Security issue fix

src/main/java/kz/project/printedFormsService/config/SecurityContextUtils.java

 package kz.project.printedFormsService.config;
 
 import kz.project.printedFormsService.exception.AccessDeniedException;
-import kz.project.printedFormsService.exception.ValidationException;
 import lombok.experimental.UtilityClass;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -56,7 +55,7 @@ public class SecurityContextUtils {
                 );
     }
 
-    public static String getGitlabProjectBranchFromRole() throws ValidationException {
+    public static String getGitlabProjectBranchFromRole() {
 
         return SecurityContextHolder
                 .getContext()

src/main/java/kz/project/printedFormsService/controller/GitlabTemplateController.java

@@ -20,8 +20,6 @@ import org.springframework.web.bind.annotation.PutMapping;
 import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RestController;
 
-import java.io.IOException;
-
 @RestController
 @RequiredArgsConstructor
 @Slf4j
@@ -61,7 +59,7 @@ public class GitlabTemplateController {
     })
     public ResponseEntity<TemplateDto> saveTemplate(
             @RequestBody @Validated GitlabUploadRequest request
-    ) throws IOException, ValidationException {
+    ) {
         return ResponseEntity.ok(gitlabTemplateService.saveFromGitlab(request));
 
     }
@@ -93,7 +91,7 @@ public class GitlabTemplateController {
     })
     public ResponseEntity<TemplateResponseDto> editTemplate(
             @RequestBody @Validated GitlabUploadRequest request
-    ) throws IOException, ValidationException {
+    ) {
         return ResponseEntity.ok(gitlabTemplateService.updateFromGitlab(request));
 
     }

src/main/java/kz/project/printedFormsService/service/impl/TemplateServiceImpl.java

 package kz.project.printedFormsService.service.impl;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
+import kz.project.printedFormsService.config.SecurityContextUtils;
 import kz.project.printedFormsService.controller.TemplateController;
 import kz.project.printedFormsService.data.dto.TemplateDataForReportDto;
 import kz.project.printedFormsService.data.dto.TemplateDto;
@@ -10,10 +11,10 @@ import kz.project.printedFormsService.data.entity.TemplateEntity;
 import kz.project.printedFormsService.data.entity.TemplateEntityVersion;
 import kz.project.printedFormsService.data.entity.TemplateFileInfoEntity;
 import kz.project.printedFormsService.data.repository.*;
+import kz.project.printedFormsService.exception.AccessDeniedException;
 import kz.project.printedFormsService.exception.ValidationException;
 import kz.project.printedFormsService.logging.ProcessLogger;
 import kz.project.printedFormsService.service.TemplateService;
-import lombok.RequiredArgsConstructor;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.Pageable;
 import org.springframework.stereotype.Service;
@@ -22,10 +23,7 @@ import org.springframework.web.multipart.MultipartFile;
 
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
+import java.util.*;
 
 @Service
 public class TemplateServiceImpl implements TemplateService {
@@ -146,12 +144,18 @@ public class TemplateServiceImpl implements TemplateService {
 
         if (code != null) {
             Page<TemplateEntity> allByCode = repository.findAllByCode(pageable, code);
+            Set<String> projects = SecurityContextUtils.getProjectRoleMap().keySet();
+
             Page<TemplateEntityVersion> allVersionsByCode = versionRepository.findAllByCode(pageable, code);
 
             processLogger.finish(TemplateController.class, new Throwable().getStackTrace()[0].getMethodName(), "Получение всех шаблонов по коду");
 
-            if (allByCode != null && allVersionsByCode != null)
+            if (allByCode != null && allVersionsByCode != null) {
+                if (!projects.containsAll(allByCode.stream().map(TemplateEntity::getProject).toList())) {
+                    throw new AccessDeniedException("User does not have access to the project");
+                }
                 return TemplateDto.toDtoList(allByCode, allVersionsByCode);
+            }
 
             if (allByCode != null)
                 return TemplateDto.toDtoList(allByCode);