Skip to content

Commit e61a32d

Browse files
HernandoJuniorHernandoJunior
committed
fix: SameSite=None para cookies cross-origin + logs debug
1 parent 16cde75 commit e61a32d

8 files changed

Lines changed: 144 additions & 25 deletions

File tree

‎close‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
16cde75 (HEAD -> dev, origin/dev) change token do httpOnly
2+
c004418 add return cpf in dto
3+
b3565fa add feature to atualize cpd administrador
4+
ce2df11 add dates to control page carteira
5+
17ad20a put supervisor to make the sale
6+
c474973 change controller venda
7+
61e9995 Merge branch 'dev' of github.com:HernandoJunior/api-java-spring-virtus into dev
8+
408f59d change value comissao
9+
e00667a Create README.md
10+
692d519 add file jar
11+
8db711b change security config
12+
0c85985 change file to .jar
13+
5305445 change .war to .jar
14+
51fcc04 test new route
15+
d077db5 add route test
16+
a82c32b change bug vendas
17+
7bd3b4a add files
18+
0265b0f add config files
19+
1fd480a Update SecurityConfig.java
20+
75812b9 Update deploy.yml
21+
0a795b5 Update SecurityConfig.java
22+
454eef4 Merge branch 'dev' of github.com:HernandoJunior/api-java-spring-virtus into dev
23+
c1d1b98 change config deploy.yml
24+
1764b88 Update deploy.yml
25+
d293816 Update deploy.yml
26+
121263d Adiciona pipeline de deploy automático para branch dev
27+
c91e656 Adiciona pipeline de deploy automático para branch dev
28+
6cbf349 add new files
29+
8c32704 final project
30+
620fd74 final project
31+
60d0c06 add token to all users
32+
f76fed0 add token to all users
33+
a6424c3 ädd files atualized/ service, controller, dtos
34+
33fd50a att project
35+
d132894 add import config
36+
d0120ae actualy project
37+
8823e7c project att
38+
8cf2c92 add new files
39+
10a7a9e add project github

‎src/main/java/com/virtusconsultoria/configsecurity/SecurityConfig.java‎

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
// src/main/java/com/virtusconsultoria/configsecurity/SecurityConfig.java
12
package com.virtusconsultoria.configsecurity;
23

34
import com.virtusconsultoria.service.AuthorizationService;
@@ -44,8 +45,7 @@ public SecurityFilterChain filtrarCadeiaDeSeguranca(HttpSecurity httpSecurity) t
4445
.authorizeHttpRequests(authorize -> authorize
4546
// --- Rotas Públicas ---
4647
.requestMatchers(HttpMethod.POST, "/auth/login").permitAll()
47-
// Adicionar rota de reset de senha aqui quando for criada
48-
// .requestMatchers(HttpMethod.POST, "/auth/reset-senha").permitAll()
48+
.requestMatchers(HttpMethod.POST, "/auth/refresh").permitAll()
4949
.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
5050

5151
// --- Rotas do USER (Colaborador) ---
@@ -65,7 +65,7 @@ public SecurityFilterChain filtrarCadeiaDeSeguranca(HttpSecurity httpSecurity) t
6565
.requestMatchers("/carteiras/**").hasAnyRole("SUPERVISOR", "ADMIN")
6666
.requestMatchers("/relatorios/**").hasAnyRole("SUPERVISOR", "ADMIN")
6767
.requestMatchers("/metas/**").hasAnyRole("SUPERVISOR", "ADMIN")
68-
.requestMatchers(HttpMethod.POST, "/clientes/upload").hasAnyRole("SUPERVISOR", "ADMIN") // Apenas Admin importa planilhas
68+
.requestMatchers(HttpMethod.POST, "/clientes/upload").hasAnyRole("SUPERVISOR", "ADMIN")
6969

7070
// --- Rotas Exclusivas do ADMIN ---
7171
.requestMatchers("/usuarios/**").hasRole("ADMIN")
@@ -78,9 +78,7 @@ public SecurityFilterChain filtrarCadeiaDeSeguranca(HttpSecurity httpSecurity) t
7878
.requestMatchers(HttpMethod.GET, "/propostas/**").authenticated()
7979
.requestMatchers(HttpMethod.GET, "/clientes/**").authenticated()
8080

81-
// SecurityConfig.java
82-
.requestMatchers(HttpMethod.POST, "/auth/login").permitAll()
83-
.requestMatchers(HttpMethod.POST, "/auth/refresh").permitAll()
81+
// Auth endpoints
8482
.requestMatchers(HttpMethod.GET, "/auth/me").authenticated()
8583
.requestMatchers(HttpMethod.POST, "/auth/logout").authenticated()
8684

@@ -111,22 +109,26 @@ public PasswordEncoder passwordEncoder() {
111109
return new BCryptPasswordEncoder();
112110
}
113111

114-
115112
@Bean
116113
public CorsConfigurationSource corsConfigurationSource() {
117114
CorsConfiguration configuration = new CorsConfiguration();
115+
118116
configuration.setAllowedOrigins(Arrays.asList(
119117
"http://localhost:5173",
120118
"http://localhost:8081",
121119
"http://localhost:8080",
122-
"https://front-end-virtus.vercel.app"
120+
"https://front-end-virtus.vercel.app",
121+
"https://front-end-virtus.vercel.app/"
123122
));
123+
124124
configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
125125
configuration.setAllowedHeaders(Arrays.asList("*"));
126-
configuration.setAllowCredentials(true); // CRUCIAL para cookies
126+
configuration.setAllowCredentials(true); // ✅ CRÍTICO
127+
128+
configuration.setExposedHeaders(Arrays.asList("Set-Cookie"));
127129

128130
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
129131
source.registerCorsConfiguration("/**", configuration);
130132
return source;
131133
}
132-
}
134+
}

‎src/main/java/com/virtusconsultoria/configsecurity/VerificarToken.java‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,23 +33,58 @@ protected void doFilterInternal(
3333
HttpServletResponse response,
3434
FilterChain filterChain) throws ServletException, IOException {
3535

36-
String token = recuperarTokenDoCookie(request);
36+
String token = recuperarToken(request);
37+
38+
System.out.println("=== FILTRO DE TOKEN ===");
39+
System.out.println("URL: " + request.getRequestURL());
40+
System.out.println("Método: " + request.getMethod());
41+
System.out.println("Origin: " + request.getHeader("Origin"));
42+
System.out.println("Token encontrado: " + (token != null ? "SIM" : "NÃO"));
43+
44+
if (request.getCookies() != null) {
45+
System.out.println("Cookies recebidos:");
46+
for (Cookie c : request.getCookies()) {
47+
System.out.println(" - " + c.getName() + " = " + c.getValue().substring(0, Math.min(20, c.getValue().length())) + "...");
48+
}
49+
} else {
50+
System.out.println("⚠️ Nenhum cookie recebido!");
51+
}
3752

3853
if (token != null) {
3954
String login = tokenService.validarAccessToken(token);
55+
System.out.println("Token válido para: " + login);
4056

4157
if (login != null) {
4258
UserDetails user = authorizationService.loadUserByUsername(login);
4359
var authentication = new UsernamePasswordAuthenticationToken(
4460
user, null, user.getAuthorities()
4561
);
4662
SecurityContextHolder.getContext().setAuthentication(authentication);
63+
System.out.println("✅ Usuário autenticado: " + login);
64+
} else {
65+
System.err.println("❌ Token inválido ou expirado");
4766
}
4867
}
4968

69+
System.out.println("========================");
70+
5071
filterChain.doFilter(request, response);
5172
}
5273

74+
private String recuperarToken(HttpServletRequest request) {
75+
String tokenDoCookie = recuperarTokenDoCookie(request);
76+
if (tokenDoCookie != null) {
77+
return tokenDoCookie;
78+
}
79+
80+
String authHeader = request.getHeader("Authorization");
81+
if (authHeader != null && authHeader.startsWith("Bearer ")) {
82+
return authHeader.substring(7);
83+
}
84+
85+
return null;
86+
}
87+
5388
private String recuperarTokenDoCookie(HttpServletRequest request) {
5489
Cookie[] cookies = request.getCookies();
5590
if (cookies != null) {

‎src/main/java/com/virtusconsultoria/controllers/AuthenticationController.java‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ public ResponseEntity<LoginUserResponse> login(
6464
response.addCookie(accessCookie);
6565
response.addCookie(refreshCookie);
6666

67+
// 🔍 DEBUG - Remover após resolver
68+
System.out.println("=== LOGIN REALIZADO ===");
69+
System.out.println("Email: " + loginDto.email());
70+
System.out.println("Access Token: " + accessToken.substring(0, 20) + "...");
71+
System.out.println("Cookies adicionados");
72+
6773
// Retorna dados públicos do usuário
6874
Object userResponseDto = montarUserResponse(auth.getPrincipal());
6975

@@ -126,13 +132,14 @@ public ResponseEntity<?> getCurrentUser(Authentication authentication) {
126132
return ResponseEntity.ok(Map.of("user", userResponseDto));
127133
}
128134

135+
// 🔥 MUDANÇAS AQUI - LINHA 136
129136
private Cookie criarCookie(String nome, String valor, int maxAge) {
130137
Cookie cookie = new Cookie(nome, valor);
131138
cookie.setHttpOnly(true);
132-
cookie.setSecure(true); // HTTPS apenas em produção
139+
cookie.setSecure(true); // ✅ HTTPS obrigatório
133140
cookie.setPath("/");
134141
cookie.setMaxAge(maxAge);
135-
cookie.setAttribute("SameSite", "Strict");
142+
cookie.setAttribute("SameSite", "None");
136143
return cookie;
137144
}
138145

‎src/main/java/com/virtusconsultoria/dtos/supervisor/SupervisorColaboradorDto.java‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package com.virtusconsultoria.dtos.supervisor;
2+
3+
import com.virtusconsultoria.model.Colaborador;
4+
import com.virtusconsultoria.model.ColaboradorRole;
5+
6+
public record SupervisorColaboradorDto(
7+
Long id,
8+
String nome,
9+
String email,
10+
String cpf,
11+
ColaboradorRole role,
12+
String telefone,
13+
String regimeContratacao
14+
) {
15+
public SupervisorColaboradorDto(Colaborador colaborador) {
16+
this(
17+
colaborador.getID_COLABORADOR(),
18+
colaborador.getNome(),
19+
colaborador.getEmail(),
20+
colaborador.getCpf(),
21+
colaborador.getRole(),
22+
colaborador.getTelefone(),
23+
colaborador.getRegimeContratacao() != null
24+
? colaborador.getRegimeContratacao().name()
25+
: null
26+
);
27+
}
28+
}

‎src/main/java/com/virtusconsultoria/dtos/supervisor/SupervisorResponseDto.java‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66

77
import java.math.BigDecimal;
88
import java.util.List;
9+
import java.util.stream.Collectors;
910

1011
public record SupervisorResponseDto(
1112
Long ID_SUPERVISOR,
@@ -16,7 +17,7 @@ public record SupervisorResponseDto(
1617
BigDecimal meta,
1718
ColaboradorRole role,
1819
String telefone,
19-
List<Colaborador> colaboradores
20+
List<SupervisorColaboradorDto> colaboradores
2021
) {
2122
public SupervisorResponseDto(Supervisor supervisor){
2223
this(
@@ -28,7 +29,12 @@ public SupervisorResponseDto(Supervisor supervisor){
2829
supervisor.getMeta(),
2930
supervisor.getRole(),
3031
supervisor.getTelefone(),
31-
supervisor.getColaboradores()
32+
supervisor.getColaboradores() != null
33+
? supervisor.getColaboradores()
34+
.stream()
35+
.map(SupervisorColaboradorDto::new)
36+
.collect(Collectors.toList())
37+
: List.of()
3238
);
3339
}
3440
}

‎src/main/java/com/virtusconsultoria/repository/SupervisorRepository.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,7 @@ public interface SupervisorRepository extends JpaRepository<Supervisor, Long > {
1818

1919
@Query("SELECT s FROM Supervisor s LEFT JOIN FETCH s.colaboradores WHERE s.ID_SUPERVISOR = :id")
2020
Optional<Supervisor> findByIdWithColaboradores(@Param("id") Long id);
21-
}
21+
22+
@Query("SELECT DISTINCT s FROM Supervisor s LEFT JOIN FETCH s.colaboradores")
23+
List<Supervisor> findAllWithColaboradores();
24+
}

‎src/main/java/com/virtusconsultoria/service/SupervisorService.java‎

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,9 @@
66
import com.virtusconsultoria.model.ColaboradorRole;
77
import com.virtusconsultoria.model.Supervisor;
88
import com.virtusconsultoria.repository.SupervisorRepository;
9-
import org.apache.poi.hssf.record.RecordInputStream;
109
import org.springframework.beans.BeanUtils;
1110
import org.springframework.beans.factory.annotation.Autowired;
1211
import org.springframework.http.ResponseEntity;
13-
import org.springframework.security.crypto.bcrypt.BCrypt;
14-
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
1512
import org.springframework.security.crypto.password.PasswordEncoder;
1613
import org.springframework.stereotype.Service;
1714
import org.springframework.transaction.annotation.Transactional;
@@ -50,9 +47,10 @@ public SupervisorResponseDto cadastrarSupervisor(SupervisorCreateDto supervisorC
5047

5148
@Transactional
5249
public ResponseEntity<String> delSupervisor(Long id){
53-
Optional<Supervisor> supervisorOptional = supervisorRepository.findById(id);
50+
// ✅ MODIFICADO: usa findByIdWithColaboradores
51+
Optional<Supervisor> supervisorOptional = supervisorRepository.findByIdWithColaboradores(id);
5452
if (supervisorOptional.isEmpty()){
55-
throw new RuntimeException("Nao foi possivel deletar o supervisor");
53+
throw new RuntimeException("Nao foi possivel deletar o supervisor");
5654
} else {
5755
supervisorRepository.delete(supervisorOptional.get());
5856
return ResponseEntity.ok("Supervisor deletado com sucesso");
@@ -61,15 +59,15 @@ public ResponseEntity<String> delSupervisor(Long id){
6159

6260
@Transactional
6361
public List<SupervisorResponseDto> listarSupervisor(){
64-
return supervisorRepository.findAll()
62+
return supervisorRepository.findAllWithColaboradores()
6563
.stream()
6664
.map(SupervisorResponseDto::new)
6765
.toList();
6866
}
6967

7068
@Transactional
7169
public SupervisorResponseDto buscarSupervisor(Long id){
72-
Optional<Supervisor> supervisorOptional = supervisorRepository.findById(id);
70+
Optional<Supervisor> supervisorOptional = supervisorRepository.findByIdWithColaboradores(id);
7371

7472
if (supervisorOptional.isEmpty()){
7573
throw new RuntimeException("Supervisor nao encontrado");
@@ -82,7 +80,8 @@ public SupervisorResponseDto buscarSupervisor(Long id){
8280

8381
@Transactional
8482
public SupervisorResponseDto atualizarSupervisor(Long id, SupervisorAtualizarDto supervisorAtualizarDto){
85-
Optional<Supervisor> supervisorOptional = supervisorRepository.findById(id);
83+
// ✅ MODIFICADO: usa findByIdWithColaboradores
84+
Optional<Supervisor> supervisorOptional = supervisorRepository.findByIdWithColaboradores(id);
8685

8786
if (supervisorOptional.isEmpty()){
8887
throw new RuntimeException("Supervisor nao encontrado na atualizacao");
@@ -100,4 +99,4 @@ public SupervisorResponseDto atualizarSupervisor(Long id, SupervisorAtualizarDto
10099

101100
return new SupervisorResponseDto(supervisorAtualizado);
102101
}
103-
}
102+
}

0 commit comments

Comments
 (0)