[issue - 65] add config for "user/update"
@@ -5,6 +5,7 @@ import java.util.Arrays;
import java.util.Collections;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
@@ -63,9 +64,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
.hasAnyRole("USER", "ADMIN", "MODERATOR")
.antMatchers("/place/save/favoritePlace")
.hasAnyRole("USER", "ADMIN", "MODERATOR")
- .antMatchers("/user/role/**")
- .hasAnyRole("USER", "ADMIN", "MODERATOR")
- .antMatchers("/user/**").permitAll()
+ .antMatchers(HttpMethod.PATCH, "/user/update/role").hasRole("ADMIN")
+ .antMatchers(HttpMethod.PATCH, "/user/update/status").hasAnyRole("ADMIN", "USER")
.anyRequest()
.hasAnyRole("ADMIN")
.and()
