Package sk.iway.iwcm.components.users.sessions

Class SessionRestController

java.lang.Object

sk.iway.iwcm.components.users.sessions.SessionRestController

@RestController
@PreAuthorize("@WebjetSecurityService.isAdmin()")
public class SessionRestController
extends Object

Session listing, personal login history and logout API for the active-session dialog.

Constructor Summary

Constructors

Constructor	Description
SessionRestController(SessionService service, AuditRepository auditRepository)

Method Summary

Modifier and Type	Method	Description
org.springframework.data.domain.Page<AuditLogEntity>	history(jakarta.servlet.http.HttpServletRequest request, int page)	Reads login events from the last thirty days, deriving ownership, period and ordering on the server.
Map<String,String>	invalidTarget(IllegalArgumentException exception)	Reports invalid target selection as a bad request rather than a server failure.
List<LoggedAdministratorDto>	loggedAdministrators(jakarta.servlet.http.HttpServletRequest request)	Returns fresh administrator summaries only to callers with the list permission.
SessionLogoutResultDto	logoutAdministrator(int userId, jakarta.servlet.http.HttpServletRequest request)	Ends another administrator's sessions; displaying the list does not grant this operation.
SessionLogoutResultDto	logoutSession(String sessionId, jakarta.servlet.http.HttpServletRequest request)	Ends another session of the current account without requiring administrator-management permission.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SessionRestController

public SessionRestController(SessionService service,
 AuditRepository auditRepository)

Method Details

loggedAdministrators

@GetMapping("/admin/rest/sessions/administrators")
@PreAuthorize("@WebjetSecurityService.hasPermission(\'welcomeShowLoggedAdmins\')")
public List<LoggedAdministratorDto> loggedAdministrators(jakarta.servlet.http.HttpServletRequest request)

Returns fresh administrator summaries only to callers with the list permission.

history

@GetMapping("/admin/rest/sessions/login-history")
@PreAuthorize("@WebjetSecurityService.isLogged()")
public org.springframework.data.domain.Page<AuditLogEntity> history(jakarta.servlet.http.HttpServletRequest request,
 @RequestParam(value="page",defaultValue="0")
 int page)

Reads login events from the last thirty days, deriving ownership, period and ordering on the server. Available to signed-in administrators without requiring audit permission.

Parameters:

request - request containing the authenticated user's session

page - zero-based page, clamped to zero for negative values

Returns:

up to twenty login audit records in descending creation order

Throws:

org.springframework.security.access.AccessDeniedException - if no authenticated user is present

logoutSession

@PostMapping("/admin/rest/sessions/logout")
public SessionLogoutResultDto logoutSession(@RequestParam("sessionId")
 String sessionId,
 jakarta.servlet.http.HttpServletRequest request)

Ends another session of the current account without requiring administrator-management permission.

logoutAdministrator

@PostMapping("/admin/rest/sessions/logout-administrator")
@PreAuthorize("@WebjetSecurityService.hasPermission(\'users.edit_admins\')")
public SessionLogoutResultDto logoutAdministrator(@RequestParam("userId")
 int userId,
 jakarta.servlet.http.HttpServletRequest request)

Ends another administrator's sessions; displaying the list does not grant this operation.

invalidTarget

@ExceptionHandler(java.lang.IllegalArgumentException.class)
@ResponseStatus(BAD_REQUEST)
public Map<String,String> invalidTarget(IllegalArgumentException exception)

Reports invalid target selection as a bad request rather than a server failure.