View Javadoc
1   /*
2    * Copyright 2009 The Kuali Foundation.
3    * 
4    * Licensed under the Educational Community License, Version 1.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    * 
8    * http://www.opensource.org/licenses/ecl1.php
9    * 
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  package org.kuali.ole.sec.document.authorization;
17  
18  import java.util.Iterator;
19  import java.util.Map;
20  import java.util.Set;
21  
22  import org.kuali.ole.sec.SecConstants;
23  import org.kuali.ole.sec.SecKeyConstants;
24  import org.kuali.ole.sec.businessobject.AccessSecurityRestrictionInfo;
25  import org.kuali.ole.sec.service.AccessSecurityService;
26  import org.kuali.ole.sys.OLEConstants;
27  import org.kuali.ole.sys.businessobject.AccountingLine;
28  import org.kuali.ole.sys.context.SpringContext;
29  import org.kuali.ole.sys.document.AccountingDocument;
30  import org.kuali.rice.coreservice.framework.parameter.ParameterService;
31  import org.kuali.rice.kim.api.identity.Person;
32  import org.kuali.rice.kns.document.authorization.TransactionalDocumentAuthorizer;
33  import org.kuali.rice.krad.bo.BusinessObject;
34  import org.kuali.rice.krad.document.Document;
35  import org.kuali.rice.krad.util.GlobalVariables;
36  import org.kuali.rice.krad.util.KRADConstants;
37  
38  
39  /**
40   * TransactionDocumentAuthorizer that wraps access security checks around another TransactionDocumentAuthorizer configured for the document type
41   */
42  public class SecTransactionalDocumentAuthorizer implements TransactionalDocumentAuthorizer {
43      protected TransactionalDocumentAuthorizer documentAuthorizer;
44  
45      private static AccessSecurityService accessSecurityService;
46      
47      protected AccessSecurityService getAccessSecurityService() {
48          if ( accessSecurityService == null ) {
49              accessSecurityService = SpringContext.getBean(AccessSecurityService.class);
50          }
51          return accessSecurityService;
52      }
53      
54      public Set<String> getEditModes(Document document, Person user, Set<String> editModes) {
55          return documentAuthorizer.getEditModes(document, user, editModes);
56      }
57  
58      public boolean canAddNoteAttachment(Document document, String attachmentTypeCode, Person user) {
59          return documentAuthorizer.canAddNoteAttachment(document, attachmentTypeCode, user);
60      }
61  
62      public boolean canDeleteNoteAttachment(Document document, String attachmentTypeCode, String createdBySelfOnly, Person user) {
63          return documentAuthorizer.canDeleteNoteAttachment(document, attachmentTypeCode, createdBySelfOnly, user);
64      }
65  
66      public boolean canInitiate(String documentTypeName, Person user) {
67          return documentAuthorizer.canInitiate(documentTypeName, user);
68      }
69  
70      /**
71       * If user has open permission then does further checks to verify there are no access security restriction setup that prevents the user from opening the document
72       * 
73       * @see org.kuali.rice.krad.document.authorization.DocumentAuthorizer#canOpen(org.kuali.rice.krad.document.Document, org.kuali.rice.kim.api.identity.Person)
74       */
75      public boolean canOpen(Document document, Person user) {
76          boolean canOpen = documentAuthorizer.canOpen(document, user);
77          if (canOpen) {
78              AccessSecurityRestrictionInfo restrictionInfo = new AccessSecurityRestrictionInfo();
79              canOpen = getAccessSecurityService().canViewDocument((AccountingDocument) document, user, restrictionInfo);
80              if (!canOpen) {
81                  GlobalVariables.getUserSession().addObject(SecConstants.OPEN_DOCUMENT_SECURITY_ACCESS_DENIED_ERROR_KEY, restrictionInfo);
82              }
83          }
84  
85          return canOpen;
86      }
87  
88      public boolean canReceiveAdHoc(Document document, Person user, String actionRequestCode) {
89          return documentAuthorizer.canReceiveAdHoc(document, user, actionRequestCode);
90      }
91  
92      public boolean canSendAdHocRequests(Document document, String actionRequestCd, Person user) {
93          return documentAuthorizer.canSendAdHocRequests(document, actionRequestCd, user);
94      }
95  
96      /**
97       * If user has permission to view notes/attachments then does further checks to verify there are no access security restriction setup that prevents the user from viewing the
98       * notes/attachments
99       * 
100      * @see org.kuali.rice.krad.document.authorization.DocumentAuthorizer#canViewNoteAttachment(org.kuali.rice.krad.document.Document, java.lang.String, org.kuali.rice.kim.api.identity.Person)
101      */
102     public boolean canViewNoteAttachment(Document document, String attachmentTypeCode, Person user) {
103         boolean canView = documentAuthorizer.canViewNoteAttachment(document, attachmentTypeCode, user);
104         if (canView) {
105             canView = getAccessSecurityService().canViewDocumentNotesAttachments((AccountingDocument) document, user);
106 
107             if (!canView) {
108                 GlobalVariables.getMessageMap().putInfo(OLEConstants.GLOBAL_ERRORS, SecKeyConstants.MESSAGE_DOCUMENT_NOTES_RESTRICTED, (String) null);
109             }
110         }
111 
112         return canView;
113     }
114 
115     /**
116      * If there are line restrictions and the initiator override flag is turned on, we need to disable the copy and error correct buttons since those would result in documents
117      * displaying the restricted lines
118      * 
119      * @see org.kuali.rice.krad.document.authorization.DocumentAuthorizer#getDocumentActions(org.kuali.rice.krad.document.Document, org.kuali.rice.kim.api.identity.Person, java.util.Set)
120      */
121     public Set<String> getDocumentActions(Document document, Person user, Set<String> documentActions) {
122         Set<String> documentActionsToReturn = documentAuthorizer.getDocumentActions(document, user, documentActions);
123 
124         boolean alwaysAllowInitiatorAccess = SpringContext.getBean(ParameterService.class).getParameterValueAsBoolean(SecConstants.ACCESS_SECURITY_NAMESPACE_CODE, SecConstants.ALL_PARAMETER_DETAIL_COMPONENT, SecConstants.SecurityParameterNames.ALWAYS_ALLOW_INITIATOR_LINE_ACCESS_IND);
125         if (alwaysAllowInitiatorAccess) {
126             // determine if any lines are view restricted
127             boolean hasViewRestrictions = false;
128 
129             AccountingDocument accountingDocument = (AccountingDocument) document;
130             for (Iterator iterator = accountingDocument.getSourceAccountingLines().iterator(); iterator.hasNext();) {
131                 AccountingLine line = (AccountingLine) iterator.next();
132                 if (!getAccessSecurityService().canViewDocumentAccountingLine(accountingDocument, line, user)) {
133                     hasViewRestrictions = true;
134                     break;
135                 }
136             }
137 
138             if (!hasViewRestrictions) {
139                 for (Iterator iterator = accountingDocument.getTargetAccountingLines().iterator(); iterator.hasNext();) {
140                     AccountingLine line = (AccountingLine) iterator.next();
141                     if (!getAccessSecurityService().canViewDocumentAccountingLine(accountingDocument, line, user)) {
142                         hasViewRestrictions = true;
143                         break;
144                     }
145                 }
146             }
147 
148             // if we have restrictions then disable copy and error correction
149             if (hasViewRestrictions) {
150                 if (documentActionsToReturn.contains(KRADConstants.KUALI_ACTION_CAN_COPY)) {
151                     documentActionsToReturn.remove(KRADConstants.KUALI_ACTION_CAN_COPY);
152                     GlobalVariables.getMessageMap().putInfo(OLEConstants.GLOBAL_ERRORS, SecKeyConstants.MESSAGE_DOCUMENT_COPY_RESTRICTED, (String) null);
153                 }
154 
155                 if (documentActionsToReturn.contains(OLEConstants.KFS_ACTION_CAN_ERROR_CORRECT)) {
156                     documentActionsToReturn.remove(OLEConstants.KFS_ACTION_CAN_ERROR_CORRECT);
157                     GlobalVariables.getMessageMap().putInfo(OLEConstants.GLOBAL_ERRORS, SecKeyConstants.MESSAGE_DOCUMENT_ERROR_CORRECT_RESTRICTED, (String) null);
158                 }
159             }
160         }
161 
162         return documentActionsToReturn;
163     }
164 
165     public Map<String, String> getCollectionItemPermissionDetails(BusinessObject collectionItemBusinessObject) {
166         return documentAuthorizer.getCollectionItemPermissionDetails(collectionItemBusinessObject);
167     }
168 
169     public Map<String, String> getCollectionItemRoleQualifications(BusinessObject collectionItemBusinessObject) {
170         return documentAuthorizer.getCollectionItemRoleQualifications(collectionItemBusinessObject);
171     }
172 
173     public boolean isAuthorized(BusinessObject businessObject, String namespaceCode, String permissionName, String principalId) {
174         return documentAuthorizer.isAuthorized(businessObject, namespaceCode, permissionName, principalId);
175     }
176 
177     public boolean isAuthorized(BusinessObject businessObject, String namespaceCode, String permissionName, String principalId, Map<String, String> additionalPermissionDetails, Map<String, String> additionalRoleQualifiers) {
178         return documentAuthorizer.isAuthorized(businessObject, namespaceCode, permissionName, principalId, additionalPermissionDetails, additionalRoleQualifiers);
179     }
180 
181     public boolean isAuthorizedByTemplate(BusinessObject businessObject, String namespaceCode, String permissionTemplateName, String principalId) {
182         return documentAuthorizer.isAuthorizedByTemplate(businessObject, namespaceCode, permissionTemplateName, principalId);
183     }
184 
185     public boolean isAuthorizedByTemplate(BusinessObject businessObject, String namespaceCode, String permissionTemplateName, String principalId, Map<String, String> additionalPermissionDetails, Map<String, String> additionalRoleQualifiers) {
186         return documentAuthorizer.isAuthorizedByTemplate(businessObject, namespaceCode, permissionTemplateName, principalId, additionalPermissionDetails, additionalRoleQualifiers);
187     }
188     @Override
189     public boolean isAuthorizedByTemplate(Object dataObject, String namespaceCode, String permissionTemplateName, String principalId, Map<String, String> additionalPermissionDetails, Map<String, String> additionalRoleQualifiers) {
190         return documentAuthorizer.isAuthorizedByTemplate(dataObject, namespaceCode, permissionTemplateName, principalId, additionalPermissionDetails, additionalRoleQualifiers);
191     }
192 
193     public void setDocumentAuthorizer(TransactionalDocumentAuthorizer documentAuthorizer) {
194         this.documentAuthorizer = documentAuthorizer;
195     }
196 
197     public boolean isAuthorized(Object dataObject, String namespaceCode, String permissionName, String principalId) {
198         return documentAuthorizer.isAuthorized(dataObject, namespaceCode, permissionName, principalId);
199     }
200 
201     public boolean isAuthorizedByTemplate(Object dataObject, String namespaceCode, String permissionTemplateName, String principalId) {
202         return documentAuthorizer.isAuthorizedByTemplate(dataObject, namespaceCode, permissionTemplateName, principalId);
203     }
204 
205     public boolean canEdit(Document document, Person user) {
206         return documentAuthorizer.canEdit(document, user);
207     }
208 
209     public boolean canAnnotate(Document document, Person user) {
210         return documentAuthorizer.canAnnotate(document, user);
211     }
212 
213     public boolean canReload(Document document, Person user) {
214         return documentAuthorizer.canReload(document, user);
215     }
216 
217     public boolean canClose(Document document, Person user) {
218         return documentAuthorizer.canClose(document, user);
219     }
220 
221     public boolean canSave(Document document, Person user) {
222         return documentAuthorizer.canSave(document, user);
223     }
224 
225     public boolean canRoute(Document document, Person user) {
226         return documentAuthorizer.canRoute(document, user);
227     }
228 
229     public boolean canCancel(Document document, Person user) {
230         return documentAuthorizer.canCancel(document, user);
231     }
232 
233     public boolean isAuthorized(Object dataObject, String namespaceCode, String permissionName, String principalId, Map<String, String> additionalPermissionDetails, Map<String, String> additionalRoleQualifiers) {
234         return documentAuthorizer.isAuthorized(dataObject, namespaceCode, permissionName, principalId, additionalPermissionDetails, additionalRoleQualifiers);
235     }
236 
237     public boolean canCopy(Document document, Person user) {
238         return documentAuthorizer.canCopy(document, user);
239     }
240 
241     public boolean canPerformRouteReport(Document document, Person user) {
242         return documentAuthorizer.canPerformRouteReport(document, user);
243     }
244 
245     public boolean canBlanketApprove(Document document, Person user) {
246         return documentAuthorizer.canBlanketApprove(document, user);
247     }
248 
249     public boolean canApprove(Document document, Person user) {
250         return documentAuthorizer.canApprove(document, user);
251     }
252 
253     public boolean canDisapprove(Document document, Person user) {
254         return documentAuthorizer.canDisapprove(document, user);
255     }
256 
257     public boolean canSendNoteFyi(Document document, Person user) {
258         return documentAuthorizer.canSendNoteFyi(document, user);
259     }
260 
261     public boolean canEditDocumentOverview(Document document, Person user) {
262         return documentAuthorizer.canEditDocumentOverview(document, user);
263     }
264 
265     public boolean canFyi(Document document, Person user) {
266         return documentAuthorizer.canFyi(document, user);
267     }
268 
269     public boolean canAcknowledge(Document document, Person user) {
270         return documentAuthorizer.canAcknowledge(document, user);
271     }
272 
273     public boolean canViewNoteAttachment(Document document, String attachmentTypeCode, String authorUniversalIdentifier, Person user) {
274         return documentAuthorizer.canViewNoteAttachment(document, attachmentTypeCode, authorUniversalIdentifier, user);
275     }
276 
277     public boolean canSendAnyTypeAdHocRequests(Document document, Person user) {
278         return documentAuthorizer.canSendAnyTypeAdHocRequests(document, user);
279     }
280 
281     public boolean canTakeRequestedAction(Document document, String actionRequestCode, Person user) {
282         return documentAuthorizer.canTakeRequestedAction(document, actionRequestCode, user);
283     }
284 
285     @Override
286     public boolean canRecall(Document document, Person user) {
287         return documentAuthorizer.canRecall(document, user);
288     }
289 
290 }