diff --git a/src/main/java/de/caritas/cob/userservice/api/config/auth/SecurityConfig.java b/src/main/java/de/caritas/cob/userservice/api/config/auth/SecurityConfig.java index fbac955c8..608b3989e 100644 --- a/src/main/java/de/caritas/cob/userservice/api/config/auth/SecurityConfig.java +++ b/src/main/java/de/caritas/cob/userservice/api/config/auth/SecurityConfig.java @@ -187,8 +187,9 @@ protected void configure(HttpSecurity http) throws Exception { .antMatchers( "/users/consultants/sessions/{sessionId:[0-9]+}", "/users/sessions/{sessionId:[0-9]+}/archive", - "/users/sessions/{sessionId:[0-9]+}", - "/appointments") + "/users/sessions/{sessionId:[0-9]+}") + .hasAnyAuthority(CONSULTANT_DEFAULT) + .antMatchers("/appointments") .hasAnyAuthority(CONSULTANT_DEFAULT, TECHNICAL_DEFAULT) .antMatchers(HttpMethod.PUT, APPOINTMENTS_APPOINTMENT_ID + UUID_PATTERN + "}") .hasAuthority(CONSULTANT_DEFAULT) diff --git a/src/test/java/de/caritas/cob/userservice/api/adapters/web/controller/AppointmentControllerAuthorizationIT.java b/src/test/java/de/caritas/cob/userservice/api/adapters/web/controller/AppointmentControllerAuthorizationIT.java index b46539c92..7221271ef 100644 --- a/src/test/java/de/caritas/cob/userservice/api/adapters/web/controller/AppointmentControllerAuthorizationIT.java +++ b/src/test/java/de/caritas/cob/userservice/api/adapters/web/controller/AppointmentControllerAuthorizationIT.java @@ -185,7 +185,6 @@ void getAppointmentsShouldReturnUnauthorizedWhenNoKeycloakAuthorization() throws AuthorityValue.ASSIGN_CONSULTANT_TO_ENQUIRY, AuthorityValue.ASSIGN_CONSULTANT_TO_PEER_SESSION, AuthorityValue.CREATE_NEW_CHAT, - AuthorityValue.TECHNICAL_DEFAULT, AuthorityValue.USE_FEEDBACK, AuthorityValue.USER_DEFAULT, AuthorityValue.USER_ADMIN, @@ -232,7 +231,6 @@ void postAppointmentsShouldReturnUnauthorizedWhenNoKeycloakAuthorization() throw AuthorityValue.ASSIGN_CONSULTANT_TO_ENQUIRY, AuthorityValue.ASSIGN_CONSULTANT_TO_PEER_SESSION, AuthorityValue.CREATE_NEW_CHAT, - AuthorityValue.TECHNICAL_DEFAULT, AuthorityValue.USE_FEEDBACK, AuthorityValue.USER_DEFAULT, AuthorityValue.USER_ADMIN,