1 | |
|
2 | |
|
3 | |
|
4 | |
|
5 | |
|
6 | |
|
7 | |
|
8 | |
|
9 | |
|
10 | |
|
11 | |
|
12 | |
|
13 | |
|
14 | |
|
15 | |
|
16 | |
package org.kuali.rice.krad.uif.authorization; |
17 | |
|
18 | |
import org.apache.commons.logging.Log; |
19 | |
import org.apache.commons.logging.LogFactory; |
20 | |
import org.kuali.rice.kew.api.KewApiServiceLocator; |
21 | |
import org.kuali.rice.kew.api.WorkflowDocument; |
22 | |
import org.kuali.rice.kew.api.doctype.ProcessDefinition; |
23 | |
import org.kuali.rice.kew.api.doctype.RoutePath; |
24 | |
import org.kuali.rice.kew.api.KewApiConstants; |
25 | |
import org.kuali.rice.kim.api.KimConstants; |
26 | |
import org.kuali.rice.kim.api.identity.Person; |
27 | |
import org.kuali.rice.krad.document.Document; |
28 | |
import org.kuali.rice.krad.service.KRADServiceLocatorWeb; |
29 | |
import org.kuali.rice.krad.util.KRADConstants; |
30 | |
import org.kuali.rice.krad.web.form.DocumentFormBase; |
31 | |
import org.kuali.rice.krad.web.form.UifFormBase; |
32 | |
|
33 | |
import java.util.Collections; |
34 | |
import java.util.HashMap; |
35 | |
import java.util.Map; |
36 | |
import java.util.Set; |
37 | |
|
38 | |
|
39 | |
|
40 | |
|
41 | 0 | public class DocumentAuthorizerBase extends AuthorizerBase { |
42 | 0 | protected static Log LOG = LogFactory.getLog(DocumentAuthorizerBase.class); |
43 | |
|
44 | |
public static final String PRE_ROUTING_ROUTE_NAME = "PreRoute"; |
45 | |
public static final String EDIT_MODE_DEFAULT_TRUE_VALUE = "TRUE"; |
46 | |
public static final String USER_SESSION_METHOD_TO_CALL_OBJECT_KEY = "METHOD_TO_CALL_KEYS_METHOD_OBJECT_KEY"; |
47 | |
public static final String USER_SESSION_METHOD_TO_CALL_COMPLETE_OBJECT_KEY = "METHOD_TO_CALL_KEYS_COMPLETE_OBJECT_KEY"; |
48 | |
|
49 | |
@Override |
50 | |
public Set<String> getActionFlags(UifFormBase model, Person user, Set<String> documentActions) { |
51 | 0 | Document document = ((DocumentFormBase) model).getDocument(); |
52 | |
|
53 | 0 | if (LOG.isDebugEnabled()) { |
54 | 0 | LOG.debug("calling DocumentAuthorizerBase.getDocumentActionFlags for document '" |
55 | |
+ document.getDocumentNumber() + "'. user '" + user.getPrincipalName() + "'"); |
56 | |
} |
57 | |
|
58 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_EDIT) |
59 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
60 | |
KimConstants.PermissionTemplateNames.EDIT_DOCUMENT, user.getPrincipalId())) { |
61 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_EDIT); |
62 | |
} |
63 | |
|
64 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_COPY) |
65 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
66 | |
KimConstants.PermissionTemplateNames.COPY_DOCUMENT, user.getPrincipalId())) { |
67 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_COPY); |
68 | |
} |
69 | |
|
70 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_BLANKET_APPROVE) |
71 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KUALI_RICE_WORKFLOW_NAMESPACE, |
72 | |
KimConstants.PermissionTemplateNames.BLANKET_APPROVE_DOCUMENT, user.getPrincipalId())) { |
73 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_BLANKET_APPROVE); |
74 | |
} |
75 | |
|
76 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_CANCEL) |
77 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KUALI_RICE_WORKFLOW_NAMESPACE, |
78 | |
KimConstants.PermissionTemplateNames.CANCEL_DOCUMENT, user.getPrincipalId())) { |
79 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_CANCEL); |
80 | |
} |
81 | |
|
82 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_SAVE) |
83 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KUALI_RICE_WORKFLOW_NAMESPACE, |
84 | |
KimConstants.PermissionTemplateNames.SAVE_DOCUMENT, user.getPrincipalId())) { |
85 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_SAVE); |
86 | |
} |
87 | |
|
88 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_ROUTE) |
89 | |
&& !isAuthorizedByTemplate(document, KRADConstants.KUALI_RICE_WORKFLOW_NAMESPACE, |
90 | |
KimConstants.PermissionTemplateNames.ROUTE_DOCUMENT, user.getPrincipalId())) { |
91 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_ROUTE); |
92 | |
} |
93 | |
|
94 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_ACKNOWLEDGE) |
95 | |
&& !canTakeRequestedAction(document, KewApiConstants.ACTION_REQUEST_ACKNOWLEDGE_REQ, user)) { |
96 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_ACKNOWLEDGE); |
97 | |
} |
98 | |
|
99 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_FYI) |
100 | |
&& !canTakeRequestedAction(document, KewApiConstants.ACTION_REQUEST_FYI_REQ, user)) { |
101 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_FYI); |
102 | |
} |
103 | |
|
104 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_APPROVE) |
105 | |
|| documentActions.contains(KRADConstants.KUALI_ACTION_CAN_DISAPPROVE)) { |
106 | 0 | if (!canTakeRequestedAction(document, KewApiConstants.ACTION_REQUEST_APPROVE_REQ, user)) { |
107 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_APPROVE); |
108 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_DISAPPROVE); |
109 | |
} |
110 | |
} |
111 | |
|
112 | 0 | if (!canSendAnyTypeAdHocRequests(document, user)) { |
113 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_ADD_ADHOC_REQUESTS); |
114 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_SEND_ADHOC_REQUESTS); |
115 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_SEND_NOTE_FYI); |
116 | |
} |
117 | |
|
118 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_SEND_NOTE_FYI) |
119 | |
&& !canSendAdHocRequests(document, KewApiConstants.ACTION_REQUEST_FYI_REQ, user)) { |
120 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_SEND_NOTE_FYI); |
121 | |
} |
122 | |
|
123 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_ANNOTATE) |
124 | |
&& !documentActions.contains(KRADConstants.KUALI_ACTION_CAN_EDIT)) { |
125 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_ANNOTATE); |
126 | |
} |
127 | |
|
128 | 0 | if (documentActions.contains(KRADConstants.KUALI_ACTION_CAN_EDIT__DOCUMENT_OVERVIEW) |
129 | |
&& !canEditDocumentOverview(document, user)) { |
130 | 0 | documentActions.remove(KRADConstants.KUALI_ACTION_CAN_EDIT__DOCUMENT_OVERVIEW); |
131 | |
} |
132 | |
|
133 | 0 | return documentActions; |
134 | |
} |
135 | |
|
136 | |
public final boolean canInitiate(String documentTypeName, Person user) { |
137 | 0 | String nameSpaceCode = KRADConstants.KUALI_RICE_SYSTEM_NAMESPACE; |
138 | 0 | Map<String, String> permissionDetails = new HashMap<String, String>(); |
139 | 0 | permissionDetails.put(KimConstants.AttributeConstants.DOCUMENT_TYPE_NAME, |
140 | |
documentTypeName); |
141 | 0 | return getPermissionService().isAuthorizedByTemplateName( |
142 | |
user.getPrincipalId(), nameSpaceCode, |
143 | |
KimConstants.PermissionTemplateNames.INITIATE_DOCUMENT, |
144 | |
permissionDetails, Collections.<String, String>emptyMap()); |
145 | |
} |
146 | |
|
147 | |
public final boolean canReceiveAdHoc(Document document, Person user, |
148 | |
String actionRequestCode) { |
149 | 0 | Map<String,String> additionalPermissionDetails = new HashMap<String, String>(); |
150 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ACTION_REQUEST_CD, actionRequestCode); |
151 | 0 | return isAuthorizedByTemplate(document, |
152 | |
KRADConstants.KUALI_RICE_WORKFLOW_NAMESPACE, |
153 | |
KimConstants.PermissionTemplateNames.AD_HOC_REVIEW_DOCUMENT, |
154 | |
user.getPrincipalId(), additionalPermissionDetails, null ); |
155 | |
} |
156 | |
|
157 | |
public final boolean canOpen(Document document, Person user) { |
158 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
159 | |
KimConstants.PermissionTemplateNames.OPEN_DOCUMENT, user |
160 | |
.getPrincipalId()); |
161 | |
} |
162 | |
|
163 | |
public final boolean canAddNoteAttachment(Document document, |
164 | |
String attachmentTypeCode, Person user) { |
165 | 0 | Map<String, String> additionalPermissionDetails = new HashMap<String, String>(); |
166 | 0 | if (attachmentTypeCode != null) { |
167 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ATTACHMENT_TYPE_CODE, |
168 | |
attachmentTypeCode); |
169 | |
} |
170 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
171 | |
KimConstants.PermissionTemplateNames.ADD_NOTE_ATTACHMENT, user |
172 | |
.getPrincipalId(), additionalPermissionDetails, null); |
173 | |
} |
174 | |
|
175 | |
public final boolean canDeleteNoteAttachment(Document document, |
176 | |
String attachmentTypeCode, String createdBySelfOnly, Person user) { |
177 | 0 | Map<String, String> additionalPermissionDetails = new HashMap<String, String>(); |
178 | 0 | if (attachmentTypeCode != null) { |
179 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ATTACHMENT_TYPE_CODE, |
180 | |
attachmentTypeCode); |
181 | |
} |
182 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.CREATED_BY_SELF, |
183 | |
createdBySelfOnly); |
184 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
185 | |
KimConstants.PermissionTemplateNames.DELETE_NOTE_ATTACHMENT, |
186 | |
user.getPrincipalId(), additionalPermissionDetails, null); |
187 | |
} |
188 | |
|
189 | |
public final boolean canViewNoteAttachment(Document document, |
190 | |
String attachmentTypeCode, Person user) { |
191 | 0 | Map<String, String> additionalPermissionDetails = new HashMap<String, String>(); |
192 | 0 | if (attachmentTypeCode != null) { |
193 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ATTACHMENT_TYPE_CODE, |
194 | |
attachmentTypeCode); |
195 | |
} |
196 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
197 | |
KimConstants.PermissionTemplateNames.VIEW_NOTE_ATTACHMENT, user |
198 | |
.getPrincipalId(), additionalPermissionDetails, null); |
199 | |
} |
200 | |
|
201 | |
public final boolean canSendAdHocRequests(Document document, |
202 | |
String actionRequestCd, Person user) { |
203 | 0 | Map<String, String> additionalPermissionDetails = new HashMap<String, String>(); |
204 | 0 | if (actionRequestCd != null) { |
205 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ACTION_REQUEST_CD, |
206 | |
actionRequestCd); |
207 | |
} |
208 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
209 | |
KimConstants.PermissionTemplateNames.SEND_AD_HOC_REQUEST, user |
210 | |
.getPrincipalId(), additionalPermissionDetails, null); |
211 | |
} |
212 | |
|
213 | |
public boolean canEditDocumentOverview(Document document, Person user){ |
214 | 0 | return isAuthorizedByTemplate(document, |
215 | |
KRADConstants.KRAD_NAMESPACE, |
216 | |
KimConstants.PermissionTemplateNames.EDIT_DOCUMENT, |
217 | |
user.getPrincipalId()) && this.isDocumentInitiator(document, user); |
218 | |
} |
219 | |
|
220 | |
protected final boolean canSendAnyTypeAdHocRequests(Document document, Person user) { |
221 | 0 | if (canSendAdHocRequests(document, KewApiConstants.ACTION_REQUEST_FYI_REQ, user)) { |
222 | 0 | RoutePath routePath = KewApiServiceLocator.getDocumentTypeService().getRoutePathForDocumentTypeName(document.getDocumentHeader().getWorkflowDocument().getDocumentTypeName()); |
223 | 0 | ProcessDefinition processDefinition = routePath.getPrimaryProcess(); |
224 | 0 | if (processDefinition != null) { |
225 | 0 | if (processDefinition.getInitialRouteNode() == null) { |
226 | 0 | return false; |
227 | |
} |
228 | |
} else { |
229 | 0 | return false; |
230 | |
} |
231 | 0 | return true; |
232 | 0 | } else if(canSendAdHocRequests(document, KewApiConstants.ACTION_REQUEST_ACKNOWLEDGE_REQ, user)){ |
233 | 0 | return true; |
234 | |
} |
235 | 0 | return canSendAdHocRequests(document, KewApiConstants.ACTION_REQUEST_APPROVE_REQ, user); |
236 | |
} |
237 | |
|
238 | |
protected boolean canTakeRequestedAction(Document document, |
239 | |
String actionRequestCode, Person user) { |
240 | 0 | Map<String, String> additionalPermissionDetails = new HashMap<String, String>(); |
241 | 0 | additionalPermissionDetails.put(KimConstants.AttributeConstants.ACTION_REQUEST_CD, |
242 | |
actionRequestCode); |
243 | 0 | return isAuthorizedByTemplate(document, KRADConstants.KRAD_NAMESPACE, |
244 | |
KimConstants.PermissionTemplateNames.TAKE_REQUESTED_ACTION, |
245 | |
user.getPrincipalId(), additionalPermissionDetails, null); |
246 | |
} |
247 | |
|
248 | |
@Override |
249 | |
protected void addPermissionDetails(Object dataObject, |
250 | |
Map<String, String> attributes) { |
251 | 0 | super.addPermissionDetails(dataObject, attributes); |
252 | 0 | if (dataObject instanceof Document) { |
253 | 0 | addStandardAttributes((Document) dataObject, attributes); |
254 | |
} |
255 | 0 | } |
256 | |
|
257 | |
@Override |
258 | |
protected void addRoleQualification(Object dataObject, |
259 | |
Map<String, String> attributes) { |
260 | 0 | super.addRoleQualification(dataObject, attributes); |
261 | 0 | if (dataObject instanceof Document) { |
262 | 0 | addStandardAttributes((Document) dataObject, attributes); |
263 | |
} |
264 | 0 | } |
265 | |
|
266 | |
protected void addStandardAttributes(Document document, |
267 | |
Map<String, String> attributes) { |
268 | 0 | WorkflowDocument wd = document.getDocumentHeader() |
269 | |
.getWorkflowDocument(); |
270 | 0 | attributes.put(KimConstants.AttributeConstants.DOCUMENT_NUMBER, document |
271 | |
.getDocumentNumber()); |
272 | 0 | attributes.put(KimConstants.AttributeConstants.DOCUMENT_TYPE_NAME, wd.getDocumentTypeName()); |
273 | 0 | if (wd.isInitiated() || wd.isSaved()) { |
274 | 0 | attributes.put(KimConstants.AttributeConstants.ROUTE_NODE_NAME, |
275 | |
PRE_ROUTING_ROUTE_NAME); |
276 | |
} else { |
277 | 0 | attributes.put(KimConstants.AttributeConstants.ROUTE_NODE_NAME, KRADServiceLocatorWeb.getWorkflowDocumentService().getCurrentRouteNodeNames(wd)); |
278 | |
} |
279 | 0 | attributes.put(KimConstants.AttributeConstants.ROUTE_STATUS_CODE, wd.getStatus().getCode()); |
280 | 0 | } |
281 | |
|
282 | |
protected boolean isDocumentInitiator(Document document, Person user) { |
283 | 0 | WorkflowDocument workflowDocument = document.getDocumentHeader().getWorkflowDocument(); |
284 | 0 | return workflowDocument.getInitiatorPrincipalId().equalsIgnoreCase(user.getPrincipalId()); |
285 | |
} |
286 | |
|
287 | |
} |