CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 64 Packages Projects Releases Wiki Activity

WIP permission - with permissions overhaul script

Browse Source
This commit is contained in:
John Woodlock
2012-11-16 19:37:43 +00:00
parent 16c395719c
commit bf847dc352
7 changed files with 129 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mifosng-provider/src/main/java/org/mifosng/platform/api/DepositAccountsApiResource.java
+13 -2
View File
@@ -41,6 +41,7 @@ import org.mifosng.platform.saving.service.DepositAccountReadPlatformService;
import org.mifosng.platform.saving.service.DepositAccountWritePlatformService;
import org.mifosng.platform.savingproduct.service.DepositProductReadPlatformService;
import org.mifosng.platform.savingproduct.service.SavingsDepositEnumerations;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Component;
@@ -65,6 +66,10 @@ public class DepositAccountsApiResource {
@Autowired
private PortfolioApiJsonSerializerService apiJsonSerializerService;
private final String entityType = "DEPOSITACCOUNT";
@Autowired
private PlatformSecurityContext context;
private static final Set<String> typicalResponseParameters = new HashSet<String>(
Arrays.asList("id", "externalId", "clientId", "clientName",
"productId", "productName", "status", "currency",
@@ -107,6 +112,8 @@ public class DepositAccountsApiResource {
@Produces({MediaType.APPLICATION_JSON})
public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
@@ -123,7 +130,9 @@ public class DepositAccountsApiResource {
@Consumes({MediaType.APPLICATION_JSON})
@Produces({MediaType.APPLICATION_JSON})
public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
DepositPermissionData permissions = null;
@@ -162,7 +171,9 @@ public class DepositAccountsApiResource {
@QueryParam("clientId") final Long clientId,
@QueryParam("productId") final Long productId,
@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
mifosng-provider/src/main/java/org/mifosng/platform/api/SavingsAccountApiResource.java
+13 -2
View File
@@ -26,6 +26,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService
import org.mifosng.platform.infrastructure.api.ApiParameterHelper;
import org.mifosng.platform.saving.service.SavingAccountReadPlatformService;
import org.mifosng.platform.saving.service.SavingAccountWritePlatformService;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Component;
@@ -46,6 +47,10 @@ public class SavingsAccountApiResource {
@Autowired
private PortfolioApiJsonSerializerService apiJsonSerializerService;
private final String entityType = "SAVINGSACCOUNT";
@Autowired
private PlatformSecurityContext context;
private static final Set<String> typicalResponseParameters = new HashSet<String>(
Arrays.asList("id", "status", "externalId", "clientId", "clientName", "productId", "productName", "productType", "currencyData", "savingsDepostiAmountPerPeriod", "savingsFrequencyType",
@@ -83,6 +88,8 @@ public class SavingsAccountApiResource {
@Produces({MediaType.APPLICATION_JSON})
public String retrieveAllDepositAccounts(@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
@@ -99,7 +106,9 @@ public class SavingsAccountApiResource {
@Consumes({MediaType.APPLICATION_JSON})
@Produces({MediaType.APPLICATION_JSON})
public String retrieveDepositAccount(@PathParam("accountId") final Long accountId, @Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
@@ -121,7 +130,9 @@ public class SavingsAccountApiResource {
@QueryParam("clientId") final Long clientId,
@QueryParam("productId") final Long productId,
@Context final UriInfo uriInfo) {
context.authenticatedUser().validateHasReadPermission(entityType);
Set<String> responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters());
if (responseParameters.isEmpty()) {
responseParameters.addAll(typicalResponseParameters);
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformService.java
+35 -23
View File
@@ -10,37 +10,49 @@ import org.mifosng.platform.api.data.EntityIdentifier;
import org.springframework.security.access.prepost.PreAuthorize;
public interface DepositAccountWritePlatformService {
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_DEPOSITACCOUNT')")
EntityIdentifier createDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_DEPOSITACCOUNT')")
EntityIdentifier updateDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'DELETE_DEPOSITACCOUNT')")
EntityIdentifier deleteDepositAccount(Long productId);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier approveDepositApplication(DepositStateTransitionApprovalCommand command);
// NOTE - took out permissions relating to doing things with deposit
// accounts in the past as doesn't appear to be code for it
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVE_DEPOSITACCOUNT')")
EntityIdentifier approveDepositApplication(
DepositStateTransitionApprovalCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'REJECT_DEPOSITACCOUNT')")
EntityIdentifier rejectDepositApplication(
DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAW_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositApplication(
DepositStateTransitionCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'APPROVALUNDO_DEPOSITACCOUNT')")
EntityIdentifier undoDepositApproval(UndoStateTransitionCommand undoCommand);
/*@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier matureDepositApplication(DepositStateTransitionCommand command);*/
/*
* @PreAuthorize(value =
* "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', '')"
* ) EntityIdentifier matureDepositApplication(DepositStateTransitionCommand
* command);
*/
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositAccountMoney(DepositAccountWithdrawalCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'WITHDRAWAL_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositAccountMoney(
DepositAccountWithdrawalCommand command);
@PreAuthorize(value = "hasAnyRole('PORTFOLIO_MANAGEMENT_SUPER_USER', 'CAN_APPROVE_DEPOSIT_ROLE', 'CAN_APPROVE_DEPOSIT_IN_THE_PAST_ROLE')")
EntityIdentifier withdrawDepositAccountInterestMoney(DepositAccountWithdrawInterestCommand command);
@PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'INTEREST_DEPOSITACCOUNT')")
EntityIdentifier withdrawDepositAccountInterestMoney(
DepositAccountWithdrawInterestCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'RENEW_DEPOSITACCOUNT')")
EntityIdentifier renewDepositAccount(DepositAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
EntityIdentifier updateDepositAccount(DepositAccountCommand command);
}
}
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/DepositAccountWritePlatformServiceJpaRepositoryImpl.java
+20 -19
View File
@@ -20,7 +20,6 @@ import org.mifosng.platform.currency.domain.Money;
import org.mifosng.platform.exceptions.DepositAccountNotFoundException;
import org.mifosng.platform.exceptions.DepositAccountReopenException;
import org.mifosng.platform.exceptions.DepositAccountTransactionsException;
import org.mifosng.platform.exceptions.NoAuthorizationException;
import org.mifosng.platform.exceptions.PlatformDataIntegrityException;
import org.mifosng.platform.exceptions.ProductNotFoundException;
import org.mifosng.platform.saving.domain.DepositAccount;
@@ -30,7 +29,6 @@ import org.mifosng.platform.saving.domain.DepositLifecycleStateMachine;
import org.mifosng.platform.saving.domain.DepositLifecycleStateMachineImpl;
import org.mifosng.platform.saving.domain.FixedTermDepositInterestCalculator;
import org.mifosng.platform.security.PlatformSecurityContext;
import org.mifosng.platform.user.domain.AppUser;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
@@ -118,7 +116,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier approveDepositApplication(final DepositStateTransitionApprovalCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionApprovalCommandValidator validator = new DepositStateTransitionApprovalCommandValidator(command);
validator.validate();
@@ -129,10 +127,11 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
}
// FIXME - madhukar - you are checking for loan permission here instead of some specific deposit account permission.
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.approve(eventDate, defaultDepositLifecycleStateMachine(), command, this.fixedTermDepositInterestCalculator);
@@ -149,9 +148,9 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
}
private boolean isBeforeToday(final LocalDate date) {
return date.isBefore(new LocalDate());
}
//private boolean isBeforeToday(final LocalDate date) {
// return date.isBefore(new LocalDate());
//}
private DepositLifecycleStateMachine defaultDepositLifecycleStateMachine() {
List<DepositAccountStatus> allowedDepositStatuses = Arrays.asList(DepositAccountStatus.values());
return new DepositLifecycleStateMachineImpl(allowedDepositStatuses);
@@ -161,7 +160,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier rejectDepositApplication(DepositStateTransitionCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command);
validator.validate();
@@ -170,11 +169,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
if (account == null || account.isDeleted()) {
throw new DepositAccountNotFoundException(command.getAccountId());
}
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.reject(eventDate, defaultDepositLifecycleStateMachine());
this.depositAccountRepository.save(account);
@@ -192,7 +192,7 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
@Override
public EntityIdentifier withdrawDepositApplication(DepositStateTransitionCommand command) {
AppUser currentUser = context.authenticatedUser();
//AppUser currentUser = context.authenticatedUser();
DepositStateTransitionCommandValidator validator = new DepositStateTransitionCommandValidator(command);
validator.validate();
@@ -201,11 +201,12 @@ public class DepositAccountWritePlatformServiceJpaRepositoryImpl implements Depo
if (account == null || account.isDeleted()) {
throw new DepositAccountNotFoundException(command.getAccountId());
}
// removing check for now until rules dealing with creating and maintaining deposit accounts in the past is clarified
LocalDate eventDate = command.getEventDate();
if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
}
//if (this.isBeforeToday(eventDate) && currentUser.canNotApproveLoanInPast()) {
// throw new NoAuthorizationException("User has no authority to approve deposit with a date in the past.");
//}
account.withdrawnByApplicant(eventDate, defaultDepositLifecycleStateMachine());
this.depositAccountRepository.save(account);
mifosng-provider/src/main/java/org/mifosng/platform/saving/service/SavingAccountWritePlatformService.java
+2 -2
View File
@@ -6,9 +6,9 @@ import org.springframework.security.access.prepost.PreAuthorize;
public interface SavingAccountWritePlatformService {
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'CREATE_SAVINGSACCOUNT')")
EntityIdentifier createSavingAccount(SavingAccountCommand command);
@PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')")
@PreAuthorize(value = "hasRole('ALL_FUNCTIONS', 'PORTFOLIO_MANAGEMENT_SUPER_USER', 'UPDATE_SAVINGSACCOUNT')")
EntityIdentifier updateSavingAccount(SavingAccountCommand command);
}
mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java
+5 -1
View File
@@ -262,7 +262,7 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
public boolean hasNotPermissionForReport(String reportName) {
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ",
if (hasNotPermissionForAnyOf("ALL_FUNCTIONS", "ALL_FUNCTIONS_READ", "REPORTING_SUPER_USER",
"READ_" + reportName))
return true;
@@ -372,6 +372,10 @@ public class AppUser extends AbstractAuditableCustom<AppUser, Long> implements
higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
} else if (entityType.equalsIgnoreCase("DEPOSITPRODUCT")) {
higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER";
} else if (entityType.equalsIgnoreCase("DEPOSITACCOUNT")) {
higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
} else if (entityType.equalsIgnoreCase("SAVINGSACCOUNT")) {
higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER";
}
if (!(higherPermission.equals(""))) {