Mercurial > hg > AnnotationManagerN4J

changeset 105:7417f5915181 default tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
check admin permission before changing permissions. Enum for typesafe actions.
author casties
date Fri, 10 Feb 2017 15:45:35 +0100
parents e953327d66bb
children
files src/main/java/de/mpiwg/itgroup/annotations/Annotation.java src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java
diffstat 6 files changed, 50 insertions(+), 35 deletions(-) [+]
line wrap: on
line diff
--- a/src/main/java/de/mpiwg/itgroup/annotations/Annotation.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/Annotation.java	Fri Feb 10 15:45:35 2017 +0100
@@ -131,6 +131,13 @@
     protected Set<String> tags;
     
     /**
+     * Enum of actions (for permissions).
+     */
+    public static enum Action {
+    	read, update, create, delete, admin
+    }
+    
+    /**
      * Returns if the requested action is allowed for the given user on this annotation.
      * 
      * @param action
@@ -138,8 +145,8 @@
      * @param store AnnotationStore to check group membership
      * @return
      */
-    public boolean isActionAllowed(String action, Person user, AnnotationStore store) {
-        if (action.equals("read")) {
+    public boolean isActionAllowed(Action action, Person user, AnnotationStore store) {
+        if (action == Action.read) {
             Actor reader = getReadPermission();
             if (reader == null) {
                 // if not specified then everybody is allowed
@@ -147,7 +154,7 @@
             } else {
                 return reader.isEquivalentWith(user, store);
             }
-        } else if (action.equals("update")) {
+        } else if (action == Action.update) {
             // require at least an authenticated user
             if (user == null) return false;
             Actor updater = getUpdatePermission();
@@ -157,7 +164,7 @@
             } else {
                 return updater.isEquivalentWith(user, store);
             }
-        } else if (action.equals("delete")) {
+        } else if (action == Action.delete) {
             // require at least an authenticated user
             if (user == null) return false;
             Actor deleter = getDeletePermission();
@@ -166,7 +173,7 @@
                 deleter = creator;
             }
             return deleter.isEquivalentWith(user, store);
-        } else if (action.equals("admin")) {
+        } else if (action == Action.admin) {
             // require at least an authenticated user
             if (user == null) return false;
             Actor admin = getAdminPermission();
--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java	Fri Feb 10 15:45:35 2017 +0100
@@ -41,6 +41,7 @@
 import org.restlet.resource.Put;
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 import de.mpiwg.itgroup.annotations.restlet.utils.JSONObjectComparator;
@@ -94,7 +95,7 @@
         AnnotationStore store = getAnnotationStore();
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("read", authUser, store)) {
+            if (!annot.isActionAllowed(Action.read, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;
             }
@@ -115,7 +116,7 @@
         List<Annotation> annotations = store.getAnnotations(null, null, 0, 0);
         for (Annotation annotation : annotations) {
             // check permission
-            if (!annotation.isActionAllowed("read", authUser, store))
+            if (!annotation.isActionAllowed(Action.read, authUser, store))
                 continue;
             // add annotation to list
             JSONObject jo = createAnnotatorJson(annotation, false);
@@ -237,7 +238,7 @@
                 setStatus(Status.CLIENT_ERROR_NOT_FOUND);
                 return null;
             }
-            if (!storedAnnot.isActionAllowed("update", authUser, store)) {
+            if (!storedAnnot.isActionAllowed(Action.update, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN);
                 return null;
             }
@@ -286,7 +287,7 @@
         AnnotationStore store = getAnnotationStore();
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("delete", authUser, store)) {
+            if (!annot.isActionAllowed(Action.delete, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;
             }
--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java	Fri Feb 10 15:45:35 2017 +0100
@@ -38,6 +38,7 @@
 import org.restlet.resource.Get;
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 import de.mpiwg.itgroup.annotations.restlet.utils.JSONObjectComparator;
@@ -89,7 +90,7 @@
 
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 
             JSONObject jo = createAnnotatorJson(annot, false);
--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java	Fri Feb 10 15:45:35 2017 +0100
@@ -37,6 +37,7 @@
 import org.restlet.resource.Get;
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 import de.mpiwg.itgroup.annotations.restlet.utils.JSONObjectComparator;
@@ -78,7 +79,7 @@
 
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 
             JSONObject jo = createAnnotatorJson(annot, false);
--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java	Fri Feb 10 15:45:35 2017 +0100
@@ -56,6 +56,7 @@
 
 import de.mpiwg.itgroup.annotations.Actor;
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Annotation.FragmentTypes;
 import de.mpiwg.itgroup.annotations.Group;
 import de.mpiwg.itgroup.annotations.Person;
@@ -679,29 +680,32 @@
         /*
          * permissions
          */
-        if (jo.has("permissions")) {
-            JSONObject permissions = jo.getJSONObject("permissions");
-            if (permissions.has("admin")) {
-                JSONArray perms = permissions.getJSONArray("admin");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setAdminPermission(actor);
-            }
-            if (permissions.has("delete")) {
-                JSONArray perms = permissions.getJSONArray("delete");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setDeletePermission(actor);
-            }
-            if (permissions.has("update")) {
-                JSONArray perms = permissions.getJSONArray("update");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setUpdatePermission(actor);
-            }
-            if (permissions.has("read")) {
-                JSONArray perms = permissions.getJSONArray("read");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setReadPermission(actor);
-            }
-        }
+		if (jo.has("permissions")) {
+			// change permissions only if user has admin permission
+			if (annot.isActionAllowed(Action.admin, authUser, getAnnotationStore())) {
+				JSONObject permissions = jo.getJSONObject("permissions");
+				if (permissions.has("admin")) {
+					JSONArray perms = permissions.getJSONArray("admin");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setAdminPermission(actor);
+				}
+				if (permissions.has("delete")) {
+					JSONArray perms = permissions.getJSONArray("delete");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setDeletePermission(actor);
+				}
+				if (permissions.has("update")) {
+					JSONArray perms = permissions.getJSONArray("update");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setUpdatePermission(actor);
+				}
+				if (permissions.has("read")) {
+					JSONArray perms = permissions.getJSONArray("read");
+					Actor actor = getActorFromPermissions(perms);
+					annot.setReadPermission(actor);
+				}
+			}
+		}
 
         /*
          * tags
--- a/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	Fri Feb 10 15:02:32 2017 +0100
+++ b/src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java	Fri Feb 10 15:45:35 2017 +0100
@@ -35,6 +35,7 @@
 import org.restlet.resource.Get;
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 import de.mpiwg.itgroup.annotations.restlet.utils.JSONObjectComparator;
@@ -76,7 +77,7 @@
         List<Annotation> annots = store.searchAnnotationByUriUser(uri, user);
         for (Annotation annot : annots) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store)) continue;
+            if (!annot.isActionAllowed(Action.read, authUser, store)) continue;
             JSONObject jo = createAnnotatorJson(annot, (authUser == null));
             if (jo != null) {
                 results.add(jo);