Prevent roles of all users being accessed via API gateway /bff/api/ path

1 files changed, 0 insertions, 12 deletions

diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
index 0eb0d51..1b0598d 100644
--- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/security/UserRestController.java
@@ -13,7 +13,6 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.annotation.AuthenticationPrincipal;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestHeader;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -27,17 +26,6 @@ public class UserRestController {
         this.userService = userService;
     }
 
-    @GetMapping("/{username}/roles")
-    public ResponseEntity<RolesResponse> getRoles(@PathVariable String username) {
-        Optional<User> user = userService.findByUsername(username);
-
-        if (user.isEmpty()) {
-            return ResponseEntity.ok(new RolesResponse(Set.of()));
-        }
-
-        return ResponseEntity.ok(new RolesResponse(user.get().getRoles()));
-    }
-
     @GetMapping("/test")
     public String test(Principal principal) {
         return principal.toString();