From bf847dc352a54d3f5e6b30aa56fd64fcd7eaa708 Mon Sep 17 00:00:00 2001 From: John Woodlock Date: Fri, 16 Nov 2012 19:37:43 +0000 Subject: [PATCH] WIP permission - with permissions overhaul script --- ...ch-0015-Mifosx-126-PermissionsOverhaul.sql | 41 +++++++++++++ .../api/DepositAccountsApiResource.java | 15 ++++- .../api/SavingsAccountApiResource.java | 15 ++++- .../DepositAccountWritePlatformService.java | 58 +++++++++++-------- ...WritePlatformServiceJpaRepositoryImpl.java | 39 +++++++------ .../SavingAccountWritePlatformService.java | 4 +- .../mifosng/platform/user/domain/AppUser.java | 6 +- 7 files changed, 129 insertions(+), 49 deletions(-) create mode 100644 mifosng-db/patches/patch-0015-Mifosx-126-PermissionsOverhaul.sql diff --git a/mifosng-db/patches/patch-0015-Mifosx-126-PermissionsOverhaul.sql b/mifosng-db/patches/patch-0015-Mifosx-126-PermissionsOverhaul.sql new file mode 100644 index 000000000..a34bb40f4 --- /dev/null +++ b/mifosng-db/patches/patch-0015-Mifosx-126-PermissionsOverhaul.sql @@ -0,0 +1,41 @@ +/* +this scripts removes all current m_role_permission and m_permission entries +and then inserts new m_permission entries and just one m_role_permission entry +which gives the role (id 1 - super user) an ALL_FUNCTIONS permission + +If you had other roles set up with specific permissions you will have to set up their permissions again. +*/ + +delete from m_role_permission; +delete from m_permission; + +/* System Supplied Permissons */ +INSERT INTO m_permission VALUES (1,'special',5,'USER_ADMINISTRATION_SUPER_USER','An application user will have permission to execute all tasks related to user administration.','User administration ALL'),(2,'special',4,'ORGANISATION_ADMINISTRATION_SUPER_USER','An application user will have permission to execute all tasks related to organisation administration.','Organisation adminsitration ALL'),(3,'special',3,'PORTFOLIO_MANAGEMENT_SUPER_USER','An application user will have permission to execute all tasks related to portfolio management.','Portfolio management ALL'),(4,'special',6,'REPORTING_SUPER_USER','An application user will have permission to execute and view all reports.','Reporting ALL'),(5,'portfolio',NULL,'CREATE_LOAN','Allows an application user to sumit new loan application.','Can submit new loan application'),(6,'portfolio',NULL,'CREATEHISTORIC_LOAN','Allows an application user to sumit new loan application where the submitted on date is in the past.','Can submit historic loan application'),(7,'portfolio',NULL,'APPROVE_LOAN','Allows an application user to approve a loan application.','Can approve loan application'),(8,'portfolio',NULL,'APPROVEINPAST_LOAN','Allows an application user to approve a loan application where the approval date is in the past.','Can approve loan application in the past'),(9,'portfolio',NULL,'REJECT_LOAN','Allows an application user to reject a loan application.','Can reject loan application'),(10,'portfolio',NULL,'REJECTINPAST_LOAN','Allows an application user to reject a loan application where the rejected date is in the past.','Can reject loan application in the past'),(11,'portfolio',NULL,'WITHDRAW_LOAN','Allows an application user to mark loan application as withdrawn by client.','Can withdraw loan application'),(12,'portfolio',NULL,'WITHDRAWINPAST_LOAN','Allows an application user to mark loan application as withdrawn by client where the withdran on date is in the past.','Can withdraw loan application in the past'),(13,'portfolio',NULL,'DELETE_LOAN','Allows an application user to complete delete the loan application if it is submitted but not approved.','Can delete submitted loan application'),(14,'portfolio',NULL,'APPROVALUNDO_LOAN','Allows an application user to undo a loan approval.','Can undo loan approval'),(15,'portfolio',NULL,'DISBURSE_LOAN','Allows an application user to disburse a loan application.','Can disburse loan'),(16,'portfolio',NULL,'DISBURSEINPAST_LOAN','Allows an application user to disburse a loan where the disbursement date is in the past.','Can disburse loan in the past'),(17,'portfolio',NULL,'DISBURSALUNDO_LOAN','Allows an application user to undo a loan disbursal if not payments already made.','Can undo loan disbursal'),(18,'portfolio',NULL,'REPAYMENT_LOAN','Allows an application user to enter a repayment on the loan.','Can enter a repayment against a loan'),(19,'portfolio',NULL,'REPAYMENTINPAST_LOAN','Allows an application user to enter a repayment on the loan where the repayment date is in the past.','Can enter a repayment against a loan in the past'),(20,'portfolio',NULL,'CREATE_CLIENT','Allows an application user to add a new client.','Can add a new client.'),(42,'special',1,'ALL_FUNCTIONS','An application user will have permission to execute all tasks.','ALL'),(43,'special',2,'ALL_FUNCTIONS_READ','An application user will have permission to execute all read tasks.','ALL READ'),(112,'organisation',NULL,'CREATE_CHARGE','Create a Charge','Create a Charge'),(113,'organisation',NULL,'READ_CHARGE','Read Charges','Read Charges'),(114,'organisation',NULL,'UPDATE_CHARGE','Update a Charge','Update a Charge'),(115,'organisation',NULL,'DELETE_CHARGE','Delete a Charge','Delete a Charge'), +(120,'portfolio',NULL,'READ_CLIENT','Read Clients','Read Clients'),(121,'portfolio',NULL,'UPDATE_CLIENT','Update a Client','Update a Client'),(122,'portfolio',NULL,'DELETE_CLIENT','Delete a Client','Delete a Client'),(123,'portfolio',NULL,'CREATE_CLIENTIMAGE','Create/Update Client Image','Create/Update Client Image'),(124,'portfolio',NULL,'READ_CLIENTIMAGE','Read Client Images','Read Client Images'),(126,'portfolio',NULL,'DELETE_CLIENTIMAGE','Delete Client Image','Delete Client Image'),(127,'portfolio',NULL,'CREATE_CLIENTNOTE','Create a Client Note','Create a Client Note'),(128,'portfolio',NULL,'READ_CLIENTNOTE','Read Client Notes','Read Client Notes'),(129,'portfolio',NULL,'UPDATE_CLIENTNOTE','Update a Client Note','Update a Client Note'),(130,'portfolio',NULL,'DELETE_CLIENTNOTE','Delete a Client Note','Delete a Client Note'),(131,'portfolio',NULL,'CREATE_CLIENTIDENTIFIER','Create a Client Identifier','Create a Client Identifier'),(132,'portfolio',NULL,'READ_CLIENTIDENTIFIER','Read Client Identifiers','Read Client Identifiers'),(133,'portfolio',NULL,'UPDATE_CLIENTIDENTIFIER','Update a Client Identifier','Update a Client Identifier'),(134,'portfolio',NULL,'DELETE_CLIENTIDENTIFIER','Delete a Client Identifier','Delete a Client Identifier'),(135,'configuration',NULL,'CREATE_CODE','Create a Code','Create a Code'),(136,'configuration',NULL,'READ_CODE','Read Codes','Read Codes'),(137,'configuration',NULL,'UPDATE_CODE','Update a Code','Update a Code'),(138,'configuration',NULL,'DELETE_CODE','Delete a Code','Delete a Code'),(139,'configuration',NULL,'READ_CURRENCY','Read Currencies','Read Currencies'),(140,'configuration',NULL,'UPDATE_CURRENCY','Update Currencies','Update Currencies'),(141,'portfolio',NULL,'CREATE_DOCUMENT','Create and Upload a Document','Create and Upload a Document'),(142,'portfolio',NULL,'READ_DOCUMENT','Read Documents','Read Documents'),(143,'portfolio',NULL,'UPDATE_DOCUMENT','Update and Upload a Document','Update and Upload a Document'),(144,'portfolio',NULL,'DELETE_DOCUMENT','Delete a Document','Delete a Document'),(145,'organisation',NULL,'CREATE_FUND','Create a Fund','Create a Fund'),(146,'organisation',NULL,'READ_FUND','Read Funds','Read Funds'),(147,'organisation',NULL,'UPDATE_FUND','Update a Fund','Update a Fund'),(148,'organisation',NULL,'DELETE_FUND','Delete Fund','Delete Fund'),(149,'portfolio',NULL,'CREATE_GROUP','Create a Group','Create a Group'),(150,'portfolio',NULL,'READ_GROUP','Read Groups','Read Groups'),(151,'portfolio',NULL,'UPDATE_GROUP','Update a Group','Update a Group'),(152,'portfolio',NULL,'DELETE_GROUP','Delete a Group','Delete a Group'),(153,'organisation',NULL,'CREATE_LOANPRODUCT','Create a Loan Product','Create a Loan Product'),(154,'organisation',NULL,'READ_LOANPRODUCT','Read Loan Products','Read Loan Products'),(155,'organisation',NULL,'UPDATE_LOANPRODUCT','Update a Loan Product','Update a Loan Product'),(156,'organisation',NULL,'DELETE_LOANPRODUCT','Delete a Loan Product','Delete a Loan Product'),(157,'portfolio',NULL,'READ_LOAN','Read Loans','Read Loans'),(158,'portfolio',NULL,'UPDATE_LOAN','Update a Loan','Update a Loan'),(159,'portfolio',NULL,'UPDATEHISTORIC_LOAN','Update a Loan that was Created Historically','Update a Loan that was Created Historically'),(160,'portfolio',NULL,'CREATE_LOANCHARGE','Create a Loan Charge','Create a Loan Charge'),(161,'portfolio',NULL,'UPDATE_LOANCHARGE','Update a Loan Charge','Update a Loan Charge'),(162,'portfolio',NULL,'DELETE_LOANCHARGE','Delete a Loan Charge','Delete a Loan Charge'),(163,'portfolio',NULL,'WAIVE_LOANCHARGE','Waive a Loan Charge','Waive a Loan Charge'),(164,'portfolio',NULL,'BULKREASSIGN_LOAN','Bulk Reassign Loans','Bulk Reassign Loans'), +(165,'portfolio',NULL,'ADJUST_LOAN','Adjust a Loan Transaction','Adjust a Loan Transaction'),(166,'portfolio',NULL,'WAIVEINTERESTPORTION_LOAN','Waive Portion of Loan Interest','Waive Portion of Loan Interest'),(167,'portfolio',NULL,'WRITEOFF_LOAN','Write-Off a Loan','Write-Off a Loan'),(168,'portfolio',NULL,'CLOSE_LOAN','Close a Loan','Close a Loan'),(169,'portfolio',NULL,'CLOSEASRESCHEDULED_LOAN','Close a Loan (having been Rescheduled (Mifos Legacy Need)','Close a Loan (having been Rescheduled (Mifos Legacy Need)'),(170,'organisation',NULL,'READ_MAKERCHECKER','Read Maker-Checker Entries','Read Maker-Checker Entries'),(171,'organisation',NULL,'CREATE_OFFICE','Create an Office','Create an Office'),(172,'organisation',NULL,'READ_OFFICE','Read Offices','Read Offices'),(173,'organisation',NULL,'UPDATE_OFFICE','Update an Office','Update an Office'),(174,'organisation',NULL,'DELETE_OFFICE','Delete an Office','Delete an Office'),(175,'organisation',NULL,'READ_OFFICETRANSACTION','Read Office Transactions','Read Office Transactions'),(176,'organisation',NULL,'CREATE_OFFICETRANSACTION','Create an Office Transaction','Create an Office Transaction'),(177,'authorisation',NULL,'READ_PERMISSION','Read Permissions','Read Permissions'),(178,'authorisation',NULL,'CREATE_ROLE','Create a Role','Create a Role'),(179,'authorisation',NULL,'READ_ROLE','Read Roles','Read Roles'),(180,'authorisation',NULL,'UPDATE_ROLE','Update a Role','Update a Role'),(181,'authorisation',NULL,'DELETE_ROLE','Delete a Role','Delete a Role'),(182,'authorisation',NULL,'CREATE_USER','Create a User','Create a User'),(183,'authorisation',NULL,'READ_USER','Read Users','Read Users'),(184,'authorisation',NULL,'UPDATE_USER','Update a User','Update a User'),(185,'authorisation',NULL,'DELETE_USER','Create a User','Create a User'),(186,'organisation',NULL,'CREATE_STAFF','Create a Staff Member','Create a Staff Member'),(187,'organisation',NULL,'READ_STAFF','Read Staff','Read Staff'),(188,'organisation',NULL,'UPDATE_STAFF','Update a Staff Member','Update a Staff Member'),(189,'organisation',NULL,'DELETE_STAFF','Delete a Staff Member','Delete a Staff Member'),(190,'organisation',NULL,'CREATE_SAVINGSPRODUCT','Create a Savings Product','Create a Savings Product'),(191,'organisation',NULL,'READ_SAVINGSPRODUCT','Read Savings Products','Read Savings Products'),(192,'organisation',NULL,'UPDATE_SAVINGSPRODUCT','Update a Savings Product','Update a Savings Product'),(193,'organisation',NULL,'DELETE_SAVINGSPRODUCT','Delete a Savings Product','Delete a Savings Product'),(194,'organisation',NULL,'CREATE_DEPOSITPRODUCT','Create a Deposit Product','Create a Deposit Product'),(195,'organisation',NULL,'READ_DEPOSITPRODUCT','Read Deposit Products','Read Deposit Products'),(196,'organisation',NULL,'UPDATE_DEPOSITPRODUCT','Update a Deposit Product','Update a Deposit Product'),(197,'organisation',NULL,'DELETE_DEPOSITPRODUCT','Delete a Deposit Product','Delete a Deposit Product'),(198,'portfolio',NULL,'CREATE_DEPOSITACCOUNT','Create a Deposit Account','Create a Deposit Account'),(199,'portfolio',NULL,'READ_DEPOSITACCOUNT','Read Deposit Accounts','Read Deposit Accounts'),(200,'portfolio',NULL,'UPDATE_DEPOSITACCOUNT','Update a Deposit Account','Update a Deposit Account'),(201,'portfolio',NULL,'DELETE_DEPOSITACCOUNT','Delete a Deposit Account','Delete a Deposit Account'),(202,'portfolio',NULL,'APPROVE_DEPOSITACCOUNT','Approve a Deposit Account','Approve a Deposit Account'),(203,'portfolio',NULL,'REJECT_DEPOSITACCOUNT','Reject Deposit Account','Reject Deposit Account'),(204,'portfolio',NULL,'WITHDRAW_DEPOSITACCOUNT','Withdraw Deposit Account','Withdraw Deposit Account'), +(205,'portfolio',NULL,'APPROVALUNDO_DEPOSITACCOUNT','Undo Approval of Deposit Account','Undo Approval of Deposit Account'),(206,'portfolio',NULL,'WITHDRAWAL_DEPOSITACCOUNT','Make a Withdrawal From Deposit Account','Make a Withdrawal From Deposit Account'),(207,'portfolio',NULL,'INTEREST_DEPOSITACCOUNT','Apply Interest to Deposit Accounts','Apply Interest to Deposit Accounts'),(208,'portfolio',NULL,'RENEW_DEPOSITACCOUNT','Renew Deposit Account','Renew Deposit Account'),(209,'portfolio',NULL,'CREATE_SAVINGSACCOUNT','Create a Savings Account','Create a Savings Account'),(210,'portfolio',NULL,'READ_SAVINGSACCOUNT','Read Savings Accounts','Read Savings Accounts'),(211,'portfolio',NULL,'UPDATE_SAVINGSACCOUNT','Update a Savings Account','Update a Savings Account'),(212,'portfolio',NULL,'DELETE_SAVINGSACCOUNT','Delete a Savings Account','Delete a Savings Account'); + +/* role 1 is super user, give it ALL_FUNCTIONS */ +INSERT INTO m_role_permission(role_id, permission_id) +select 1, id +from m_permission +where code = 'ALL_FUNCTIONS'; + +/* add a read permission for each defined report */ +insert into m_permission(grouping, `code`, default_description, default_name) +select 'report', concat('READ_', sr.report_name), concat('READ_', sr.report_name), concat('READ_', sr.report_name) +from stretchy_report sr; + +/* add a create, read, update and delete permission for each registered datatable */ +insert into m_permission(grouping, `code`, default_description, default_name) +select 'datatable', concat('CREATE_', r.registered_table_name), concat('CREATE_', r.registered_table_name), concat('CREATE_', r.registered_table_name) +from x_registered_table r; + +insert into m_permission(grouping, `code`, default_description, default_name) +select 'datatable', concat('READ_', r.registered_table_name), concat('READ_', r.registered_table_name), concat('READ_', r.registered_table_name) +from x_registered_table r; + +insert into m_permission(grouping, `code`, default_description, default_name) +select 'datatable', concat('UPDATE_', r.registered_table_name), concat('UPDATE_', r.registered_table_name), concat('UPDATE_', r.registered_table_name) +from x_registered_table r; + diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java index 06bf2794c..b593bb2a2 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java @@ -41,6 +41,7 @@ import org.mifosng.platform.saving.service.DepositAccountReadPlatformService; import org.mifosng.platform.saving.service.DepositAccountWritePlatformService; import org.mifosng.platform.savingproduct.service.DepositProductReadPlatformService; import org.mifosng.platform.savingproduct.service.SavingsDepositEnumerations; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -65,6 +66,10 @@ public class DepositAccountsApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + private final String entityType = "DEPOSITACCOUNT"; + @Autowired + private PlatformSecurityContext context; + private static final Set typicalResponseParameters = new HashSet( Arrays.asList("id", "externalId", "clientId", "clientName", "productId", "productName", "status", "currency", @@ -107,6 +112,8 @@ public class DepositAccountsApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); @@ -123,7 +130,9 @@ public class DepositAccountsApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); DepositPermissionData permissions = null; @@ -162,7 +171,9 @@ public class DepositAccountsApiResource { @QueryParam("clientId") final Long clientId, @QueryParam("productId") final Long productId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java index fe2ed4111..500b7f252 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java @@ -26,6 +26,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService import org.mifosng.platform.infrastructure.api.ApiParameterHelper; import org.mifosng.platform.saving.service.SavingAccountReadPlatformService; import org.mifosng.platform.saving.service.SavingAccountWritePlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -46,6 +47,10 @@ public class SavingsAccountApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + + private final String entityType = "SAVINGSACCOUNT"; + @Autowired + private PlatformSecurityContext context; private static final Set typicalResponseParameters = new HashSet( Arrays.asList("id", "status", "externalId", "clientId", "clientName", "productId", "productName", "productType", "currencyData", "savingsDepostiAmountPerPeriod", "savingsFrequencyType", @@ -83,6 +88,8 @@ public class SavingsAccountApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); @@ -99,7 +106,9 @@ public class SavingsAccountApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { @@ -121,7 +130,9 @@ public class SavingsAccountApiResource { @QueryParam("clientId") final Long clientId, @QueryParam("productId") final Long productId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); if (responseParameters.isEmpty()) { responseParameters.addAll(typicalResponseParameters); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java index 66a948529..c976ed977 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java @@ -10,37 +10,49 @@ import org.mifosng.platform.api.data.EntityIdentifier; import org.springframework.security.access.prepost.PreAuthorize; public interface DepositAccountWritePlatformService { - - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_DEPOSITACCOUNT')") EntityIdentifier createDepositAccount(DepositAccountCommand command); - - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_DEPOSITACCOUNT')") + EntityIdentifier updateDepositAccount(DepositAccountCommand command); + + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'DELETE_DEPOSITACCOUNT')") EntityIdentifier deleteDepositAccount(Long productId); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier approveDepositApplication(DepositStateTransitionApprovalCommand command); + // NOTE - took out permissions relating to doing things with deposit + // accounts in the past as doesn't appear to be code for it + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVE_DEPOSITACCOUNT')") + EntityIdentifier approveDepositApplication( + DepositStateTransitionApprovalCommand command); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command); - - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command); + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'REJECT_DEPOSITACCOUNT')") + EntityIdentifier rejectDepositApplication( + DepositStateTransitionCommand command); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAW_DEPOSITACCOUNT')") + EntityIdentifier withdrawDepositApplication( + DepositStateTransitionCommand command); + + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVALUNDO_DEPOSITACCOUNT')") EntityIdentifier undoDepositApproval(UndoStateTransitionCommand undoCommand); - /*@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier matureDepositApplication(DepositStateTransitionCommand command);*/ + /* + * @PreAuthorize(value = + * "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', '')" + * ) EntityIdentifier matureDepositApplication(DepositStateTransitionCommand + * command); + */ - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier withdrawDepositAccountMoney(DepositAccountWithdrawalCommand command); + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAWAL_DEPOSITACCOUNT')") + EntityIdentifier withdrawDepositAccountMoney( + DepositAccountWithdrawalCommand command); - @PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')") - EntityIdentifier withdrawDepositAccountInterestMoney(DepositAccountWithdrawInterestCommand command); + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'INTEREST_DEPOSITACCOUNT')") + EntityIdentifier withdrawDepositAccountInterestMoney( + DepositAccountWithdrawInterestCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'RENEW_DEPOSITACCOUNT')") EntityIdentifier renewDepositAccount(DepositAccountCommand command); - - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") - EntityIdentifier updateDepositAccount(DepositAccountCommand command); - } + +} \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java index ee3712219..00fa74e48 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java @@ -20,7 +20,6 @@ import org.mifosng.platform.currency.domain.Money; import org.mifosng.platform.exceptions.DepositAccountNotFoundException; import org.mifosng.platform.exceptions.DepositAccountReopenException; import org.mifosng.platform.exceptions.DepositAccountTransactionsException; -import org.mifosng.platform.exceptions.NoAuthorizationException; import org.mifosng.platform.exceptions.PlatformDataIntegrityException; import org.mifosng.platform.exceptions.ProductNotFoundException; import org.mifosng.platform.saving.domain.DepositAccount; @@ -30,7 +29,6 @@ import org.mifosng.platform.saving.domain.DepositLifecycleStateMachine; import org.mifosng.platform.saving.domain.DepositLifecycleStateMachineImpl; import org.mifosng.platform.saving.domain.FixedTermDepositInterestCalculator; import org.mifosng.platform.security.PlatformSecurityContext; -import org.mifosng.platform.user.domain.AppUser; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -118,7 +116,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo @Override public EntityIdentifier approveDepositApplication(final DepositStateTransitionApprovalCommand command) { - AppUser currentUser = context.authenticatedUser(); + //AppUser currentUser = context.authenticatedUser(); DepositStateTransitionApprovalCommandValidator validator = new DepositStateTransitionApprovalCommandValidator(command); validator.validate(); @@ -129,10 +127,11 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo } // FIXME - madhukar - you are checking for loan permission here instead of some specific deposit account permission. + // removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified LocalDate eventDate = command.getEventDate(); - if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { - throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); - } + //if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { + // throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); + //} account.approve(eventDate, defaultDepositLifecycleStateMachine(), command, this.fixedTermDepositInterestCalculator); @@ -149,9 +148,9 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo } - private boolean isBeforeToday(final LocalDate date) { - return date.isBefore(new LocalDate()); - } + //private boolean isBeforeToday(final LocalDate date) { + // return date.isBefore(new LocalDate()); + //} private DepositLifecycleStateMachine defaultDepositLifecycleStateMachine() { List allowedDepositStatuses = Arrays.asList(DepositAccountStatus.values()); return new DepositLifecycleStateMachineImpl(allowedDepositStatuses); @@ -161,7 +160,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo @Override public EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command) { - AppUser currentUser = context.authenticatedUser(); + //AppUser currentUser = context.authenticatedUser(); DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command); validator.validate(); @@ -170,11 +169,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo if (account == null || account.isDeleted()) { throw new DepositAccountNotFoundException(command.getAccountId()); } - + + // removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified LocalDate eventDate = command.getEventDate(); - if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { - throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); - } + //if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { + // throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); + //} account.reject(eventDate, defaultDepositLifecycleStateMachine()); this.depositAccountRepository.save(account); @@ -192,7 +192,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo @Override public EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command) { - AppUser currentUser = context.authenticatedUser(); + //AppUser currentUser = context.authenticatedUser(); DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command); validator.validate(); @@ -201,11 +201,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo if (account == null || account.isDeleted()) { throw new DepositAccountNotFoundException(command.getAccountId()); } - + + // removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified LocalDate eventDate = command.getEventDate(); - if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { - throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); - } + //if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) { + // throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past."); + //} account.withdrawnByApplicant(eventDate, defaultDepositLifecycleStateMachine()); this.depositAccountRepository.save(account); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java index 3e84784c9..bae4f6b27 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java @@ -6,9 +6,9 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface SavingAccountWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_SAVINGSACCOUNT')") EntityIdentifier createSavingAccount(SavingAccountCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_SAVINGSACCOUNT')") EntityIdentifier updateSavingAccount(SavingAccountCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java index 8ad7189e1..44c5407a8 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java @@ -262,7 +262,7 @@ public class AppUser extends AbstractAuditableCustom implements public boolean hasNotPermissionForReport(String reportName) { - if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", + if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", "REPORTING_SUPER_USER", "READ_" + reportName)) return true; @@ -372,6 +372,10 @@ public class AppUser extends AbstractAuditableCustom implements higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } else if (entityType.equalsIgnoreCase("DEPOSITPRODUCT")) { higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("DEPOSITACCOUNT")) { + higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("SAVINGSACCOUNT")) { + higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER"; } if (!(higherPermission.equals(""))) {