Restricted getting account details

ScarletRedMan · Mar 25, 2024 · d0a1e25 · d0a1e25
1 parent 743c3a9
commit d0a1e25
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/server/src/main/java/ru/dragonestia/picker/controller/AccountsController.java b/server/src/main/java/ru/dragonestia/picker/controller/AccountsController.java
@@ -2,6 +2,7 @@
 
 import lombok.RequiredArgsConstructor;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.web.bind.annotation.*;
@@ -22,6 +23,7 @@ ResponseAccount currentAccount() {
         return account.toResponseObject();
     }
 
+    @PreAuthorize("hasRole('ADMIN')")
     @GetMapping("/{accountId}")
     ResponseEntity<ResponseAccount> findAccount(@PathVariable String accountId) {
         try {