Enforce "self or admin" authorization on PATCH /users/{id}

src/main/java/com/booker/constants/Auth.java

@@ -6,6 +6,7 @@ public final class Auth {
 
   public static final String ADMIN_AUTHORIZATION = "hasRole('" + ADMIN_ROLE + "')";
   public static final String REVIEW_OWNER_OR_ADMIN = "@reviewService.isOwner(#id, authentication.principal.username) or " + ADMIN_AUTHORIZATION;
+  public static final String USER_SELF_OR_ADMIN = "@userService.isSelf(#id, authentication.principal.username) or " + ADMIN_AUTHORIZATION;
 
   private Auth() {}
 }

src/main/java/com/booker/controllers/UserController.java

@@ -39,6 +39,7 @@
 
 import static com.booker.constants.Auth.ADMIN_ROLE;
 import static com.booker.constants.Auth.ADMIN_AUTHORIZATION;
+import static com.booker.constants.Auth.USER_SELF_OR_ADMIN;
 
 @RestController
 @RequestMapping("/users")
@@ -92,6 +93,7 @@ public ResponseEntity<UserDTO> post(@RequestBody @Valid CreateUserDTO data) {
   }
 
   @PatchMapping("/{id}")
+  @PreAuthorize(USER_SELF_OR_ADMIN)
   @Operation(
     summary = "Update user",
     description = "Update an existing user's information. The fields 'role' and 'accountNonLocked' are admin-only."

src/main/java/com/booker/services/UserService.java

@@ -170,4 +170,11 @@ public void updatePassword(UUID id, UpdatePasswordDTO data) {
   public void delete(UUID id) {
     repository.deleteById(id);
   }
+
+  @Transactional(readOnly = true)
+  public boolean isSelf(UUID id, String username) {
+    return repository.findById(id)
+        .map(user -> user.getUsername().equals(username))
+        .orElse(false);
+  }
 }