Fix Auth for add lesson

Author: Tellmarch

playshogi-library-database/src/main/java/com/playshogi/library/database/LessonRepository.java

@@ -815,6 +815,30 @@ public boolean isLessonAuthor(final int lessonId, final int userId) {
         return false;
     }
 
+    public boolean isCampaignAuthor(final int campaignId, final int userId) {
+        Connection connection = dbConnection.getConnection();
+
+        try (PreparedStatement preparedStatement = connection.prepareStatement(CHECK_CAMPAIGN_AUTHOR)) {
+
+            preparedStatement.setInt(1, campaignId);
+            preparedStatement.setInt(2, userId);
+
+            try (ResultSet resultSet = preparedStatement.executeQuery()) {
+                if (resultSet.next()) {
+                    return true;
+                }
+            }
+
+        } catch (SQLException e) {
+            LOGGER.log(Level.SEVERE,
+                    "Error checking authorship for campaign " + campaignId + " by user " + userId, e);
+            return false;
+        }
+
+        LOGGER.log(Level.INFO, "User {0} is NOT the author of campaign {1}.", new Object[]{userId, campaignId});
+        return false;
+    }
+
     private static final String FIND_CHAPTERS_BY_LESSON_ID =
             "SELECT c.chapter_id, c.lesson_id, c.kifu_id, c.type, c.title, c.chapter_number, c.orientation, c.hidden," +
                     " k.usf " +

playshogi-website/playshogi-website-server/src/main/java/com/playshogi/website/gwt/server/services/LessonServiceImpl.java

@@ -105,7 +105,12 @@ public void addLessonToCampaign(final String sessionId, final String campaignId,
         if (loginResult == null || !loginResult.isLoggedIn()) {
             throw new IllegalStateException("Only logged in users can add a lesson in campaign");
         }
-        //TODO: auth
+
+        // Authorization Check: Check if the current user is the author of the campaign
+        if (!lessonRepository.isCampaignAuthor(Integer.parseInt(campaignId), loginResult.getUserId())) {
+            throw new IllegalStateException("User " + loginResult.getUserId() + " is not authorized to modify campaign "
+                    + campaignId);
+        }
 
         if (!lessonRepository.addLessonToCampaign(new PersistentCampaignLesson(Integer.parseInt(campaignId),
                 Integer.parseInt(lessonId), x, y, false,
@@ -133,7 +138,13 @@ public void updateCampaignNode(final String sessionId, final String campaignId,
 
         LoginResult loginResult = authenticator.checkSession(sessionId);
         if (loginResult == null || !loginResult.isLoggedIn()) {
-            throw new IllegalStateException("Only logged in users can delete a lesson in campaign");
+            throw new IllegalStateException("Only logged in users can update a lesson in campaign");
+        }
+
+        // Authorization Check: Check if the current user is the author of the campaign
+        if (!lessonRepository.isCampaignAuthor(Integer.parseInt(campaignId), loginResult.getUserId())) {
+            throw new IllegalStateException("User " + loginResult.getUserId() + " is not authorized to modify campaign "
+                    + campaignId);
         }
 
         if (!lessonRepository.updateCampaignLesson(getPersistentCampaignLesson(Integer.parseInt(campaignId), node))) {
@@ -146,7 +157,19 @@ public void updateCampaignNode(final String sessionId, final String campaignId,
 
     public void setPrerequisites(final String sessionId, final String campaignId, final String lessonId,
                                  List<String> prereqs) {
-        //TODO auth
+        LOGGER.log(Level.INFO, "setPrerequisites: " + campaignId);
+
+        LoginResult loginResult = authenticator.checkSession(sessionId);
+        if (loginResult == null || !loginResult.isLoggedIn()) {
+            throw new IllegalStateException("Only logged in users can update a lesson in campaign");
+        }
+
+        // Authorization Check: Check if the current user is the author of the campaign
+        if (!lessonRepository.isCampaignAuthor(Integer.parseInt(campaignId), loginResult.getUserId())) {
+            throw new IllegalStateException("User " + loginResult.getUserId() + " is not authorized to modify campaign "
+                    + campaignId);
+        }
+
         lessonRepository.updateLessonPrerequisites(Integer.parseInt(campaignId), Integer.parseInt(lessonId),
                 prereqs.stream().map(Integer::parseInt).collect(Collectors.toList()));
     }