Posts CRUD and Ownership

Goal

This snapshot advances Ironclad Gazette by teaching you to create, edit, and delete posts with owner authorization.

Every numbered folder is a complete app. Run this stage independently, then compare it with the previous folder.

Prerequisites

Use Java 17+, Maven, a terminal, and Docker for MySQL stages. You should recognize classes, annotations, and HTTP verbs.

Port 8080 must be free. Copy .env.example before starting database stages.

• Java 17 and Maven
• A code editor and terminal
• Docker from part 4 onward

Concepts

Authentication identifies a user; authorization compares that identity with post.author.id before mutations.

Keep controllers thin: accept input, delegate to repositories or services, and let Thymeleaf escape output by default.

Walkthrough

Create posts with the authenticated user and return 403 when another account attempts edit or delete.

Read the example, then open the matching snapshot. The repository includes the surrounding setup and error handling.

if (!post.getAuthor().getId().equals(principal.getUser().getId())) {
  return "error/403";
}

Run and verify

Enter 09-Posts-CRUD-And-Ownership, start MySQL when needed, copy .env.example, and run mvn spring-boot:run on port 8080.

Open http://127.0.0.1:8080. Watch the terminal for validation and database errors.

docker compose -f ../docker-compose.yml up -d
git clone https://github.com/michaeldunga1/fcc-spring-blog.git
cd fcc-spring-blog/09-Posts-CRUD-And-Ownership
cp .env.example .env
mvn spring-boot:run

Troubleshooting

Forgetting the ownership check is a security bug even if the UI hides edit links.

Connection refused usually means Docker MySQL is stopped or the port is not 3308. For auth issues, confirm you are using email (not username) on the login form.

• Read the first error first
• Restart after environment changes
• Never commit .env or uploads

Try this

Log in as Ada and confirm Grace's post returns 403 on delete.

Test a happy path and one invalid or unauthorized request.

• Make one small change
• Test it in the browser
• Compare with the next snapshot only after it works