{"action":"created","issue":{"url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/47","labels_url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/47/labels{/name}","comments_url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/47/comments","events_url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/47/events","html_url":"https://github.com/Cweorth/Surreal-Travel/issues/47","id":54361515,"number":47,"title":"@Secured annotations, recent changes and question","user":{"login":"FiXerCz","id":8997474,"avatar_url":"https://avatars.githubusercontent.com/u/8997474?v=3","gravatar_id":"","url":"https://api.github.com/users/FiXerCz","html_url":"https://github.com/FiXerCz","followers_url":"https://api.github.com/users/FiXerCz/followers","following_url":"https://api.github.com/users/FiXerCz/following{/other_user}","gists_url":"https://api.github.com/users/FiXerCz/gists{/gist_id}","starred_url":"https://api.github.com/users/FiXerCz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FiXerCz/subscriptions","organizations_url":"https://api.github.com/users/FiXerCz/orgs","repos_url":"https://api.github.com/users/FiXerCz/repos","events_url":"https://api.github.com/users/FiXerCz/events{/privacy}","received_events_url":"https://api.github.com/users/FiXerCz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/Cweorth/Surreal-Travel/labels/help+wanted","name":"help wanted","color":"159818"},{"url":"https://api.github.com/repos/Cweorth/Surreal-Travel/labels/question","name":"question","color":"cc317c"}],"state":"open","locked":false,"assignee":{"login":"Cweorth","id":3329989,"avatar_url":"https://avatars.githubusercontent.com/u/3329989?v=3","gravatar_id":"","url":"https://api.github.com/users/Cweorth","html_url":"https://github.com/Cweorth","followers_url":"https://api.github.com/users/Cweorth/followers","following_url":"https://api.github.com/users/Cweorth/following{/other_user}","gists_url":"https://api.github.com/users/Cweorth/gists{/gist_id}","starred_url":"https://api.github.com/users/Cweorth/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Cweorth/subscriptions","organizations_url":"https://api.github.com/users/Cweorth/orgs","repos_url":"https://api.github.com/users/Cweorth/repos","events_url":"https://api.github.com/users/Cweorth/events{/privacy}","received_events_url":"https://api.github.com/users/Cweorth/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2015-01-14T19:00:34Z","updated_at":"2015-01-14T21:57:21Z","closed_at":null,"body":"Issue regarding my commit ddc3b4ea5fc0f4aff613b95122658745ba3a9d72. Second opinion wanted :)\r\n\r\n*This commit changed quite a few things:*\r\n\r\n1) In SpringSec I have enabled annotations @Secured and @RolesAllowed. Those can be used throughout the code to restrict user roles, that should have access to the annotated methods.\r\n\r\n2) I have added error messages when user inputs wrong credentials (forgot about it before :smile: ). Probably nothing can go wrong with this change.\r\n\r\n3) ```AuthController.java``` is also pretty self-explanatory and easy enough in order for me not to screw it up.\r\n\r\n4) ```AuthCommons.java``` - there would be quite lot of repeating of SpringSec code calls just to get a simple username or determining which roles (authorities) user has. This could simplify it for us.\r\n\r\n5) ReservationController + its views have quite a few changes and that is the part, where I would like your opinion (when you have the time).\r\n\r\n---\r\n\r\n**ReservationController:**\r\n\r\nI have annotated all methods according to roles that should have access to them. Basically the whole reservation-part-of-app should be only accessible for authenticated people (unlike Excursions and Trips - listing could be shown to all), so I have hidden it from the menu for anonymous users. Some methods should have different functionality for ROLE_USER and for higher roles. I have dealt with this as best as I knew how.\r\n\r\nBasically for ROLE_STAFF and ROLE_ADMIN ReservationController is the same as it was before commit. For ROLE_USER:\r\n- Only user's reservations are shown\r\n- User can create reservation only for himself (no Customer select box)\r\n- Should also ROLE_USER be able to edit and delete his reservations (right now the funcionaly is hidden from GUI and reserved for STAFF and ADMIN only)?\r\n\r\nDo you think this approach will be fine or do you see any holes in the current version?\r\n\r\nOh and a footnote: Login page is no longer at /login but at /auth/login. Could you please change your redirect url after creating new Account? Thanks and sorry about it :smile: "},"comment":{"url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/comments/70000287","html_url":"https://github.com/Cweorth/Surreal-Travel/issues/47#issuecomment-70000287","issue_url":"https://api.github.com/repos/Cweorth/Surreal-Travel/issues/47","id":70000287,"user":{"login":"FiXerCz","id":8997474,"avatar_url":"https://avatars.githubusercontent.com/u/8997474?v=3","gravatar_id":"","url":"https://api.github.com/users/FiXerCz","html_url":"https://github.com/FiXerCz","followers_url":"https://api.github.com/users/FiXerCz/followers","following_url":"https://api.github.com/users/FiXerCz/following{/other_user}","gists_url":"https://api.github.com/users/FiXerCz/gists{/gist_id}","starred_url":"https://api.github.com/users/FiXerCz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FiXerCz/subscriptions","organizations_url":"https://api.github.com/users/FiXerCz/orgs","repos_url":"https://api.github.com/users/FiXerCz/repos","events_url":"https://api.github.com/users/FiXerCz/events{/privacy}","received_events_url":"https://api.github.com/users/FiXerCz/received_events","type":"User","site_admin":false},"created_at":"2015-01-14T21:57:21Z","updated_at":"2015-01-14T21:57:21Z","body":"Yep, I also am lost. If the tutor could shed some light onto this it would help.."}}