WIP permissions

mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java

@@ -23,6 +23,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
 import org.mifosng.platform.organisation.service.CodeWritePlatformService;
 import org.mifosng.platform.organisation.service.CodeReadPlatformService;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -44,11 +45,21 @@ public class CodesApiResource {
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
 
+	private final String entityType = "CODE";
+	private final PlatformSecurityContext context;
+
+	@Autowired
+	public CodesApiResource(final PlatformSecurityContext context) {
+		this.context = context;
+	}
+	
 	@GET
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveCodes(@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 		

mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java

@@ -21,6 +21,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
 import org.mifosng.platform.configuration.service.ConfigurationReadPlatformService;
 import org.mifosng.platform.configuration.service.ConfigurationWritePlatformService;
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -42,12 +43,20 @@ public class ConfigurationApiResource {
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
 
+	private final PlatformSecurityContext context;
+
+	@Autowired
+	public ConfigurationApiResource(final PlatformSecurityContext context) {
+		this.context = context;
+	}
 	@GET
 	@Path("currency")
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveCurrencyDataForConfiguration(@Context final UriInfo uriInfo) {
 
+		context.authenticatedUser().validateHasReadPermission("CURRENCY");
+		
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("selectedCurrencyOptions", "currencyOptions"));
 		

mifosng-provider/src/main/java/org/mifosng/platform/configuration/service/ConfigurationWritePlatformService.java

@@ -1,9 +1,11 @@
 package org.mifosng.platform.configuration.service;
 
 import org.mifosng.platform.api.commands.OrganisationCurrencyCommand;
+import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface ConfigurationWritePlatformService {
 
+	@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_CURRENCY')")
 	void updateOrganisationCurrencies(OrganisationCurrencyCommand command);
 	
 }

mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/CodeWritePlatformService.java

@@ -5,9 +5,9 @@ import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface CodeWritePlatformService {
 
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_CODE')")
 	Long createCode(final CodeCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_CODE)")
 	Long updateCode(final CodeCommand command);
 }

mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java

@@ -327,8 +327,9 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 				+ entityType.toLowerCase() + "s";
 		String matchPermission = "READ_" + entityType.toUpperCase();
 
-		if (hasNotPermissionForAnyOf("ALL_FUNCTIONS_READ", matchPermission))
+		if (!(hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
-			throw new NoAuthorizationException(authorizationMessage);
+				matchPermission)))
+			return;
 
 		String higherPermission = "";
 		if (entityType.equalsIgnoreCase("CHARGE")) {
@@ -341,6 +342,10 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 			higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
 		} else if (entityType.equalsIgnoreCase("CLIENTIMAGE")) {
 			higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("CODE")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("CURRENCY")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
 		}
 
 		if (!(higherPermission.equals(""))) {