This commit is contained in:
trochas
2026-01-12 14:06:51 +01:00
4 changed files with 69 additions and 8 deletions

View File

@@ -30,11 +30,9 @@ public class WebSecurityConfig {
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
// 2. Allow public endpoints BEFORE any authenticated() calls
.requestMatchers("/athlete/create", "/", "/public").permitAll()
.requestMatchers("/coach/**").permitAll()
// 3. Authenticated endpoints
.requestMatchers("/users/sync").authenticated()
.requestMatchers("/coach/**").hasRole("coach")
.requestMatchers("/admin/**").hasRole("admin")
.requestMatchers("/user/**").hasRole("user")
.requestMatchers("/athlete/**").hasRole("athlete")
.anyRequest().authenticated())
.oauth2ResourceServer(oauth2 -> oauth2
.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtToken -> {

View File

@@ -140,7 +140,6 @@ public class AthleteResource {
athlete.setName(dto.getName());
athlete.setCategorie(dto.getCategorie());
athlete.setNiveau(dto.getNiveau());
// Relationship: sessionId → session
if (dto.getSessionIds() != null) {
List<Session> sessions = new ArrayList<>();