diff --git a/project-service/src/main/java/com/techtorque/project_service/config/GatewayHeaderFilter.java b/project-service/src/main/java/com/techtorque/project_service/config/GatewayHeaderFilter.java index 994fc70..5a07258 100644 --- a/project-service/src/main/java/com/techtorque/project_service/config/GatewayHeaderFilter.java +++ b/project-service/src/main/java/com/techtorque/project_service/config/GatewayHeaderFilter.java @@ -26,7 +26,19 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse if (userId != null && !userId.isEmpty()) { List authorities = rolesHeader == null ? Collections.emptyList() : Arrays.stream(rolesHeader.split(",")) - .map(role -> new SimpleGrantedAuthority("ROLE_" + role.trim().toUpperCase())) + .map(role -> { + String roleUpper = role.trim().toUpperCase(); + // Treat SUPER_ADMIN as ADMIN for authorization purposes + if ("SUPER_ADMIN".equals(roleUpper)) { + // Add both SUPER_ADMIN and ADMIN roles + return Arrays.asList( + new SimpleGrantedAuthority("ROLE_SUPER_ADMIN"), + new SimpleGrantedAuthority("ROLE_ADMIN") + ); + } + return Collections.singletonList(new SimpleGrantedAuthority("ROLE_" + roleUpper)); + }) + .flatMap(List::stream) .collect(Collectors.toList()); UsernamePasswordAuthenticationToken authentication = diff --git a/project-service/src/main/java/com/techtorque/project_service/controller/ProjectController.java b/project-service/src/main/java/com/techtorque/project_service/controller/ProjectController.java index 1ecad5f..8c4a451 100644 --- a/project-service/src/main/java/com/techtorque/project_service/controller/ProjectController.java +++ b/project-service/src/main/java/com/techtorque/project_service/controller/ProjectController.java @@ -43,9 +43,21 @@ public ResponseEntity requestModification( @Operation(summary = "List projects for the current customer") @GetMapping - @PreAuthorize("hasRole('CUSTOMER')") - public ResponseEntity listCustomerProjects(@RequestHeader("X-User-Subject") String customerId) { - List projects = projectService.getProjectsForCustomer(customerId); + @PreAuthorize("hasAnyRole('CUSTOMER', 'ADMIN', 'EMPLOYEE')") + public ResponseEntity listCustomerProjects( + @RequestHeader("X-User-Subject") String userId, + @RequestHeader("X-User-Roles") String roles) { + + List projects; + + // Admin and Employee can see all projects + if (roles.contains("ADMIN") || roles.contains("EMPLOYEE")) { + projects = projectService.getAllProjects(); + } else { + // Customer sees only their own projects + projects = projectService.getProjectsForCustomer(userId); + } + List response = projects.stream() .map(this::mapToResponseDto) .collect(Collectors.toList()); diff --git a/project-service/src/main/java/com/techtorque/project_service/controller/ServiceController.java b/project-service/src/main/java/com/techtorque/project_service/controller/ServiceController.java index 264e5de..624c2b4 100644 --- a/project-service/src/main/java/com/techtorque/project_service/controller/ServiceController.java +++ b/project-service/src/main/java/com/techtorque/project_service/controller/ServiceController.java @@ -42,11 +42,34 @@ public ResponseEntity createService( @Operation(summary = "List services for the current customer") @GetMapping - @PreAuthorize("hasRole('CUSTOMER')") + @PreAuthorize("hasAnyRole('CUSTOMER', 'ADMIN', 'EMPLOYEE')") public ResponseEntity listCustomerServices( - @RequestHeader("X-User-Subject") String customerId, + @RequestHeader("X-User-Subject") String userId, + @RequestHeader("X-User-Roles") String roles, @RequestParam(required = false) String status) { - List services = standardServiceService.getServicesForCustomer(customerId, status); + + List services; + + // Admin and Employee can see all services + if (roles.contains("ADMIN") || roles.contains("EMPLOYEE")) { + services = standardServiceService.getAllServices(); + // Apply status filter if provided + if (status != null && !status.isEmpty()) { + try { + com.techtorque.project_service.entity.ServiceStatus statusEnum = + com.techtorque.project_service.entity.ServiceStatus.valueOf(status.toUpperCase()); + services = services.stream() + .filter(s -> s.getStatus() == statusEnum) + .collect(Collectors.toList()); + } catch (IllegalArgumentException e) { + // Invalid status, ignore filter + } + } + } else { + // Customer sees only their own services + services = standardServiceService.getServicesForCustomer(userId, status); + } + List response = services.stream() .map(this::mapToServiceResponseDto) .collect(Collectors.toList()); diff --git a/project-service/src/main/java/com/techtorque/project_service/service/StandardServiceService.java b/project-service/src/main/java/com/techtorque/project_service/service/StandardServiceService.java index 4b2b0c3..827a865 100644 --- a/project-service/src/main/java/com/techtorque/project_service/service/StandardServiceService.java +++ b/project-service/src/main/java/com/techtorque/project_service/service/StandardServiceService.java @@ -13,6 +13,8 @@ public interface StandardServiceService { StandardService createServiceFromAppointment(CreateServiceDto dto, String employeeId); List getServicesForCustomer(String customerId, String status); + + List getAllServices(); // For admin/employee to see all services Optional getServiceDetails(String serviceId, String userId, String userRole); diff --git a/project-service/src/main/java/com/techtorque/project_service/service/impl/StandardServiceServiceImpl.java b/project-service/src/main/java/com/techtorque/project_service/service/impl/StandardServiceServiceImpl.java index 0aa6735..7ed0286 100644 --- a/project-service/src/main/java/com/techtorque/project_service/service/impl/StandardServiceServiceImpl.java +++ b/project-service/src/main/java/com/techtorque/project_service/service/impl/StandardServiceServiceImpl.java @@ -77,6 +77,13 @@ public List getServicesForCustomer(String customerId, String st return services; } + @Override + @Transactional(readOnly = true) + public List getAllServices() { + log.info("Fetching all services (admin/employee access)"); + return serviceRepository.findAll(); + } + @Override public Optional getServiceDetails(String serviceId, String userId, String userRole) { log.info("Fetching service {} for user: {} with role: {}", serviceId, userId, userRole);