Controller (Login / Loan)

Html (applicatinList /erroe/login)

book-rent/src/main/java/com/example/demo/controller/LoanContorller.java

@@ -1,5 +0,0 @@
-package com.example.demo.controller;
-
-public class LoanContorller {
-
-}

book-rent/src/main/java/com/example/demo/controller/LoanController.java

@@ -0,0 +1,113 @@
+package com.example.demo.controller;
+
+
+
+import java.util.List;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.SessionAttribute;
+import org.springframework.web.servlet.mvc.support.RedirectAttributes;
+
+import com.example.demo.common.BusinessException;
+import com.example.demo.common.Const;
+import com.example.demo.common.LoginUser;
+import com.example.demo.service.LoanService;
+
+/** LOAN-01：書籍貸出申請（一般ユーザーのみ）。入力 → 確認 → 完了 */
+@Controller
+@RequestMapping("/loan")
+public class LoanController {
+    private final LoanService loanService;
+
+    public LoanController(LoanService loanService) {
+        this.loanService = loanService;
+    }
+
+    /** 書籍一覧 →（申請ボタン）→ 申請入力 */
+    @GetMapping("/apply")
+    public String input(@RequestParam Integer idBook,
+                        @SessionAttribute(Const.SESSION_LOGIN_USER) LoginUser user,
+                        Model model, RedirectAttributes ra) {
+        return showInput(idBook, "", "", List.of(), user, model, ra);
+    }
+
+    /** 確認画面 →（申請情報入力に戻る）→ 申請入力（入力値を保持） */
+    @PostMapping("/apply/input")
+    public String back(@RequestParam Integer idBook,
+                       @RequestParam(defaultValue = "") String dateBorrow,
+                       @RequestParam(defaultValue = "") String dateScheduledReturn,
+                       @SessionAttribute(Const.SESSION_LOGIN_USER) LoginUser user,
+                       Model model, RedirectAttributes ra) {
+        return showInput(idBook, dateBorrow, dateScheduledReturn, List.of(), user, model, ra);
+    }
+
+    /** 申請入力 →（申請確認）→ 確認 */
+    @PostMapping("/apply/confirm")
+    public String confirm(@RequestParam Integer idBook,
+                          @RequestParam(defaultValue = "") String dateBorrow,
+                          @RequestParam(defaultValue = "") String dateScheduledReturn,
+                          @SessionAttribute(Const.SESSION_LOGIN_USER) LoginUser user,
+                          Model model, RedirectAttributes ra) {
+        List<String> errors = loanService.validateDates(dateBorrow, dateScheduledReturn);
+        if (!errors.isEmpty()) {
+            return showInput(idBook, dateBorrow, dateScheduledReturn, errors, user, model, ra);
+        }
+        if (user.isAdmin()) return "redirect:/menu";
+        try {
+            model.addAttribute("book", loanService.getLendableBook(idBook));
+        } catch (BusinessException e) {
+            ra.addFlashAttribute("errorMessage", e.getMessage());
+            return "redirect:/books";
+        }
+        model.addAttribute("idBook", idBook);
+        model.addAttribute("dateBorrow", dateBorrow);
+        model.addAttribute("dateScheduledReturn", dateScheduledReturn);
+        return "loanApplyConfirm";
+    }
+
+    /** 確認 →（申請）→ 完了。二重送信防止のため登録後はリダイレクトする（PRG） */
+    @PostMapping("/apply/execute")
+    public String execute(@RequestParam Integer idBook,
+                          @RequestParam(defaultValue = "") String dateBorrow,
+                          @RequestParam(defaultValue = "") String dateScheduledReturn,
+                          @SessionAttribute(Const.SESSION_LOGIN_USER) LoginUser user,
+                          RedirectAttributes ra) {
+        if (user.isAdmin()) return "redirect:/menu";
+        try {
+            Integer id = loanService.apply(idBook, dateBorrow, dateScheduledReturn, user);
+            ra.addFlashAttribute("message", "書籍貸出申請が完了しました。（申請ID：" + id + "）");
+            return "redirect:/loan/apply/complete";
+        } catch (BusinessException e) {
+            ra.addFlashAttribute("errorMessage", e.getMessage());
+            return "redirect:/books";
+        }
+    }
+
+    @GetMapping("/apply/complete")
+    public String complete(Model model) {
+        model.addAttribute("backUrl", "/books");
+        model.addAttribute("backLabel", "書籍一覧に戻る");
+        return "complete";
+    }
+
+    private String showInput(Integer idBook, String dateBorrow, String dateScheduledReturn, List<String> errors,
+                             LoginUser user, Model model, RedirectAttributes ra) {
+        if (user.isAdmin()) return "redirect:/menu";   // 申請は一般ユーザーのみ
+        try {
+            model.addAttribute("book", loanService.getLendableBook(idBook));
+        } catch (BusinessException e) {
+            ra.addFlashAttribute("errorMessage", e.getMessage());
+            return "redirect:/books";
+        }
+        model.addAttribute("idBook", idBook);
+        model.addAttribute("dateBorrow", dateBorrow);
+        model.addAttribute("dateScheduledReturn", dateScheduledReturn);
+        model.addAttribute("errors", errors);
+        return "loanApplyInput";
+    }
+}

book-rent/src/main/java/com/example/demo/controller/LoginController.java

@@ -1,5 +1,73 @@
 package com.example.demo.controller;
 
-public class LoginController {
 
+import java.util.Optional;
+
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpSession;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import com.example.demo.common.Const;
+import com.example.demo.common.LoginUser;
+import com.example.demo.service.AuthService;
+
+/** AUTH-01：ログイン／ログアウト（login.html） */
+@Controller
+public class LoginController {
+    private final AuthService authService;
+
+    public LoginController(AuthService authService) {
+        this.authService = authService;
+    }
+
+    @GetMapping("/")
+    public String root() {
+        return "redirect:/menu";
+    }
+
+    @GetMapping("/login")
+    public String loginForm(HttpSession session) {
+        if (session.getAttribute(Const.SESSION_LOGIN_USER) != null) {
+            return "redirect:/menu";
+        }
+        return "login";
+    }
+
+    @PostMapping("/login")
+    public String login(@RequestParam(defaultValue = "") String mailAddress,
+                        @RequestParam(defaultValue = "") String password,
+                        HttpServletRequest request, Model model) {
+        String mail = mailAddress.trim();
+        model.addAttribute("mailAddress", mail);   // 入力値を保持（パスワードは保持しない）
+
+        if (mail.isEmpty() || password.isEmpty()) {
+            model.addAttribute("errorMessage", "メールアドレスとパスワードを入力してください。");
+            return "login";
+        }
+        Optional<LoginUser> user = authService.authenticate(mail, password);
+        if (user.isEmpty()) {
+            // どちらが誤りかは分からない文言にする
+            model.addAttribute("errorMessage", "メールアドレスまたはパスワードが正しくありません。");
+            return "login";
+        }
+        // セッション固定化攻撃対策：古いセッションを破棄して新規発行
+        HttpSession old = request.getSession(false);
+        if (old != null) {
+            old.invalidate();
+        }
+        request.getSession(true).setAttribute(Const.SESSION_LOGIN_USER, user.get());
+        return "redirect:/menu";
+    }
+
+    @PostMapping("/logout")
+    public String logout(HttpSession session) {
+        session.invalidate();
+        return "redirect:/login";
+    }
 }
+

book-rent/src/main/resources/templates/application.html

@@ -1,37 +0,0 @@
-<!DOCTYPE html>
-<html xmlns:th="http://www.thymeleaf.org">
-
-<head>
-	<meta charset="UTF-8">
-	<title>書籍貸出申請画面</title>
-	<!--	<link rel="stylesheet" th:href="@{/css/style.css}">-->
-</head>
-
-<body>
-	<table>
-		<!-- エラーメッセージ -->
-		<div class="msgBox error" th:if="${messageError != null}">
-			<span class="error" th:text="${messageError.message}"></span>
-			<th class="header">蔵書ID</th>
-			<td>
-				<input placeholder="蔵書ID" th:field="*{id_book}" type="number" />
-			</td>
-			<th class="header">書籍名</th>
-			<td>
-				<input placeholder="蔵書ID" th:field="*{nm_book}" type="text" />
-			</td>
-			<th class="header">貸出日</th>
-			<td>
-				<input placeholder="貸出日" th:field="*{date_borrow}" type="text" />
-			</td>
-			<th class="header">返却予定日</th>
-			<td>
-				<input placeholder="返却予定日" th:field="*{date_schedule_return}" type="text" />
-			</td>
-
-			<a href="applicationConfirm/html" class="btn"> 申請確認</a>
-	</table>
-	<a href="@{/boolList.html}">書籍一覧に戻る</a>
-</body>
-
-</html>

book-rent/src/main/resources/templates/applicationList.html

@@ -0,0 +1,34 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+  <meta charset="UTF-8">
+  <title>書籍貸出申請一覧（承認待ち）</title>
+  <link rel="stylesheet" th:href="@{/css/style.css}">
+</head>
+<body>
+<div th:replace="~{fragments/header :: header}"></div>
+<main>
+  <h1>書籍貸出申請一覧（承認待ち）</h1>
+  <div class="error" th:if="${errorMessage}" th:text="${errorMessage}"></div>
+  <div class="error" th:each="e : ${errors}" th:text="${e}"></div>
+  <div class="card">
+    <p th:if="${#lists.isEmpty(list)}">承認待ちの申請はありません。</p>
+    <table th:unless="${#lists.isEmpty(list)}">
+      <thead><tr><th>申請ID</th><th>申請者名</th><th>書籍名</th><th>申請日</th><th>貸出日</th><th>返却予定日</th><th>操作</th></tr></thead>
+      <tbody>
+        <tr th:each="r : ${list}">
+          <td th:text="${r.idRequest}"></td>
+          <td th:text="${r.nmApplicant}"></td>
+          <td th:text="${r.nmBook}"></td>
+          <td th:text="${r.dateRequest}"></td>
+          <td th:text="${r.dateBorrow}"></td>
+          <td th:text="${r.dateScheduledReturn}"></td>
+          <td><a class="btn" th:href="@{/admin/applications/{id}(id=${r.idRequest})}">承認</a></td>
+        </tr>
+      </tbody>
+    </table>
+  </div>
+  <p><a class="btn sub" th:href="@{/menu}">メニューに戻る</a></p>
+</main>
+</body>
+</html>

book-rent/src/main/resources/templates/error.html

@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org">
+<head>
+  <meta charset="UTF-8">
+  <title>エラー</title>
+  <link rel="stylesheet" th:href="@{/css/style.css}">
+</head>
+<body>
+<main>
+  <h1>エラー</h1>
+  <div class="card">
+    <div class="error" th:text="${errorMessage} ?: 'エラーが発生しました。'"></div>
+    <a class="btn" th:href="@{/menu}">メニューに戻る</a>
+  </div>
+</main>
+</body>
+</html>

book-rent/src/main/resources/templates/login.html

@@ -2,93 +2,122 @@
 <html xmlns:th="http://www.thymeleaf.org">
 
 <head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-
-    <!-- 外部スクリプトの読み込み -->
-    <script th:src="@{/js/common.js}"></script>
-
-    <!-- CSSの読み込み -->
-    <link rel="stylesheet" th:href="@{/css/all.css}" type="text/css">
-    <link rel="stylesheet" th:href="@{/css/style.css}" type="text/css">
-
-    <title>ログイン</title>
+	<meta charset="UTF-8">
+	<title>ログイン</title>
+	<link rel="stylesheet" th:href="@{/css/style.css}">
 </head>
 
 <body>
-
-    <div class="loginContainer">
-
-        <h1>ログイン</h1>
-
-        <form th:action="@{/doLogin}"
-              method="post"
-              th:object="${loginInfoForm}">
-
-            <!-- エラーメッセージ -->
-            <div class="msgBox error"
-                 th:if="${messageError != null}">
-                <span class="error"
-                      th:text="${messageError.message}"></span>
-            </div>
-
-            <table>
-                <!-- メールアドレス -->
-                <tr>
-                    <th class="header">メールアドレス</th>
-                    <td>
-                        <input
-                            id="mailAddress"
-                            type="text"
-                            th:field="*{mailAddress}"
-                            placeholder="メールアドレス"
-                            required
-                        />
-                    </td>
-                </tr>
-
-                <!-- パスワード -->
-                <tr>
-                    <th class="header">パスワード</th>
-                    <td>
-                        <input
-                            id="password"
-                            type="password"
-                            th:field="*{password}"
-                            placeholder="パスワード"
-                            required
-                        />
-                    </td>
-                </tr>
-
-                <!-- ボタン -->
-                <tr>
-                    <td class="btnArea" colspan="2">
-                        <input
-                            type="submit"
-                            value="ログイン"
-                        />
-
-                        <button
-                            type="button"
-                            onclick="clearInput()">
-                            リセット
-                        </button>
-                    </td>
-                </tr>
-            </table>
-
-        </form>
-
-    </div>
-
-    <!-- 入力内容のリセット -->
-    <script>
-        function clearInput() {
-            document.getElementById('mailAddress').value = '';
-            document.getElementById('password').value = '';
-        }
-    </script>
-
+	<main>
+		<h1>書籍貸出管理システム</h1>
+		<div class="card">
+			<h2>ログイン</h2>
+			<div class="error" th:if="${errorMessage}" th:text="${errorMessage}"></div>
+			<form th:action="@{/login}" method="post">
+				<label for="mailAddress">メールアドレス</label>
+				<input type="text" id="mailAddress" name="mailAddress" th:value="${mailAddress}"
+					autocomplete="username">
+				<label for="password">パスワード</label>
+				<input type="password" id="password" name="password" autocomplete="current-password">
+				<p><button type="submit">ログイン</button></p>
+			</form>
+		</div>
+	</main>
 </body>
-</html>
+
+</html>
+
+<!--<!DOCTYPE html>-->
+<!--<html xmlns:th="http://www.thymeleaf.org">-->
+
+<!--<head>-->
+<!--    <meta charset="UTF-8">-->
+<!--    <meta name="viewport" content="width=device-width, initial-scale=1.0">-->
+
+<!--     外部スクリプトの読み込み -->
+<!--    <script th:src="@{/js/common.js}"></script>-->
+
+<!--     CSSの読み込み -->
+<!--    <link rel="stylesheet" th:href="@{/css/all.css}" type="text/css">-->
+<!--    <link rel="stylesheet" th:href="@{/css/style.css}" type="text/css">-->
+
+<!--    <title>ログイン</title>-->
+<!--</head>-->
+
+<!--<body>-->
+
+<!--    <div class="loginContainer">-->
+
+<!--        <h1>ログイン</h1>-->
+
+<!--        <form th:action="@{/doLogin}"-->
+<!--              method="post"-->
+<!--              th:object="${loginInfoForm}">-->
+
+<!--             エラーメッセージ -->
+<!--            <div class="msgBox error"-->
+<!--                 th:if="${messageError != null}">-->
+<!--                <span class="error"-->
+<!--                      th:text="${messageError.message}"></span>-->
+<!--            </div>-->
+
+<!--            <table>-->
+<!--                 メールアドレス -->
+<!--                <tr>-->
+<!--                    <th class="header">メールアドレス</th>-->
+<!--                    <td>-->
+<!--                        <input-->
+<!--                            id="mailAddress"-->
+<!--                            type="text"-->
+<!--                            th:field="*{mailAddress}"-->
+<!--                            placeholder="メールアドレス"-->
+<!--                            required-->
+<!--                        />-->
+<!--                    </td>-->
+<!--                </tr>-->
+
+<!--                 パスワード -->
+<!--                <tr>-->
+<!--                    <th class="header">パスワード</th>-->
+<!--                    <td>-->
+<!--                        <input-->
+<!--                            id="password"-->
+<!--                            type="password"-->
+<!--                            th:field="*{password}"-->
+<!--                            placeholder="パスワード"-->
+<!--                            required-->
+<!--                        />-->
+<!--                    </td>-->
+<!--                </tr>-->
+
+<!--                 ボタン -->
+<!--                <tr>-->
+<!--                    <td class="btnArea" colspan="2">-->
+<!--                        <input-->
+<!--                            type="submit"-->
+<!--                            value="ログイン"-->
+<!--                        />-->
+
+<!--                        <button-->
+<!--                            type="button"-->
+<!--                            onclick="clearInput()">-->
+<!--                            リセット-->
+<!--                        </button>-->
+<!--                    </td>-->
+<!--                </tr>-->
+<!--            </table>-->
+
+<!--        </form>-->
+
+<!--    </div>-->
+
+<!--     入力内容のリセット -->
+<!--    <script>-->
+<!--        function clearInput() {-->
+<!--            document.getElementById('mailAddress').value = '';-->
+<!--            document.getElementById('password').value = '';-->
+<!--        }-->
+<!--    </script>-->
+
+<!--</body>-->
+<!--</html>-->