadmin@test.com", roles = {"SUPER_ADMIN"})
@DisplayName("listerOrganisations — SUPER_ADMIN + service retourne liste vide → résultat non null")
void listerOrganisations_superAdmin_listeVide_retourneResultatNonNull() {
when(securityIdentity.getRoles()).thenReturn(Set.of("SUPER_ADMIN"));
when(organisationService.listerOrganisationsActives(anyInt(), anyInt())).thenReturn(List.of());
when(organisationService.compterOrganisationsActives()).thenReturn(0L);
PagedResponse<OrganisationSummaryResponse> result = organisationResource.listerOrganisations(
0, 20, null);
assertThat(result).isNotNull();
assertThat(result.getData()).isEmpty();
}
@Test
@TestSecurity(user = "orgadmin@test.com", roles = {"ADMIN_ORGANISATION"})
@DisplayName("listerOrganisations — ADMIN_ORGANISATION + service lève exception → exception propagée")
void listerOrganisations_adminOrg_serviceException_propagee() {
when(securityIdentity.getRoles()).thenReturn(Set.of("ADMIN_ORGANISATION"));
Principal principal = () -> "orgadmin@test.com";
when(securityIdentity.getPrincipal()).thenReturn(principal);
when(organisationService.listerOrganisationsPourUtilisateur(anyString()))
.thenThrow(new RuntimeException("Accès base de données impossible"));
org.junit.jupiter.api.Assertions.assertThrows(RuntimeException.class,
() -> organisationResource.listerOrganisations(0, 20, null));
}
}