Ozg-5176 Require ADMIN_ADMIN role for configuration endpoint

src/main/java/de/ozgcloud/admin/security/SecurityConfiguration.java

@@ -55,8 +55,8 @@ public class SecurityConfiguration {
 
 		http.authorizeHttpRequests(requests -> requests
 				.requestMatchers(HttpMethod.GET, "/api/environment").permitAll()
-				.requestMatchers("/api/configuration/settings").hasRole(UserRole.ADMIN_USER)
-				.requestMatchers("/api/configuration/settings/**").hasRole(UserRole.ADMIN_USER)
+				.requestMatchers("/api/configuration").hasRole(UserRole.ADMIN_USER)
+				.requestMatchers("/api/configuration/**").hasRole(UserRole.ADMIN_USER)
 				.requestMatchers("/api").authenticated()
 				.requestMatchers("/api/**").authenticated()
 				.requestMatchers("/actuator").permitAll()

src/test/java/de/ozgcloud/admin/security/SecurityConfigurationITCase.java

@@ -138,35 +138,33 @@ class SecurityConfigurationITCase {
 	@Nested
 	class TestWithAuthentication {
 
-		static final String CLAIMS = """
-				{
-				  "preferredUsername": "testUser",
-				  "scope": "openid testscope"
-				}""";
-
+		@Test
 		@SneakyThrows
-		@ParameterizedTest
-		@ValueSource(strings = {
-				"/api/environment",
-				"/configserver/name/profile",
-				"/api", "/api/configuration"
-		})
-		@WithJwt(CLAIMS)
-		void shouldAllow(String path) {
-			var result = doPerformAuthenticated(path);
+		@WithMockUser
+		void shouldAllowApiEndpoint() {
+			var result = doPerformAuthenticated("/api");
 
 			result.andExpect(status().isOk());
 		}
 
 		@Test
 		@SneakyThrows
-		@WithJwt(CLAIMS)
-		void shouldForbid() {
+		@WithMockUser
+		void shouldForbidSettingsEndpoint() {
 			var result = doPerformAuthenticated("/api/configuration/settings");
 
 			result.andExpect(status().isForbidden());
 		}
 
+		@Test
+		@SneakyThrows
+		@WithMockUser
+		void shouldForbidConfigurationsEndpoint() {
+			var result = doPerformAuthenticated("/api/configuration");
+
+			result.andExpect(status().isForbidden());
+		}
+
 		@SneakyThrows
 		private ResultActions doPerformAuthenticated(String path) {
 			return mockMvc.perform(get(path));
@@ -179,10 +177,19 @@ class SecurityConfigurationITCase {
 		@Test
 		@SneakyThrows
 		@WithMockUser(roles = UserRole.ADMIN_USER)
-		void shouldAllow() {
+		void shouldAllowSettings() {
 			var result = mockMvc.perform(get("/api/configuration/settings"));
 
 			result.andExpect(status().isOk());
 		}
+
+		@Test
+		@SneakyThrows
+		@WithMockUser(roles = UserRole.ADMIN_USER)
+		void shouldAllowConfiguration() {
+			var result = mockMvc.perform(get("/api/configuration"));
+
+			result.andExpect(status().isOk());
+		}
 	}
 }