[SELC-4808] Added @PreAuthorize in createUserGroup API (#438)

pagopa · May 13, 2024 · 650ee42 · 650ee42
1 parent 6f3aebf
commit 650ee42
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/web/src/main/java/it/pagopa/selfcare/dashboard/web/controller/UserGroupV2Controller.java b/web/src/main/java/it/pagopa/selfcare/dashboard/web/controller/UserGroupV2Controller.java
@@ -13,6 +13,7 @@
 import org.springframework.data.domain.Pageable;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletResponse;
@@ -34,6 +35,7 @@ public class UserGroupV2Controller {
     @ApiResponses({
             @ApiResponse(code = HttpServletResponse.SC_CONFLICT, message = "Conflict")
     })
+    @PreAuthorize("hasPermission(new it.pagopa.selfcare.dashboard.web.security.ProductAclDomain(#group.getInstitutionId(), #group.getProductId()), 'ADMIN')")
     public UserGroupIdResource createUserGroup(@RequestBody @Valid CreateUserGroupDto group) {
         log.trace("createGroup start");
         log.debug("createGroup group = {}", group);