feat: implement role based access control rbac

server/build.gradle

@@ -72,6 +72,9 @@ dependencies {
     // API Documentation
     implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.4'
 
+    // CSV parsing
+    implementation 'org.apache.commons:commons-csv:1.11.0'
+
     // Utilities
     compileOnly 'org.projectlombok:lombok'
     annotationProcessor 'org.projectlombok:lombok'

server/src/main/java/de/tum/cit/memo/controller/AdminController.java

@@ -0,0 +1,95 @@
+package de.tum.cit.memo.controller;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import de.tum.cit.memo.dto.CompetencyImportRow;
+import de.tum.cit.memo.dto.ImportResult;
+import de.tum.cit.memo.service.CompetencyService;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.security.SecurityRequirement;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.validation.Valid;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.List;
+import org.apache.commons.csv.CSVFormat;
+import org.apache.commons.csv.CSVRecord;
+import lombok.RequiredArgsConstructor;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+@RestController
+@RequestMapping("/api/admin")
+@RequiredArgsConstructor
+@Tag(name = "Admin", description = "Admin-only operations")
+@SecurityRequirement(name = "bearer-jwt")
+@SuppressWarnings("null")
+public class AdminController {
+
+    private final CompetencyService competencyService;
+    private final ObjectMapper objectMapper;
+
+    @PostMapping("/competencies/import")
+    @Operation(summary = "Bulk import competencies from JSON array")
+    public ResponseEntity<ImportResult> importJson(
+        @Valid @RequestBody List<CompetencyImportRow> rows
+    ) {
+        return ResponseEntity.ok(competencyService.bulkImportCompetencies(rows));
+    }
+
+    @PostMapping(value = "/competencies/import/file", consumes = "multipart/form-data")
+    @Operation(summary = "Bulk import competencies from uploaded CSV or JSON file")
+    public ResponseEntity<ImportResult> importFile(
+        @RequestParam("file") MultipartFile file
+    ) throws IOException {
+        String originalFilename = file.getOriginalFilename();
+        List<CompetencyImportRow> rows;
+        if (originalFilename != null && originalFilename.endsWith(".csv")) {
+            rows = parseCsv(file);
+        } else {
+            rows = parseJson(file);
+        }
+        return ResponseEntity.ok(competencyService.bulkImportCompetencies(rows));
+    }
+
+    private List<CompetencyImportRow> parseCsv(MultipartFile file) throws IOException {
+        List<CompetencyImportRow> rows = new ArrayList<>();
+        CSVFormat format = CSVFormat.DEFAULT.builder()
+            .setHeader()
+            .setSkipHeaderRecord(true)
+            .setTrim(true)
+            .build();
+        try (var reader = new InputStreamReader(file.getInputStream(), StandardCharsets.UTF_8);
+             var parser = format.parse(reader)) {
+            for (CSVRecord record : parser) {
+            String title;
+            if (record.size() > 0) {
+                title = record.get(0);
+            } else {
+                title = "";
+            }
+            String description;
+            if (record.size() > 1) {
+                description = record.get(1);
+            } else {
+                description = null;
+            }
+                rows.add(new CompetencyImportRow(title, description));
+            }
+        }
+        return rows;
+    }
+
+    private List<CompetencyImportRow> parseJson(MultipartFile file) throws IOException {
+        return objectMapper.readValue(
+            file.getInputStream(),
+            objectMapper.getTypeFactory().constructCollectionType(List.class, CompetencyImportRow.class)
+        );
+    }
+}

server/src/main/java/de/tum/cit/memo/dto/CompetencyImportRow.java

@@ -0,0 +1,17 @@
+package de.tum.cit.memo.dto;
+
+import jakarta.validation.constraints.NotBlank;
+import lombok.AllArgsConstructor;
+import lombok.Data;
+import lombok.NoArgsConstructor;
+
+@Data
+@NoArgsConstructor
+@AllArgsConstructor
+public class CompetencyImportRow {
+
+    @NotBlank(message = "Title is required")
+    private String title;
+
+    private String description;
+}

server/src/main/java/de/tum/cit/memo/dto/ImportResult.java

@@ -0,0 +1,5 @@
+package de.tum.cit.memo.dto;
+
+import java.util.List;
+
+public record ImportResult(int imported, int skipped, List<String> errors) { }

server/src/main/java/de/tum/cit/memo/repository/CompetencyRepository.java

@@ -27,4 +27,6 @@ public interface CompetencyRepository extends JpaRepository<Competency, String>
     @org.springframework.data.jpa.repository.Modifying(flushAutomatically = true, clearAutomatically = true)
     @Query(value = "UPDATE competencies SET degree = GREATEST(degree - 1, 0) WHERE id IN :ids", nativeQuery = true)
     void decrementDegree(@Param("ids") List<String> ids);
+
+    boolean existsByTitle(String title);
 }

server/src/main/java/de/tum/cit/memo/security/DbRoleJwtAuthenticationConverter.java

@@ -0,0 +1,33 @@
+package de.tum.cit.memo.security;
+
+import de.tum.cit.memo.entity.User;
+import de.tum.cit.memo.enums.UserRole;
+import de.tum.cit.memo.repository.UserRepository;
+import java.util.List;
+import java.util.Objects;
+import lombok.RequiredArgsConstructor;
+import org.springframework.core.convert.converter.Converter;
+import org.springframework.lang.NonNull;
+import org.springframework.security.authentication.AbstractAuthenticationToken;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.oauth2.jwt.Jwt;
+import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationToken;
+import org.springframework.stereotype.Component;
+
+@Component
+@RequiredArgsConstructor
+@SuppressWarnings("null")
+public class DbRoleJwtAuthenticationConverter implements Converter<Jwt, AbstractAuthenticationToken> {
+
+    private final UserRepository userRepository;
+
+    @Override
+    public AbstractAuthenticationToken convert(@NonNull Jwt jwt) {
+        String subject = Objects.requireNonNullElse(jwt.getSubject(), "");
+        UserRole role = userRepository.findById(subject)
+            .map(User::getRole)
+            .orElse(UserRole.USER);
+        return new JwtAuthenticationToken(jwt,
+            List.of(new SimpleGrantedAuthority("ROLE_" + role.name())));
+    }
+}

server/src/main/java/de/tum/cit/memo/security/SecurityConfig.java

@@ -3,7 +3,6 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
-import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
@@ -20,7 +19,7 @@
 public class SecurityConfig {
 
     @Bean
-    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    public SecurityFilterChain filterChain(HttpSecurity http, DbRoleJwtAuthenticationConverter jwtConverter) throws Exception {
         http
             .csrf(AbstractHttpConfigurer::disable)
             .cors(cors -> cors.configurationSource(corsConfigurationSource()))
@@ -29,9 +28,13 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
                 .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                 .requestMatchers("/swagger-ui/**", "/swagger-ui.html", "/api-docs/**").permitAll()
                 .requestMatchers("/actuator/health").permitAll()
+                .requestMatchers("/api/users/**").hasRole("ADMIN")
+                .requestMatchers("/api/admin/**").hasRole("ADMIN")
+                .requestMatchers(HttpMethod.DELETE, "/api/competencies/**").hasRole("ADMIN")
+                .requestMatchers(HttpMethod.DELETE, "/api/learning-resources/**").hasRole("ADMIN")
                 .anyRequest().authenticated()
             )
-            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
+            .oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtConverter)));
 
         return http.build();
     }

server/src/main/java/de/tum/cit/memo/service/CompetencyService.java

@@ -1,6 +1,8 @@
 package de.tum.cit.memo.service;
 
+import de.tum.cit.memo.dto.CompetencyImportRow;
 import de.tum.cit.memo.dto.CreateCompetencyRequest;
+import de.tum.cit.memo.dto.ImportResult;
 import de.tum.cit.memo.dto.UpdateCompetencyRequest;
 import de.tum.cit.memo.entity.Competency;
 import de.tum.cit.memo.exception.ResourceNotFoundException;
@@ -10,6 +12,7 @@
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
+import java.util.ArrayList;
 import java.util.List;
 
 @Service
@@ -70,4 +73,31 @@ public void deleteCompetency(String id) {
         }
         competencyRepository.deleteById(id);
     }
+
+    @Transactional
+    public ImportResult bulkImportCompetencies(List<CompetencyImportRow> rows) {
+        List<Competency> toSave = new ArrayList<>();
+        List<String> errors = new ArrayList<>();
+        int skipped = 0;
+
+        for (int i = 0; i < rows.size(); i++) {
+            CompetencyImportRow row = rows.get(i);
+            if (row.getTitle() == null || row.getTitle().isBlank()) {
+                errors.add("Row " + (i + 1) + ": title is required");
+                continue;
+            }
+            if (competencyRepository.existsByTitle(row.getTitle())) {
+                skipped++;
+                continue;
+            }
+            toSave.add(Competency.builder()
+                .id(IdGenerator.generateCuid())
+                .title(row.getTitle())
+                .description(row.getDescription())
+                .build());
+        }
+
+        competencyRepository.saveAll(toSave);
+        return new ImportResult(toSave.size(), skipped, errors);
+    }
 }

server/src/main/resources/application-local.yml

@@ -7,9 +7,16 @@ spring:
   jpa:
     show-sql: true
 
+  flyway:
+    validate-on-migrate: false
+
 server:
   port: 8080
 
+memo:
+  allowed-email-domains:
+    - memo.local
+
 logging:
   level:
     root: INFO

server/src/main/resources/application.yml

@@ -26,10 +26,15 @@ spring:
         jdbc:
           time_zone: UTC
 
+  servlet:
+    multipart:
+      max-file-size: 5MB
+      max-request-size: 5MB
+
   flyway:
     enabled: true
     baseline-on-migrate: true
-    validate-on-migrate: false
+    validate-on-migrate: true
     locations: classpath:db/migration
 
 server:
@@ -125,8 +130,6 @@ memo:
     # --- Universität Erlangen-Nürnberg ---
     - fau.de
     - fau.eu
-    # --- Dev / demo (remove in production) ---
-    - memo.local
 
 logging:
   level:

server/src/main/resources/db/migration/V10__fix_competency_resource_links_user_id_length.sql

@@ -0,0 +1,4 @@
+-- V9 extended competency_relationships_votes.user_id to VARCHAR(36) for Keycloak UUIDs
+-- but missed competency_resource_links.user_id which is still VARCHAR(30).
+-- A 36-char Keycloak UUID inserted as user_id would fail with "value too long".
+ALTER TABLE competency_resource_links ALTER COLUMN user_id TYPE VARCHAR(36);

src/App.tsx

@@ -12,6 +12,12 @@ import { ImprintPage } from './pages/ImprintPage';
 import { PrivacyPage } from './pages/PrivacyPage';
 import { DashboardPage } from './pages/DashboardPage';
 import { ProtectedRoute } from './components/ProtectedRoute';
+import { AdminRoute } from './components/AdminRoute';
+import { AdminPage } from './pages/AdminPage';
+import { ModerationPage } from './pages/ModerationPage';
+import { ImportPage } from './pages/ImportPage';
+import { RolesPage } from './pages/RolesPage';
+import { ExportPage } from './pages/ExportPage';
 import { AuthProvider } from './contexts/AuthContext';
 
 export function App() {
@@ -42,6 +48,16 @@ export function App() {
               <Route element={<ProtectedRoute />}>
                 <Route path="/dashboard" element={<DashboardPage />} />
                 <Route path="/session" element={<SessionPage />} />
+                <Route element={<AdminRoute />}>
+                  <Route path="/admin" element={<AdminPage />} />
+                  <Route
+                    path="/admin/moderation"
+                    element={<ModerationPage />}
+                  />
+                  <Route path="/admin/import" element={<ImportPage />} />
+                  <Route path="/admin/roles" element={<RolesPage />} />
+                  <Route path="/admin/export" element={<ExportPage />} />
+                </Route>
               </Route>
             </Route>
           </Routes>