Merge pull request 'feature/task-6-security' (#24) from feature/task-6-security into master

Reviewed-on: L_DelOff/ServerMonitorBot#24

src/main/java/ru/ldeloff/servermonitorbot/config/SshConfig.java

@@ -1,5 +1,8 @@
 package ru.ldeloff.servermonitorbot.config;
 
+import lombok.Getter;
+import lombok.RequiredArgsConstructor;
+import lombok.Setter;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.context.annotation.Configuration;
 import ru.ldeloff.servermonitorbot.model.SshServer;
@@ -8,14 +11,8 @@ import java.util.List;
 
 @Configuration
 @ConfigurationProperties(prefix = "ssh")
+@Getter
+@Setter
 public class SshConfig {
     private List<SshServer> servers;
-
-    public List<SshServer> getServers() {
-        return servers;
-    }
-
-    public void setServers(List<SshServer> servers) {
-        this.servers = servers;
-    }
 }

src/main/java/ru/ldeloff/servermonitorbot/config/UserConfig.java

@@ -0,0 +1,17 @@
+package ru.ldeloff.servermonitorbot.config;
+
+import lombok.Getter;
+import lombok.Setter;
+import org.springframework.boot.context.properties.ConfigurationProperties;
+import org.springframework.context.annotation.Configuration;
+import ru.ldeloff.servermonitorbot.model.dto.InitUserDto;
+
+import java.util.List;
+
+@Configuration
+@ConfigurationProperties(prefix = "bot")
+@Getter
+@Setter
+public class UserConfig {
+    private List<InitUserDto> users;
+}

src/main/java/ru/ldeloff/servermonitorbot/controller/TelegramBotController.java

@@ -7,9 +7,13 @@ import org.telegram.telegrambots.bots.TelegramLongPollingBot;
 import org.telegram.telegrambots.meta.api.methods.send.SendMessage;
 import org.telegram.telegrambots.meta.api.objects.Update;
 import org.telegram.telegrambots.meta.exceptions.TelegramApiException;
+import ru.ldeloff.servermonitorbot.model.Role;
 import ru.ldeloff.servermonitorbot.model.TelegramBot;
+import ru.ldeloff.servermonitorbot.model.User;
 import ru.ldeloff.servermonitorbot.repository.SshRepository;
 import ru.ldeloff.servermonitorbot.service.TelegramBotService;
+import ru.ldeloff.servermonitorbot.service.role.RoleService;
+import ru.ldeloff.servermonitorbot.service.user.UserService;
 import ru.ldeloff.servermonitorbot.utils.ui.TelegramBotKeyboard;
 import ru.ldeloff.servermonitorbot.utils.ui.uname.UnameChatButtonAggregate;
 
@@ -21,32 +25,67 @@ public class TelegramBotController extends TelegramLongPollingBot {
     final TelegramBot telegramBot;
     final SshRepository sshRepository;
     final TelegramBotService telegramBotService;
+    final UserService userService;
+    final RoleService roleService;
 
     @Override
     public void onUpdateReceived(Update update) {
+        Role role = getRole(update);
         if (update.hasMessage()) {
             if (update.getMessage().hasText()) {
                 String messageText = update.getMessage().getText();
                 switch (messageText) {
                     case "/start" -> {
+                        if (role.getId() < 3) {
                             log.info("Получена команда '" + messageText
-                                + "' от " + update.getMessage().getChat().getUserName());
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). OK");
                             telegramBotService.firstUse(update, this);
+                        } else {
+                            log.warn("Получена команда '" + messageText
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                     }
                     case "Статус" -> {
+                        if (role.getId() < 3) {
                             log.info("Получена команда '" + messageText
-                                + "' от " + update.getMessage().getChat().getUserName());
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). OK");
                             telegramBotService.getStatusSessions(update, this);
+                        } else {
+                            log.warn("Получена команда '" + messageText
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                     }
                     case "uname" -> {
+                        if (role.getId() < 3) {
                             log.info("Получена команда '" + messageText
-                                + "' от " + update.getMessage().getChat().getUserName());
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). OK");
                             telegramBotService.sendUnameAggregate(update, this);
+                        } else {
+                            log.warn("Получена команда '" + messageText
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                     }
                     default -> {
+                        if (role.getId() < 3) {
                             log.warn("Неизвестная команда '" + messageText
-                                + "' от " + update.getMessage().getChat().getUserName());
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). ОК");
                             telegramBotService.switchToMainMenu(update, this);
+                        } else {
+                            log.warn("Неизвестная команда '" + messageText
+                                    + "' от " + update.getMessage().getChat().getUserName()
+                                    + " (" + update.getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                     }
                 }
             }
@@ -56,20 +95,44 @@ public class TelegramBotController extends TelegramLongPollingBot {
             if (tags.length > 1) {
                 switch (tags[0]) {
                     case "uname":
+                        if (role.getId() < 3) {
                             log.info("Получена команда '" + messageText
-                                + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName());
+                                    + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                                    + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). ОК");
                             telegramBotService.uname(update, this);
+                        } else {
+                            log.info("Получена команда '" + messageText
+                                    + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                                    + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                         break;
                     default:
+                        if (role.getId() < 3) {
                             log.warn("Неизвестная команда '" + messageText
-                                + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName());
+                                    + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                                    + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). ОК");
                             telegramBotService.switchToMainMenu(update, this);
+                        } else {
+                            log.warn("Неизвестная команда '" + messageText
+                                    + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                                    + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). Нет прав");
+                            telegramBotService.notAuthorization(update, this);
+                        }
                         break;
                 }
             } else {
+                if (role.getId() < 3) {
                     log.warn("Неверный формат команды '" + messageText
-                            + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName());
+                            + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                            + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). ОК");
                     telegramBotService.switchToMainMenu(update, this);
+                } else {
+                    log.warn("Неверный формат команды '" + messageText
+                            + "' от " + update.getCallbackQuery().getMessage().getChat().getUserName()
+                            + " (" + update.getCallbackQuery().getMessage().getChat().getId() + "). Нет прав");
+                    telegramBotService.notAuthorization(update, this);
+                }
             }
         }
     }
@@ -89,4 +152,19 @@ public class TelegramBotController extends TelegramLongPollingBot {
         super.onClosing();
         sshRepository.disconnectSessions();
     }
+
+    private Role getRole(Update update) {
+        Long id = null;
+        if (update.hasMessage()) {
+            id = update.getMessage().getChat().getId();            
+        } else if (update.hasCallbackQuery()) {
+            id = update.getCallbackQuery().getMessage().getChat().getId();
+        }
+        User user = userService.getByTelegramId(id);
+        if (user == null) {
+            return roleService.findRoleById(3L);
+        } else {
+            return user.getRole();
+        }
+    }
 }

src/main/java/ru/ldeloff/servermonitorbot/init/AddUsers.java

@@ -0,0 +1,34 @@
+package ru.ldeloff.servermonitorbot.init;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.ApplicationArguments;
+import org.springframework.boot.ApplicationRunner;
+import org.springframework.stereotype.Component;
+import ru.ldeloff.servermonitorbot.config.UserConfig;
+import ru.ldeloff.servermonitorbot.mapper.UserMapper;
+import ru.ldeloff.servermonitorbot.model.User;
+import ru.ldeloff.servermonitorbot.model.dto.InitUserDto;
+import ru.ldeloff.servermonitorbot.service.user.UserService;
+
+import java.util.List;
+
+@Component
+public class AddUsers implements ApplicationRunner {
+    final List<InitUserDto> initUsers;
+    final UserService userService;
+    final UserMapper userMapper;
+
+    @Autowired
+    public AddUsers(UserConfig userConfig, UserService userService, UserMapper userMapper) {
+        this.initUsers = userConfig.getUsers();
+        this.userService = userService;
+        this.userMapper = userMapper;
+    }
+
+    @Override
+    public void run(ApplicationArguments args) throws Exception {
+        initUsers.forEach(initUserDto -> {
+            User user = userService.saveOrUpdateUser(userMapper.dtoToUser(initUserDto));
+        });
+    }
+}

src/main/java/ru/ldeloff/servermonitorbot/mapper/UserMapper.java

@@ -0,0 +1,22 @@
+package ru.ldeloff.servermonitorbot.mapper;
+
+import org.springframework.stereotype.Component;
+import ru.ldeloff.servermonitorbot.model.User;
+import ru.ldeloff.servermonitorbot.model.dto.InitUserDto;
+import ru.ldeloff.servermonitorbot.service.role.RoleService;
+
+@Component
+public class UserMapper {
+    final RoleService roleService;
+
+    public UserMapper(RoleService roleService) {
+        this.roleService = roleService;
+    }
+
+    public User dtoToUser(InitUserDto initUserDto) {
+        User user = new User();
+        user.setTelegramId(initUserDto.getTelegramId());
+        user.setRole(roleService.findRoleByName(initUserDto.getRole()));
+        return user;
+    }
+}

src/main/java/ru/ldeloff/servermonitorbot/model/Role.java

@@ -12,6 +12,6 @@ public class Role {
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private long id;
 
-    @Column(name = "role")
+    @Column(name = "name")
-    private String role;
+    private String name;
 }

src/main/java/ru/ldeloff/servermonitorbot/model/User.java

@@ -12,10 +12,10 @@ public class User {
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Long id;
 
-    @Column(name = "login")
+    @Column(name = "telegram_id")
-    private Long login;
+    private Long telegramId;
 
     @ManyToOne
-    @JoinColumn(name = "id_role")
+    @JoinColumn(name = "role_id")
     private Role role;
 }

src/main/java/ru/ldeloff/servermonitorbot/model/dto/InitUserDto.java

@@ -0,0 +1,14 @@
+package ru.ldeloff.servermonitorbot.model.dto;
+
+import jakarta.validation.constraints.NotNull;
+import lombok.Data;
+import org.springframework.stereotype.Component;
+
+@Data
+@Component
+public class InitUserDto {
+    @NotNull
+    private long telegramId;
+    @NotNull
+    private String role;
+}

src/main/java/ru/ldeloff/servermonitorbot/repository/RoleRepository.java

@@ -0,0 +1,13 @@
+package ru.ldeloff.servermonitorbot.repository;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+import ru.ldeloff.servermonitorbot.model.Role;
+
+import java.util.Optional;
+
+@Repository
+public interface RoleRepository extends JpaRepository<Role, Long> {
+    Optional<Role> findRoleByName(String name);
+    Optional<Role> findRoleById(Long id);
+}

src/main/java/ru/ldeloff/servermonitorbot/repository/UserRepository.java

@@ -0,0 +1,10 @@
+package ru.ldeloff.servermonitorbot.repository;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+import ru.ldeloff.servermonitorbot.model.User;
+
+@Repository
+public interface UserRepository extends JpaRepository<User, Long> {
+    User getByTelegramId(long id);
+}

src/main/java/ru/ldeloff/servermonitorbot/service/TelegramBotService.java

@@ -9,5 +9,6 @@ public interface TelegramBotService {
     void getStatusSessions(Update update, TelegramBotController bot);
     void sendUnameAggregate(Update update, TelegramBotController bot);
     void uname(Update update, TelegramBotController bot);
-    void firstUse(Update update, TelegramBotController telegramBotController);
+    void firstUse(Update update, TelegramBotController bot);
+    void notAuthorization(Update update, TelegramBotController bot);
 }

src/main/java/ru/ldeloff/servermonitorbot/service/TelegramBotServiceImpl.java

@@ -31,6 +31,28 @@ public class TelegramBotServiceImpl implements TelegramBotService {
         message.setChatId(chatId);
         sendMessage(telegramBotKeyboard.uiForm(message), bot);
     }
+
+    @Override
+    public void notAuthorization(Update update, TelegramBotController bot) {
+        long id = 0L;
+        String login = null;
+        long chatId = 0L;
+        if (update.hasMessage()) {
+            id = update.getMessage().getChat().getId();
+            login = update.getMessage().getChat().getUserName();
+            chatId = update.getMessage().getChatId();
+        } else if (update.hasCallbackQuery()) {
+            id = update.getCallbackQuery().getMessage().getChat().getId();
+            login = update.getCallbackQuery().getMessage().getChat().getUserName();
+            chatId = update.getCallbackQuery().getMessage().getChatId();
+        }
+        SendMessage message = new SendMessage();
+        message.setText("У пользователя " + login
+                + " (" + id + ") недостаточно прав для выполнения этой команды");
+        message.setChatId(chatId);
+        sendMessage(message, bot);
+    }
+
     @Override
     public void switchToMainMenu(Update update, TelegramBotController bot) {
         SendMessage message = new SendMessage();

src/main/java/ru/ldeloff/servermonitorbot/service/role/RoleService.java

@@ -0,0 +1,9 @@
+package ru.ldeloff.servermonitorbot.service.role;
+
+import ru.ldeloff.servermonitorbot.model.Role;
+
+public interface RoleService {
+    Role findRoleByName(String name);
+
+    Role findRoleById(Long id);
+}

src/main/java/ru/ldeloff/servermonitorbot/service/role/RoleServiceImpl.java

@@ -0,0 +1,28 @@
+package ru.ldeloff.servermonitorbot.service.role;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+import ru.ldeloff.servermonitorbot.model.Role;
+import ru.ldeloff.servermonitorbot.repository.RoleRepository;
+
+import java.util.Locale;
+import java.util.Optional;
+
+@Service
+@RequiredArgsConstructor
+public class RoleServiceImpl implements RoleService {
+    private final RoleRepository roleRepository;
+
+    @Override
+    public Role findRoleByName(String name) {
+        Optional<Role> role = roleRepository.findRoleByName(name.toUpperCase(Locale.ROOT));
+        //noinspection OptionalGetWithoutIsPresent
+        return role.orElseGet(() -> roleRepository.findRoleByName("ANONYMOUS").get());
+    }
+
+    @Override
+    public Role findRoleById(Long id) {
+        Optional<Role> role = roleRepository.findRoleById(id);
+        return role.orElseGet(() -> roleRepository.findRoleByName("ANONYMOUS").get());
+    }
+}

src/main/java/ru/ldeloff/servermonitorbot/service/user/UserService.java

@@ -0,0 +1,9 @@
+package ru.ldeloff.servermonitorbot.service.user;
+
+import ru.ldeloff.servermonitorbot.model.User;
+
+public interface UserService {
+    User saveOrUpdateUser(User user);
+
+    User getByTelegramId(Long id);
+}

src/main/java/ru/ldeloff/servermonitorbot/service/user/UserServiceImpl.java

@@ -0,0 +1,29 @@
+package ru.ldeloff.servermonitorbot.service.user;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.stereotype.Service;
+import ru.ldeloff.servermonitorbot.model.User;
+import ru.ldeloff.servermonitorbot.repository.UserRepository;
+
+@Service
+@RequiredArgsConstructor
+@Slf4j
+public class UserServiceImpl implements UserService {
+
+    final UserRepository userRepository;
+
+    @Override
+    public User saveOrUpdateUser(User user) {
+        User existUser = userRepository.getByTelegramId(user.getTelegramId());
+        if (existUser != null) {
+            user.setId(existUser.getId());
+        }
+        return userRepository.save(user);
+    }
+
+    @Override
+    public User getByTelegramId(Long id) {
+        return userRepository.getByTelegramId(id);
+    }
+}

src/main/java/ru/ldeloff/servermonitorbot/utils/ui/TelegramBotKeyboard.java

@@ -17,8 +17,8 @@ public class TelegramBotKeyboard implements UiFormer {
     @Override
     public SendMessage uiForm(SendMessage message) {
         ReplyKeyboardMarkup replyKeyboardMarkup = new ReplyKeyboardMarkup();
-        replyKeyboardMarkup.setResizeKeyboard(true); //подгоняем размер
+        replyKeyboardMarkup.setResizeKeyboard(true);
-        replyKeyboardMarkup.setOneTimeKeyboard(false); //скрываем после использования
+        replyKeyboardMarkup.setOneTimeKeyboard(false);
 
         ArrayList<KeyboardRow> keyboardRows = new ArrayList<>();
 

src/main/resources/application.yml

@@ -19,6 +19,9 @@ spring:
 bot:
   name: "ServerMonitorBot"
   token: "token"
+  users:
+    - telegramId: 123456789
+      role: admin
 ssh:
   servers:
     -

src/main/resources/db/scripts/release_0_0_1/changelog.xml

@@ -8,5 +8,9 @@
     <include file="scripts/02_create_table_roles.sql" relativeToChangelogFile="true"/>
     <include file="scripts/03_add_FK_users_to_roles.sql" relativeToChangelogFile="true"/>
     <include file="scripts/04_add_roles.sql" relativeToChangelogFile="true"/>
+    <include file="scripts/05_add_anonymous_role.sql" relativeToChangelogFile="true"/>
+    <include file="scripts/06_refactor_users_table.sql" relativeToChangelogFile="true"/>
+    <include file="scripts/07_refactor_roles_table.sql" relativeToChangelogFile="true"/>
+    <include file="scripts/08_add_roles.sql" relativeToChangelogFile="true"/>
 
 </databaseChangeLog>

src/main/resources/db/scripts/release_0_0_1/scripts/01_create_table_users.sql

@@ -4,7 +4,7 @@
 --comment: Создание таблицы пользователей
 CREATE TABLE users
 (
-    id       integer        PRIMARY KEY,
+    id       SERIAL        PRIMARY KEY,
     login    VARCHAR(128),
     id_role  integer
 );

src/main/resources/db/scripts/release_0_0_1/scripts/02_create_table_roles.sql

@@ -4,7 +4,7 @@
 --comment: Создание таблицы ролей
 CREATE TABLE roles
 (
-    id       integer        PRIMARY KEY,
+    id       SERIAL        PRIMARY KEY,
     role    VARCHAR(128)
 );
 

src/main/resources/db/scripts/release_0_0_1/scripts/05_add_anonymous_role.sql

@@ -0,0 +1 @@
+INSERT INTO roles (id, role) VALUES (3, 'ANONYMOUS');

src/main/resources/db/scripts/release_0_0_1/scripts/06_refactor_users_table.sql

@@ -0,0 +1,9 @@
+ALTER TABLE users
+    DROP COLUMN login;
+
+ALTER TABLE users
+    ADD COLUMN telegram_id INTEGER UNIQUE;
+    COMMENT ON COLUMN users.telegram_id IS 'Telegram ID пользователя';
+
+ALTER TABLE users
+    DROP COLUMN id_role;

src/main/resources/db/scripts/release_0_0_1/scripts/07_refactor_roles_table.sql

@@ -0,0 +1,6 @@
+ALTER TABLE roles
+    DROP COLUMN role;
+
+ALTER TABLE roles
+    ADD COLUMN name VARCHAR(128);
+COMMENT ON COLUMN roles.name IS 'Имя роли';

src/main/resources/db/scripts/release_0_0_1/scripts/08_add_roles.sql

@@ -0,0 +1,4 @@
+TRUNCATE TABLE roles CASCADE;
+INSERT INTO roles (id, name) VALUES (1, 'ADMIN');
+INSERT INTO roles (id, name) VALUES (2, 'USER');
+INSERT INTO roles (id, name) VALUES (3, 'ANONYMOUS');