Change the integrity check to use the @PreAuthorize instead of writing the full logic

autograde-service/src/main/java/ch/epfl/autograde/api/v1/controller/FeedbackController.java

@@ -7,6 +7,7 @@ import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 /**
@@ -18,22 +19,17 @@ import org.springframework.web.bind.annotation.*;
 @Slf4j
 @RestController
 @RequestMapping("/api/v1/feedback")
-public final class FeedbackController {
-
-    /** Service to generate and check the integrity of the requests */
-    private final IntegrityService integrity;
+public class FeedbackController {
 
     /** Service to communicate with Moodle */
     private final MoodleWebService moodle;
 
     /**
      * @param moodle service to use to communicate with Moodle.
-     * @param integrity service to use for the integrity checks.
      */
     @Autowired
-    public FeedbackController(MoodleWebService moodle, IntegrityService integrity) {
+    public FeedbackController(MoodleWebService moodle) {
         this.moodle = moodle;
-        this.integrity = integrity;
     }
 
     /**
@@ -46,19 +42,12 @@ public final class FeedbackController {
      * @apiNote This end point should only be called by the autograde-service itself
      */
     @PostMapping("/upload")
+    @PreAuthorize("@integrityService.check(#signature, #id)")
     public ResponseEntity<?> submitGrade(@RequestParam int id,
                                          @RequestParam String signature,
                                          @RequestBody UploadFeedbackDTO feedback)
     {
         log.info("Received an 'upload feedback' request for submission with id {}", id);
-        // HR : Check the integrity of the request
-        if (!integrity.check(signature, id)) {
-            log.error("Integrity check failed for 'upload feedback' request for submission {}", id);
-            return ResponseEntity
-                    .status(HttpStatus.UNAUTHORIZED)
-                    .body("The provided signature is not correct !");
-        }
-        log.info("Integrity check for 'upload feedback' request for submission {} was successful", id);
         // HR : Upload the grade and feedback to Moodle
         try {
             var res = moodle.upload_feedback(id, feedback.getGrade(), feedback.getFeedback().toJson());

autograde-service/src/main/java/ch/epfl/autograde/api/v1/controller/SubmissionController.java

 package ch.epfl.autograde.api.v1.controller;
 
-import ch.epfl.autograde.api.v1.service.IntegrityService;
 import ch.epfl.autograde.api.v1.service.MoodleWebService;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.core.io.InputStreamResource;
 import org.springframework.http.HttpHeaders;
-import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
@@ -25,22 +24,17 @@ import static org.springframework.http.MediaType.APPLICATION_OCTET_STREAM_VALUE;
 @Slf4j
 @RestController
 @RequestMapping("/api/v1/submission")
-public final class SubmissionController {
+public class SubmissionController {
 
     /** Service to communicate with Moodle */
     private final MoodleWebService moodle;
 
-    /** Service to generate and check the integrity of the requests */
-    private final IntegrityService integrity;
-
     /**
      * @param moodle service to use to communicate with Moodle.
-     * @param integrity service to use for the integrity checks.
      */
     @Autowired
-    public SubmissionController(MoodleWebService moodle, IntegrityService integrity) {
+    public SubmissionController(MoodleWebService moodle) {
         this.moodle = moodle;
-        this.integrity = integrity;
     }
 
     /**
@@ -55,17 +49,9 @@ public final class SubmissionController {
      * @apiNote This end point should only be called by the autograde-service itself
      */
     @GetMapping("/download")
+    @PreAuthorize("@integrityService.check(#signature, #id)")
     public ResponseEntity<?> download(@RequestParam int id, @RequestParam String signature) {
         log.info("Received a 'download submission' request for submission {}", id);
-
-        // HR : Check the integrity of the signature
-        if (!integrity.check(signature, id)){
-            log.error("Integrity check failed for 'download submission' request for submission {}", id);
-            return ResponseEntity
-                    .status(HttpStatus.UNAUTHORIZED)
-                    .body("The provided signature is not correct !");
-        }
-        log.info("Integrity check for 'download submission' request for submission {} was successful", id);
         // HR : Serve the actual file, the integrity of the signature was checked
         try (var file = moodle.download_submission(id)) {
             // HR : Prepare the headers

autograde-service/src/main/java/ch/epfl/autograde/config/SecurityConfig.java

@@ -4,6 +4,7 @@ import ch.epfl.autograde.auth.filter.ApiKeyAuthenticationFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -18,6 +19,7 @@ import org.springframework.security.web.authentication.www.BasicAuthenticationFi
  */
 @Configuration
 @EnableWebSecurity
+@EnableMethodSecurity
 public class SecurityConfig {
 
     /** autograde custom API-KEY authentication filter */