Enhance event management with CRUD and organizer retrieval#9
Conversation
There was a problem hiding this comment.
Pull request overview
This PR expands the backend event domain to support full CRUD-style management (update/cancel/soft-delete/hard-delete) and adds an admin query to retrieve events by organizer email, while also refactoring several endpoints to use the authenticated user (Principal) instead of accepting userId as a request parameter.
Changes:
- Added service/repository methods for updating, cancelling, soft deleting, and permanently deleting events.
- Added admin endpoint + repository query to list events by organizer email.
- Updated controller flows to derive the acting user from
Principal(and set organizerId server-side for create/update).
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
src/main/java/dev/pasinduog/eventsphere/service/impl/EventServiceImpl.java |
Implements new event operations (update/cancel/soft/hard delete) and organizer-based retrieval. |
src/main/java/dev/pasinduog/eventsphere/service/EventService.java |
Extends service API with new event-management methods. |
src/main/java/dev/pasinduog/eventsphere/repository/impl/EventRepositoryImpl.java |
Adds SQL implementations for update/cancel/soft/hard delete and organizer-email query; adjusts findById filtering. |
src/main/java/dev/pasinduog/eventsphere/repository/EventRepository.java |
Extends repository API with new event-management methods. |
src/main/java/dev/pasinduog/eventsphere/controller/EventController.java |
Adds new endpoints and switches user-specific actions to use Principal. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| boolean updateEvent(@PathVariable String eventId, @RequestBody Event event, Principal principal) { | ||
| User currentUser = userService.getUserEntityByEmail(principal.getName()); | ||
| event.setOrganizerId(currentUser.getId()); | ||
| return eventService.updateEvent(event, eventId); |
There was a problem hiding this comment.
In updateEvent, the controller sets event.organizerId to the current user, and the repository update writes organizer_id = ?. This means any ORGANIZER can update any event ID and effectively transfer ownership; admins editing would also unintentionally become the organizer. The update flow should preserve the existing organizer_id and/or verify the current user owns the event unless the caller is ADMIN.
| if (event.getId() == null || event.getId().isEmpty()) { | ||
| event.setId(eventId); | ||
| } |
There was a problem hiding this comment.
updateEvent only assigns eventId into event.id when the request body omits an ID. If the client supplies a different non-empty event.id, the service will still proceed and EventRepositoryImpl.update() will update by event.getId(), not the path eventId. Make the path ID authoritative (always set event.id = eventId or reject mismatches).
| if (event.getId() == null || event.getId().isEmpty()) { | |
| event.setId(eventId); | |
| } | |
| event.setId(eventId); |
| @Override | ||
| public boolean delete(String eventId) { | ||
| if (eventRepository.findById(eventId).isEmpty()) | ||
| throw new EventNotFoundException("Update failed. Event not found"); |
There was a problem hiding this comment.
The exception message in delete says "Update failed..." which is misleading for a hard delete operation. Consider changing it to operation-specific wording (e.g., "Delete failed. Event not found") or a generic "Event not found".
| throw new EventNotFoundException("Update failed. Event not found"); | |
| throw new EventNotFoundException("Delete failed. Event not found"); |
This pull request adds comprehensive event management features to the backend, including support for event creation, updating, cancellation, deletion, and querying by organizer. It also refactors authentication to use the currently logged-in user (via
Principal) for user-specific actions, improving security and code clarity.Event management enhancements:
Authentication and security improvements:
Principalfor retrieving the current user, removing reliance on passinguserIdas a request parameter and ensuring actions are performed on behalf of the authenticated user. [1] [2] [3]Repository and service layer changes:
Bug prevention and data integrity:
organizerId, and to exclude cancelled or unavailable events from queries. [1] [2]Dependency and annotation fixes:
EventServiceImplannotation from@Repositoryto@Serviceto correctly indicate its role in the application context.