How to restrict CRUD functions for not logged users? - jsf

Question

I followed this tutorial to do a CRUD application: https://www.youtube.com/watch?v=DFFKMq1kh-M&t=339s
Here is my ManagedBean for it:
package model_controller;
import com.sun.net.httpserver.HttpsServer;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Map;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.inject.Named;
import javax.enterprise.context.RequestScoped;
import javax.faces.context.FacesContext;
import javax.servlet.http.HttpServletRequest;
#Named(value = "studentManagedBean")
#RequestScoped
public class StudentManagedBean {
private int id, wiek;
private String nazwisko, email, adres;
public StudentManagedBean() {
}
public StudentManagedBean(int id, int wiek, String nazwisko, String email, String adres) {
//konstruktory
this.id = id;
this.wiek = wiek;
this.nazwisko = nazwisko;
this.email = email;
this.adres = adres;
}
public int getId() {
return id;
}
public void setId(int id) {
this.id = id;
}
public int getWiek() {
return wiek;
}
public void setWiek(int wiek) {
this.wiek = wiek;
}
public String getNazwisko() {
return nazwisko;
}
public void setNazwisko(String nazwisko) {
this.nazwisko = nazwisko;
}
public String getEmail() {
return email;
}
public void setEmail(String email) {
this.email = email;
}
public String getAdres() {
return adres;
}
public void setAdres(String adres) {
this.adres = adres;
}
//
public static Connection conn = null;
public static PreparedStatement pstmt = null;
public static ResultSet rs = null;
private String str = "";
//
public static Connection getConnection() {
try {
Class.forName("com.mysql.jdbc.Driver");
//Alt+enter
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/studenci?zeroDateTimeBehavior=convertToNull", "root", "");
} catch (ClassNotFoundException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
}
return conn;
}
public static void closeAll(Connection conn, PreparedStatement pstmt, ResultSet rs) {
if (conn != null) {
try {
conn.close();
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
}
}
if (pstmt != null) {
try {
pstmt.close();
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
}
}
if (rs != null) {
try {
rs.close();
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
}
}
}
public ArrayList<StudentManagedBean> GetAllStudent() {
ArrayList<StudentManagedBean> arr = new ArrayList<>();
str = "SELECT s.id, s.nazwisko, s.wiek, s.adres, s.email FROM student s";
getConnection();
try {
pstmt = conn.prepareStatement(str);
rs = pstmt.executeQuery();
while (rs.next()) {
StudentManagedBean st = new StudentManagedBean();
st.setId(rs.getInt("id"));
st.setNazwisko(rs.getString("nazwisko"));
st.setWiek(rs.getInt("wiek"));
st.setAdres(rs.getString("adres"));
st.setEmail(rs.getString("email"));
//
arr.add(st);
}
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
} finally {
closeAll(conn, pstmt, rs);
}
return arr;
}
public void add() {
getConnection();
str = "insert into student(nazwisko, wiek, adres, email) values(?,?,?,?)";
try {
pstmt = conn.prepareStatement(str);
pstmt.setString(1, this.getNazwisko());
pstmt.setInt(2, this.getWiek());
pstmt.setString(3, this.getAdres());
pstmt.setString(4, this.getEmail());
int executeUpdate = pstmt.executeUpdate();
if (executeUpdate > 0) {
System.out.println("Zaktualizowano dane");
}
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
} finally {
closeAll(conn, pstmt, rs);
}
}
public void Edit() {
ArrayList<StudentManagedBean> arrList = GetAllStudent();
FacesContext fc = FacesContext.getCurrentInstance();
// Map<String,String> mapParam = fc.getExternalContext().getInitParameterMap();
// idStudent = mapParam.get("id");
int idStudent;
HttpServletRequest request = (HttpServletRequest) fc.getExternalContext().getRequest();
idStudent = Integer.parseInt(request.getParameter("id"));
//
for (StudentManagedBean studentManagedBean : arrList) {
if (studentManagedBean.getId() == idStudent) {
this.setId(studentManagedBean.getId());//błąd
this.setNazwisko(studentManagedBean.getNazwisko());
this.setWiek(studentManagedBean.getWiek());
this.setAdres(studentManagedBean.getAdres());
this.setEmail(studentManagedBean.getEmail());
}
}
setId(idStudent);
}
public void update() {
getConnection();
str = "update student set nazwisko=?, wiek=?, adres=?, email=? where id=?";
// Map<String,String> mapParam = fc.getExternalContext().getInitParameterMap();
// idStudent = mapParam.get("id");
FacesContext fc = FacesContext.getCurrentInstance();
HttpServletRequest request = (HttpServletRequest) fc.getExternalContext().getRequest();
int idStudent = Integer.parseInt(request.getParameter("id"));
try {
pstmt = conn.prepareStatement(str);
pstmt.setString(1, this.getNazwisko());
pstmt.setInt(2, this.getWiek());
pstmt.setString(3, this.getAdres());
pstmt.setString(4, this.getEmail());
pstmt.setInt(5, idStudent);
System.out.println(getNazwisko());
int executeUpdate = pstmt.executeUpdate();
if (executeUpdate > 0) {
System.out.println("Zaktualizowano dane");
}
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
} finally {
closeAll(conn, pstmt, rs);
}
}
public void delete() {
getConnection();
str = "DELETE FROM student where id=?";
FacesContext fc = FacesContext.getCurrentInstance();
HttpServletRequest request = (HttpServletRequest) fc.getExternalContext().getRequest();
int idStudent = Integer.parseInt(request.getParameter("id"));
try {
pstmt = conn.prepareStatement(str);
pstmt.setInt(1, idStudent);
int executeUpdate = pstmt.executeUpdate();
if (executeUpdate > 0) {
System.out.println("Usunięto dane");
}
} catch (SQLException ex) {
Logger.getLogger(StudentManagedBean.class.getName()).log(Level.SEVERE, null, ex);
} finally {
closeAll(conn, pstmt, rs);
}
}
}
It works pretty well, and I wanted to upgrade it - so everyone can see the data, but only logged in users can edit, add and delete records.
I found login tutorial: http://www.journaldev.com/7252/jsf-authentication-login-logout-database-example
How can I restrict edit, add and delete functions only for users that are logged in?
CRUD app is using RequestScope, login uses SessionScope, can i even use two different scopes in one app?
Should I use two different databases for login and students, or should I put it in one database, just two tables?

Answer 1

You can use the rendered attribute, which by default is set to true.
// Your form for inserting data to the database
<h:form rendered="#{studentManagedBean.isLoggedIn}">
...
</h:form>
// delete button
<h:commandButton action="#{studentManagedBean.delete()}"
rendered="#{studentManagedBean.isLoggedIn}" />
You have to add a variable and a method to your managedbean to check whether the user is logged in or not.
private boolean loggedIn;
// getter and setter
public boolean isLoggedIn(){
return loggedIn;
}