From 1c00864045eba9cbe37588144d4f6c89cb6be3cc Mon Sep 17 00:00:00 2001
From: Fabrice Daugan <fabrice.daugan@gmail.com>
Date: Mon, 25 Sep 2023 00:44:53 +0200
Subject: [PATCH] Admin only secured operation

---
 .../org/ligoj/app/resource/node/ParameterValueResource.java     | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/plugin-core/src/main/java/org/ligoj/app/resource/node/ParameterValueResource.java b/plugin-core/src/main/java/org/ligoj/app/resource/node/ParameterValueResource.java
index 45e93f50..26aaeaaa 100644
--- a/plugin-core/src/main/java/org/ligoj/app/resource/node/ParameterValueResource.java
+++ b/plugin-core/src/main/java/org/ligoj/app/resource/node/ParameterValueResource.java
@@ -29,6 +29,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.CacheManager;
 import org.springframework.data.domain.Persistable;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.stereotype.Service;
 
 import javax.cache.annotation.CacheKey;
@@ -637,6 +638,7 @@ public List<ParameterNodeVo> getNodeParameters(@PathParam("node") final String n
 	 * mode.
 	 */
 	@GET
+	@PreAuthorize("hasAuthority('ADMIN')")
 	@Path("{node:service:.+}/parameter-value/{mode}/secured")
 	public List<ParameterNodeVo> getNodeParametersSecured(@PathParam("node") final String node,
 			@PathParam("mode") final SubscriptionMode mode) {