Merge pull request #71 from Zenfulcode/70-unauthenticated-error-when-creating-order

fixing unauthenticated users aka guests, could make order requests

Author: gustaavik

src/main/java/com/zenfulcode/commercify/commercify/config/SecurityConfig.java

@@ -35,7 +35,10 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
                         .requestMatchers(
                                 "/api/v1/auth/**",
                                 "/api/v1/products/active",
-                                "/api/v1/products/{id}").permitAll()
+                                "/api/v1/products/{id}",
+                                "/api/v1/orders",
+                                "/api/v1/payments/mobilepay/create",
+                                "/api/v1/payments/stripe/create").permitAll()
                         .anyRequest().authenticated()
                 )
                 .sessionManagement(smc -> smc.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

src/main/java/com/zenfulcode/commercify/commercify/controller/OrderController.java

@@ -37,6 +37,7 @@ public class OrderController {
             "id", "userId", "status", "currency", "totalAmount", "createdAt", "updatedAt"
     );
 
+    @PreAuthorize("hasRole('USER') and #userId == authentication.principal.id")
     @PostMapping("/{userId}")
     public ResponseEntity<?> createOrder(@PathVariable Long userId, @RequestBody CreateOrderRequest orderRequest) {
         try {

src/main/java/com/zenfulcode/commercify/commercify/integration/mobilepay/MobilePayController.java

@@ -5,6 +5,7 @@
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 @RestController
@@ -37,6 +38,7 @@ public ResponseEntity<String> handleCallback(
         }
     }
 
+    @PreAuthorize("hasRole('ADMIN')")
     @PostMapping("/webhook")
     public ResponseEntity<String> handleWebhook(
             @RequestParam String paymentReference,