Merge pull request #419 from Adyen/feature/AD-271

AD-271 OCC Security
Adyen · Jun 7, 2024 · 5b25c2d · 5b25c2d
2 parents 6124e54 + 1f89f74
commit 5b25c2d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/adyenocc/src/com/adyen/commerce/controllers/PaymentMethodsController.java b/adyenocc/src/com/adyen/commerce/controllers/PaymentMethodsController.java
@@ -13,6 +13,7 @@
 import io.swagger.v3.oas.annotations.tags.Tag;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -26,6 +27,7 @@ public class PaymentMethodsController
     @Autowired
     private AdyenCheckoutFacade adyenCheckoutFacade;
 
+    @Secured({ "ROLE_CUSTOMERGROUP", "ROLE_TRUSTED_CLIENT", "ROLE_CUSTOMERMANAGERGROUP" })
     @GetMapping(value = "/checkout-configuration")
     @Operation(operationId = "getCheckoutConfiguration", summary = "Get checkout configuration", description =
             "Returns configuration for Adyen dropin component")

diff --git a/adyenocc/src/com/adyen/commerce/controllers/PlaceOrderController.java b/adyenocc/src/com/adyen/commerce/controllers/PlaceOrderController.java
@@ -13,6 +13,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.annotation.Secured;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestBody;
@@ -28,6 +29,7 @@ public class PlaceOrderController extends PlaceOrderControllerBase {
     private AdyenCheckoutApiFacade adyenCheckoutApiFacade;
 
 
+    @Secured({ "ROLE_CUSTOMERGROUP", "ROLE_CLIENT", "ROLE_CUSTOMERMANAGERGROUP", "ROLE_TRUSTED_CLIENT" })
     @PostMapping(value = "/additional-details", produces= MediaType.APPLICATION_JSON_VALUE)
     @Operation(operationId = "additionalDetails", summary = "Handle additional details action", description =
             "Places pending order based on additional details request")