[SELC-4812] Feat: Added @PreAuthorize in deleteUserGroup API (#442)

pagopa · May 14, 2024 · 16a2a3d · 16a2a3d
1 parent be2068b
commit 16a2a3d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/web/src/main/java/it/pagopa/selfcare/dashboard/web/controller/UserGroupV2Controller.java b/web/src/main/java/it/pagopa/selfcare/dashboard/web/controller/UserGroupV2Controller.java
@@ -102,6 +102,7 @@ public void updateUserGroup(@ApiParam("${swagger.dashboard.user-group.model.id}"
     @PostMapping(value = "/{id}/members/{userId}", produces = MediaType.APPLICATION_JSON_VALUE)
     @ResponseStatus(HttpStatus.NO_CONTENT)
     @ApiOperation(value = "", notes = "${swagger.dashboard.user-group.api.addMember}")
+    @PreAuthorize("hasPermission(#id, 'UserGroupResource', 'ADMIN')")
     public void addMemberToUserGroup(@ApiParam("${swagger.dashboard.user-group.model.id}")
                                      @PathVariable("id") String id,
                                      @ApiParam("${swagger.dashboard.user.model.id}")