From e2f424ce652c258520d5637d3eed5ca0e998639d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Mar 2026 22:22:55 +0000
Subject: [PATCH 1/2] Initial plan


From ab212a673fca82c486191d8d2bb8849376e973fa Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Mar 2026 22:27:15 +0000
Subject: [PATCH 2/2] feat: enforce self-or-admin authorization for user update
 endpoint

Co-authored-by: Mats057 <119885089+Mats057@users.noreply.github.com>
---
 src/main/java/com/booker/constants/Auth.java             | 1 +
 src/main/java/com/booker/controllers/UserController.java | 2 ++
 src/main/java/com/booker/services/UserService.java       | 7 +++++++
 3 files changed, 10 insertions(+)

diff --git a/src/main/java/com/booker/constants/Auth.java b/src/main/java/com/booker/constants/Auth.java
index cfd0cc3..602aee4 100644
--- a/src/main/java/com/booker/constants/Auth.java
+++ b/src/main/java/com/booker/constants/Auth.java
@@ -6,6 +6,7 @@ public final class Auth {
 
   public static final String ADMIN_AUTHORIZATION = "hasRole('" + ADMIN_ROLE + "')";
   public static final String REVIEW_OWNER_OR_ADMIN = "@reviewService.isOwner(#id, authentication.principal.username) or " + ADMIN_AUTHORIZATION;
+  public static final String USER_SELF_OR_ADMIN = "@userService.isSelf(#id, authentication.principal.username) or " + ADMIN_AUTHORIZATION;
 
   private Auth() {}
 }
\ No newline at end of file
diff --git a/src/main/java/com/booker/controllers/UserController.java b/src/main/java/com/booker/controllers/UserController.java
index d399672..7252251 100644
--- a/src/main/java/com/booker/controllers/UserController.java
+++ b/src/main/java/com/booker/controllers/UserController.java
@@ -39,6 +39,7 @@
 
 import static com.booker.constants.Auth.ADMIN_ROLE;
 import static com.booker.constants.Auth.ADMIN_AUTHORIZATION;
+import static com.booker.constants.Auth.USER_SELF_OR_ADMIN;
 
 @RestController
 @RequestMapping("/users")
@@ -92,6 +93,7 @@ public ResponseEntity<UserDTO> post(@RequestBody @Valid CreateUserDTO data) {
   }
 
   @PatchMapping("/{id}")
+  @PreAuthorize(USER_SELF_OR_ADMIN)
   @Operation(summary = "Update user", description = "Update an existing user's information")
   @ApiResponses(value = {
       @ApiResponse(responseCode = "200", description = "User updated successfully"),
diff --git a/src/main/java/com/booker/services/UserService.java b/src/main/java/com/booker/services/UserService.java
index 0a85600..3078188 100644
--- a/src/main/java/com/booker/services/UserService.java
+++ b/src/main/java/com/booker/services/UserService.java
@@ -170,4 +170,11 @@ public void updatePassword(UUID id, UpdatePasswordDTO data) {
   public void delete(UUID id) {
     repository.deleteById(id);
   }
+
+  @Transactional(readOnly = true)
+  public boolean isSelf(UUID id, String username) {
+    return repository.findById(id)
+        .map(user -> user.getUsername().equals(username))
+        .orElse(false);
+  }
 }
\ No newline at end of file