From ac353ec28eea5f135ba6a7b62081a82458c5066b Mon Sep 17 00:00:00 2001 From: John Woodlock Date: Thu, 15 Nov 2012 13:26:36 +0000 Subject: [PATCH] wip permissions --- .../mifosng/platform/api/ChargesApiResource.java | 8 ++------ .../platform/api/ClientIdentifiersApiResource.java | 8 ++------ .../mifosng/platform/api/ClientsApiResource.java | 8 ++------ .../org/mifosng/platform/api/CodesApiResource.java | 8 ++------ .../platform/api/ConfigurationApiResource.java | 9 +++------ .../mifosng/platform/api/DataTableApiResource.java | 8 ++------ .../platform/api/DocumentManagementApiResource.java | 11 +++++++++++ .../org/mifosng/platform/api/FundsApiResource.java | 13 +++++++++++-- .../mifosng/platform/api/ReportsApiResource.java | 8 ++------ .../service/DocumentWritePlatformService.java | 7 +++---- .../fund/service/FundWritePlatformService.java | 4 ++-- .../org/mifosng/platform/user/domain/AppUser.java | 4 ++++ 12 files changed, 46 insertions(+), 50 deletions(-) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ChargesApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ChargesApiResource.java index 63e8bceb4..d295cc1c0 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ChargesApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ChargesApiResource.java @@ -47,12 +47,8 @@ public class ChargesApiResource { private PortfolioApiJsonSerializerService apiJsonSerializerService; private final String entityType = "CHARGE"; - private final PlatformSecurityContext context; - - @Autowired - public ChargesApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @GET @Consumes({MediaType.APPLICATION_JSON}) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientIdentifiersApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientIdentifiersApiResource.java index 2bc5cec41..afb70b1f3 100755 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientIdentifiersApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientIdentifiersApiResource.java @@ -55,12 +55,8 @@ public class ClientIdentifiersApiResource { "documentKey", "documentTypeName")); private final String entityType = "CLIENTIDENTIFIER"; - private final PlatformSecurityContext context; - - @Autowired - public ClientIdentifiersApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @GET @Consumes({ MediaType.APPLICATION_JSON }) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientsApiResource.java index d469948c5..f22051bd0 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ClientsApiResource.java @@ -85,12 +85,8 @@ public class ClientsApiResource { @Autowired private PortfolioMakerCheckerReadPlatformService makerCheckerReadPlatformService; - private final PlatformSecurityContext context; - - @Autowired - public ClientsApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @GET @Consumes({MediaType.APPLICATION_JSON}) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java index b934565fa..9e46951e5 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/CodesApiResource.java @@ -46,12 +46,8 @@ public class CodesApiResource { private PortfolioApiJsonSerializerService apiJsonSerializerService; private final String entityType = "CODE"; - private final PlatformSecurityContext context; - - @Autowired - public CodesApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @GET @Consumes({MediaType.APPLICATION_JSON}) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java index dc6a19202..61d03879a 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ConfigurationApiResource.java @@ -43,12 +43,9 @@ public class ConfigurationApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; - private final PlatformSecurityContext context; - - @Autowired - public ConfigurationApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; + @GET @Path("currency") @Consumes({MediaType.APPLICATION_JSON}) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/DataTableApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/DataTableApiResource.java index 0a6274588..86414c204 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/DataTableApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/DataTableApiResource.java @@ -47,12 +47,8 @@ public class DataTableApiResource { private final static Logger logger = LoggerFactory .getLogger(DataTableApiResource.class); - private final PlatformSecurityContext context; - - @Autowired - public DataTableApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @Autowired private GenericDataService genericDataService; diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/DocumentManagementApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/DocumentManagementApiResource.java index 906478e5a..c0b275192 100755 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/DocumentManagementApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/DocumentManagementApiResource.java @@ -31,6 +31,7 @@ import org.mifosng.platform.common.FileUtils; import org.mifosng.platform.documentmanagement.service.DocumentReadPlatformService; import org.mifosng.platform.documentmanagement.service.DocumentWritePlatformService; import org.mifosng.platform.infrastructure.api.ApiParameterHelper; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -57,6 +58,10 @@ public class DocumentManagementApiResource { Arrays.asList("id", "parentEntityType", "parentEntityId", "name", "fileName", "type", "size", "description")); + private final String SystemEntityType = "DOCUMENT"; + @Autowired + private PlatformSecurityContext context; + /** * @param uriInfo * @param entityType @@ -70,6 +75,8 @@ public class DocumentManagementApiResource { @PathParam("entityType") String entityType, @PathParam("entityId") Long entityId) { + context.authenticatedUser().validateHasReadPermission(SystemEntityType); + Set responseParameters = ApiParameterHelper .extractFieldsForResponseIfProvided(uriInfo .getQueryParameters()); @@ -204,6 +211,8 @@ public class DocumentManagementApiResource { @PathParam("documentId") Long documentId, @Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(SystemEntityType); + Set responseParameters = ApiParameterHelper .extractFieldsForResponseIfProvided(uriInfo .getQueryParameters()); @@ -235,6 +244,8 @@ public class DocumentManagementApiResource { @PathParam("entityId") Long entityId, @PathParam("documentId") Long documentId) { + context.authenticatedUser().validateHasReadPermission(SystemEntityType); + DocumentData documentData = this.documentReadPlatformService .retrieveDocument(entityType, entityId, documentId); File file = new File(documentData.getLocation()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/FundsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/FundsApiResource.java index 6066aca83..58cde26f8 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/FundsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/FundsApiResource.java @@ -23,6 +23,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService import org.mifosng.platform.fund.service.FundReadPlatformService; import org.mifosng.platform.fund.service.FundWritePlatformService; import org.mifosng.platform.infrastructure.api.ApiParameterHelper; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -43,12 +44,18 @@ public class FundsApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + + private final String entityType = "FUND"; + @Autowired + private PlatformSecurityContext context; @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveFunds(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); @@ -73,8 +80,10 @@ public class FundsApiResource { @Path("{fundId}") @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) - public String retreiveOffice(@PathParam("fundId") final Long fundId, @Context final UriInfo uriInfo) { - + public String retreiveFund(@PathParam("fundId") final Long fundId, @Context final UriInfo uriInfo) { + + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/ReportsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/ReportsApiResource.java index cc4d12974..168a13b35 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/ReportsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/ReportsApiResource.java @@ -32,12 +32,8 @@ import org.springframework.stereotype.Component; @Scope("singleton") public class ReportsApiResource { - private final PlatformSecurityContext context; - - @Autowired - public ReportsApiResource(final PlatformSecurityContext context) { - this.context = context; - } + @Autowired + private PlatformSecurityContext context; @Autowired private ReadReportingService readExtraDataAndReportingService; diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/documentmanagement/service/DocumentWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/documentmanagement/service/DocumentWritePlatformService.java index d3a358895..dcd3c9d97 100755 --- a/mifosng-provider/src/main/java/org/mifosng/platform/documentmanagement/service/DocumentWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/documentmanagement/service/DocumentWritePlatformService.java @@ -7,15 +7,14 @@ import org.mifosng.platform.api.data.EntityIdentifier; import org.springframework.security.access.prepost.PreAuthorize; public interface DocumentWritePlatformService { - - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_DOCUMENT')") Long createDocument(DocumentCommand documentCommand, InputStream inputStream); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_DOCUMENT')") EntityIdentifier updateDocument(DocumentCommand documentCommand, InputStream inputStream); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'DELETE_DOCUMENT')") EntityIdentifier deleteDocument(DocumentCommand documentCommand); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/fund/service/FundWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/fund/service/FundWritePlatformService.java index 17c924aab..2accae083 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/fund/service/FundWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/fund/service/FundWritePlatformService.java @@ -5,9 +5,9 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface FundWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_FUND')") Long createFund(final FundCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_FUND')") Long updateFund(final FundCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java index e219f3829..136de8621 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java @@ -346,6 +346,10 @@ public class AppUser extends AbstractAuditableCustom implements higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } else if (entityType.equalsIgnoreCase("CURRENCY")) { higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("DOCUMENTMAN")) { + higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("FUND")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } if (!(higherPermission.equals(""))) {