Feat/comment controller

pom.xml

@@ -77,6 +77,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-validation</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

src/main/java/org/example/vet1177/controllers/CommentController.java

@@ -0,0 +1,99 @@
+package org.example.vet1177.controllers;
+
+import jakarta.validation.Valid;
+import org.example.vet1177.dto.request.comment.CreateCommentRequest;
+import org.example.vet1177.dto.request.comment.UpdateCommentRequest;
+import org.example.vet1177.dto.response.comment.CommentResponse;
+import org.example.vet1177.entities.User;
+import org.example.vet1177.services.CommentService;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.annotation.AuthenticationPrincipal;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/comments")
+public class CommentController {
+
+    private final CommentService commentService;
+
+    public CommentController(CommentService commentService) {
+        this.commentService = commentService;
+    }
+
+    // POST /api/comments
+    @PostMapping
+    @Transactional
+    public ResponseEntity<CommentResponse> create(
+            @Valid @RequestBody CreateCommentRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        return ResponseEntity.ok(
+                CommentResponse.from(
+                        commentService.create(
+                                request.recordId(),
+                                request.body(),
+                                currentUser
+                        )
+                )
+        );
+    }
+
+    // GET /api/comments/record/{recordId}
+    @GetMapping("/record/{recordId}")
+    @Transactional(readOnly = true)
+    public ResponseEntity<List<CommentResponse>> getByRecord(
+            @PathVariable UUID recordId,
+            @AuthenticationPrincipal User currentUser) {
+
+        return ResponseEntity.ok(
+                commentService.getByRecord(recordId, currentUser)
+                        .stream()
+                        .map(CommentResponse::from)
+                        .toList()
+        );
+    }
+
+    // PUT /api/comments/{id}
+    @PutMapping("/{id}")
+    @Transactional
+    public ResponseEntity<CommentResponse> update(
+            @PathVariable UUID id,
+            @Valid @RequestBody UpdateCommentRequest request,
+            @AuthenticationPrincipal User currentUser) {
+
+        return ResponseEntity.ok(
+                CommentResponse.from(
+                        commentService.update(id, request.body(), currentUser)
+                )
+        );
+    }
+    // DELETE /api/comments/{id}
+    @DeleteMapping("/{id}")
+    @Transactional
+    public ResponseEntity<Void> delete(
+            @PathVariable UUID id,
+            @AuthenticationPrincipal User currentUser) {
+
+        commentService.delete(id, currentUser);
+        return ResponseEntity.noContent().build();
+    }
+
+    // CommentController — lägg till currentUser
+    @GetMapping("/record/{recordId}/count")
+    @Transactional(readOnly = true)
+    public ResponseEntity<Long> countByRecord(
+            @PathVariable UUID recordId,
+            @AuthenticationPrincipal User currentUser) {
+        return ResponseEntity.ok(
+                commentService.countByRecord(recordId, currentUser)
+        );
+    }
+
+
+
+
+}

src/main/java/org/example/vet1177/security/SecurityConfig.java

@@ -0,0 +1,28 @@
+package org.example.vet1177.security;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http)
+            throws Exception {
+        return http
+                .csrf(csrf -> csrf.disable())
+                .authorizeHttpRequests(auth -> auth
+                        .anyRequest().permitAll()  // ← temporärt, öppnar allt
+                )
+                .build();
+    }
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}

src/main/java/org/example/vet1177/services/CommentService.java

@@ -1,7 +1,6 @@
 package org.example.vet1177.services;
 
 import org.example.vet1177.entities.*;
-import org.example.vet1177.exception.BusinessRuleException;
 import org.example.vet1177.exception.ResourceNotFoundException;
 import org.example.vet1177.policy.CommentPolicy;
 import org.example.vet1177.repository.CommentRepository;
@@ -72,7 +71,12 @@ public void delete(UUID commentId, User currentUser) {
     }
 
     @Transactional(readOnly = true)
-    public long countByRecord(UUID recordId) {
+    public long countByRecord(UUID recordId, User currentUser) {
+        MedicalRecord record = medicalRecordRepository.findById(recordId)
+                .orElseThrow(() -> new ResourceNotFoundException("MedicalRecord", recordId));
+
+        commentPolicy.canView(currentUser, record);  // ← åtkomstkontroll
+
         return commentRepository.countByMedicalRecordId(recordId);
     }
 }