Add authorization for perftest APIs

naver · May 7, 2024 · a394fd1 · a394fd1
1 parent 86b9983
commit a394fd1
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/...nder-controller/src/main/java/org/ngrinder/perftest/controller/PerfTestApiController.java b/...nder-controller/src/main/java/org/ngrinder/perftest/controller/PerfTestApiController.java
@@ -44,6 +44,7 @@
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.data.web.PageableDefault;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import java.net.URL;
@@ -74,6 +75,7 @@
 @RestController
 @RequestMapping("/perftest/api")
 @RequiredArgsConstructor
+@PreAuthorize("hasAnyRole('A', 'S', 'U')")
 public class PerfTestApiController {
 
 	private final PerfTestService perfTestService;
@@ -337,6 +339,7 @@ public Map<String, Object> refreshTestRunning(User user, @PathVariable long id)
 	}
 
 	@GetMapping("/{id}/detail_report")
+	@PreAuthorize("permitAll")
 	public Map<String, Object> getReport(@PathVariable long id) {
 		Map<String, Object> model = newHashMap();
 		model.put("test", perfTestService.getOne(id));
@@ -601,6 +604,7 @@ public List<String> getLogs(User user, @PathVariable long id) {
 	 * @return perf test result list.
 	 */
 	@GetMapping({"/{id}/perf", "/{id}/graph"})
+	@PreAuthorize("permitAll")
 	public Map<String, Object> getPerfGraph(@PathVariable long id,
 											@RequestParam(defaultValue = "") String dataType,
 											@RequestParam(defaultValue = "false") boolean onlyTotal,
@@ -630,6 +634,7 @@ private Map<String, Object> getPerfGraphData(Long id, String[] dataTypes, boolea
 	 * @return json message
 	 */
 	@GetMapping("/{id}/monitor")
+	@PreAuthorize("permitAll")
 	public Map<String, Object> getMonitorGraph(@PathVariable long id,
 											   @RequestParam String targetIP, @RequestParam int imgWidth) {
 		int interval = perfTestService.getMonitorGraphInterval(id, targetIP, imgWidth);
@@ -649,6 +654,7 @@ public Map<String, Object> getMonitorGraph(@PathVariable long id,
 	 * @return json message
 	 */
 	@GetMapping("/{id}/plugin/{plugin}")
+	@PreAuthorize("permitAll")
 	public Map<String, Object> getPluginGraph(@PathVariable long id,
 											  @PathVariable String plugin,
 											  @RequestParam String kind,

diff --git a/ngrinder-controller/src/main/java/org/ngrinder/perftest/controller/PerfTestController.java b/ngrinder-controller/src/main/java/org/ngrinder/perftest/controller/PerfTestController.java
@@ -24,6 +24,7 @@
 import org.ngrinder.infra.spring.RemainedPath;
 import org.ngrinder.model.*;
 import org.ngrinder.perftest.service.PerfTestService;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.*;
@@ -44,6 +45,7 @@
 @RequestMapping("/perftest")
 @GlobalControllerModel
 @RequiredArgsConstructor
+@PreAuthorize("hasAnyRole('A', 'S', 'U')")
 public class PerfTestController {
 
 	private final PerfTestService perfTestService;
@@ -150,6 +152,7 @@ public void showLog(User user, @PathVariable("id") long id, @RemainedPath String
 	 * @return perftest/detail_report
 	 */
 	@GetMapping({"/{id}/detail_report", /* for backward compatibility */"/{id}/report"})
+	@PreAuthorize("permitAll")
 	public String getReport(@PathVariable long id) {
 		return "app";
 	}
@@ -162,6 +165,7 @@ public String getReport(@PathVariable long id) {
 	 */
 	@SuppressWarnings("UnusedParameters")
 	@GetMapping("/{id}/detail_report/perf")
+	@PreAuthorize("permitAll")
 	public String getDetailPerfReport(@PathVariable("id") long id) {
 		return "perftest/detail_report/perf";
 	}
@@ -176,6 +180,7 @@ public String getDetailPerfReport(@PathVariable("id") long id) {
 	 */
 	@SuppressWarnings("UnusedParameters")
 	@GetMapping("/{id}/detail_report/monitor")
+	@PreAuthorize("permitAll")
 	public String getDetailMonitorReport(@PathVariable("id") long id, @RequestParam("targetIP") String targetIP,
 	                                     ModelMap modelMap) {
 		modelMap.addAttribute("targetIP", targetIP);
@@ -192,6 +197,7 @@ public String getDetailMonitorReport(@PathVariable("id") long id, @RequestParam(
 	 */
 	@SuppressWarnings("UnusedParameters")
 	@GetMapping("/{id}/detail_report/plugin/{plugin}")
+	@PreAuthorize("permitAll")
 	public String getDetailPluginReport(@PathVariable("id") long id,
 	                                    @PathVariable("plugin") String plugin, @RequestParam("kind") String kind, ModelMap modelMap) {
 		modelMap.addAttribute("plugin", plugin);