Changeset 105:7417f5915181 in AnnotationManagerN4J

Timestamp:

Feb 10, 2017, 2:45:35 PM (8 years ago)

Author:

casties

Branch:

default

Tags:

tip

Message:

check admin permission before changing permissions.
Enum for typesafe actions.

Location:

src/main/java/de/mpiwg/itgroup/annotations

Files:

• Annotation.java (modified) (5 diffs)
• restlet/AnnotatorAnnotations.java (modified) (5 diffs)
• restlet/AnnotatorAnnotationsByResources.java (modified) (2 diffs)
• restlet/AnnotatorAnnotationsByTags.java (modified) (2 diffs)
• restlet/AnnotatorResourceImpl.java (modified) (2 diffs)
• restlet/AnnotatorSearch.java (modified) (2 diffs)

src/main/java/de/mpiwg/itgroup/annotations/Annotation.java

@@ -132 +132 @@
     
     /**
+     * Enum of actions (for permissions).
+     */
+    public static enum Action {
+        read, update, create, delete, admin
+    }
+    
+    /**
      * Returns if the requested action is allowed for the given user on this annotation.
      * 
@@ -139 +146 @@
      * @return
      */
-    public boolean isActionAllowed(String action, Person user, AnnotationStore store) {
-        if (action.equals("read")) {
+    public boolean isActionAllowed(Action action, Person user, AnnotationStore store) {
+        if (action == Action.read) {
             Actor reader = getReadPermission();
             if (reader == null) {
@@ -148 +155 @@
                 return reader.isEquivalentWith(user, store);
             }
-        } else if (action.equals("update")) {
+        } else if (action == Action.update) {
             // require at least an authenticated user
             if (user == null) return false;
@@ -158 +165 @@
                 return updater.isEquivalentWith(user, store);
             }
-        } else if (action.equals("delete")) {
+        } else if (action == Action.delete) {
             // require at least an authenticated user
             if (user == null) return false;
@@ -167 +174 @@
             }
             return deleter.isEquivalentWith(user, store);
-        } else if (action.equals("admin")) {
+        } else if (action == Action.admin) {
             // require at least an authenticated user
             if (user == null) return false;

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotations.java

@@ -42 +42 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -95 +96 @@
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("read", authUser, store)) {
+            if (!annot.isActionAllowed(Action.read, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;
@@ -116 +117 @@
         for (Annotation annotation : annotations) {
             // check permission
-            if (!annotation.isActionAllowed("read", authUser, store))
+            if (!annotation.isActionAllowed(Action.read, authUser, store))
                 continue;
             // add annotation to list
@@ -238 +239 @@
                 return null;
             }
-            if (!storedAnnot.isActionAllowed("update", authUser, store)) {
+            if (!storedAnnot.isActionAllowed(Action.update, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN);
                 return null;
@@ -287 +288 @@
         Annotation annot = store.getAnnotationById(id);
         if (annot != null) {
-            if (!annot.isActionAllowed("delete", authUser, store)) {
+            if (!annot.isActionAllowed(Action.delete, authUser, store)) {
                 setStatus(Status.CLIENT_ERROR_FORBIDDEN, "Not Authorized!");
                 return null;

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByResources.java

@@ -39 +39 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -90 +91 @@
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorAnnotationsByTags.java

@@ -38 +38 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -79 +80 @@
         for (Annotation annot : annotations) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store))
+            if (!annot.isActionAllowed(Action.read, authUser, store))
                 continue;
 

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorResourceImpl.java

@@ -57 +57 @@
 import de.mpiwg.itgroup.annotations.Actor;
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Annotation.FragmentTypes;
 import de.mpiwg.itgroup.annotations.Group;
@@ -680 +681 @@
          * permissions
          */
-        if (jo.has("permissions")) {
-            JSONObject permissions = jo.getJSONObject("permissions");
-            if (permissions.has("admin")) {
-                JSONArray perms = permissions.getJSONArray("admin");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setAdminPermission(actor);
-            }
-            if (permissions.has("delete")) {
-                JSONArray perms = permissions.getJSONArray("delete");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setDeletePermission(actor);
-            }
-            if (permissions.has("update")) {
-                JSONArray perms = permissions.getJSONArray("update");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setUpdatePermission(actor);
-            }
-            if (permissions.has("read")) {
-                JSONArray perms = permissions.getJSONArray("read");
-                Actor actor = getActorFromPermissions(perms);
-                annot.setReadPermission(actor);
-            }
-        }
+                if (jo.has("permissions")) {
+                        // change permissions only if user has admin permission
+                        if (annot.isActionAllowed(Action.admin, authUser, getAnnotationStore())) {
+                                JSONObject permissions = jo.getJSONObject("permissions");
+                                if (permissions.has("admin")) {
+                                        JSONArray perms = permissions.getJSONArray("admin");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setAdminPermission(actor);
+                                }
+                                if (permissions.has("delete")) {
+                                        JSONArray perms = permissions.getJSONArray("delete");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setDeletePermission(actor);
+                                }
+                                if (permissions.has("update")) {
+                                        JSONArray perms = permissions.getJSONArray("update");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setUpdatePermission(actor);
+                                }
+                                if (permissions.has("read")) {
+                                        JSONArray perms = permissions.getJSONArray("read");
+                                        Actor actor = getActorFromPermissions(perms);
+                                        annot.setReadPermission(actor);
+                                }
+                        }
+                }
 
         /*

src/main/java/de/mpiwg/itgroup/annotations/restlet/AnnotatorSearch.java

@@ -36 +36 @@
 
 import de.mpiwg.itgroup.annotations.Annotation;
+import de.mpiwg.itgroup.annotations.Annotation.Action;
 import de.mpiwg.itgroup.annotations.Person;
 import de.mpiwg.itgroup.annotations.neo4j.AnnotationStore;
@@ -77 +78 @@
         for (Annotation annot : annots) {
             // check permission
-            if (!annot.isActionAllowed("read", authUser, store)) continue;
+            if (!annot.isActionAllowed(Action.read, authUser, store)) continue;
             JSONObject jo = createAnnotatorJson(annot, (authUser == null));
             if (jo != null) {