Skip to content
Snippets Groups Projects

feat: user cannot list users

Merged Mathieu.Vonlanthen requested to merge MVO-restrict-listing-users into master
Files
26
package ch.unige.aou.controller.admin;
import ch.unige.aou.business.NotificationService;
import ch.unige.aou.business.UserService;
import ch.unige.aou.controller.AdminController;
import ch.unige.aou.model.notification.Notification;
import ch.unige.aou.model.security.User;
import ch.unige.aou.repository.UserRepository;
import ch.unige.aou.rest.AouActionName;
import ch.unige.aou.rest.UrlPath;
import ch.unige.solidify.SolidifyConstants;
@@ -32,7 +32,6 @@ import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import java.security.Principal;
import java.time.OffsetDateTime;
import static org.springframework.hateoas.server.mvc.WebMvcLinkBuilder.linkTo;
@@ -42,18 +41,16 @@ import static org.springframework.hateoas.server.mvc.WebMvcLinkBuilder.linkTo;
@RequestMapping(UrlPath.ADMIN_NOTIFICATIONS)
public class NotificationController extends ResourceController<Notification> {
private final HttpRequestInfoProvider httpRequestInfoProvider;
private final UserRepository userRepository;
private final UserService userService;
public NotificationController(HttpRequestInfoProvider httpRequestInfoProvider, UserRepository userRepository) {
this.httpRequestInfoProvider = httpRequestInfoProvider;
this.userRepository = userRepository;
public NotificationController(UserService userService) {
this.userService = userService;
}
@Override
@PreAuthorize("@notificationPermissionService.isAllowedToCreate(#notification)")
public HttpEntity<Notification> create(@RequestBody Notification notification) {
notification.setRecipient(this.getCurrentUser().getPerson());
notification.setRecipient(this.userService.getCurrentUser().getPerson());
notification.setSentTime(OffsetDateTime.now());
return super.create(notification);
}
@@ -79,7 +76,7 @@ public class NotificationController extends ResourceController<Notification> {
@UserPermissions
@GetMapping(SolidifyConstants.URL_SEP + AouActionName.INBOX + SolidifyConstants.URL_ID)
public HttpEntity<Notification> getInboxNotification(@PathVariable String id) {
final Notification inboxNotification = ((NotificationService) this.itemService).getInboxNotification(id, this.getCurrentUser());
final Notification inboxNotification = ((NotificationService) this.itemService).getInboxNotification(id, this.userService.getCurrentUser());
return new ResponseEntity<>(inboxNotification, HttpStatus.OK);
}
@@ -93,7 +90,7 @@ public class NotificationController extends ResourceController<Notification> {
@GetMapping(SolidifyConstants.URL_SEP + AouActionName.INBOX)
@SuppressWarnings("squid:S4684")
public HttpEntity<Collection<Notification>> listInboxNotification(@ModelAttribute Notification search, Pageable pageable) {
final Page<Notification> listItem = ((NotificationService) (this.itemService)).listInboxNotification(this.getCurrentUser(), search, null, null, pageable);
final Page<Notification> listItem = ((NotificationService) (this.itemService)).listInboxNotification(this.userService.getCurrentUser(), search, null, null, pageable);
final Collection<Notification> collection = this.addRemainingLinks(listItem, pageable);
return new ResponseEntity<>(collection, HttpStatus.OK);
}
@@ -103,7 +100,7 @@ public class NotificationController extends ResourceController<Notification> {
public HttpEntity<Collection<Notification>> advancedSearch(@ModelAttribute Notification notification,
@RequestParam(value="structureId", required = false) String structureId,
@RequestParam(value = "researchGroupId", required = false) String researchGroupId, Pageable pageable) {
final Page<Notification> listItem = ((NotificationService) (this.itemService)).listInboxNotification(this.getCurrentUser(), notification, structureId, researchGroupId, pageable);
final Page<Notification> listItem = ((NotificationService) (this.itemService)).listInboxNotification(this.userService.getCurrentUser(), notification, structureId, researchGroupId, pageable);
final Collection<Notification> collection = this.addRemainingLinks(listItem, pageable);
return new ResponseEntity<>(collection, HttpStatus.OK);
}
@@ -111,7 +108,7 @@ public class NotificationController extends ResourceController<Notification> {
@PreAuthorize("@notificationPermissionService.isMyNotification(#id)")
@PostMapping(SolidifyConstants.URL_ID + SolidifyConstants.URL_SEP + AouActionName.SET_READ)
public HttpEntity<Notification> markNotificationAsRead(@PathVariable String id) {
final Notification notification = ((NotificationService) (this.itemService)).getInboxNotification(id, this.getCurrentUser());
final Notification notification = ((NotificationService) (this.itemService)).getInboxNotification(id, this.userService.getCurrentUser());
if (notification != null) {
notification.setReadTime(OffsetDateTime.now());
this.itemService.save(notification);
@@ -141,9 +138,5 @@ public class NotificationController extends ResourceController<Notification> {
return collection;
}
private User getCurrentUser() {
final Principal principal = this.httpRequestInfoProvider.getPrincipal();
return this.userRepository.findByExternalUid(principal.getName());
}
}
Loading