From e046d86e06d06d4da82a2173c675b6f6707a4509 Mon Sep 17 00:00:00 2001 From: John Woodlock Date: Thu, 15 Nov 2012 16:36:49 +0000 Subject: [PATCH] wip permissions --- .../platform/api/MakerCheckerApiResource.java | 9 ++++++++- .../api/OfficeTransactionsApiResource.java | 9 +++++++++ .../mifosng/platform/api/OfficesApiResource.java | 15 +++++++++++++-- .../PortfolioMakerCheckerWriteService.java | 6 ++++-- .../service/OfficeWritePlatformService.java | 9 +++++---- .../org/mifosng/platform/user/domain/AppUser.java | 4 ++++ 6 files changed, 43 insertions(+), 9 deletions(-) diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/MakerCheckerApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/MakerCheckerApiResource.java index e0065d3d6..d167acfe5 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/MakerCheckerApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/MakerCheckerApiResource.java @@ -22,6 +22,7 @@ import org.mifosng.platform.exceptions.UnrecognizedQueryParamException; import org.mifosng.platform.infrastructure.api.ApiParameterHelper; import org.mifosng.platform.makerchecker.service.PortfolioMakerCheckerReadPlatformService; import org.mifosng.platform.makerchecker.service.PortfolioMakerCheckerWriteService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -39,12 +40,18 @@ public class MakerCheckerApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; - + + private final String entityType = "MAKERCHECKER"; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveCodes(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + final Set responseParameters = ApiParameterHelper.extractFieldsForResponseIfProvided(uriInfo.getQueryParameters()); final boolean prettyPrint = ApiParameterHelper.prettyPrint(uriInfo.getQueryParameters()); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java index bfaa6c32d..21a7bfa8b 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficeTransactionsApiResource.java @@ -23,6 +23,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService import org.mifosng.platform.infrastructure.api.ApiParameterHelper; import org.mifosng.platform.organisation.service.OfficeReadPlatformService; import org.mifosng.platform.organisation.service.OfficeWritePlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -44,11 +45,17 @@ public class OfficeTransactionsApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + private final String entityType = "OFFICE"; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({ MediaType.APPLICATION_JSON }) @Produces({ MediaType.APPLICATION_JSON }) public String retrieveOfficeTransactions(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "transactionDate", "fromOfficeId", "fromOfficeName", "toOfficeId", "toOfficeIdName", @@ -78,6 +85,8 @@ public class OfficeTransactionsApiResource { @Produces({ MediaType.APPLICATION_JSON }) public String newOfficeTransactionDetails(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "transactionDate", "allowedOffices", "currencyOptions")); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficesApiResource.java b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficesApiResource.java index c94028dac..cc544fdc5 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficesApiResource.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/api/OfficesApiResource.java @@ -28,6 +28,7 @@ import org.mifosng.platform.api.infrastructure.PortfolioApiJsonSerializerService import org.mifosng.platform.infrastructure.api.ApiParameterHelper; import org.mifosng.platform.organisation.service.OfficeReadPlatformService; import org.mifosng.platform.organisation.service.OfficeWritePlatformService; +import org.mifosng.platform.security.PlatformSecurityContext; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Component; @@ -49,11 +50,17 @@ public class OfficesApiResource { @Autowired private PortfolioApiJsonSerializerService apiJsonSerializerService; + private final String entityType = "OFFICE"; + @Autowired + private PlatformSecurityContext context; + @GET @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retrieveOffices(@Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "name", "nameDecorated", "externalId", "openingDate", "hierarchy", "parentId", "parentName")); @@ -75,6 +82,8 @@ public class OfficesApiResource { @Produces({MediaType.APPLICATION_JSON}) public String retrieveOfficeTemplate(@Context final UriInfo uriInfo) { + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "name", "nameDecorated", "externalId", "openingDate", "hierarchy", "parentId", "parentName", "allowedParents")); @@ -106,7 +115,9 @@ public class OfficesApiResource { @Consumes({MediaType.APPLICATION_JSON}) @Produces({MediaType.APPLICATION_JSON}) public String retreiveOffice(@PathParam("officeId") final Long officeId, @Context final UriInfo uriInfo) { - + + context.authenticatedUser().validateHasReadPermission(entityType); + Set typicalResponseParameters = new HashSet( Arrays.asList("id", "name", "nameDecorated", "externalId", "openingDate", "hierarchy", "parentId", "parentName")); diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/makerchecker/service/PortfolioMakerCheckerWriteService.java b/mifosng-provider/src/main/java/org/mifosng/platform/makerchecker/service/PortfolioMakerCheckerWriteService.java index 95fad39b6..26a7799d4 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/makerchecker/service/PortfolioMakerCheckerWriteService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/makerchecker/service/PortfolioMakerCheckerWriteService.java @@ -1,8 +1,10 @@ package org.mifosng.platform.makerchecker.service; + public interface PortfolioMakerCheckerWriteService { - +//TODO - permissions on this to be done after development completes + Long logNewEntry(String taskName, String taskJson); - + Long approveEntry(Long id); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java index 8a9d295f3..62abc4659 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/organisation/service/OfficeWritePlatformService.java @@ -6,12 +6,13 @@ import org.springframework.security.access.prepost.PreAuthorize; public interface OfficeWritePlatformService { - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'CREATE_OFFICE')") Long createOffice(final OfficeCommand command); - - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER', 'UPDATE_OFFICE')") Long updateOffice(final OfficeCommand command); - @PreAuthorize(value = "hasRole('ORGANISATION_ADMINISTRATION_SUPER_USER')") + //TODO - complete permissions for office transactions when more functionality add or it is replaced by simple accounting equivalent (JPW) + @PreAuthorize(value = "hasAnyRole('ALL_FUNCTIONS', 'ORGANISATION_ADMINISTRATION_SUPER_USER')") Long externalBranchMoneyTransfer(BranchMoneyTransferCommand command); } \ No newline at end of file diff --git a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java index 1d7d59e8b..702d85f57 100644 --- a/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java +++ b/mifosng-provider/src/main/java/org/mifosng/platform/user/domain/AppUser.java @@ -356,6 +356,10 @@ public class AppUser extends AbstractAuditableCustom implements higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } else if (entityType.equalsIgnoreCase("LOAN")) { higherPermission = "PORTFOLIO_MANAGEMENT_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("OFFICE")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; + } else if (entityType.equalsIgnoreCase("OFFICETRANSACTION")) { + higherPermission = "ORGANISATION_ADMINISTRATION_SUPER_USER"; } if (!(higherPermission.equals(""))) {