1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package org.kuali.rice.kns.service.impl;
17
18 import org.apache.commons.beanutils.PropertyUtils;
19 import org.apache.commons.lang.StringUtils;
20 import org.kuali.rice.core.api.config.property.ConfigurationService;
21 import org.kuali.rice.kim.api.KimConstants;
22 import org.kuali.rice.kim.api.identity.Person;
23 import org.kuali.rice.kim.api.permission.PermissionService;
24 import org.kuali.rice.kim.api.services.KimApiServiceLocator;
25 import org.kuali.rice.kns.datadictionary.BusinessObjectEntry;
26 import org.kuali.rice.kns.datadictionary.FieldDefinition;
27 import org.kuali.rice.kns.datadictionary.InquiryCollectionDefinition;
28 import org.kuali.rice.kns.datadictionary.InquirySectionDefinition;
29 import org.kuali.rice.kns.datadictionary.MaintainableCollectionDefinition;
30 import org.kuali.rice.kns.datadictionary.MaintainableItemDefinition;
31 import org.kuali.rice.kns.datadictionary.MaintainableSectionDefinition;
32 import org.kuali.rice.kns.datadictionary.MaintenanceDocumentEntry;
33 import org.kuali.rice.kns.document.MaintenanceDocument;
34 import org.kuali.rice.kns.document.authorization.BusinessObjectRestrictions;
35 import org.kuali.rice.kns.document.authorization.BusinessObjectRestrictionsBase;
36 import org.kuali.rice.kns.document.authorization.InquiryOrMaintenanceDocumentRestrictions;
37 import org.kuali.rice.kns.document.authorization.InquiryOrMaintenanceDocumentRestrictionsBase;
38 import org.kuali.rice.kns.document.authorization.MaintenanceDocumentRestrictions;
39 import org.kuali.rice.kns.document.authorization.MaintenanceDocumentRestrictionsBase;
40 import org.kuali.rice.kns.inquiry.InquiryAuthorizer;
41 import org.kuali.rice.kns.inquiry.InquiryPresentationController;
42 import org.kuali.rice.kns.inquiry.InquiryRestrictions;
43 import org.kuali.rice.kns.service.BusinessObjectAuthorizationService;
44 import org.kuali.rice.kns.service.BusinessObjectDictionaryService;
45 import org.kuali.rice.kns.service.KNSServiceLocator;
46 import org.kuali.rice.kns.service.MaintenanceDocumentDictionaryService;
47 import org.kuali.rice.krad.authorization.BusinessObjectAuthorizer;
48 import org.kuali.rice.krad.bo.BusinessObject;
49 import org.kuali.rice.krad.bo.authorization.InquiryOrMaintenanceDocumentAuthorizer;
50 import org.kuali.rice.krad.bo.authorization.InquiryOrMaintenanceDocumentPresentationController;
51 import org.kuali.rice.krad.datadictionary.AttributeDefinition;
52 import org.kuali.rice.krad.datadictionary.DataObjectEntry;
53 import org.kuali.rice.krad.document.Document;
54 import org.kuali.rice.krad.document.authorization.MaintenanceDocumentAuthorizer;
55 import org.kuali.rice.krad.document.authorization.MaintenanceDocumentPresentationController;
56 import org.kuali.rice.krad.service.DataDictionaryService;
57 import org.kuali.rice.krad.service.DocumentHelperService;
58 import org.kuali.rice.krad.service.KRADServiceLocator;
59 import org.kuali.rice.krad.service.KRADServiceLocatorWeb;
60 import org.kuali.rice.krad.service.impl.DataObjectAuthorizationServiceImpl;
61 import org.kuali.rice.krad.util.KRADConstants;
62 import org.kuali.rice.krad.util.KRADUtils;
63 import org.kuali.rice.krad.util.ObjectUtils;
64
65 import java.util.Collection;
66 import java.util.Collections;
67 import java.util.HashMap;
68 import java.util.Iterator;
69 import java.util.List;
70 import java.util.Map;
71
72 @Deprecated
73 public class BusinessObjectAuthorizationServiceImpl extends DataObjectAuthorizationServiceImpl implements BusinessObjectAuthorizationService {
74 private DataDictionaryService dataDictionaryService;
75 private PermissionService permissionService;
76 private BusinessObjectDictionaryService businessObjectDictionaryService;
77 private DocumentHelperService documentHelperService;
78 private MaintenanceDocumentDictionaryService maintenanceDocumentDictionaryService;
79 private ConfigurationService kualiConfigurationService;
80
81 public BusinessObjectRestrictions getLookupResultRestrictions(
82 Object dataObject, Person user) {
83 BusinessObjectRestrictions businessObjectRestrictions = new BusinessObjectRestrictionsBase();
84 considerBusinessObjectFieldUnmaskAuthorization(dataObject, user,
85 businessObjectRestrictions, "", null);
86 return businessObjectRestrictions;
87 }
88
89 public InquiryRestrictions getInquiryRestrictions(
90 BusinessObject businessObject, Person user) {
91 InquiryRestrictions inquiryRestrictions = new InquiryOrMaintenanceDocumentRestrictionsBase();
92 BusinessObjectEntry businessObjectEntry = (BusinessObjectEntry) getDataDictionaryService()
93 .getDataDictionary().getBusinessObjectEntry(
94 businessObject.getClass().getName());
95 InquiryPresentationController inquiryPresentationController = getBusinessObjectDictionaryService()
96 .getInquiryPresentationController(businessObject.getClass());
97 InquiryAuthorizer inquiryAuthorizer = getBusinessObjectDictionaryService()
98 .getInquiryAuthorizer(businessObject.getClass());
99 considerBusinessObjectFieldUnmaskAuthorization(businessObject, user,
100 inquiryRestrictions, "", null);
101 considerBusinessObjectFieldViewAuthorization(businessObjectEntry,
102 businessObject, null, user, inquiryAuthorizer, inquiryRestrictions,
103 "");
104 considerInquiryOrMaintenanceDocumentPresentationController(
105 inquiryPresentationController, businessObject,
106 inquiryRestrictions);
107 considerInquiryOrMaintenanceDocumentAuthorizer(inquiryAuthorizer,
108 businessObject, user, inquiryRestrictions);
109 for (InquirySectionDefinition inquirySectionDefinition : businessObjectEntry.getInquiryDefinition().getInquirySections()) {
110 if (inquirySectionDefinition.getInquiryCollections() != null) {
111 addInquirableItemRestrictions(inquirySectionDefinition.getInquiryCollections().values(), inquiryAuthorizer,
112 inquiryRestrictions, businessObject, businessObject, "", user);
113 }
114
115 List<FieldDefinition> inquiryFields = inquirySectionDefinition.getInquiryFields();
116 if (inquiryFields != null) {
117 for (FieldDefinition fieldDefinition : inquiryFields) {
118 addInquirableItemRestrictions(inquiryFields, inquiryAuthorizer,
119 inquiryRestrictions, businessObject, businessObject, "", user);
120 }
121 }
122 }
123
124 return inquiryRestrictions;
125 }
126
127 public MaintenanceDocumentRestrictions getMaintenanceDocumentRestrictions(
128 MaintenanceDocument maintenanceDocument, Person user) {
129
130 MaintenanceDocumentRestrictions maintenanceDocumentRestrictions = new MaintenanceDocumentRestrictionsBase();
131 DataObjectEntry dataObjectEntry = getDataDictionaryService()
132 .getDataDictionary().getDataObjectEntry(
133 maintenanceDocument.getNewMaintainableObject()
134 .getDataObject().getClass().getName());
135 MaintenanceDocumentPresentationController maintenanceDocumentPresentationController = (MaintenanceDocumentPresentationController) getDocumentHelperService()
136 .getDocumentPresentationController(maintenanceDocument);
137 MaintenanceDocumentAuthorizer maintenanceDocumentAuthorizer = (MaintenanceDocumentAuthorizer) getDocumentHelperService()
138 .getDocumentAuthorizer(maintenanceDocument);
139 considerBusinessObjectFieldUnmaskAuthorization(maintenanceDocument
140 .getNewMaintainableObject().getDataObject(), user,
141 maintenanceDocumentRestrictions, "", maintenanceDocument );
142 considerBusinessObjectFieldViewAuthorization(dataObjectEntry,
143 maintenanceDocument.getNewMaintainableObject().getDataObject(),
144 null, user, maintenanceDocumentAuthorizer,
145 maintenanceDocumentRestrictions, "");
146 considerBusinessObjectFieldModifyAuthorization(dataObjectEntry,
147 maintenanceDocument.getNewMaintainableObject().getDataObject(),
148 null, user, maintenanceDocumentAuthorizer,
149 maintenanceDocumentRestrictions, "");
150 considerCustomButtonFieldAuthorization(dataObjectEntry,
151 maintenanceDocument.getNewMaintainableObject().getDataObject(),
152 null, user, maintenanceDocumentAuthorizer,
153 maintenanceDocumentRestrictions, "");
154 considerInquiryOrMaintenanceDocumentPresentationController(
155 maintenanceDocumentPresentationController, maintenanceDocument,
156 maintenanceDocumentRestrictions);
157 considerInquiryOrMaintenanceDocumentAuthorizer(
158 maintenanceDocumentAuthorizer, maintenanceDocument, user,
159 maintenanceDocumentRestrictions);
160 considerMaintenanceDocumentPresentationController(
161 maintenanceDocumentPresentationController, maintenanceDocument,
162 maintenanceDocumentRestrictions);
163 considerMaintenanceDocumentAuthorizer(maintenanceDocumentAuthorizer,
164 maintenanceDocument, user, maintenanceDocumentRestrictions);
165
166 MaintenanceDocumentEntry maintenanceDocumentEntry = getMaintenanceDocumentDictionaryService().getMaintenanceDocumentEntry(maintenanceDocument
167 .getDocumentHeader().getWorkflowDocument().getDocumentTypeName());
168 for (MaintainableSectionDefinition maintainableSectionDefinition : maintenanceDocumentEntry.getMaintainableSections()) {
169 addMaintainableItemRestrictions(maintainableSectionDefinition.getMaintainableItems(), maintenanceDocumentAuthorizer, maintenanceDocumentRestrictions,
170 maintenanceDocument, maintenanceDocument.getNewMaintainableObject().getBusinessObject(), "", user);
171 }
172 return maintenanceDocumentRestrictions;
173 }
174
175 protected void considerBusinessObjectFieldUnmaskAuthorization(Object dataObject, Person user, BusinessObjectRestrictions businessObjectRestrictions, String propertyPrefix, Document document) {
176 DataObjectEntry objectEntry = getDataDictionaryService().getDataDictionary().getDataObjectEntry(dataObject.getClass().getName());
177 for (String attributeName : objectEntry.getAttributeNames()) {
178 AttributeDefinition attributeDefinition = objectEntry.getAttributeDefinition(attributeName);
179 if (attributeDefinition.getAttributeSecurity() != null) {
180 if (attributeDefinition.getAttributeSecurity().isMask() &&
181 !canFullyUnmaskField(user, dataObject.getClass(), attributeName, document)) {
182 businessObjectRestrictions.addFullyMaskedField(propertyPrefix + attributeName, attributeDefinition.getAttributeSecurity().getMaskFormatter());
183 }
184 if (attributeDefinition.getAttributeSecurity().isPartialMask() &&
185 !canPartiallyUnmaskField(user, dataObject.getClass(), attributeName, document)) {
186 businessObjectRestrictions.addPartiallyMaskedField(propertyPrefix + attributeName, attributeDefinition.getAttributeSecurity().getPartialMaskFormatter());
187 }
188 }
189 }
190 }
191
192
193
194
195
196
197
198
199
200
201
202 protected void considerBusinessObjectFieldViewAuthorization(
203 DataObjectEntry dataObjectEntry,
204 Object primaryDataObject,
205 BusinessObject collectionItemBusinessObject,
206 Person user,
207 BusinessObjectAuthorizer businessObjectAuthorizer,
208 InquiryOrMaintenanceDocumentRestrictions inquiryOrMaintenanceDocumentRestrictions,
209 String propertyPrefix) {
210 for (String attributeName : dataObjectEntry.getAttributeNames()) {
211 AttributeDefinition attributeDefinition = dataObjectEntry
212 .getAttributeDefinition(attributeName);
213 if (attributeDefinition.getAttributeSecurity() != null) {
214 if (attributeDefinition.getAttributeSecurity().isHide()) {
215 Map<String, String> collectionItemPermissionDetails = new HashMap<String, String>();
216 Map<String, String> collectionItemRoleQualifications = null;
217 if (ObjectUtils.isNotNull(collectionItemBusinessObject)) {
218 collectionItemPermissionDetails.putAll(getFieldPermissionDetails(collectionItemBusinessObject, attributeName));
219 collectionItemPermissionDetails.putAll(businessObjectAuthorizer.
220 getCollectionItemPermissionDetails(collectionItemBusinessObject));
221 collectionItemRoleQualifications = new HashMap<String, String>(businessObjectAuthorizer.
222 getCollectionItemRoleQualifications(collectionItemBusinessObject));
223 }
224 else {
225 collectionItemPermissionDetails.putAll(getFieldPermissionDetails(primaryDataObject, attributeName));
226 }
227 if (!businessObjectAuthorizer
228 .isAuthorizedByTemplate(
229 primaryDataObject,
230 KRADConstants.KRAD_NAMESPACE,
231 KimConstants.PermissionTemplateNames.VIEW_FIELD,
232 user.getPrincipalId(),
233 collectionItemPermissionDetails,
234 collectionItemRoleQualifications)) {
235 inquiryOrMaintenanceDocumentRestrictions
236 .addHiddenField(propertyPrefix + attributeName);
237 }
238 }
239 }
240 }
241 }
242
243
244
245
246
247
248
249
250
251
252
253 protected void considerBusinessObjectFieldModifyAuthorization(
254 DataObjectEntry dataObjectEntry,
255 Object primaryDataObject,
256 BusinessObject collectionItemBusinessObject, Person user,
257 BusinessObjectAuthorizer businessObjectAuthorizer,
258 MaintenanceDocumentRestrictions maintenanceDocumentRestrictions,
259 String propertyPrefix) {
260 for (String attributeName : dataObjectEntry.getAttributeNames()) {
261 AttributeDefinition attributeDefinition = dataObjectEntry
262 .getAttributeDefinition(attributeName);
263 if (attributeDefinition.getAttributeSecurity() != null) {
264 Map<String, String> collectionItemPermissionDetails = new HashMap<String, String>();
265 Map<String, String> collectionItemRoleQualifications = null;
266 if (ObjectUtils.isNotNull(collectionItemBusinessObject)) {
267 collectionItemPermissionDetails.putAll(getFieldPermissionDetails(collectionItemBusinessObject, attributeName));
268 collectionItemPermissionDetails.putAll(businessObjectAuthorizer.
269 getCollectionItemPermissionDetails(collectionItemBusinessObject));
270 collectionItemRoleQualifications = new HashMap<String, String>(businessObjectAuthorizer.
271 getCollectionItemRoleQualifications(collectionItemBusinessObject));
272 }
273 else {
274 collectionItemPermissionDetails.putAll(getFieldPermissionDetails(primaryDataObject, attributeName));
275 }
276 if (attributeDefinition.getAttributeSecurity().isReadOnly()) {
277 if (!businessObjectAuthorizer
278 .isAuthorizedByTemplate(
279 primaryDataObject,
280 KRADConstants.KRAD_NAMESPACE,
281 KimConstants.PermissionTemplateNames.MODIFY_FIELD,
282 user.getPrincipalId(),
283 collectionItemPermissionDetails,
284 collectionItemRoleQualifications)) {
285 maintenanceDocumentRestrictions
286 .addReadOnlyField(propertyPrefix + attributeName);
287 }
288 }
289 }
290 }
291 }
292
293
294
295
296
297
298
299
300
301
302
303 protected void considerCustomButtonFieldAuthorization(
304 DataObjectEntry dataObjectEntry,
305 Object primaryDataObject,
306 BusinessObject collectionItemBusinessObject,
307 Person user,
308 BusinessObjectAuthorizer businessObjectAuthorizer,
309 MaintenanceDocumentRestrictions maintenanceDocumentRestrictions,
310 String propertyPrefix) {
311 for (String attributeName : dataObjectEntry.getAttributeNames()) {
312 AttributeDefinition attributeDefinition = dataObjectEntry
313 .getAttributeDefinition(attributeName);
314
315 if (attributeDefinition.getControl() != null &&
316 attributeDefinition.getControl().isButton()) {
317 Map<String, String> collectionItemPermissionDetails = new HashMap<String, String>();
318 Map<String, String> collectionItemRoleQualifications = null;
319 if (ObjectUtils.isNotNull(collectionItemBusinessObject)) {
320 collectionItemPermissionDetails.putAll(getButtonFieldPermissionDetails(collectionItemBusinessObject, attributeName));
321 collectionItemPermissionDetails.putAll(businessObjectAuthorizer.
322 getCollectionItemPermissionDetails(collectionItemBusinessObject));
323 collectionItemRoleQualifications = new HashMap<String, String>(businessObjectAuthorizer.
324 getCollectionItemRoleQualifications(collectionItemBusinessObject));
325 }
326 else {
327 getButtonFieldPermissionDetails(primaryDataObject, attributeName);
328 }
329
330 if (!businessObjectAuthorizer
331 .isAuthorizedByTemplate(
332 primaryDataObject,
333 KRADConstants.KRAD_NAMESPACE,
334 KimConstants.PermissionTemplateNames.PERFORM_CUSTOM_MAINTENANCE_DOCUMENT_FUNCTION,
335 user.getPrincipalId(),
336 collectionItemPermissionDetails,
337 collectionItemRoleQualifications)) {
338 maintenanceDocumentRestrictions
339 .addHiddenField(propertyPrefix + attributeName);
340 }
341 }
342 }
343 }
344
345 protected void considerInquiryOrMaintenanceDocumentPresentationController(
346 InquiryOrMaintenanceDocumentPresentationController businessObjectPresentationController,
347 BusinessObject businessObject,
348 InquiryOrMaintenanceDocumentRestrictions inquiryOrMaintenanceDocumentRestrictions) {
349 for (String attributeName : businessObjectPresentationController
350 .getConditionallyHiddenPropertyNames(businessObject)) {
351 inquiryOrMaintenanceDocumentRestrictions
352 .addHiddenField(attributeName);
353 }
354 for (String sectionId : businessObjectPresentationController
355 .getConditionallyHiddenSectionIds(businessObject)) {
356 inquiryOrMaintenanceDocumentRestrictions
357 .addHiddenSectionId(sectionId);
358 }
359 }
360
361 protected void considerInquiryOrMaintenanceDocumentAuthorizer(
362 InquiryOrMaintenanceDocumentAuthorizer authorizer,
363 BusinessObject businessObject, Person user,
364 InquiryOrMaintenanceDocumentRestrictions restrictions) {
365 for (String sectionId : authorizer
366 .getSecurePotentiallyHiddenSectionIds()) {
367 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
368 additionalPermissionDetails
369 .put(KimConstants.AttributeConstants.SECTION_ID, sectionId);
370 if (!authorizer.isAuthorizedByTemplate(businessObject,
371 KRADConstants.KRAD_NAMESPACE,
372 KimConstants.PermissionTemplateNames.VIEW_SECTION, user
373 .getPrincipalId(), additionalPermissionDetails,
374 null)) {
375 restrictions.addHiddenSectionId(sectionId);
376 }
377 }
378 }
379
380 protected void considerMaintenanceDocumentPresentationController(
381 MaintenanceDocumentPresentationController presentationController,
382 MaintenanceDocument document,
383 MaintenanceDocumentRestrictions restrictions) {
384 for (String attributeName : presentationController
385 .getConditionallyReadOnlyPropertyNames(document)) {
386 restrictions.addReadOnlyField(attributeName);
387 }
388 for (String sectionId : presentationController
389 .getConditionallyReadOnlySectionIds(document)) {
390 restrictions.addReadOnlySectionId(sectionId);
391 }
392 }
393
394 protected void considerMaintenanceDocumentAuthorizer(
395 MaintenanceDocumentAuthorizer authorizer,
396 MaintenanceDocument document, Person user,
397 MaintenanceDocumentRestrictions restrictions) {
398 for (String sectionId : authorizer
399 .getSecurePotentiallyReadOnlySectionIds()) {
400 Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
401 additionalPermissionDetails
402 .put(KimConstants.AttributeConstants.SECTION_ID, sectionId);
403 if (!authorizer.isAuthorizedByTemplate(document,
404 KRADConstants.KRAD_NAMESPACE,
405 KimConstants.PermissionTemplateNames.MODIFY_SECTION, user
406 .getPrincipalId(), additionalPermissionDetails,
407 null)) {
408 restrictions.addReadOnlySectionId(sectionId);
409 }
410 }
411 }
412
413 @SuppressWarnings("unchecked")
414 protected void addInquirableItemRestrictions(Collection sectionDefinitions,
415 InquiryAuthorizer authorizer, InquiryRestrictions restrictions,
416 BusinessObject primaryBusinessObject,
417 BusinessObject businessObject, String propertyPrefix, Person user) {
418 for (Object inquirableItemDefinition : sectionDefinitions) {
419 if (inquirableItemDefinition instanceof InquiryCollectionDefinition) {
420 InquiryCollectionDefinition inquiryCollectionDefinition = (InquiryCollectionDefinition) inquirableItemDefinition;
421 BusinessObjectEntry collectionBusinessObjectEntry = (BusinessObjectEntry) getDataDictionaryService()
422 .getDataDictionary().getBusinessObjectEntry(
423 inquiryCollectionDefinition.getBusinessObjectClass().getName());
424
425 try {
426 Collection<BusinessObject> collection = (Collection<BusinessObject>) PropertyUtils
427 .getProperty(businessObject,
428 inquiryCollectionDefinition.getName());
429 int i = 0;
430 for (Iterator<BusinessObject> iterator = collection.iterator(); iterator
431 .hasNext();) {
432 String newPropertyPrefix = propertyPrefix + inquiryCollectionDefinition.getName() + "[" + i + "].";
433 BusinessObject collectionItemBusinessObject = iterator.next();
434 considerBusinessObjectFieldUnmaskAuthorization(
435 collectionItemBusinessObject, user, restrictions,
436 newPropertyPrefix, null);
437 considerBusinessObjectFieldViewAuthorization(
438 collectionBusinessObjectEntry, primaryBusinessObject, collectionItemBusinessObject,
439 user, authorizer, restrictions, newPropertyPrefix);
440 addInquirableItemRestrictions(
441 inquiryCollectionDefinition
442 .getInquiryCollections(),
443 authorizer,
444 restrictions,
445 primaryBusinessObject,
446 collectionItemBusinessObject,
447 newPropertyPrefix,
448 user);
449 i++;
450 }
451 } catch (Exception e) {
452 throw new RuntimeException(
453 "Unable to resolve collection property: "
454 + businessObject.getClass() + ":"
455 + inquiryCollectionDefinition.getName(), e);
456 }
457 }
458 }
459 }
460
461 @SuppressWarnings("unchecked")
462 protected void addMaintainableItemRestrictions(List<? extends MaintainableItemDefinition> itemDefinitions,
463 MaintenanceDocumentAuthorizer authorizer,
464 MaintenanceDocumentRestrictions restrictions,
465 MaintenanceDocument maintenanceDocument,
466 BusinessObject businessObject, String propertyPrefix, Person user) {
467 for (MaintainableItemDefinition maintainableItemDefinition : itemDefinitions) {
468 if (maintainableItemDefinition instanceof MaintainableCollectionDefinition) {
469 try {
470 MaintainableCollectionDefinition maintainableCollectionDefinition = (MaintainableCollectionDefinition) maintainableItemDefinition;
471
472 Collection<BusinessObject> collection = (Collection<BusinessObject>) ObjectUtils
473 .getNestedValue(businessObject,
474 maintainableItemDefinition.getName());
475 BusinessObjectEntry collectionBusinessObjectEntry = (BusinessObjectEntry) getDataDictionaryService()
476 .getDataDictionary().getBusinessObjectEntry(
477 maintainableCollectionDefinition.getBusinessObjectClass().getName());
478 if (collection != null && !collection.isEmpty()) {
479 int i = 0;
480 for (Iterator<BusinessObject> iterator = collection.iterator(); iterator
481 .hasNext();) {
482 String newPropertyPrefix = propertyPrefix + maintainableItemDefinition.getName() + "[" + i + "].";
483 BusinessObject collectionBusinessObject = iterator.next();
484 considerBusinessObjectFieldUnmaskAuthorization(
485 collectionBusinessObject, user, restrictions,
486 newPropertyPrefix, maintenanceDocument);
487 considerBusinessObjectFieldViewAuthorization(
488 collectionBusinessObjectEntry, maintenanceDocument, collectionBusinessObject, user,
489 authorizer, restrictions, newPropertyPrefix);
490 considerBusinessObjectFieldModifyAuthorization(
491 collectionBusinessObjectEntry, maintenanceDocument, collectionBusinessObject, user,
492 authorizer, restrictions, newPropertyPrefix);
493 addMaintainableItemRestrictions(
494 ((MaintainableCollectionDefinition) maintainableItemDefinition)
495 .getMaintainableCollections(),
496 authorizer, restrictions, maintenanceDocument,
497 collectionBusinessObject, newPropertyPrefix,
498 user);
499 addMaintainableItemRestrictions(
500 ((MaintainableCollectionDefinition) maintainableItemDefinition)
501 .getMaintainableFields(), authorizer,
502 restrictions, maintenanceDocument,
503 collectionBusinessObject, newPropertyPrefix,
504 user);
505 i++;
506 }
507 }
508 } catch (Exception e) {
509 throw new RuntimeException(
510 "Unable to resolve collection property: "
511 + businessObject.getClass() + ":"
512 + maintainableItemDefinition.getName(), e);
513 }
514 }
515 }
516 }
517
518 public boolean canFullyUnmaskField(Person user,
519 Class<?> dataObjectClass, String fieldName, Document document) {
520
521 if(isNonProductionEnvAndUnmaskingTurnedOff())
522 return false;
523
524 if(user==null || StringUtils.isEmpty(user.getPrincipalId()))
525 return false;
526 Boolean result = null;
527 if (document != null) {
528 try {
529 result = getDocumentHelperService().getDocumentAuthorizer( document )
530 .isAuthorizedByTemplate( document,
531 KRADConstants.KRAD_NAMESPACE,
532 KimConstants.PermissionTemplateNames.FULL_UNMASK_FIELD,
533 user.getPrincipalId(), getFieldPermissionDetails(dataObjectClass, fieldName), null );
534 } catch (IllegalArgumentException e) {
535
536
537 }
538 }
539 if (result == null) {
540 result = getPermissionService().isAuthorizedByTemplateName(
541 user.getPrincipalId(),
542 KRADConstants.KRAD_NAMESPACE,
543 KimConstants.PermissionTemplateNames.FULL_UNMASK_FIELD,
544 new HashMap<String, String>(getFieldPermissionDetails(dataObjectClass, fieldName)),
545 Collections.<String, String>emptyMap());
546 }
547 return result;
548
549 }
550
551 public boolean canPartiallyUnmaskField(
552 Person user, Class<?> dataObjectClass, String fieldName, Document document) {
553
554 if(isNonProductionEnvAndUnmaskingTurnedOff())
555 return false;
556
557 if(user==null || StringUtils.isEmpty(user.getPrincipalId()))
558 return false;
559
560 if ( document == null ) {
561 return getPermissionService().isAuthorizedByTemplateName(
562 user.getPrincipalId(),
563 KRADConstants.KRAD_NAMESPACE,
564 KimConstants.PermissionTemplateNames.PARTIAL_UNMASK_FIELD,
565 new HashMap<String, String>(getFieldPermissionDetails(dataObjectClass,fieldName)),
566 Collections.<String, String>emptyMap());
567 } else {
568 return getDocumentHelperService().getDocumentAuthorizer( document )
569 .isAuthorizedByTemplate( document,
570 KRADConstants.KRAD_NAMESPACE,
571 KimConstants.PermissionTemplateNames.PARTIAL_UNMASK_FIELD,
572 user.getPrincipalId(), getFieldPermissionDetails(dataObjectClass, fieldName), Collections.<String, String>emptyMap() );
573 }
574 }
575
576 protected Map<String, String> getFieldPermissionDetails(
577 Class<?> dataObjectClass, String attributeName) {
578 try {
579 return getFieldPermissionDetails(dataObjectClass.newInstance(),
580 attributeName);
581 } catch (Exception e) {
582 throw new RuntimeException(
583 "The getPermissionDetails method of BusinessObjectAuthorizationServiceImpl was unable to instantiate the dataObjectClass"
584 + dataObjectClass, e);
585 }
586 }
587
588 protected Map<String, String> getFieldPermissionDetails(
589 Object dataObject, String attributeName) {
590 Map<String, String> permissionDetails = null;
591 String namespaceCode = null;
592 String componentName = null;
593 String propertyName = null;
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613 permissionDetails = KRADUtils
614 .getNamespaceAndComponentSimpleName(dataObject.getClass());
615 permissionDetails.put(KimConstants.AttributeConstants.PROPERTY_NAME, attributeName);
616
617 return permissionDetails;
618 }
619
620 protected Map<String, String> getButtonFieldPermissionDetails(
621 Object businessObject, String attributeName) {
622 Map<String, String> permissionDetails = new HashMap<String, String>();
623 if (attributeName.contains(".")) {
624 permissionDetails.put(KimConstants.AttributeConstants.BUTTON_NAME, attributeName);
625 } else {
626 permissionDetails.put(KimConstants.AttributeConstants.BUTTON_NAME, attributeName);
627 }
628 return permissionDetails;
629 }
630
631 private PermissionService getPermissionService() {
632 if (permissionService == null) {
633 permissionService = KimApiServiceLocator
634 .getPermissionService();
635 }
636 return permissionService;
637 }
638
639 private BusinessObjectDictionaryService getBusinessObjectDictionaryService() {
640 if (businessObjectDictionaryService == null) {
641 businessObjectDictionaryService = KNSServiceLocator
642 .getBusinessObjectDictionaryService();
643 }
644 return businessObjectDictionaryService;
645 }
646
647 private MaintenanceDocumentDictionaryService getMaintenanceDocumentDictionaryService() {
648 if (maintenanceDocumentDictionaryService == null) {
649 maintenanceDocumentDictionaryService = KNSServiceLocator
650 .getMaintenanceDocumentDictionaryService();
651 }
652 return maintenanceDocumentDictionaryService;
653 }
654
655 private ConfigurationService getKualiConfigurationService() {
656 if (kualiConfigurationService == null) {
657 kualiConfigurationService = KRADServiceLocator.getKualiConfigurationService();
658 }
659 return kualiConfigurationService;
660 }
661
662 private boolean isNonProductionEnvAndUnmaskingTurnedOff(){
663 return !getKualiConfigurationService().getPropertyValueAsString(KRADConstants.PROD_ENVIRONMENT_CODE_KEY)
664 .equalsIgnoreCase(
665 getKualiConfigurationService().getPropertyValueAsString(KRADConstants.ENVIRONMENT_KEY)) &&
666 !getKualiConfigurationService().getPropertyValueAsBoolean(KRADConstants.ENABLE_NONPRODUCTION_UNMASKING);
667 }
668
669 }