CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

MIFOSX-648: allow user to fetch their own account data no matter what permissions they hold.

Browse Source
This commit is contained in:
Keith Woodlock
2013-09-09 09:54:42 +01:00
parent bdb2162ab7
commit 0de4adf6e5
3 changed files with 472 additions and 512 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosplatform/portfolio/savings/domain/SavingsProduct.java
+5 -6
View File
@@ -121,7 +121,6 @@ public class SavingsProduct extends AbstractPersistable<Long> {
private Integer withdrawalFeeType;
@Column(name = "withdrawal_fee_for_transfer")
@SuppressWarnings("unused")
private boolean withdrawalFeeApplicableForTransfer;
@Column(name = "annual_fee_amount", scale = 6, precision = 19, nullable = true)
@@ -138,7 +137,7 @@ public class SavingsProduct extends AbstractPersistable<Long> {
final SavingsPostingInterestPeriodType interestPostingPeriodType, final SavingsInterestCalculationType interestCalculationType,
final SavingsInterestCalculationDaysInYearType interestCalculationDaysInYearType, final BigDecimal minRequiredOpeningBalance,
final Integer lockinPeriodFrequency, final SavingsPeriodFrequencyType lockinPeriodFrequencyType,
final BigDecimal withdrawalFeeAmount, final SavingsWithdrawalFeesType withdrawalFeeType, boolean withdrawalFeeApplicableForTransfer,
final BigDecimal withdrawalFeeAmount, final SavingsWithdrawalFeesType withdrawalFeeType, final boolean withdrawalFeeApplicableForTransfer,
final BigDecimal annualFeeAmount, final MonthDay annualFeeOnMonthDay, final AccountingRuleType accountingRuleType) {
return new SavingsProduct(name, description, currency, interestRate, interestCompoundingPeriodType, interestPostingPeriodType,
@@ -484,16 +483,16 @@ public class SavingsProduct extends AbstractPersistable<Long> {
.resource(SAVINGS_PRODUCT_RESOURCE_NAME);
if (this.lockinPeriodFrequency == null) {
baseDataValidator.reset().parameter(lockinPeriodFrequencyTypeParamName).value(lockinPeriodFrequencyType).ignoreIfNull()
baseDataValidator.reset().parameter(lockinPeriodFrequencyTypeParamName).value(this.lockinPeriodFrequencyType).ignoreIfNull()
.inMinMaxRange(0, 3);
if (this.lockinPeriodFrequencyType != null) {
baseDataValidator.reset().parameter(lockinPeriodFrequencyParamName).value(lockinPeriodFrequency).notNull()
baseDataValidator.reset().parameter(lockinPeriodFrequencyParamName).value(this.lockinPeriodFrequency).notNull()
.integerZeroOrGreater();
}
} else {
baseDataValidator.reset().parameter(lockinPeriodFrequencyParamName).value(lockinPeriodFrequencyType).integerZeroOrGreater();
baseDataValidator.reset().parameter(lockinPeriodFrequencyTypeParamName).value(lockinPeriodFrequencyType).notNull()
baseDataValidator.reset().parameter(lockinPeriodFrequencyParamName).value(this.lockinPeriodFrequencyType).integerZeroOrGreater();
baseDataValidator.reset().parameter(lockinPeriodFrequencyTypeParamName).value(this.lockinPeriodFrequencyType).notNull()
.inMinMaxRange(0, 3);
}
mifosng-provider/src/main/java/org/mifosplatform/useradministration/api/UsersApiResource.java
+15 -15
View File
@@ -75,25 +75,25 @@ public class UsersApiResource {
@GET
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String retrieveUsers(@Context final UriInfo uriInfo) {
public String retrieveAll(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(resourceNameForPermissions);
this.context.authenticatedUser().validateHasReadPermission(this.resourceNameForPermissions);
final Collection<AppUserData> users = this.readPlatformService.retrieveAllUsers();
final ApiRequestJsonSerializationSettings settings = apiRequestParameterHelper.process(uriInfo.getQueryParameters());
return this.toApiJsonSerializer.serialize(settings, users, RESPONSE_DATA_PARAMETERS);
final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
return this.toApiJsonSerializer.serialize(settings, users, this.RESPONSE_DATA_PARAMETERS);
}
@GET
@Path("{userId}")
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String retrieveUser(@PathParam("userId") final Long userId, @Context final UriInfo uriInfo) {
public String retrieveOne(@PathParam("userId") final Long userId, @Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(resourceNameForPermissions);
this.context.authenticatedUser().validateHasReadPermission(this.resourceNameForPermissions, userId);
final ApiRequestJsonSerializationSettings settings = apiRequestParameterHelper.process(uriInfo.getQueryParameters());
final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
AppUserData user = this.readPlatformService.retrieveUser(userId);
if (settings.isTemplate()) {
@@ -101,27 +101,27 @@ public class UsersApiResource {
user = AppUserData.template(user, offices);
}
return this.toApiJsonSerializer.serialize(settings, user, RESPONSE_DATA_PARAMETERS);
return this.toApiJsonSerializer.serialize(settings, user, this.RESPONSE_DATA_PARAMETERS);
}
@GET
@Path("template")
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String newUserDetails(@Context final UriInfo uriInfo) {
public String template(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(resourceNameForPermissions);
this.context.authenticatedUser().validateHasReadPermission(this.resourceNameForPermissions);
final AppUserData user = this.readPlatformService.retrieveNewUserDetails();
final ApiRequestJsonSerializationSettings settings = apiRequestParameterHelper.process(uriInfo.getQueryParameters());
return this.toApiJsonSerializer.serialize(settings, user, RESPONSE_DATA_PARAMETERS);
final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
return this.toApiJsonSerializer.serialize(settings, user, this.RESPONSE_DATA_PARAMETERS);
}
@POST
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String createUser(final String apiRequestBodyAsJson) {
public String create(final String apiRequestBodyAsJson) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.createUser() //
@@ -137,7 +137,7 @@ public class UsersApiResource {
@Path("{userId}")
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String updateUser(@PathParam("userId") final Long userId, final String apiRequestBodyAsJson) {
public String update(@PathParam("userId") final Long userId, final String apiRequestBodyAsJson) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.updateUser(userId) //
@@ -153,7 +153,7 @@ public class UsersApiResource {
@Path("{userId}")
@Consumes({ MediaType.APPLICATION_JSON })
@Produces({ MediaType.APPLICATION_JSON })
public String deleteUser(@PathParam("userId") final Long userId) {
public String delete(@PathParam("userId") final Long userId) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.deleteUser(userId) //
mifosng-provider/src/main/java/org/mifosplatform/useradministration/domain/AppUser.java
+52 -91
View File
@@ -89,13 +89,11 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
@JoinTable(name = "m_appuser_role", joinColumns = @JoinColumn(name = "appuser_id"), inverseJoinColumns = @JoinColumn(name = "role_id"))
private Set<Role> roles;
public static AppUser fromJson(final Office userOffice,
final Set<Role> allRoles, final JsonCommand command) {
public static AppUser fromJson(final Office userOffice, final Set<Role> allRoles, final JsonCommand command) {
final String username = command.stringValueOfParameterNamed("username");
String password = command.stringValueOfParameterNamed("password");
final Boolean sendPasswordToEmail = command
.booleanObjectValueOfParameterNamed("sendPasswordToEmail");
final Boolean sendPasswordToEmail = command.booleanObjectValueOfParameterNamed("sendPasswordToEmail");
if (sendPasswordToEmail.booleanValue()) {
password = new RandomPasswordGenerator(13).generate();
@@ -107,20 +105,16 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
final boolean userAccountNonLocked = true;
final Collection<SimpleGrantedAuthority> authorities = new ArrayList<SimpleGrantedAuthority>();
authorities.add(new SimpleGrantedAuthority(
"DUMMY_ROLE_NOT_USED_OR_PERSISTED_TO_AVOID_EXCEPTION"));
authorities.add(new SimpleGrantedAuthority("DUMMY_ROLE_NOT_USED_OR_PERSISTED_TO_AVOID_EXCEPTION"));
final User user = new User(username, password, userEnabled,
userAccountNonExpired, userCredentialsNonExpired,
userAccountNonLocked, authorities);
final User user = new User(username, password, userEnabled, userAccountNonExpired, userCredentialsNonExpired, userAccountNonLocked,
authorities);
final String email = command.stringValueOfParameterNamed("email");
final String firstname = command
.stringValueOfParameterNamed("firstname");
final String firstname = command.stringValueOfParameterNamed("firstname");
final String lastname = command.stringValueOfParameterNamed("lastname");
return new AppUser(userOffice, user, allRoles, email, firstname,
lastname);
return new AppUser(userOffice, user, allRoles, email, firstname, lastname);
}
protected AppUser() {
@@ -129,8 +123,8 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
this.roles = new HashSet<Role>();
}
public AppUser(final Office office, final User user, final Set<Role> roles,
final String email, final String firstname, final String lastname) {
public AppUser(final Office office, final User user, final Set<Role> roles, final String email, final String firstname,
final String lastname) {
this.office = office;
this.email = email.trim();
this.username = user.getUsername().trim();
@@ -169,84 +163,66 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
}
}
public Map<String, Object> update(final JsonCommand command,
final PlatformPasswordEncoder platformPasswordEncoder) {
public Map<String, Object> update(final JsonCommand command, final PlatformPasswordEncoder platformPasswordEncoder) {
final Map<String, Object> actualChanges = new LinkedHashMap<String, Object>(
7);
final Map<String, Object> actualChanges = new LinkedHashMap<String, Object>(7);
// unencoded password provided
final String passwordParamName = "password";
final String passwordEncodedParamName = "passwordEncoded";
if (command.hasParameter(passwordParamName)) {
if (command.isChangeInPasswordParameterNamed(passwordParamName,
this.password, platformPasswordEncoder, getId())) {
final String passwordEncodedValue = command
.passwordValueOfParameterNamed(passwordParamName,
platformPasswordEncoder, getId());
actualChanges.put(passwordEncodedParamName,
passwordEncodedValue);
if (command.isChangeInPasswordParameterNamed(passwordParamName, this.password, platformPasswordEncoder, getId())) {
final String passwordEncodedValue = command.passwordValueOfParameterNamed(passwordParamName, platformPasswordEncoder,
getId());
actualChanges.put(passwordEncodedParamName, passwordEncodedValue);
updatePassword(passwordEncodedValue);
}
}
if (command.hasParameter(passwordEncodedParamName)) {
if (command.isChangeInStringParameterNamed(
passwordEncodedParamName, this.password)) {
final String newValue = command
.stringValueOfParameterNamed(passwordEncodedParamName);
if (command.isChangeInStringParameterNamed(passwordEncodedParamName, this.password)) {
final String newValue = command.stringValueOfParameterNamed(passwordEncodedParamName);
actualChanges.put(passwordEncodedParamName, newValue);
updatePassword(newValue);
}
}
final String officeIdParamName = "officeId";
if (command.isChangeInLongParameterNamed(officeIdParamName,
this.office.getId())) {
final Long newValue = command
.longValueOfParameterNamed(officeIdParamName);
if (command.isChangeInLongParameterNamed(officeIdParamName, this.office.getId())) {
final Long newValue = command.longValueOfParameterNamed(officeIdParamName);
actualChanges.put(officeIdParamName, newValue);
}
final String rolesParamName = "roles";
if (command.isChangeInArrayParameterNamed(rolesParamName,
getRolesAsIdStringArray())) {
final String[] newValue = command
.arrayValueOfParameterNamed(rolesParamName);
if (command.isChangeInArrayParameterNamed(rolesParamName, getRolesAsIdStringArray())) {
final String[] newValue = command.arrayValueOfParameterNamed(rolesParamName);
actualChanges.put(rolesParamName, newValue);
}
final String usernameParamName = "username";
if (command.isChangeInStringParameterNamed(usernameParamName,
this.username)) {
final String newValue = command
.stringValueOfParameterNamed(usernameParamName);
if (command.isChangeInStringParameterNamed(usernameParamName, this.username)) {
final String newValue = command.stringValueOfParameterNamed(usernameParamName);
actualChanges.put(usernameParamName, newValue);
this.username = newValue;
}
final String firstnameParamName = "firstname";
if (command.isChangeInStringParameterNamed(firstnameParamName,
this.firstname)) {
final String newValue = command
.stringValueOfParameterNamed(firstnameParamName);
if (command.isChangeInStringParameterNamed(firstnameParamName, this.firstname)) {
final String newValue = command.stringValueOfParameterNamed(firstnameParamName);
actualChanges.put(firstnameParamName, newValue);
this.firstname = newValue;
}
final String lastnameParamName = "lastname";
if (command.isChangeInStringParameterNamed(lastnameParamName,
this.lastname)) {
final String newValue = command
.stringValueOfParameterNamed(lastnameParamName);
if (command.isChangeInStringParameterNamed(lastnameParamName, this.lastname)) {
final String newValue = command.stringValueOfParameterNamed(lastnameParamName);
actualChanges.put(lastnameParamName, newValue);
this.lastname = newValue;
}
final String emailParamName = "email";
if (command.isChangeInStringParameterNamed(emailParamName, this.email)) {
final String newValue = command
.stringValueOfParameterNamed(emailParamName);
final String newValue = command.stringValueOfParameterNamed(emailParamName);
actualChanges.put(emailParamName, newValue);
this.email = newValue;
}
@@ -292,8 +268,7 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
for (final Role role : this.roles) {
final Collection<Permission> permissions = role.getPermissions();
for (final Permission permission : permissions) {
grantedAuthorities.add(new SimpleGrantedAuthority(permission
.getCode()));
grantedAuthorities.add(new SimpleGrantedAuthority(permission.getCode()));
}
}
return grantedAuthorities;
@@ -371,32 +346,23 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
public boolean hasNotPermissionForReport(final String reportName) {
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
"REPORTING_SUPER_USER", "READ_" + reportName)) {
return true;
}
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", "REPORTING_SUPER_USER", "READ_" + reportName)) { return true; }
return false;
}
public boolean hasNotPermissionForDatatable(final String datatable,
final String accessType) {
public boolean hasNotPermissionForDatatable(final String datatable, final String accessType) {
final String matchPermission = accessType + "_" + datatable;
if (accessType.equalsIgnoreCase("READ")) {
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
matchPermission)) {
return true;
}
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", matchPermission)) { return true; }
return false;
}
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", matchPermission)) {
return true;
}
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", matchPermission)) { return true; }
return false;
}
@@ -415,14 +381,10 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
public void validateHasReadPermission(final String resourceType) {
final String authorizationMessage = "User has no authority to view "
+ resourceType.toLowerCase() + "s";
final String authorizationMessage = "User has no authority to view " + resourceType.toLowerCase() + "s";
final String matchPermission = "READ_" + resourceType.toUpperCase();
if (!hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
matchPermission)) {
return;
}
if (!hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", matchPermission)) { return; }
throw new NoAuthorizationException(authorizationMessage);
}
@@ -476,42 +438,41 @@ public class AppUser extends AbstractPersistable<Long> implements PlatformUser {
return hasAtLeastOneOf;
}
public void validateHasPermissionTo(final String function,
final List<String> allowedPermissions) {
public void validateHasPermissionTo(final String function, final List<String> allowedPermissions) {
if (hasNotAnyPermission(allowedPermissions)) {
final String authorizationMessage = "User has no authority to: "
+ function;
final String authorizationMessage = "User has no authority to: " + function;
throw new NoAuthorizationException(authorizationMessage);
}
}
public void validateHasPermissionTo(final String function) {
if (hasNotPermissionTo(function)) {
final String authorizationMessage = "User has no authority to: "
+ function;
logger.info("Unauthorized access: userId: " + getId() + " action: "
+ function + " allowed: " + getAuthorities());
final String authorizationMessage = "User has no authority to: " + function;
logger.info("Unauthorized access: userId: " + getId() + " action: " + function + " allowed: " + getAuthorities());
throw new NoAuthorizationException(authorizationMessage);
}
}
public void validateHasReadPermission(final String function, final Long userId) {
if ("USER".equalsIgnoreCase(function) && userId.equals(getId())) {
// abstain from validation as user allowed fetch their own data no matter what permissions they have.
} else {
validateHasPermissionTo(function);
}
}
public void validateHasCheckerPermissionTo(final String function) {
final String checkerPermissionName = function.toUpperCase()
+ "_CHECKER";
if (hasNotPermissionTo("CHECKER_SUPER_USER")
&& hasNotPermissionTo(checkerPermissionName)) {
final String authorizationMessage = "User has no authority to be a checker for: "
+ function;
final String checkerPermissionName = function.toUpperCase() + "_CHECKER";
if (hasNotPermissionTo("CHECKER_SUPER_USER") && hasNotPermissionTo(checkerPermissionName)) {
final String authorizationMessage = "User has no authority to be a checker for: " + function;
throw new NoAuthorizationException(authorizationMessage);
}
}
public void validateHasDatatableReadPermission(final String datatable) {
if (hasNotPermissionForDatatable(datatable, "READ")) {
throw new NoAuthorizationException(
"Not authorised to read datatable: " + datatable);
}
if (hasNotPermissionForDatatable(datatable, "READ")) { throw new NoAuthorizationException("Not authorised to read datatable: "
+ datatable); }
}
public Long getStaffId() {