1 /**
2 * Copyright 2005-2011 The Kuali Foundation
3 *
4 * Licensed under the Educational Community License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.opensource.org/licenses/ecl2.php
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16 package org.kuali.rice.krad.uif.view;
17
18 import org.kuali.rice.kim.api.identity.Person;
19 import org.kuali.rice.krad.uif.container.CollectionGroup;
20 import org.kuali.rice.krad.uif.container.Group;
21 import org.kuali.rice.krad.uif.field.ActionField;
22 import org.kuali.rice.krad.uif.field.DataField;
23 import org.kuali.rice.krad.uif.field.Field;
24 import org.kuali.rice.krad.uif.field.InputField;
25 import org.kuali.rice.krad.uif.widget.Widget;
26 import org.kuali.rice.krad.web.form.UifFormBase;
27
28 import java.util.Set;
29
30 /**
31 * Performs user based authorization for actions and components contained in a {@link View}
32 *
33 * <p>
34 * Note only user authorization is done by the authorizer class. For non-user based logic, use the
35 * {@link ViewPresentationController}
36 * </p>
37 *
38 * @author Kuali Rice Team (rice.collab@kuali.org)
39 */
40 public interface ViewAuthorizer {
41
42 /**
43 * Returns the set of action flags that are authorized for the given user
44 *
45 * <p>
46 * Action flags are created for views to indicate some action or feature should be enabled. These flags can be
47 * used within expressions for configuring the view content.
48 *
49 * For example:
50 * <bean parent="ActionField" p:methodToCall="save" p:actionLabel="save"
51 * p:render="@{#actionFlags[#Constants.KUALI_ACTION_CAN_SAVE]}"/>
52 * </p>
53 *
54 * <p>
55 * For each action flag, KIM is consulted to determine if a permission exist for the template associated with
56 * the action flag. If so, a check is then made to determine if the user has that permission. If the permission
57 * fails for the user, the action flag is removed from the returned set.
58 * </p>
59 *
60 * <p>
61 * The Set of available action flags should first be exported by the
62 * {@link ViewPresentationController#getActionFlags(View, org.kuali.rice.krad.web.form.UifFormBase)} method. The
63 * set returned from this method will be passed as the method argument here by the framework.
64 * </p>
65 *
66 * @param view - view instance the action flags apply to
67 * @param model - object containing the view data
68 * @param user - user we are authorizing the actions for
69 * @param actions - set of action flags to authorize
70 * @return Set<String> set of action flags that have been authorized, this will be equal to or a subset of the
71 * actions passed in
72 */
73 public Set<String> getActionFlags(View view, ViewModel model, Person user, Set<String> actions);
74
75 /**
76 * Returns the set of edit modes that are authorized for the given user
77 *
78 * <p>
79 * An edit mode is a string that identifies a set of editable fields within the view. These are generally used
80 * when the entire view is not editable, but only certain fields. A field can be associated with an edit mode in
81 * two ways. The first is by using the edit mode in an expression when setting the field readOnly property.
82 *
83 * For example:
84 * <property name="readOnly" value="@{!#editModes['specialEdit'] and !fullEdit}" />
85 *
86 * The second way is with the
87 * {@link ViewPresentationController#canEditField(View, ViewModel, org.kuali.rice.krad.uif.field.Field, String)}
88 * method which can look at the edit modes map on the view to determine if the given field should be editable.
89 * </p>
90 *
91 * <p>
92 * For each edit mode, KIM is consulted to determine if a permission exist for the 'Use View' template and
93 * the edit mode detail. If so, a check is then made to determine if the user has that permission. If the
94 * permission
95 * fails for the user, the edit mode is removed from the returned set.
96 * </p>
97 *
98 * <p>
99 * The Set of available edit modes should first be exported by the
100 * {@link ViewPresentationController#getEditModes(View, org.kuali.rice.krad.web.form.UifFormBase)} method. The
101 * set returned from this method will be passed as the method argument here by the framework.
102 * </p>
103 *
104 * @param view - view instance the edit modes apply to
105 * @param model - object containing the view data
106 * @param user - user we are authorizing the actions for
107 * @param editModes - set of edit modes to authorize
108 * @return Set<String> set of edit modes that have been authorized, this will be equal to or a subset of the
109 * edit mode set passed in
110 */
111 public Set<String> getEditModes(View view, ViewModel model, Person user, Set<String> editModes);
112
113 /**
114 * Checks whether the mask authorization exists for the given property and if so whether the given user has the
115 * ability to unmask the value
116 *
117 * @param view - view instance the field belongs to
118 * @param model - object containing the view data
119 * @param field - field associated for the property and from which the
120 * {@link org.kuali.rice.krad.uif.component.ComponentSecurity} will be retrieved
121 * @param propertyName - name of the property associated with the field
122 * @param user - user we are authorizing
123 * @return boolean true if the value can be unmasked, false if it should be masked
124 */
125 public boolean canUnmaskField(View view, ViewModel model, DataField field, String propertyName, Person user);
126
127 /**
128 * Checks whether the partial mask authorization exists for the given property and if so whether the given user
129 * has the ability to unmask the value
130 *
131 * @param view - view instance the field belongs to
132 * @param model - object containing the view data
133 * @param field - field associated for the property and from which the
134 * {@link org.kuali.rice.krad.uif.component.ComponentSecurity} will be retrieved
135 * @param propertyName - name of the property associated with the field
136 * @param user - user we are authorizing
137 * @return boolean true if the value can be unmasked, false if it should be partially masked
138 */
139 public boolean canPartialUnmaskField(View view, ViewModel model, DataField field, String propertyName, Person user);
140
141 public boolean canEditField(View view, ViewModel model, Field field, String propertyName, Person user);
142
143 public boolean canViewField(View view, ViewModel model, Field field, String propertyName, Person user);
144
145 public boolean canEditGroup(View view, ViewModel model, Group group, String groupId, Person user);
146
147 public boolean canViewGroup(View view, ViewModel model, Group group, String groupId, Person user);
148
149 public boolean canEditWidget(View view, ViewModel model, Widget widget, String widgetId, Person user);
150
151 public boolean canViewWidget(View view, ViewModel model, Widget widget, String widgetId, Person user);
152
153 public boolean canTakeAction(View view, ViewModel model, ActionField actionField, String actionEvent,
154 String actionId, Person user);
155
156 public boolean canEditLine(View view, ViewModel model, CollectionGroup collectionGroup,
157 String collectionPropertyName, Object line, Person user);
158
159 public boolean canViewLine(View view, ViewModel model, CollectionGroup collectionGroup,
160 String collectionPropertyName, Object line, Person user);
161
162 public boolean canEditLineField(View view, ViewModel model, CollectionGroup collectionGroup,
163 String collectionPropertyName, Object line, Field field, String propertyName, Person user);
164
165 public boolean canViewLineField(View view, ViewModel model, CollectionGroup collectionGroup,
166 String collectionPropertyName, Object line, Field field, String propertyName, Person user);
167
168 public boolean canTakeLineAction(View view, ViewModel model, CollectionGroup collectionGroup,
169 String collectionPropertyName, Object line, ActionField actionField, String actionEvent, String actionId,
170 Person user);
171
172 }