Paul-Christian Volkmer authored 10 years ago and Daniel Gerhardt committed 10 years ago

Set default evaluation result to false and throw an AccessDeniedException.
SecurityExceptionControllerAdvice checks if there is an valid login and
decides whether to send HTTP 401 or HTTP 403.

Conflicts:
	src/test/java/de/thm/arsnova/controller/AbstractControllerTest.java

Spring security based permission check will do this for us.

Permission handling is the same as with removed Authorized annotation

Renamed TEACHER to SPEAKER to adapt roles to ARSnova client, and
also added some convenience methods for role handling.

All relevant information about users (e.g. session mebership) are
accessible via UserService.
The method IUserService::getCurrentUser provides information about
the actual logged in user. If no user is logged in, this method will
throw a UnauthorizedException which will end up in 401 HTTP error.

Use this method to implement further checks on session membership.
The old HTTP code assert should never be reached because an
UnauthroizedException should have been thrown first.

This checks if there is a user in current security context. If not, an
UnauthorizedException is thrown which will result in HTTP - 401.

This patch uses AbstractController class to add exception handlers
into controllers. These handlers are used to detect some runtime exceptions
which can be thrown in any layer e.g. DAO or service layer.
They recognize NotFoundException and ForbiddenException. Test classes are
able to check if any of these exceptions are thrown during runtime.

If a session was not found in database this will result in http 404,
if the session is not accessable for the current user the request will
result in http 403.

The old behavior was to check for null. This was the response if the
session was not found or the current user could not access this session
(not owner and inactive sessions). Both ended up with http 404 - not found.

Old tests are ignored because they allways fail with unknown reason.
The new tests are very simple and there is a lot of work to be done to
have a fully tested application.