Merge pull request #798 from lingalamadhukar/MIFOSX-985

#MIFOSX-985, Added missed permissions

mifosng-db/migrations/core_db/V153__Insert_missed_permissions.sql

@@ -0,0 +1,9 @@
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_ACCOUNTINGRULE', 'ACCOUNTINGRULE', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_JOURNALENTRY', 'JOURNALENTRY', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_GLACCOUNT', 'GLACCOUNT', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('accounting', 'READ_GLCLOSURE', 'GLCLOSURE', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('organisation', 'READ_HOLIDAY', 'HOLIDAY', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('jobs', 'READ_SCHEDULER', 'SCHEDULER', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('portfolio', 'READ_PRODUCTMIX', 'PRODUCTMIX', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('portfolio', 'READ_MEETING', 'MEETING', 'READ', 0);
+INSERT INTO `m_permission` (`grouping`, `code`, `entity_name`, `action_name`, `can_maker_checker`) VALUES ('jobs', 'EXECUTEJOB_SCHEDULER', 'SCHEDULER', 'EXECUTEJOB', 0);

mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerApiResource.java

@@ -18,6 +18,8 @@ import org.mifosplatform.infrastructure.core.serialization.ApiRequestJsonSeriali
 import org.mifosplatform.infrastructure.core.serialization.ToApiJsonSerializer;
 import org.mifosplatform.infrastructure.jobs.data.SchedulerDetailData;
 import org.mifosplatform.infrastructure.jobs.service.JobRegisterService;
+import org.mifosplatform.infrastructure.security.exception.NoAuthorizationException;
+import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
@@ -25,13 +27,15 @@ import org.springframework.stereotype.Component;
 @Component
 public class SchedulerApiResource {
 
+    private final PlatformSecurityContext context;
     private final JobRegisterService jobRegisterService;
     private final ToApiJsonSerializer<SchedulerDetailData> toApiJsonSerializer;
     private final ApiRequestParameterHelper apiRequestParameterHelper;
 
     @Autowired
-    public SchedulerApiResource(final JobRegisterService jobRegisterService,
+    public SchedulerApiResource(final PlatformSecurityContext context, final JobRegisterService jobRegisterService,
             final ToApiJsonSerializer<SchedulerDetailData> toApiJsonSerializer, final ApiRequestParameterHelper apiRequestParameterHelper) {
+        this.context = context;
         this.jobRegisterService = jobRegisterService;
         this.toApiJsonSerializer = toApiJsonSerializer;
         this.apiRequestParameterHelper = apiRequestParameterHelper;
@@ -41,6 +45,7 @@ public class SchedulerApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     public String retrieveStatus(@Context final UriInfo uriInfo) {
+        this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME);
         final boolean isSchedulerRunning = this.jobRegisterService.isSchedulerRunning();
         final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
         final SchedulerDetailData schedulerDetailData = new SchedulerDetailData(isSchedulerRunning);
@@ -52,6 +57,12 @@ public class SchedulerApiResource {
     @Consumes({ MediaType.APPLICATION_JSON })
     @Produces({ MediaType.APPLICATION_JSON })
     public Response changeSchedulerStatus(@QueryParam(SchedulerJobApiConstants.COMMAND) final String commandParam) {
+        // check the logged in user have permissions to update scheduler status
+        final boolean hasNotPermission = this.context.authenticatedUser().hasNotPermissionForAnyOf("ALL_FUNCTIONS", "UPDATE_SCHEDULER");
+        if (hasNotPermission) {
+            final String authorizationMessage = "User has no authority to update scheduler status";
+            throw new NoAuthorizationException(authorizationMessage);
+        }
         Response response = Response.status(400).build();
         if (is(commandParam, SchedulerJobApiConstants.COMMAND_START_SCHEDULER)) {
             this.jobRegisterService.startScheduler();

mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiConstants.java

@@ -7,6 +7,7 @@ import java.util.Set;
 public class SchedulerJobApiConstants {
 
     public static final String JOB_RESOURCE_NAME = "schedulerjob";
+    public static final String SCHEDULER_RESOURCE_NAME = "SCHEDULER";
     // response parameters
     public static final String jobIdentifierParamName = "jobId";
     public static final String displayNameParamName = "displayName";

mifosng-provider/src/main/java/org/mifosplatform/infrastructure/jobs/api/SchedulerJobApiResource.java

@@ -29,6 +29,8 @@ import org.mifosplatform.infrastructure.jobs.data.JobDetailData;
 import org.mifosplatform.infrastructure.jobs.data.JobDetailHistoryData;
 import org.mifosplatform.infrastructure.jobs.service.JobRegisterService;
 import org.mifosplatform.infrastructure.jobs.service.SchedulerJobRunnerReadService;
+import org.mifosplatform.infrastructure.security.exception.NoAuthorizationException;
+import org.mifosplatform.infrastructure.security.service.PlatformSecurityContext;
 import org.mifosplatform.portfolio.group.service.SearchParameters;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
@@ -45,23 +47,27 @@ public class SchedulerJobApiResource {
     private final ToApiJsonSerializer<JobDetailData> toApiJsonSerializer;
     private final ToApiJsonSerializer<JobDetailHistoryData> jobHistoryToApiJsonSerializer;
     private final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService;
+    private final PlatformSecurityContext context;
 
     @Autowired
     public SchedulerJobApiResource(final SchedulerJobRunnerReadService schedulerJobRunnerReadService,
             final JobRegisterService jobRegisterService, final ToApiJsonSerializer<JobDetailData> toApiJsonSerializer,
             final ApiRequestParameterHelper apiRequestParameterHelper,
             final ToApiJsonSerializer<JobDetailHistoryData> jobHistoryToApiJsonSerializer,
-            final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService) {
+            final PortfolioCommandSourceWritePlatformService commandsSourceWritePlatformService,
+            final PlatformSecurityContext context) {
         this.schedulerJobRunnerReadService = schedulerJobRunnerReadService;
         this.jobRegisterService = jobRegisterService;
         this.toApiJsonSerializer = toApiJsonSerializer;
         this.jobHistoryToApiJsonSerializer = jobHistoryToApiJsonSerializer;
         this.apiRequestParameterHelper = apiRequestParameterHelper;
         this.commandsSourceWritePlatformService = commandsSourceWritePlatformService;
+        this.context = context;
     }
 
     @GET
     public String retrieveAll(@Context final UriInfo uriInfo) {
+        this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME);
         final List<JobDetailData> jobDetailDatas = this.schedulerJobRunnerReadService.findAllJobDeatils();
         final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
         return this.toApiJsonSerializer.serialize(settings, jobDetailDatas, SchedulerJobApiConstants.JOB_DETAIL_RESPONSE_DATA_PARAMETERS);
@@ -70,6 +76,7 @@ public class SchedulerJobApiResource {
     @GET
     @Path("{" + SchedulerJobApiConstants.JOB_ID + "}")
     public String retrieveOne(@PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId, @Context final UriInfo uriInfo) {
+        this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME);
         final JobDetailData jobDetailData = this.schedulerJobRunnerReadService.retrieveOne(jobId);
         final ApiRequestJsonSerializationSettings settings = this.apiRequestParameterHelper.process(uriInfo.getQueryParameters());
         return this.toApiJsonSerializer.serialize(settings, jobDetailData, SchedulerJobApiConstants.JOB_DETAIL_RESPONSE_DATA_PARAMETERS);
@@ -80,6 +87,7 @@ public class SchedulerJobApiResource {
     public String retrieveHistory(@Context final UriInfo uriInfo, @PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId,
             @QueryParam("offset") final Integer offset, @QueryParam("limit") final Integer limit,
             @QueryParam("orderBy") final String orderBy, @QueryParam("sortOrder") final String sortOrder) {
+        this.context.authenticatedUser().validateHasReadPermission(SchedulerJobApiConstants.SCHEDULER_RESOURCE_NAME);
         final SearchParameters searchParameters = SearchParameters.forPagination(offset, limit, orderBy, sortOrder);
         final Page<JobDetailHistoryData> jobhistoryDetailData = this.schedulerJobRunnerReadService.retrieveJobHistory(jobId,
                 searchParameters);
@@ -92,6 +100,12 @@ public class SchedulerJobApiResource {
     @Path("{" + SchedulerJobApiConstants.JOB_ID + "}")
     public Response executeJob(@PathParam(SchedulerJobApiConstants.JOB_ID) final Long jobId,
             @QueryParam(SchedulerJobApiConstants.COMMAND) final String commandParam) {
+        // check the logged in user have permissions to execute scheduler jobs
+        final boolean hasNotPermission = this.context.authenticatedUser().hasNotPermissionForAnyOf("ALL_FUNCTIONS", "EXECUTEJOB_SCHEDULER");
+        if (hasNotPermission) {
+            final String authorizationMessage = "User has no authority to execute scheduler jobs";
+            throw new NoAuthorizationException(authorizationMessage);
+        }
         Response response = Response.status(400).build();
         if (is(commandParam, SchedulerJobApiConstants.COMMAND_EXECUTE_JOB)) {
             this.jobRegisterService.executeJob(jobId);