Feat/fees only

src/main/java/school/hei/haapi/endpoint/FeesOnly.java

@@ -0,0 +1,8 @@
+package school.hei.haapi.endpoint;
+
+import java.lang.annotation.*;
+
+@Target({ElementType.TYPE, ElementType.METHOD})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface FeesOnly {
+}

src/main/java/school/hei/haapi/endpoint/FeesOnlyInterceptor.java

@@ -0,0 +1,57 @@
+package school.hei.haapi.endpoint;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.stereotype.Component;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.HandlerInterceptor;
+
+@Slf4j
+@Component
+public class FeesOnlyInterceptor implements HandlerInterceptor {
+    private final boolean feesOnly;
+    public FeesOnlyInterceptor(@Value("${FEES_ONLY:false}") boolean feesOnly) {
+        this.feesOnly = feesOnly;
+    }
+    @Override
+    public boolean preHandle(
+            HttpServletRequest request,
+            HttpServletResponse response,
+            Object handler) throws Exception {
+
+        String uri = request.getRequestURI();
+
+        if (!feesOnly || isAlwaysAllowed(uri)) {return true;}
+        if (!(handler instanceof HandlerMethod handlerMethod)) {return true;}
+        boolean allowed =
+                handlerMethod.getBeanType().isAnnotationPresent(FeesOnly.class)
+                        || handlerMethod.getMethod().isAnnotationPresent(FeesOnly.class);
+        if (!allowed) {
+            log.warn("Blocked by FEES_ONLY: {} {}", request.getMethod(), uri);
+            response.sendError(
+                    HttpServletResponse.SC_FORBIDDEN,
+                    "FEES_ONLY mode active");
+            return false;
+        }
+        return true;
+    }
+    private boolean isAlwaysAllowed(String uri) {
+        return uri.equals("/whoami")
+                || uri.equals("/ping")
+                || uri.equals("/health/db")
+                || uri.startsWith("/authentication/")
+                || uri.startsWith("/oauth2/")
+                || uri.startsWith("/oauth2/authorization/")
+                || uri.startsWith("/login")
+                || uri.startsWith("/login/oauth2/")
+                || uri.startsWith("/logout")
+                || uri.startsWith("/error")
+                || uri.startsWith("/actuator")
+                || uri.startsWith("/auth/")
+                || uri.startsWith("/api/auth/")
+                || uri.startsWith("/callback")
+                || uri.startsWith("/casdoor/");
+    }
+}

src/main/java/school/hei/haapi/endpoint/FeesOnlyInterceptorConfigurer.java

@@ -0,0 +1,19 @@
+package school.hei.haapi.endpoint;
+
+import lombok.AllArgsConstructor;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
+
+@Configuration
+@AllArgsConstructor
+public class FeesOnlyInterceptorConfigurer implements WebMvcConfigurer {
+
+    private final FeesOnlyInterceptor feesOnlyInterceptor;
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(feesOnlyInterceptor)
+                .addPathPatterns("/**");
+    }
+}

src/main/java/school/hei/haapi/endpoint/rest/controller/AdminController.java

@@ -5,6 +5,7 @@
 import lombok.AllArgsConstructor;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
+import school.hei.haapi.endpoint.FeesOnly;
 import school.hei.haapi.endpoint.rest.mapper.UserMapper;
 import school.hei.haapi.endpoint.rest.model.Admin;
 import school.hei.haapi.endpoint.rest.model.CrupdateManager;
@@ -13,6 +14,7 @@
 
 @RestController
 @AllArgsConstructor
+@FeesOnly
 public class AdminController {
 
   private final UserService userService;

src/main/java/school/hei/haapi/endpoint/rest/controller/FeeController.java

@@ -20,6 +20,7 @@
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import school.hei.haapi.endpoint.FeesOnly;
 import school.hei.haapi.endpoint.rest.mapper.FeeMapper;
 import school.hei.haapi.endpoint.rest.mapper.FeeTemplateMapper;
 import school.hei.haapi.endpoint.rest.model.*;
@@ -37,6 +38,7 @@
 
 @RestController
 @AllArgsConstructor
+@FeesOnly
 @Slf4j
 public class FeeController {
   private final UserService userService;

src/main/java/school/hei/haapi/endpoint/rest/controller/ManagerController.java

@@ -14,6 +14,7 @@
 import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
+import school.hei.haapi.endpoint.FeesOnly;
 import school.hei.haapi.endpoint.rest.mapper.SexEnumMapper;
 import school.hei.haapi.endpoint.rest.mapper.StatusEnumMapper;
 import school.hei.haapi.endpoint.rest.mapper.UserMapper;
@@ -30,6 +31,7 @@
 
 @RestController
 @AllArgsConstructor
+@FeesOnly
 public class ManagerController {
   private final SexEnumMapper sexEnumMapper;
   private final StatusEnumMapper statusEnumMapper;

src/main/java/school/hei/haapi/endpoint/rest/controller/PaymentController.java

@@ -11,6 +11,7 @@
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import school.hei.haapi.endpoint.FeesOnly;
 import school.hei.haapi.endpoint.rest.mapper.PaymentMapper;
 import school.hei.haapi.endpoint.rest.model.CreatePayment;
 import school.hei.haapi.endpoint.rest.model.Payment;
@@ -21,6 +22,7 @@
 
 @RestController
 @AllArgsConstructor
+@FeesOnly
 public class PaymentController {
   private final PaymentService paymentService;
   private final PaymentMapper paymentMapper;

src/main/java/school/hei/haapi/endpoint/rest/controller/StudentController.java

@@ -17,6 +17,7 @@
 import org.springframework.web.bind.annotation.RequestPart;
 import org.springframework.web.bind.annotation.RestController;
 import org.springframework.web.multipart.MultipartFile;
+import school.hei.haapi.endpoint.FeesOnly;
 import school.hei.haapi.endpoint.rest.mapper.GroupFlowMapper;
 import school.hei.haapi.endpoint.rest.mapper.SexEnumMapper;
 import school.hei.haapi.endpoint.rest.mapper.StatusCheckMapper;
@@ -50,6 +51,7 @@
 
 @RestController
 @AllArgsConstructor
+@FeesOnly
 public class StudentController {
   private final UserService userService;
   private final UserMapper userMapper;