Changeset 14:629e15b345aa in AnnotationManagerN4J for src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java

Timestamp:

Jul 13, 2012, 6:41:02 PM (12 years ago)

Author:

casties

Branch:

default

Message:

permissions mostly work. need more server-side checking.

File:

• src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java (modified) (4 diffs)

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java

@@ -16 +16 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
-import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
 
 /**
@@ -32 +31 @@
 
     /**
-     * result for JSON content-type. optional search parameters: uri user limit
-     * offset
+     * result for JSON content-type. optional search parameters: uri, user, limit,
+     * offset.
      * 
      * @param entity
@@ -42 +41 @@
         logger.debug("AnnotatorSearch doGetJSON!");
         setCorsHeaders();
-        // TODO: what to do with authentication?
-        boolean authenticated = isAuthenticated(entity);
-        logger.debug("request authenticated=" + authenticated);
+        // do authentication
+        String authUser = this.checkAuthToken(entity);
+        logger.debug("request authenticated=" + authUser);
 
         Form form = getRequest().getResourceRef().getQueryAsForm();
         String uri = form.getFirstValue("uri");
         String user = form.getFirstValue("user");
-
         String limit = form.getFirstValue("limit");
         String offset = form.getFirstValue("offset");
 
-        AnnotationStore searcher = getAnnotationStore();
-
-        JSONArray ja;
-
-        List<Annotation> annots = searcher.searchByUriUser(uri, user, limit, offset);
-
-        ja = new JSONArray();
+        JSONArray results = new JSONArray();
+        // do search
+        logger.debug(String.format("searching for uri=%s user=%s", uri, user));
+        List<Annotation> annots = getAnnotationStore().searchByUriUser(uri, user, limit, offset);
         for (Annotation annot : annots) {
-            JSONObject jo = createAnnotatorJson(annot);
+            // check permission
+            if (!annot.isActionAllowed("read", authUser)) continue;
+            JSONObject jo = createAnnotatorJson(annot, (authUser == null));
             if (jo != null) {
-                ja.put(createAnnotatorJson(annot));
+                results.put(jo);
             } else {
                 setStatus(Status.SERVER_ERROR_INTERNAL, "JSON Error");
@@ -69 +66 @@
             }
         }
-
+        // assemble result object
         JSONObject result = new JSONObject();
         try {
-            result.put("rows", ja);
-            result.put("total", ja.length());
+            result.put("rows", results);
+            result.put("total", results.length());
         } catch (JSONException e) {
-            e.printStackTrace();
             setStatus(Status.SERVER_ERROR_INTERNAL, "JSON Error");
             return null;