Package sk.iway.iwcm.users.devices

Class AdminDeviceRestController

java.lang.Object

sk.iway.iwcm.users.devices.AdminDeviceRestController

@RestController
@RequestMapping("/admin/rest/security/login-events")
@PreAuthorize("@WebjetSecurityService.isAdmin()")
public class AdminDeviceRestController
extends Object

Account-owned device listing and security actions; notice details also arrive with the overview page.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final record	AdminDeviceRestController.Confirmation

Constructor Summary

Constructors

Constructor	Description
AdminDeviceRestController(AdminDeviceService service)

Method Summary

Modifier and Type	Method	Description
DeviceEntity	confirm(String id, AdminDeviceRestController.Confirmation proof, jakarta.servlet.http.HttpServletRequest request)	Requires exactly one email proof in addition to the authenticated account.
org.springframework.data.domain.Page<DeviceEntity>	devices(jakarta.servlet.http.HttpServletRequest request, int page)	Lists only the signed-in account's devices, ignoring client-supplied ownership, size and sorting.
DeviceEntity	report(String id, jakarta.servlet.http.HttpServletRequest request)	Blocks the reported browser and signs out its known sessions.
void	requestCode(String id, jakarta.servlet.http.HttpServletRequest request)	Sends a code to the authenticated account's email, never a client-supplied address.
void	unavailable(IllegalStateException exception)	Returns HTTP 503 instead of the default 500.jsp, which changes the status to 404 and can expose exception details to administrators.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AdminDeviceRestController

public AdminDeviceRestController(AdminDeviceService service)

Method Details

devices

@GetMapping
public org.springframework.data.domain.Page<DeviceEntity> devices(jakarta.servlet.http.HttpServletRequest request,
 @RequestParam(value="page",defaultValue="0")
 int page)

Lists only the signed-in account's devices, ignoring client-supplied ownership, size and sorting.

requestCode

@PostMapping("/{id}/code")
@ResponseStatus(NO_CONTENT)
public void requestCode(@PathVariable("id")
 String id,
 jakarta.servlet.http.HttpServletRequest request)

Sends a code to the authenticated account's email, never a client-supplied address.

confirm

@PostMapping("/{id}/confirm")
public DeviceEntity confirm(@PathVariable("id")
 String id,
 @RequestBody
 AdminDeviceRestController.Confirmation proof,
 jakarta.servlet.http.HttpServletRequest request)

Requires exactly one email proof in addition to the authenticated account.

report

@PostMapping("/{id}/report")
public DeviceEntity report(@PathVariable("id")
 String id,
 jakarta.servlet.http.HttpServletRequest request)

Blocks the reported browser and signs out its known sessions.

unavailable

@ExceptionHandler(java.lang.IllegalStateException.class)
@ResponseStatus(SERVICE_UNAVAILABLE)
public void unavailable(IllegalStateException exception)

Returns HTTP 503 instead of the default 500.jsp, which changes the status to 404 and can expose exception details to administrators. No response body is needed: the client checks the HTTP status and displays its own localized error message.

Parameters:

exception - persistence failure to log with its stack trace