add report permission checking

mifosng-provider/src/main/java/org/mifosng/platform/api/ReportsApiResource.java

@@ -20,6 +20,9 @@ import org.mifosng.platform.ReadExtraDataAndReportingService;
 import org.mifosng.platform.api.data.GenericResultsetData;
 import org.mifosng.platform.api.infrastructure.ApiJsonSerializerService;
 import org.mifosng.platform.api.infrastructure.ApiParameterHelper;
+import org.mifosng.platform.exceptions.NoAuthorizationException;
+import org.mifosng.platform.security.PlatformSecurityContext;
+import org.mifosng.platform.user.domain.AppUser;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Scope;
 import org.springframework.stereotype.Component;
@@ -29,31 +32,43 @@ import org.springframework.stereotype.Component;
 @Scope("singleton")
 public class ReportsApiResource {
 
+	private final PlatformSecurityContext context;
+
+	@Autowired
+	public ReportsApiResource(final PlatformSecurityContext context) {
+		this.context = context;
+	}
+
 	@Autowired
 	private ReadExtraDataAndReportingService readExtraDataAndReportingService;
 
 	@Autowired
 	private ApiJsonSerializerService apiJsonSerializerService;
-	
+
 	@GET
-	@Consumes({MediaType.APPLICATION_JSON})
+	@Consumes({ MediaType.APPLICATION_JSON })
-	@Produces({MediaType.APPLICATION_JSON, "application/x-msdownload" })
+	@Produces({ MediaType.APPLICATION_JSON, "application/x-msdownload" })
 	public Response retrieveReportList(@Context final UriInfo uriInfo) {
 
 		Map<String, String> extractedQueryParams = new HashMap<String, String>();
-		
+
-		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
+		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo
-		boolean exportCsv = ApiParameterHelper.exportCsv(uriInfo.getQueryParameters());
+				.getQueryParameters());
+		boolean exportCsv = ApiParameterHelper.exportCsv(uriInfo
+				.getQueryParameters());
 
 		if (!exportCsv) {
-			GenericResultsetData result = this.readExtraDataAndReportingService.retrieveGenericResultset(".", ".", extractedQueryParams);
+			GenericResultsetData result = this.readExtraDataAndReportingService
-			
+					.retrieveGenericResultset(".", ".", extractedQueryParams);
-			final String json = this.apiJsonSerializerService.serializeGenericResultsetDataToJson(prettyPrint, result);
+
-			
+			final String json = this.apiJsonSerializerService
+					.serializeGenericResultsetDataToJson(prettyPrint, result);
+
 			return Response.ok().entity(json).build();
 		}
 
-		StreamingOutput result = this.readExtraDataAndReportingService.retrieveReportCSV(".", ".", extractedQueryParams);
+		StreamingOutput result = this.readExtraDataAndReportingService
+				.retrieveReportCSV(".", ".", extractedQueryParams);
 
 		return Response
 				.ok()
@@ -64,44 +79,62 @@ public class ReportsApiResource {
 
 	@GET
 	@Path("{reportName}")
-	@Consumes({MediaType.APPLICATION_JSON})
+	@Consumes({ MediaType.APPLICATION_JSON })
-	@Produces({MediaType.APPLICATION_JSON, "application/x-msdownload","application/vnd.ms-excel", "application/pdf", "text/html" })
+	@Produces({ MediaType.APPLICATION_JSON, "application/x-msdownload",
+			"application/vnd.ms-excel", "application/pdf", "text/html" })
 	public Response retrieveReport(
 			@PathParam("reportName") final String reportName,
 			@Context final UriInfo uriInfo) {
 
-		MultivaluedMap<String, String> queryParams = uriInfo.getQueryParameters();
+		MultivaluedMap<String, String> queryParams = uriInfo
-		
+				.getQueryParameters();
-		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters());
+
-		boolean exportCsv = ApiParameterHelper.exportCsv(uriInfo.getQueryParameters());
+		boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo
-		boolean parameterType = ApiParameterHelper.parameterType(uriInfo.getQueryParameters());
+				.getQueryParameters());
+		boolean exportCsv = ApiParameterHelper.exportCsv(uriInfo
+				.getQueryParameters());
+		boolean parameterType = ApiParameterHelper.parameterType(uriInfo
+				.getQueryParameters());
+
+		checkUserPermissionForReport(reportName, parameterType);
 
 		String parameterTypeValue = null;
 		if (!parameterType) {
 			parameterTypeValue = "report";
-			if (this.readExtraDataAndReportingService.getReportType(reportName).equalsIgnoreCase("Pentaho")) {
+			if (this.readExtraDataAndReportingService.getReportType(reportName)
-				Map<String, String> reportParams = getReportParams(queryParams, true);
+					.equalsIgnoreCase("Pentaho")) {
-				return this.readExtraDataAndReportingService.processPentahoRequest(reportName, queryParams.getFirst("output-type"), reportParams);
+				Map<String, String> reportParams = getReportParams(queryParams,
+						true);
+				return this.readExtraDataAndReportingService
+						.processPentahoRequest(reportName,
+								queryParams.getFirst("output-type"),
+								reportParams);
 			}
 		} else {
 			parameterTypeValue = "parameter";
 		}
 
 		if (!exportCsv) {
-			
-			Map<String, String> reportParams = getReportParams(queryParams, false);
-			
-			GenericResultsetData result = this.readExtraDataAndReportingService.retrieveGenericResultset(reportName, parameterTypeValue, reportParams);
 
-			final String json = this.apiJsonSerializerService.serializeGenericResultsetDataToJson(prettyPrint, result);
+			Map<String, String> reportParams = getReportParams(queryParams,
-			
+					false);
-			return Response.ok().entity(json).type(MediaType.APPLICATION_JSON).build();
+
+			GenericResultsetData result = this.readExtraDataAndReportingService
+					.retrieveGenericResultset(reportName, parameterTypeValue,
+							reportParams);
+
+			final String json = this.apiJsonSerializerService
+					.serializeGenericResultsetDataToJson(prettyPrint, result);
+
+			return Response.ok().entity(json).type(MediaType.APPLICATION_JSON)
+					.build();
 		}
 
 		// CSV Export
 		Map<String, String> reportParams = getReportParams(queryParams, false);
-		StreamingOutput result = this.readExtraDataAndReportingService.retrieveReportCSV(reportName, parameterTypeValue, reportParams);
+		StreamingOutput result = this.readExtraDataAndReportingService
-		
+				.retrieveReportCSV(reportName, parameterTypeValue, reportParams);
+
 		return Response
 				.ok()
 				.entity(result)
@@ -111,7 +144,26 @@ public class ReportsApiResource {
 								+ ".csv").build();
 	}
 
-	private Map<String, String> getReportParams(final MultivaluedMap<String, String> queryParams, final Boolean isPentaho) {
+	private void checkUserPermissionForReport(String reportName,
+			boolean parameterType) {
+
+		// Anyone can run a 'report' that is simply getting possible parameter
+		// (dropdown listbox) values.
+
+		if (!parameterType) {
+			AppUser currentUser = context.authenticatedUser();
+			if (currentUser.hasNotPermissionForReport(reportName)) {
+				// TODO - message isnt passing back the message in the string in
+				// the json just a generalised not authorised message
+				throw new NoAuthorizationException(
+						"Not Authorised to Run Report: " + reportName);
+			}
+		}
+	}
+
+	private Map<String, String> getReportParams(
+			final MultivaluedMap<String, String> queryParams,
+			final Boolean isPentaho) {
 
 		Map<String, String> reportParams = new HashMap<String, String>();
 		Set<String> keys = queryParams.keySet();
@@ -120,9 +172,11 @@ public class ReportsApiResource {
 		for (String k : keys) {
 
 			if (k.startsWith("R_")) {
-				if (isPentaho) pKey = k.substring(2);
+				if (isPentaho)
-				else pKey = "${" + k.substring(2) + "}";
+					pKey = k.substring(2);
-				
+				else
+					pKey = "${" + k.substring(2) + "}";
+
 				pValue = queryParams.get(k).get(0);
 				reportParams.put(pKey, pValue);
 			}

mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java

@@ -244,6 +244,18 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements P
 	public boolean canNotMakeRepaymentOnLoanInPast() {
 		return hasNotPermissionForAnyOf("CAN_MAKE_LOAN_REPAYMENT_IN_THE_PAST_ROLE", "PORTFOLIO_MANAGEMENT_SUPER_USER_ROLE");
 	}
+	public boolean hasNotPermissionForReport(String reportName) {
+		
+		for (Role role : this.roles) {
+			if ((role.getName().equalsIgnoreCase("Super User")) || (role.getName().equalsIgnoreCase("Read Only"))) {
+				return false;
+			}
+		}
+		
+		if (hasPermissionTo("CAN_RUN_" + reportName)) return false;
+		
+		return true;
+	}
 	
 	public boolean hasNotPermissionForAnyOf(final String... permissionCodes) {
 		boolean hasNotPermission = true;
@@ -268,6 +280,7 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements P
 
 		return match;
 	}
+	
 
 	public boolean hasIdOf(final Long userId) {
 		return getId().equals(userId);

mifosng-provider/src/main/java/org/mifosng/platform/user/domain/Role.java

@@ -85,4 +85,9 @@ public class Role extends AbstractAuditableCustom<AppUser, Long> {
 			this.permissions = new HashSet<Permission>(selectedPermissions);
 		}
 	}
+
+	public String getName() {
+		return name;
+	}
+	
 }