diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositProductsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositProductsApiResource.java index 74fed5c57..939bf5609 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositProductsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositProductsApiResource.java @@ -32,6 +32,7 @@ import org.mifosng.platform.loan.domain.PeriodFrequencyType; import org.mifosng.platform.savingproduct.service.DepositProductReadPlatformService; import org.mifosng.platform.savingproduct.service.DepositProductWritePlatformService; import org.mifosng.platform.savingproduct.service.SavingsDepositEnumerations; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -55,6 +56,10 @@ public class DepositProductsApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + + private final String entityType = "DEPOSITPRODUCT"; + @Autowired + private PlatformSecurityContext context; @POST @Consumes({MediaType.APPLICATION_JSON}) @@ -94,7 +99,9 @@ public class DepositProductsApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllDepositProducts(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "externalId", "name", "description", "createdOn", "lastModifedOn", "currencyCode","digitsAfterDecimal","minimumBalance","maximumBalance","tenureInMonths", @@ -118,7 +125,9 @@ public class DepositProductsApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveDepositProductDetails(@PathParam("productId") final Long productId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "externalId", "name", "description", "createdOn", "lastModifedOn", "currencyCode","digitsAfterDecimal","minimumBalance","maximumBalance","tenureInMonths", @@ -148,7 +157,9 @@ public class DepositProductsApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveNewDepositProductDetails(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("currencyOptions", "interestCompoundedEveryPeriodTypeOptions", "id", "externalId", "name", "description", "createdOn", "lastModifedOn", diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java index 21a7bfa8b..ec787db48 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java @@ -113,6 +113,8 @@ public class OfficeTransactionsApiResource { @Produces({ MediaType.APPLICATION_JSON }) public Response transferMoneyFrom(final String jsonRequestBody) { + context.authenticatedUser().validateHasReadPermission("OFFICETRANSACTION"); + BranchMoneyTransferCommand command = this.apiDataConversionService .convertJsonToBranchMoneyTransferCommand(jsonRequestBody); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/PermissionsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/PermissionsApiResource.java index 1d17ff2c1..a3fa52826 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/PermissionsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/PermissionsApiResource.java @@ -14,6 +14,7 @@ import javax.ws.rs.core.UriInfo; import org.mifosng.platform.api.data.PermissionData; import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService; import org.mifosng.platform.infrastructure.api.ApiParameterHelper; +import org.mifosng.platform.security.PlatformSecurityContext; import org.mifosng.platform.user.service.PermissionReadPlatformService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; @@ -30,11 +31,17 @@ public class PermissionsApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + private final String entityType = "PERMISSION"; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllPermissions(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/RolesApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/RolesApiResource.java index 952590c29..08d8ac58c 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/RolesApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/RolesApiResource.java @@ -22,6 +22,7 @@ import org.mifosng.platform.api.data.RoleData; import org.mifosng.platform.api.infrastructure.PortfolioApiDataConversionService; import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService; import org.mifosng.platform.infrastructure.api.ApiParameterHelper; +import org.mifosng.platform.security.PlatformSecurityContext; import org.mifosng.platform.user.service.PermissionReadPlatformService; import org.mifosng.platform.user.service.RoleReadPlatformService; import org.mifosng.platform.user.service.RoleWritePlatformService; @@ -49,11 +50,17 @@ public class RolesApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + private final String entityType = "ROLE"; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllRoles(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); @@ -68,6 +75,8 @@ public class RolesApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveNewRoleDetails(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); @@ -99,7 +108,9 @@ public class RolesApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveRole(@PathParam("roleId") final Long roleId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); final boolean template = ApiParameterHelper.template(uriInfo.getQueryParameters()); @@ -135,6 +146,8 @@ public class RolesApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveRolePermissions(@PathParam("roleId") final Long roleId, @Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet(Arrays.asList("id", "name", "description", jpw)); Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingProductsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingProductsApiResource.java index d04d52965..a549ca14c 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingProductsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingProductsApiResource.java @@ -37,6 +37,7 @@ import org.mifosng.platform.savingproduct.domain.TenureTypeEnum; import org.mifosng.platform.savingproduct.service.SavingProductEnumerations; import org.mifosng.platform.savingproduct.service.SavingProductReadPlatformService; import org.mifosng.platform.savingproduct.service.SavingProductWritePlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -60,6 +61,10 @@ public class SavingProductsApiResource { @Autowired private CurrencyReadPlatformService currencyReadPlatformService; + + private final String entityType = "SAVINGSPRODUCT"; + @Autowired + private PlatformSecurityContext context; @POST @Consumes({MediaType.APPLICATION_JSON}) @@ -89,6 +94,8 @@ public class SavingProductsApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllSavingProducts(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet(Arrays.asList("id", "createdOn", "lastModifedOn", "locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", "minInterestRate","maxInterestRate", "savingsDepositAmount","savingProductType","tenureType","tenure", "frequency","interestType","interestCalculationMethod", @@ -111,6 +118,8 @@ public class SavingProductsApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveSavingProductDetails(@PathParam("productId") final Long productId, @Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet(Arrays.asList("id", "createdOn", "lastModifedOn", "locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", "minInterestRate","maxInterestRate", "savingsDepositAmount","savingProductType","tenureType","tenure", "frequency","interestType","interestCalculationMethod", @@ -136,7 +145,9 @@ public class SavingProductsApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveNewSavingProductDetails(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "createdOn", "lastModifedOn", "locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/StaffApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/StaffApiResource.java index 7e413e7f6..7a9f5caa0 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/StaffApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/StaffApiResource.java @@ -31,6 +31,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService import org.mifosng.platform.infrastructure.api.ApiParameterHelper; import org.mifosng.platform.loan.service.LoanWritePlatformService; import org.mifosng.platform.organisation.service.OfficeReadPlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.mifosng.platform.staff.service.StaffReadPlatformService; import org.mifosng.platform.staff.service.StaffWritePlatformService; import org.slf4j.Logger; @@ -62,6 +63,10 @@ public class StaffApiResource { @Autowired private LoanWritePlatformService loanWritePlatformService; + private final String entityType = "STAFF"; + @Autowired + private PlatformSecurityContext context; + private final static Logger logger = LoggerFactory .getLogger(StaffApiResource.class); @@ -72,6 +77,8 @@ public class StaffApiResource { @QueryParam("sqlSearch") final String sqlSearch, @QueryParam("officeId") final Integer officeId) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper .extractFieldsForResponseIfProvided(uriInfo .getQueryParameters()); @@ -106,6 +113,8 @@ public class StaffApiResource { public String retreiveStaff(@PathParam("staffId") final Long staffId, @Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper .extractFieldsForResponseIfProvided(uriInfo .getQueryParameters()); @@ -161,6 +170,8 @@ public class StaffApiResource { @QueryParam("fromLoanOfficerId") final Long loanOfficerId, @Context final UriInfo uriInfo){ + context.authenticatedUser().validateHasReadPermission("LOAN"); + final Set responseParameters = ApiParameterHelper .extractFieldsForResponseIfProvided(uriInfo .getQueryParameters()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java index 6638facb9..34c6381a2 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java @@ -55,7 +55,8 @@ public class UsersApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; - + + private final String entityType = "USER"; @Autowired private PlatformSecurityContext context; @@ -65,7 +66,9 @@ public class UsersApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveUsers(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); @@ -82,7 +85,9 @@ public class UsersApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveUser(@PathParam("userId") final Long userId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); @@ -110,7 +115,9 @@ public class UsersApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String newUserDetails(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java index 62abc4659..99e973adf 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java @@ -13,6 +13,6 @@ public interface OfficeWritePlatformService { Long updateOffice(final OfficeCommand command); //TODO - complete permissions for office transactions when more functionality add or it is replaced by simple accounting equivalent (JPW) - @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_OFFICETRANSACTION')") Long externalBranchMoneyTransfer(BranchMoneyTransferCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/DepositProductWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/DepositProductWritePlatformService.java index eb15d6b0f..141a0de52 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/DepositProductWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/DepositProductWritePlatformService.java @@ -6,13 +6,13 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface DepositProductWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_DEPOSITPRODUCT')") EntityIdentifier createDepositProduct(DepositProductCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_DEPOSITPRODUCT')") EntityIdentifier updateDepositProduct(DepositProductCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'DELETE_DEPOSITPRODUCT')") EntityIdentifier deleteDepositProduct(Long productId); } diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/SavingProductWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/SavingProductWritePlatformService.java index c6653f418..9daf41f3d 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/SavingProductWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/SavingProductWritePlatformService.java @@ -5,12 +5,13 @@ import org.mifosng.platform.api.data.EntityIdentifier; import org.springframework.security.access.prepost.PreAuthorize; public interface SavingProductWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_SAVINGSPRODUCT')") EntityIdentifier createSavingProduct(SavingProductCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_SAVINGSPRODUCT')") EntityIdentifier updateSavingProduct(SavingProductCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'DELETE_SAVINGSPRODUCT')") EntityIdentifier deleteSavingProduct(Long productId); } diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/staff/service/StaffWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/staff/service/StaffWritePlatformService.java index e33fab8d0..a542301b5 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/staff/service/StaffWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/staff/service/StaffWritePlatformService.java @@ -5,9 +5,9 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface StaffWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_STAFF')") Long createStaff(final StaffCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_STAFF')") Long updateStaff(final StaffCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java index 702d85f57..8ad7189e1 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java @@ -256,8 +256,8 @@ public class AppUser extends AbstractAuditableCustom implements } public boolean canNotMakeRepaymentOnLoanInPast() { - return hasNotPermissionForAnyOf("ALL_FUNCTIONS", "REPAYMENTINPAST_LOAN", - "PORTFOLIO_MANAGEMENT_SUPER_USER"); + return hasNotPermissionForAnyOf("ALL_FUNCTIONS", + "REPAYMENTINPAST_LOAN", "PORTFOLIO_MANAGEMENT_SUPER_USER"); } public boolean hasNotPermissionForReport(String reportName) { @@ -360,6 +360,18 @@ public class AppUser extends AbstractAuditableCustom implements higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } else if (entityType.equalsIgnoreCase("OFFICETRANSACTION")) { higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("PERMISSION")) { + higherPermission = "USER_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("ROLE")) { + higherPermission = "USER_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("USER")) { + higherPermission = "USER_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("STAFF")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("SAVINGSPRODUCT")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("DEPOSITPRODUCT")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } if (!(higherPermission.equals(""))) { diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java index 3e96ba1ef..702e022b4 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java @@ -5,13 +5,13 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface AppUserWritePlatformService { - @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'CREATE_USER')") Long createUser(final UserCommand command); - - @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'UPDATE_USER')") Long updateUser(final UserCommand command); - - @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'DELETE_USER')") void deleteUser(final Long userId); // we dont put any permissions on this e.g. a user with no admin rights can change their own details (email, username, password etc). diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/RoleWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/RoleWritePlatformService.java index e07fa6d8b..d27db1ea6 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/service/RoleWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/service/RoleWritePlatformService.java @@ -4,10 +4,10 @@ import org.mifosng.platform.api.commands.RoleCommand; import org.springframework.security.access.prepost.PreAuthorize; public interface RoleWritePlatformService { - - @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')") - Long createRole(RoleCommand command); - @PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'CREATE_ROLE')") + Long createRole(RoleCommand command); + + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'UPDATE_ROLE')") Long updateRole(RoleCommand command); } \ No newline at end of file