1313
1414import jakarta .validation .Valid ;
1515
16-
16+ import org . springframework . security . access . prepost . PreAuthorize ;
1717import org .springframework .web .bind .annotation .*;
1818import jakarta .servlet .http .HttpServletRequest ;
1919
@@ -45,40 +45,46 @@ public ApiResponse<ArticleDetailResponse> detailPublished(@PathVariable("article
4545 }
4646
4747 @ PostMapping ("/articles" )
48+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
4849 public ApiResponse <ArticleListItemResponse > createDraft (@ RequestBody @ Valid ArticleCreateRequest req ) {
4950 Long uid = currentUser .userId ();
5051 return ApiResponse .ok (articleService .createDraft (uid , req ));
5152 }
5253
5354 @ PutMapping ("/articles/{articleId}" )
55+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
5456 public ApiResponse <ArticleListItemResponse > updateArticle (@ PathVariable ("articleId" ) Long articleId ,
5557 @ RequestBody @ Valid ArticleUpdateRequest req ) {
5658 Long uid = currentUser .userId ();
5759 return ApiResponse .ok (articleService .updateArticle (uid , articleId , req ));
5860 }
5961
6062 @ PostMapping ("/articles/{articleId}/publish" )
63+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
6164 public ApiResponse <ArticleListItemResponse > submitForReview (@ PathVariable ("articleId" ) Long articleId ,
6265 @ RequestBody (required = false ) ArticlePublishRequest req ) {
6366 Long uid = currentUser .userId ();
6467 return ApiResponse .ok (articleService .publish (uid , articleId , req == null ? null : req .getPublishedAt ()));
6568 }
6669
6770 @ PostMapping ("/articles/{articleId}/unpublish" )
71+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
6872 public ApiResponse <Void > unpublish (@ PathVariable ("articleId" ) Long articleId ) {
6973 Long uid = currentUser .userId ();
7074 articleService .unpublishOrDelete (uid , articleId );
7175 return ApiResponse .ok ();
7276 }
7377
7478 @ DeleteMapping ("/articles/{articleId}" )
79+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
7580 public ApiResponse <Void > deleteArticle (@ PathVariable ("articleId" ) Long articleId ) {
7681 Long uid = currentUser .userId ();
7782 articleService .unpublishOrDelete (uid , articleId );
7883 return ApiResponse .ok ();
7984 }
8085
8186 @ GetMapping ("/users/me/articles" )
87+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
8288 public ApiResponse <PageResult <ArticleListItemResponse >> listMine (
8389 @ RequestParam (defaultValue = "0" ) int page ,
8490 @ RequestParam (defaultValue = "20" ) int size ) {
@@ -87,6 +93,7 @@ public ApiResponse<PageResult<ArticleListItemResponse>> listMine(
8793 }
8894
8995 @ GetMapping ("/users/me/articles/{articleId}" )
96+ @ PreAuthorize ("hasAnyRole('ADMIN','AUTHOR')" )
9097 public ApiResponse <ArticleDetailResponse > detailMine (@ PathVariable ("articleId" ) Long articleId ,
9198 HttpServletRequest request ) {
9299 Long uid = currentUser .userId ();
0 commit comments