From 1eb4978eea667e88cd7e582c5942d6c9a2f30910 Mon Sep 17 00:00:00 2001
From: Keith Woodlock <keithwoodlock@gmail.com>
Date: Fri, 1 Jun 2012 01:35:05 +0100
Subject: [PATCH] add check for client id when updating client notes.

---
 .../java/org/mifosng/platform/client/domain/Client.java     | 4 ++++
 .../main/java/org/mifosng/platform/client/domain/Note.java  | 5 ++++-
 .../ClientWritePlatformServiceJpaRepositoryImpl.java        | 6 +++---
 .../mifosng/platform/exceptions/NoteNotFoundException.java  | 4 ++++
 4 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Client.java b/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Client.java
index b7116faa8..4e24c0b05 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Client.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Client.java
@@ -86,6 +86,10 @@ public class Client extends AbstractAuditableCustom<AppUser, Long> {
 	public boolean identifiedBy(final String identifier) {
 		return identifier.equalsIgnoreCase(this.externalId);
 	}
+	
+	public boolean identifiedBy(Long clientId) {
+		return getId().equals(clientId);
+	}
 
 	public void update(ClientCommand command) {
 		this.joiningDate = command.getJoiningLocalDate().toDate();
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Note.java b/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Note.java
index af698f3cd..72d692941 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Note.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/client/domain/Note.java
@@ -21,7 +21,6 @@ public class Note extends AbstractAuditableCustom<AppUser, Long> {
     @JoinColumn(name = "org_id", nullable = false)
     private final Organisation organisation;
 
-    @SuppressWarnings("unused")
 	@ManyToOne
     @JoinColumn(name = "client_id", nullable = false)
     private final Client       client;
@@ -113,4 +112,8 @@ public class Note extends AbstractAuditableCustom<AppUser, Long> {
 	public void update(final String note) {
 		this.note = note;
 	}
+
+	public boolean isNotAgainstClientWithIdOf(Long clientId) {
+		return !this.client.identifiedBy(clientId);
+	}
 }
\ No newline at end of file
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java b/mifosng-provider/src/main/java/org/mifosng/platform/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java
index 3f93935b3..c4cdec054 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/client/service/ClientWritePlatformServiceJpaRepositoryImpl.java
@@ -128,11 +128,11 @@ public class ClientWritePlatformServiceJpaRepositoryImpl implements ClientWriteP
 		
 		AppUser currentUser = context.authenticatedUser();
 		
-		// FIXME - check client id matches.
 		Note noteForUpdate = this.noteRepository.findOne(notesThatMatch(currentUser.getOrganisation(), command.getId()));
-		if (noteForUpdate == null) {
-			throw new NoteNotFoundException(command.getClientId());
+		if (noteForUpdate == null || noteForUpdate.isNotAgainstClientWithIdOf(command.getClientId())) {
+			throw new NoteNotFoundException(command.getId(), command.getClientId(), "client");
 		}
+		
 		noteForUpdate.update(command.getNote());
 		
 		return new EntityIdentifier(noteForUpdate.getId());
diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/exceptions/NoteNotFoundException.java b/mifosng-provider/src/main/java/org/mifosng/platform/exceptions/NoteNotFoundException.java
index f83c91ff7..20fcd87d4 100644
--- a/mifosng-provider/src/main/java/org/mifosng/platform/exceptions/NoteNotFoundException.java
+++ b/mifosng-provider/src/main/java/org/mifosng/platform/exceptions/NoteNotFoundException.java
@@ -8,4 +8,8 @@ public class NoteNotFoundException extends AbstractPlatformResourceNotFoundExcep
 	public NoteNotFoundException(Long id) {
 		super("error.msg.note.id.invalid", "Note with identifier " + id + " does not exist", id);
 	}
+
+	public NoteNotFoundException(Long id, Long clientId, final String resource) {
+		super("error.msg." + resource + ".note.id.invalid", "Note with identifier " + id + " does not exist for " + resource + " with identifier " + clientId, id, clientId);
+	}
 }
\ No newline at end of file