wip permissions

mifosng-provider/src/main/java/org/mifosng/platform/api/DepositProductsApiResource.java

@@ -32,6 +32,7 @@ import org.mifosng.platform.loan.domain.PeriodFrequencyType;
 import org.mifosng.platform.savingproduct.service.DepositProductReadPlatformService;
 import org.mifosng.platform.savingproduct.service.DepositProductWritePlatformService;
 import org.mifosng.platform.savingproduct.service.SavingsDepositEnumerations;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -55,6 +56,10 @@ public class DepositProductsApiResource {
 	
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
+
+	private final String entityType = "DEPOSITPRODUCT";
+	@Autowired
+	private PlatformSecurityContext context;
 	
 	@POST
 	@Consumes({MediaType.APPLICATION_JSON})
@@ -94,7 +99,9 @@ public class DepositProductsApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveAllDepositProducts(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("id", "externalId", "name", "description", "createdOn", "lastModifedOn",
 				"currencyCode","digitsAfterDecimal","minimumBalance","maximumBalance","tenureInMonths",
@@ -118,7 +125,9 @@ public class DepositProductsApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveDepositProductDetails(@PathParam("productId") final Long productId, @Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("id", "externalId", "name", "description", "createdOn", "lastModifedOn",
 				"currencyCode","digitsAfterDecimal","minimumBalance","maximumBalance","tenureInMonths",
@@ -148,7 +157,9 @@ public class DepositProductsApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveNewDepositProductDetails(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("currencyOptions", "interestCompoundedEveryPeriodTypeOptions", 
 				"id", "externalId", "name", "description", "createdOn", "lastModifedOn",

mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java

@@ -113,6 +113,8 @@ public class OfficeTransactionsApiResource {
 	@Produces({ MediaType.APPLICATION_JSON })
 	public Response transferMoneyFrom(final String jsonRequestBody) {
 
+    	context.authenticatedUser().validateHasReadPermission("OFFICETRANSACTION");
+    	
 		BranchMoneyTransferCommand command = this.apiDataConversionService
 				.convertJsonToBranchMoneyTransferCommand(jsonRequestBody);
 

mifosng-provider/src/main/java/org/mifosng/platform/api/PermissionsApiResource.java

@@ -14,6 +14,7 @@ import javax.ws.rs.core.UriInfo;
 import org.mifosng.platform.api.data.PermissionData;
 import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService;
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.mifosng.platform.user.service.PermissionReadPlatformService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
@@ -30,11 +31,17 @@ public class PermissionsApiResource {
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
 
+	private final String entityType = "PERMISSION";
+    @Autowired
+    private PlatformSecurityContext context;
+    
 	@GET
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveAllPermissions(@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		final Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 		

mifosng-provider/src/main/java/org/mifosng/platform/api/RolesApiResource.java

@@ -22,6 +22,7 @@ import org.mifosng.platform.api.data.RoleData;
 import org.mifosng.platform.api.infrastructure.PortfolioApiDataConversionService;
 import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService;
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.mifosng.platform.user.service.PermissionReadPlatformService;
 import org.mifosng.platform.user.service.RoleReadPlatformService;
 import org.mifosng.platform.user.service.RoleWritePlatformService;
@@ -49,11 +50,17 @@ public class RolesApiResource {
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
 
+	private final String entityType = "ROLE";
+    @Autowired
+    private PlatformSecurityContext context;
+    
 	@GET
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveAllRoles(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		final Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 
@@ -68,6 +75,8 @@ public class RolesApiResource {
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveNewRoleDetails(@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		final Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 		
@@ -99,7 +108,9 @@ public class RolesApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveRole(@PathParam("roleId") final Long roleId, @Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		final Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
 		final boolean template = ApiParameterHelper.template(uriInfo.getQueryParameters());
@@ -135,6 +146,8 @@ public class RolesApiResource {
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveRolePermissions(@PathParam("roleId") final Long roleId, @Context final UriInfo uriInfo) {
 		
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(Arrays.asList("id", "name", "description", jpw));
 		
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());

mifosng-provider/src/main/java/org/mifosng/platform/api/SavingProductsApiResource.java

@@ -37,6 +37,7 @@ import org.mifosng.platform.savingproduct.domain.TenureTypeEnum;
 import org.mifosng.platform.savingproduct.service.SavingProductEnumerations;
 import org.mifosng.platform.savingproduct.service.SavingProductReadPlatformService;
 import org.mifosng.platform.savingproduct.service.SavingProductWritePlatformService;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -60,6 +61,10 @@ public class SavingProductsApiResource {
     
     @Autowired
 	private CurrencyReadPlatformService currencyReadPlatformService;
+
+	private final String entityType = "SAVINGSPRODUCT";
+	@Autowired
+	private PlatformSecurityContext context;
 	
 	@POST
 	@Consumes({MediaType.APPLICATION_JSON})
@@ -89,6 +94,8 @@ public class SavingProductsApiResource {
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveAllSavingProducts(@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(Arrays.asList("id", "createdOn", "lastModifedOn",
 				"locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", "minInterestRate","maxInterestRate",
 				"savingsDepositAmount","savingProductType","tenureType","tenure", "frequency","interestType","interestCalculationMethod",
@@ -111,6 +118,8 @@ public class SavingProductsApiResource {
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveSavingProductDetails(@PathParam("productId") final Long productId, @Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(Arrays.asList("id", "createdOn", "lastModifedOn",
 				"locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", "minInterestRate","maxInterestRate",
 				"savingsDepositAmount","savingProductType","tenureType","tenure", "frequency","interestType","interestCalculationMethod",
@@ -136,7 +145,9 @@ public class SavingProductsApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveNewSavingProductDetails(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> typicalResponseParameters = new HashSet<String>(
 				Arrays.asList("id", "createdOn", "lastModifedOn",
 						"locale", "name", "description","currencyCode", "digitsAfterDecimal","interstRate", 

mifosng-provider/src/main/java/org/mifosng/platform/api/StaffApiResource.java

@@ -31,6 +31,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
 import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
 import org.mifosng.platform.loan.service.LoanWritePlatformService;
 import org.mifosng.platform.organisation.service.OfficeReadPlatformService;
+import org.mifosng.platform.security.PlatformSecurityContext;
 import org.mifosng.platform.staff.service.StaffReadPlatformService;
 import org.mifosng.platform.staff.service.StaffWritePlatformService;
 import org.slf4j.Logger;
@@ -62,6 +63,10 @@ public class StaffApiResource {
     @Autowired
     private LoanWritePlatformService loanWritePlatformService;
 
+	private final String entityType = "STAFF";
+	@Autowired
+	private PlatformSecurityContext context;
+	
 	private final static Logger logger = LoggerFactory
 			.getLogger(StaffApiResource.class);
 
@@ -72,6 +77,8 @@ public class StaffApiResource {
 			@QueryParam("sqlSearch") final String sqlSearch,
 			@QueryParam("officeId") final Integer officeId) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper
 				.extractFieldsForResponseIfProvided(uriInfo
 						.getQueryParameters());
@@ -106,6 +113,8 @@ public class StaffApiResource {
 	public String retreiveStaff(@PathParam("staffId") final Long staffId,
 			@Context final UriInfo uriInfo) {
 
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		final Set<String> responseParameters = ApiParameterHelper
 				.extractFieldsForResponseIfProvided(uriInfo
 						.getQueryParameters());
@@ -161,6 +170,8 @@ public class StaffApiResource {
                                            @QueryParam("fromLoanOfficerId") final Long loanOfficerId,
                                            @Context final UriInfo uriInfo){
 
+    	context.authenticatedUser().validateHasReadPermission("LOAN");
+    	
         final Set<String> responseParameters = ApiParameterHelper
                 .extractFieldsForResponseIfProvided(uriInfo
                         .getQueryParameters());

mifosng-provider/src/main/java/org/mifosng/platform/api/UsersApiResource.java

@@ -55,7 +55,8 @@ public class UsersApiResource {
 	
 	@Autowired
 	private PortfolioApiJsonSerializerService apiJsonSerializerService;
-	
+
+	private final String entityType = "USER";
 	@Autowired
 	private PlatformSecurityContext context;
 
@@ -65,7 +66,9 @@ public class UsersApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveUsers(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		if (responseParameters.isEmpty()) {
 			responseParameters.addAll(typicalResponseParameters);
@@ -82,7 +85,9 @@ public class UsersApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String retrieveUser(@PathParam("userId") final Long userId, @Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		if (responseParameters.isEmpty()) {
 			responseParameters.addAll(typicalResponseParameters);
@@ -110,7 +115,9 @@ public class UsersApiResource {
 	@Consumes({MediaType.APPLICATION_JSON})
 	@Produces({MediaType.APPLICATION_JSON})
 	public String newUserDetails(@Context final UriInfo uriInfo) {
-		
+
+    	context.authenticatedUser().validateHasReadPermission(entityType);
+    	
 		Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
 		if (responseParameters.isEmpty()) {
 			responseParameters.addAll(typicalResponseParameters);

mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java

@@ -13,6 +13,6 @@ public interface OfficeWritePlatformService {
 	Long updateOffice(final OfficeCommand command);
 
     //TODO - complete permissions for office transactions when more functionality add or it is replaced by simple accounting equivalent (JPW)
-    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER')")
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_OFFICETRANSACTION')")
 	Long externalBranchMoneyTransfer(BranchMoneyTransferCommand command);
 }

mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/DepositProductWritePlatformService.java

@@ -6,13 +6,13 @@ import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface DepositProductWritePlatformService {
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_DEPOSITPRODUCT')")
 	EntityIdentifier createDepositProduct(DepositProductCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_DEPOSITPRODUCT')")
 	EntityIdentifier updateDepositProduct(DepositProductCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'DELETE_DEPOSITPRODUCT')")
 	EntityIdentifier deleteDepositProduct(Long productId);
 
 }

mifosng-provider/src/main/java/org/mifosng/platform/savingproduct/service/SavingProductWritePlatformService.java

@@ -5,12 +5,13 @@ import org.mifosng.platform.api.data.EntityIdentifier;
 import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface SavingProductWritePlatformService {
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_SAVINGSPRODUCT')")
 	EntityIdentifier createSavingProduct(SavingProductCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_SAVINGSPRODUCT')")
 	EntityIdentifier updateSavingProduct(SavingProductCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'DELETE_SAVINGSPRODUCT')")
 	EntityIdentifier deleteSavingProduct(Long productId);
 }

mifosng-provider/src/main/java/org/mifosng/platform/staff/service/StaffWritePlatformService.java

@@ -5,9 +5,9 @@ import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface StaffWritePlatformService {
 
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_STAFF')")
 	Long createStaff(final StaffCommand command);
 	
-	@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
+	@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_STAFF')")
 	Long updateStaff(final StaffCommand command);
 }

mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java

@@ -256,8 +256,8 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 	}
 
 	public boolean canNotMakeRepaymentOnLoanInPast() {
-		return hasNotPermissionForAnyOf("ALL_FUNCTIONS", "REPAYMENTINPAST_LOAN",
+		return hasNotPermissionForAnyOf("ALL_FUNCTIONS",
-				"PORTFOLIO_MANAGEMENT_SUPER_USER");
+				"REPAYMENTINPAST_LOAN", "PORTFOLIO_MANAGEMENT_SUPER_USER");
 	}
 
 	public boolean hasNotPermissionForReport(String reportName) {
@@ -360,6 +360,18 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
 			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
 		} else if (entityType.equalsIgnoreCase("OFFICETRANSACTION")) {
 			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("PERMISSION")) {
+			higherPermission = "USER_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("ROLE")) {
+			higherPermission = "USER_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("USER")) {
+			higherPermission = "USER_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("STAFF")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("SAVINGSPRODUCT")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
+		} else if (entityType.equalsIgnoreCase("DEPOSITPRODUCT")) {
+			higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
 		}
 
 		if (!(higherPermission.equals(""))) {

mifosng-provider/src/main/java/org/mifosng/platform/user/service/AppUserWritePlatformService.java

@@ -5,13 +5,13 @@ import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface AppUserWritePlatformService {
 
-	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')")
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'CREATE_USER')")
 	Long createUser(final UserCommand command);
-	
+
-	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')")
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'UPDATE_USER')")
 	Long updateUser(final UserCommand command);
-	
+
-	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')")
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'DELETE_USER')")
 	void deleteUser(final Long userId);
 
 	// we dont put any permissions on this e.g. a user with no admin rights can change their own details (email, username, password etc).

mifosng-provider/src/main/java/org/mifosng/platform/user/service/RoleWritePlatformService.java

@@ -4,10 +4,10 @@ import org.mifosng.platform.api.commands.RoleCommand;
 import org.springframework.security.access.prepost.PreAuthorize;
 
 public interface RoleWritePlatformService {
-
-	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')")
-	Long createRole(RoleCommand command);
 	
-	@PreAuthorize(value = "hasRole('USER_ADMINISTRATION_SUPER_USER')")
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'CREATE_ROLE')")
+	Long createRole(RoleCommand command);
+
+    @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'USER_ADMINISTRATION_SUPER_USER', 'UPDATE_ROLE')")
 	Long updateRole(RoleCommand command);
 }