CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

WIP permission - with permissions overhaul script

Browse Source
This commit is contained in:
John Woodlock
2012-11-16 19:37:43 +00:00
parent 16c395719c
commit bf847dc352
7 changed files with 129 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-db/patches/patch-0015-Mifosx-126-PermissionsOverhaul.sql
+41
View File
@@ -0,0 +1,41 @@
/*
this scripts removes all current m_role_permission and m_permission entries
and then inserts new m_permission entries and just one m_role_permission entry
which gives the role (id 1 - super user) an ALL_FUNCTIONS permission
If you had other roles set up with specific permissions you will have to set up their permissions again.
*/
delete from m_role_permission;
delete from m_permission;
/* System Supplied Permissons */
INSERT INTO m_permission VALUES (1,'special',5,'USER_ADMINISTRATION_SUPER_USER','An application user will have permission to execute all tasks related to user administration.','User administration ALL'),(2,'special',4,'ORGANISATION_ADMINISTRATION_SUPER_USER','An application user will have permission to execute all tasks related to organisation administration.','Organisation adminsitration ALL'),(3,'special',3,'PORTFOLIO_MANAGEMENT_SUPER_USER','An application user will have permission to execute all tasks related to portfolio management.','Portfolio management ALL'),(4,'special',6,'REPORTING_SUPER_USER','An application user will have permission to execute and view all reports.','Reporting ALL'),(5,'portfolio',NULL,'CREATE_LOAN','Allows an application user to sumit new loan application.','Can submit new loan application'),(6,'portfolio',NULL,'CREATEHISTORIC_LOAN','Allows an application user to sumit new loan application where the submitted on date is in the past.','Can submit historic loan application'),(7,'portfolio',NULL,'APPROVE_LOAN','Allows an application user to approve a loan application.','Can approve loan application'),(8,'portfolio',NULL,'APPROVEINPAST_LOAN','Allows an application user to approve a loan application where the approval date is in the past.','Can approve loan application in the past'),(9,'portfolio',NULL,'REJECT_LOAN','Allows an application user to reject a loan application.','Can reject loan application'),(10,'portfolio',NULL,'REJECTINPAST_LOAN','Allows an application user to reject a loan application where the rejected date is in the past.','Can reject loan application in the past'),(11,'portfolio',NULL,'WITHDRAW_LOAN','Allows an application user to mark loan application as withdrawn by client.','Can withdraw loan application'),(12,'portfolio',NULL,'WITHDRAWINPAST_LOAN','Allows an application user to mark loan application as withdrawn by client where the withdran on date is in the past.','Can withdraw loan application in the past'),(13,'portfolio',NULL,'DELETE_LOAN','Allows an application user to complete delete the loan application if it is submitted but not approved.','Can delete submitted loan application'),(14,'portfolio',NULL,'APPROVALUNDO_LOAN','Allows an application user to undo a loan approval.','Can undo loan approval'),(15,'portfolio',NULL,'DISBURSE_LOAN','Allows an application user to disburse a loan application.','Can disburse loan'),(16,'portfolio',NULL,'DISBURSEINPAST_LOAN','Allows an application user to disburse a loan where the disbursement date is in the past.','Can disburse loan in the past'),(17,'portfolio',NULL,'DISBURSALUNDO_LOAN','Allows an application user to undo a loan disbursal if not payments already made.','Can undo loan disbursal'),(18,'portfolio',NULL,'REPAYMENT_LOAN','Allows an application user to enter a repayment on the loan.','Can enter a repayment against a loan'),(19,'portfolio',NULL,'REPAYMENTINPAST_LOAN','Allows an application user to enter a repayment on the loan where the repayment date is in the past.','Can enter a repayment against a loan in the past'),(20,'portfolio',NULL,'CREATE_CLIENT','Allows an application user to add a new client.','Can add a new client.'),(42,'special',1,'ALL_FUNCTIONS','An application user will have permission to execute all tasks.','ALL'),(43,'special',2,'ALL_FUNCTIONS_READ','An application user will have permission to execute all read tasks.','ALL READ'),(112,'organisation',NULL,'CREATE_CHARGE','Create a Charge','Create a Charge'),(113,'organisation',NULL,'READ_CHARGE','Read Charges','Read Charges'),(114,'organisation',NULL,'UPDATE_CHARGE','Update a Charge','Update a Charge'),(115,'organisation',NULL,'DELETE_CHARGE','Delete a Charge','Delete a Charge'),
(120,'portfolio',NULL,'READ_CLIENT','Read Clients','Read Clients'),(121,'portfolio',NULL,'UPDATE_CLIENT','Update a Client','Update a Client'),(122,'portfolio',NULL,'DELETE_CLIENT','Delete a Client','Delete a Client'),(123,'portfolio',NULL,'CREATE_CLIENTIMAGE','Create/Update Client Image','Create/Update Client Image'),(124,'portfolio',NULL,'READ_CLIENTIMAGE','Read Client Images','Read Client Images'),(126,'portfolio',NULL,'DELETE_CLIENTIMAGE','Delete Client Image','Delete Client Image'),(127,'portfolio',NULL,'CREATE_CLIENTNOTE','Create a Client Note','Create a Client Note'),(128,'portfolio',NULL,'READ_CLIENTNOTE','Read Client Notes','Read Client Notes'),(129,'portfolio',NULL,'UPDATE_CLIENTNOTE','Update a Client Note','Update a Client Note'),(130,'portfolio',NULL,'DELETE_CLIENTNOTE','Delete a Client Note','Delete a Client Note'),(131,'portfolio',NULL,'CREATE_CLIENTIDENTIFIER','Create a Client Identifier','Create a Client Identifier'),(132,'portfolio',NULL,'READ_CLIENTIDENTIFIER','Read Client Identifiers','Read Client Identifiers'),(133,'portfolio',NULL,'UPDATE_CLIENTIDENTIFIER','Update a Client Identifier','Update a Client Identifier'),(134,'portfolio',NULL,'DELETE_CLIENTIDENTIFIER','Delete a Client Identifier','Delete a Client Identifier'),(135,'configuration',NULL,'CREATE_CODE','Create a Code','Create a Code'),(136,'configuration',NULL,'READ_CODE','Read Codes','Read Codes'),(137,'configuration',NULL,'UPDATE_CODE','Update a Code','Update a Code'),(138,'configuration',NULL,'DELETE_CODE','Delete a Code','Delete a Code'),(139,'configuration',NULL,'READ_CURRENCY','Read Currencies','Read Currencies'),(140,'configuration',NULL,'UPDATE_CURRENCY','Update Currencies','Update Currencies'),(141,'portfolio',NULL,'CREATE_DOCUMENT','Create and Upload a Document','Create and Upload a Document'),(142,'portfolio',NULL,'READ_DOCUMENT','Read Documents','Read Documents'),(143,'portfolio',NULL,'UPDATE_DOCUMENT','Update and Upload a Document','Update and Upload a Document'),(144,'portfolio',NULL,'DELETE_DOCUMENT','Delete a Document','Delete a Document'),(145,'organisation',NULL,'CREATE_FUND','Create a Fund','Create a Fund'),(146,'organisation',NULL,'READ_FUND','Read Funds','Read Funds'),(147,'organisation',NULL,'UPDATE_FUND','Update a Fund','Update a Fund'),(148,'organisation',NULL,'DELETE_FUND','Delete Fund','Delete Fund'),(149,'portfolio',NULL,'CREATE_GROUP','Create a Group','Create a Group'),(150,'portfolio',NULL,'READ_GROUP','Read Groups','Read Groups'),(151,'portfolio',NULL,'UPDATE_GROUP','Update a Group','Update a Group'),(152,'portfolio',NULL,'DELETE_GROUP','Delete a Group','Delete a Group'),(153,'organisation',NULL,'CREATE_LOANPRODUCT','Create a Loan Product','Create a Loan Product'),(154,'organisation',NULL,'READ_LOANPRODUCT','Read Loan Products','Read Loan Products'),(155,'organisation',NULL,'UPDATE_LOANPRODUCT','Update a Loan Product','Update a Loan Product'),(156,'organisation',NULL,'DELETE_LOANPRODUCT','Delete a Loan Product','Delete a Loan Product'),(157,'portfolio',NULL,'READ_LOAN','Read Loans','Read Loans'),(158,'portfolio',NULL,'UPDATE_LOAN','Update a Loan','Update a Loan'),(159,'portfolio',NULL,'UPDATEHISTORIC_LOAN','Update a Loan that was Created Historically','Update a Loan that was Created Historically'),(160,'portfolio',NULL,'CREATE_LOANCHARGE','Create a Loan Charge','Create a Loan Charge'),(161,'portfolio',NULL,'UPDATE_LOANCHARGE','Update a Loan Charge','Update a Loan Charge'),(162,'portfolio',NULL,'DELETE_LOANCHARGE','Delete a Loan Charge','Delete a Loan Charge'),(163,'portfolio',NULL,'WAIVE_LOANCHARGE','Waive a Loan Charge','Waive a Loan Charge'),(164,'portfolio',NULL,'BULKREASSIGN_LOAN','Bulk Reassign Loans','Bulk Reassign Loans'),
(165,'portfolio',NULL,'ADJUST_LOAN','Adjust a Loan Transaction','Adjust a Loan Transaction'),(166,'portfolio',NULL,'WAIVEINTERESTPORTION_LOAN','Waive Portion of Loan Interest','Waive Portion of Loan Interest'),(167,'portfolio',NULL,'WRITEOFF_LOAN','Write-Off a Loan','Write-Off a Loan'),(168,'portfolio',NULL,'CLOSE_LOAN','Close a Loan','Close a Loan'),(169,'portfolio',NULL,'CLOSEASRESCHEDULED_LOAN','Close a Loan (having been Rescheduled (Mifos Legacy Need)','Close a Loan (having been Rescheduled (Mifos Legacy Need)'),(170,'organisation',NULL,'READ_MAKERCHECKER','Read Maker-Checker Entries','Read Maker-Checker Entries'),(171,'organisation',NULL,'CREATE_OFFICE','Create an Office','Create an Office'),(172,'organisation',NULL,'READ_OFFICE','Read Offices','Read Offices'),(173,'organisation',NULL,'UPDATE_OFFICE','Update an Office','Update an Office'),(174,'organisation',NULL,'DELETE_OFFICE','Delete an Office','Delete an Office'),(175,'organisation',NULL,'READ_OFFICETRANSACTION','Read Office Transactions','Read Office Transactions'),(176,'organisation',NULL,'CREATE_OFFICETRANSACTION','Create an Office Transaction','Create an Office Transaction'),(177,'authorisation',NULL,'READ_PERMISSION','Read Permissions','Read Permissions'),(178,'authorisation',NULL,'CREATE_ROLE','Create a Role','Create a Role'),(179,'authorisation',NULL,'READ_ROLE','Read Roles','Read Roles'),(180,'authorisation',NULL,'UPDATE_ROLE','Update a Role','Update a Role'),(181,'authorisation',NULL,'DELETE_ROLE','Delete a Role','Delete a Role'),(182,'authorisation',NULL,'CREATE_USER','Create a User','Create a User'),(183,'authorisation',NULL,'READ_USER','Read Users','Read Users'),(184,'authorisation',NULL,'UPDATE_USER','Update a User','Update a User'),(185,'authorisation',NULL,'DELETE_USER','Create a User','Create a User'),(186,'organisation',NULL,'CREATE_STAFF','Create a Staff Member','Create a Staff Member'),(187,'organisation',NULL,'READ_STAFF','Read Staff','Read Staff'),(188,'organisation',NULL,'UPDATE_STAFF','Update a Staff Member','Update a Staff Member'),(189,'organisation',NULL,'DELETE_STAFF','Delete a Staff Member','Delete a Staff Member'),(190,'organisation',NULL,'CREATE_SAVINGSPRODUCT','Create a Savings Product','Create a Savings Product'),(191,'organisation',NULL,'READ_SAVINGSPRODUCT','Read Savings Products','Read Savings Products'),(192,'organisation',NULL,'UPDATE_SAVINGSPRODUCT','Update a Savings Product','Update a Savings Product'),(193,'organisation',NULL,'DELETE_SAVINGSPRODUCT','Delete a Savings Product','Delete a Savings Product'),(194,'organisation',NULL,'CREATE_DEPOSITPRODUCT','Create a Deposit Product','Create a Deposit Product'),(195,'organisation',NULL,'READ_DEPOSITPRODUCT','Read Deposit Products','Read Deposit Products'),(196,'organisation',NULL,'UPDATE_DEPOSITPRODUCT','Update a Deposit Product','Update a Deposit Product'),(197,'organisation',NULL,'DELETE_DEPOSITPRODUCT','Delete a Deposit Product','Delete a Deposit Product'),(198,'portfolio',NULL,'CREATE_DEPOSITACCOUNT','Create a Deposit Account','Create a Deposit Account'),(199,'portfolio',NULL,'READ_DEPOSITACCOUNT','Read Deposit Accounts','Read Deposit Accounts'),(200,'portfolio',NULL,'UPDATE_DEPOSITACCOUNT','Update a Deposit Account','Update a Deposit Account'),(201,'portfolio',NULL,'DELETE_DEPOSITACCOUNT','Delete a Deposit Account','Delete a Deposit Account'),(202,'portfolio',NULL,'APPROVE_DEPOSITACCOUNT','Approve a Deposit Account','Approve a Deposit Account'),(203,'portfolio',NULL,'REJECT_DEPOSITACCOUNT','Reject Deposit Account','Reject Deposit Account'),(204,'portfolio',NULL,'WITHDRAW_DEPOSITACCOUNT','Withdraw Deposit Account','Withdraw Deposit Account'),
(205,'portfolio',NULL,'APPROVALUNDO_DEPOSITACCOUNT','Undo Approval of Deposit Account','Undo Approval of Deposit Account'),(206,'portfolio',NULL,'WITHDRAWAL_DEPOSITACCOUNT','Make a Withdrawal From Deposit Account','Make a Withdrawal From Deposit Account'),(207,'portfolio',NULL,'INTEREST_DEPOSITACCOUNT','Apply Interest to Deposit Accounts','Apply Interest to Deposit Accounts'),(208,'portfolio',NULL,'RENEW_DEPOSITACCOUNT','Renew Deposit Account','Renew Deposit Account'),(209,'portfolio',NULL,'CREATE_SAVINGSACCOUNT','Create a Savings Account','Create a Savings Account'),(210,'portfolio',NULL,'READ_SAVINGSACCOUNT','Read Savings Accounts','Read Savings Accounts'),(211,'portfolio',NULL,'UPDATE_SAVINGSACCOUNT','Update a Savings Account','Update a Savings Account'),(212,'portfolio',NULL,'DELETE_SAVINGSACCOUNT','Delete a Savings Account','Delete a Savings Account');
/* role 1 is super user, give it ALL_FUNCTIONS */
INSERT INTO m_role_permission(role_id, permission_id)
select 1, id
from m_permission
where code = 'ALL_FUNCTIONS';
/* add a read permission for each defined report */
insert into m_permission(grouping, `code`, default_description, default_name)
select 'report', concat('READ_', sr.report_name), concat('READ_', sr.report_name), concat('READ_', sr.report_name)
from stretchy_report sr;
/* add a create, read, update and delete permission for each registered datatable */
insert into m_permission(grouping, `code`, default_description, default_name)
select 'datatable', concat('CREATE_', r.registered_table_name), concat('CREATE_', r.registered_table_name), concat('CREATE_', r.registered_table_name)
from x_registered_table r;
insert into m_permission(grouping, `code`, default_description, default_name)
select 'datatable', concat('READ_', r.registered_table_name), concat('READ_', r.registered_table_name), concat('READ_', r.registered_table_name)
from x_registered_table r;
insert into m_permission(grouping, `code`, default_description, default_name)
select 'datatable', concat('UPDATE_', r.registered_table_name), concat('UPDATE_', r.registered_table_name), concat('UPDATE_', r.registered_table_name)
from x_registered_table r;
mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java
+13 -2
View File
@@ -41,6 +41,7 @@ import org.mifosng.platform.saving.service.DepositAccountReadPlatformService;
import org.mifosng.platform.saving.service.DepositAccountWritePlatformService;
import org.mifosng.platform.savingproduct.service.DepositProductReadPlatformService;
import org.mifosng.platform.savingproduct.service.SavingsDepositEnumerations;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Component;
@@ -65,6 +66,10 @@ public class DepositAccountsApiResource {
@Autowired
private PortfolioApiJsonSerializerService apiJsonSerializerService;
private final String entityType = "DEPOSITACCOUNT";
@Autowired
private PlatformSecurityContext context;
private static final Set<String> typicalResponseParameters = new HashSet<String>(
Arrays.asList("id", "externalId", "clientId", "clientName",
"productId", "productName", "status", "currency",
@@ -107,6 +112,8 @@ public class DepositAccountsApiResource {
@Produces({MediaType.APPLICATION_JSON})
public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
@@ -123,7 +130,9 @@ public class DepositAccountsApiResource {
@Consumes({MediaType.APPLICATION_JSON})
@Produces({MediaType.APPLICATION_JSON})
public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
DepositPermissionData permissions = null;
@@ -162,7 +171,9 @@ public class DepositAccountsApiResource {
@QueryParam("clientId") final Long clientId,
@QueryParam("productId") final Long productId,
@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java
+13 -2
View File
@@ -26,6 +26,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
import org.mifosng.platform.saving.service.SavingAccountReadPlatformService;
import org.mifosng.platform.saving.service.SavingAccountWritePlatformService;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Component;
@@ -46,6 +47,10 @@ public class SavingsAccountApiResource {
@Autowired
private PortfolioApiJsonSerializerService apiJsonSerializerService;
private final String entityType = "SAVINGSACCOUNT";
@Autowired
private PlatformSecurityContext context;
private static final Set<String> typicalResponseParameters = new HashSet<String>(
Arrays.asList("id", "status", "externalId", "clientId", "clientName", "productId", "productName", "productType", "currencyData", "savingsDepostiAmountPerPeriod", "savingsFrequencyType",
@@ -83,6 +88,8 @@ public class SavingsAccountApiResource {
@Produces({MediaType.APPLICATION_JSON})
public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
@@ -99,7 +106,9 @@ public class SavingsAccountApiResource {
@Consumes({MediaType.APPLICATION_JSON})
@Produces({MediaType.APPLICATION_JSON})
public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
@@ -121,7 +130,9 @@ public class SavingsAccountApiResource {
@QueryParam("clientId") final Long clientId,
@QueryParam("productId") final Long productId,
@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java
+35 -23
View File
@@ -10,37 +10,49 @@ import org.mifosng.platform.api.data.EntityIdentifier;
import org.springframework.security.access.prepost.PreAuthorize;
public interface DepositAccountWritePlatformService {
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_DEPOSITACCOUNT')")
EntityIdentifier createDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_DEPOSITACCOUNT')")
EntityIdentifier updateDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'DELETE_DEPOSITACCOUNT')")
EntityIdentifier deleteDepositAccount(Long productId);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier approveDepositApplication(DepositStateTransitionApprovalCommand command);
// NOTE - took out permissions relating to doing things with deposit
// accounts in the past as doesn't appear to be code for it
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVE_DEPOSITACCOUNT')")
EntityIdentifier approveDepositApplication(
DepositStateTransitionApprovalCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'REJECT_DEPOSITACCOUNT')")
EntityIdentifier rejectDepositApplication(
DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAW_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositApplication(
DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVALUNDO_DEPOSITACCOUNT')")
EntityIdentifier undoDepositApproval(UndoStateTransitionCommand undoCommand);
/*@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier matureDepositApplication(DepositStateTransitionCommand command);*/
/*
* @PreAuthorize(value =
* "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', '')"
* ) EntityIdentifier matureDepositApplication(DepositStateTransitionCommand
* command);
*/
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositAccountMoney(DepositAccountWithdrawalCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAWAL_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositAccountMoney(
DepositAccountWithdrawalCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositAccountInterestMoney(DepositAccountWithdrawInterestCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'INTEREST_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositAccountInterestMoney(
DepositAccountWithdrawInterestCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'RENEW_DEPOSITACCOUNT')")
EntityIdentifier renewDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
EntityIdentifier updateDepositAccount(DepositAccountCommand command);
}
}
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java
+20 -19
View File
@@ -20,7 +20,6 @@ import org.mifosng.platform.currency.domain.Money;
import org.mifosng.platform.exceptions.DepositAccountNotFoundException;
import org.mifosng.platform.exceptions.DepositAccountReopenException;
import org.mifosng.platform.exceptions.DepositAccountTransactionsException;
import org.mifosng.platform.exceptions.NoAuthorizationException;
import org.mifosng.platform.exceptions.PlatformDataIntegrityException;
import org.mifosng.platform.exceptions.ProductNotFoundException;
import org.mifosng.platform.saving.domain.DepositAccount;
@@ -30,7 +29,6 @@ import org.mifosng.platform.saving.domain.DepositLifecycleStateMachine;
import org.mifosng.platform.saving.domain.DepositLifecycleStateMachineImpl;
import org.mifosng.platform.saving.domain.FixedTermDepositInterestCalculator;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.mifosng.platform.user.domain.AppUser;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -118,7 +116,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier approveDepositApplication(final DepositStateTransitionApprovalCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionApprovalCommandValidator validator = new DepositStateTransitionApprovalCommandValidator(command);
validator.validate();
@@ -129,10 +127,11 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
}
// FIXME - madhukar - you are checking for loan permission here instead of some specific deposit account permission.
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.approve(eventDate, defaultDepositLifecycleStateMachine(), command, this.fixedTermDepositInterestCalculator);
@@ -149,9 +148,9 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
}
private boolean isBeforeToday(final LocalDate date) {
return date.isBefore(new LocalDate());
}
//private boolean isBeforeToday(final LocalDate date) {
// return date.isBefore(new LocalDate());
//}
private DepositLifecycleStateMachine defaultDepositLifecycleStateMachine() {
List<DepositAccountStatus> allowedDepositStatuses = Arrays.asList(DepositAccountStatus.values());
return new DepositLifecycleStateMachineImpl(allowedDepositStatuses);
@@ -161,7 +160,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command);
validator.validate();
@@ -170,11 +169,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
if (account == null || account.isDeleted()) {
throw new DepositAccountNotFoundException(command.getAccountId());
}
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.reject(eventDate, defaultDepositLifecycleStateMachine());
this.depositAccountRepository.save(account);
@@ -192,7 +192,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command);
validator.validate();
@@ -201,11 +201,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
if (account == null || account.isDeleted()) {
throw new DepositAccountNotFoundException(command.getAccountId());
}
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.withdrawnByApplicant(eventDate, defaultDepositLifecycleStateMachine());
this.depositAccountRepository.save(account);
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java
+2 -2
View File
@@ -6,9 +6,9 @@ import org.springframework.security.access.prepost.PreAuthorize;
public interface SavingAccountWritePlatformService {
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_SAVINGSACCOUNT')")
EntityIdentifier createSavingAccount(SavingAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_SAVINGSACCOUNT')")
EntityIdentifier updateSavingAccount(SavingAccountCommand command);
}
mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java
+5 -1
View File
@@ -262,7 +262,7 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
public boolean hasNotPermissionForReport(String reportName) {
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", "REPORTING_SUPER_USER",
"READ_" + reportName))
return true;
@@ -372,6 +372,10 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
} else if (entityType.equalsIgnoreCase("DEPOSITPRODUCT")) {
higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
} else if (entityType.equalsIgnoreCase("DEPOSITACCOUNT")) {
higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
} else if (entityType.equalsIgnoreCase("SAVINGSACCOUNT")) {
higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
}
if (!(higherPermission.equals(""))) {