org.cyclos.security

Class CRUDServiceSecurity<DTO extends EntityDTO,E extends BaseEntity,D extends EntityData<DTO>,DP>

java.lang.Object

org.cyclos.impl.AbstractServerComponent

org.cyclos.impl.AbstractNetworkedServerComponent

org.cyclos.security.BaseServiceSecurity

org.cyclos.security.CRUDServiceSecurity<DTO,E,D,DP>

All Implemented Interfaces:

CRUDService<DTO,D,DP>, CRUDWithConfirmationPasswordService<DTO,D,DP>, Service

Direct Known Subclasses:

AccessClientServiceSecurity, AdAddressServiceSecurity, AdDeliveryMethodServiceSecurity, AdInterestServiceSecurity, AdServiceSecurity, BannerServiceSecurity, BaseCustomFieldPossibleValueCategoryServiceSecurity, BaseCustomFieldPossibleValueServiceSecurity, BaseCustomFieldServiceSecurity, ChannelConfigurationServiceSecurity, ConfigurationServiceSecurity, CustomOperationServiceSecurity, CustomScheduledTaskServiceSecurity, CustomScriptServiceSecurity, CustomWebServiceServiceSecurity, DocumentServiceSecurity, ExtensionPointServiceSecurity, GeneralReferenceServiceSecurity, ImportServiceSecurity, MenuEntryServiceSecurity, MobilePageServiceSecurity, NetworkServiceSecurity, OperatorGroupServiceSecurity, OperatorServiceSecurity, OrderServiceSecurity, PhoneServiceSecurity, RecordServiceSecurity, SimpleCRUDServiceSecurity, SmsOperationConfigurationServiceSecurity, StaticContentServiceSecurity, ThemeServiceSecurity, TokenServiceSecurity, TransactionFeedbackServiceSecurity, UserAddressServiceSecurity, UserServiceSecurity, VoucherTypeServiceSecurity

public abstract class CRUDServiceSecurity<DTO extends EntityDTO,E extends BaseEntity,D extends EntityData<DTO>,DP>
extends BaseServiceSecurity
implements CRUDWithConfirmationPasswordService<DTO,D,DP>

Base implementation for security layer of CRUDServices, handling the idea of view and manage authorizations. hasViewAccess(BaseEntity) hasManageAccess(BaseEntity)

Author:

luis

Field Summary

Fields

Modifier and Type	Field and Description
protected java.lang.Class<E>	entityClass

Constructor Summary

Constructors

Constructor and Description
CRUDServiceSecurity(java.lang.Class<E> entityClass)

Method Summary

Modifier and Type	Method and Description
boolean	canPerformOperation(E entity, CRUDOperation operation) Returns whether the logged user can perform the given operation over the given entity
protected boolean	canViewHistoryLog(E entity) Subclasses working with entities which generates log can override this method for customization. The default implementation delegates to EntityLogServiceSecurity.canViewEntityLog(BaseEntity)
protected abstract void	checkCreateNew(DP params) Checks whether creating new entities with the given context parameters is allowed, throwing PermissionDeniedException if not
void	checkManageAccess(E entity) Checks whether the caller is allowed to manage the given entity
void	checkOperation(E entity, CRUDOperation operation) Throws a PermissionDeniedException if canPerformOperation(BaseEntity, CRUDOperation) returns false
void	checkViewAccess(E entity) Checks whether the caller is allowed to view the given entity
protected void	customizeData(D data) Can be overridden in order to process the returned data object for the given entity
protected abstract boolean	doHasManageAccess(E entity) Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation
abstract boolean	doHasViewAccess(E entity) Should be implemented in order to return whether the caller is allowed to view the given entity.
<Entity extends E> Entity	find(java.lang.Long id) Returns the entity with the given id
PasswordInputDTO	getConfirmationPasswordInputForRemove(java.lang.Long id) Returns the PasswordInputDTO for the confirmation password that would be required if removing the entity with the given id
D	getData(java.lang.Long id) Returns data for details of the given entity
D	getDataForNew(DP params) Returns data for a new entity with the given context parameters
java.lang.Class<E>	getEntityClass()
protected abstract CRUDServiceLocal<E,DTO,D,DP>	getImplementation() Should be implemented in order to return the actual implementation of the service
boolean	hasManageAccess(E entity) Returns whether the logged user can manage the given entity
boolean	hasViewAccess(E entity) Returns whether the logged user can view the given entity
abstract boolean	isAccessible(SessionData sessionData, E entity) Must be implemented in order to determine whether the given entity is accessible for the given session data.
DTO	load(java.lang.Long id) Loads a DTO for the entity with the given id, ensuring that the logged user can see the record
protected void	onBeforeSave(DTO dto, E entity)
void	remove(java.lang.Long id) Removes the entity associated with the given identifier
void	removeAll(java.util.Collection<java.lang.Long> ids) Removes the entities associated with the given identifiers
void	removeAllWithConfirmationPassword(java.util.Collection<java.lang.Long> ids, java.lang.String confirmationPassword) Removes the entities associated with the given identifiers, checking the confirmation password first (if enabled)
void	removeWithConfirmationPassword(java.lang.Long id, java.lang.String confirmationPassword) Removes an entity, checking the confirmation password first (if enabled)
protected org.cyclos.impl.access.EntityCheck<E>	resolveEntityCheck() Must be implemented in order to resolve the corresponding EntityCheck for the root entity type
java.lang.Long	save(DTO dto) Saves the given object, returning the generated identifier
java.lang.Long	saveWithConfirmationPassword(DTO dto, java.lang.String confirmationPassword) Saves the given object, returning the generated identifier, checking the confirmation password first (if enabled)

Methods inherited from class org.cyclos.security.BaseServiceSecurity

checkGuest, checkId, checkIds, checkInternalName, checkLoggedIn, checkManagesUser, checkRelatesToUser, checkVO, checkVOs, doInitialize, getEntityCheckRegistry, getUser, initialize

Methods inherited from class org.cyclos.impl.AbstractNetworkedServerComponent

canManage, checkManagesUser, checkPermission, checkRelatesToUser, checkValue, clearAlreadyValidated, getAccountHandler, getAuthHandler, getBaseEntityManagerHandler, getChannelConfiguration, getConfiguration, getConversionHandler, getCustomFieldValueHandler, getEntityManagerHandler, getGroupsHandler, getLoggedBasicUser, getLoggedUser, getProducts, getProductsHandler, getReportHandler, getTranslatedName, getTranslatedValue, getUserLocatorHandler, getValidationResult, hasPermission, hasValue, inSameNetwork, inSameNetworkOrGlobal, isAdmin, isAlreadyValidated, isBroker, isGlobalAdmin, isGlobalAdminInNetwork, isGuest, isLoggedIn, isMember, isNetworkAdmin, isOperator, isRelatedToUser, isSystem, isUserManager, isUserManagerOf, message, message, permission, permission, permissionOptionalValue, permissionOptionalValue, toDate, toDateTime, validate

Methods inherited from class org.cyclos.impl.AbstractServerComponent

delete, detach, find, flush, from, getApplicationContext, getConfigurationHandler, getDataTranslationHandler, getFormatter, getFormatter, getFormatter, getLogger, getNotificationHandler, getProfileFieldHandler, getRemoteAddress, getSessionData, getTransactionHandler, getTranslationHandler, message, message, persist, processBatch, refresh, remove, subQuery, update

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

entityClass

protected final java.lang.Class<E extends BaseEntity> entityClass

Constructor Detail

CRUDServiceSecurity

public CRUDServiceSecurity(java.lang.Class<E> entityClass)

Method Detail

canPerformOperation

public boolean canPerformOperation(E entity,
                                   CRUDOperation operation)

Returns whether the logged user can perform the given operation over the given entity

checkManageAccess

public final void checkManageAccess(E entity)
                             throws PermissionDeniedException

Checks whether the caller is allowed to manage the given entity

Throws:

PermissionDeniedException

checkOperation

public final void checkOperation(E entity,
                                 CRUDOperation operation)

Throws a PermissionDeniedException if canPerformOperation(BaseEntity, CRUDOperation) returns false

checkViewAccess

public final void checkViewAccess(E entity)
                           throws PermissionDeniedException

Checks whether the caller is allowed to view the given entity

Throws:

PermissionDeniedException

doHasViewAccess

public abstract boolean doHasViewAccess(E entity)

Should be implemented in order to return whether the caller is allowed to view the given entity.

find

public <Entity extends E> Entity find(java.lang.Long id)

Returns the entity with the given id

getConfirmationPasswordInputForRemove

public final PasswordInputDTO getConfirmationPasswordInputForRemove(java.lang.Long id)
                                                             throws FrameworkException

Description copied from interface: CRUDWithConfirmationPasswordService

Returns the PasswordInputDTO for the confirmation password that would be required if removing the entity with the given id

Specified by:

getConfirmationPasswordInputForRemove in interface CRUDWithConfirmationPasswordService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

FrameworkException

getData

public final D getData(java.lang.Long id)
                throws FrameworkException

Description copied from interface: CRUDService

Returns data for details of the given entity

Specified by:

getData in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

EntityNotFoundException - When the given id is not valid (or represents a not visible entity)

FrameworkException

getDataForNew

public final D getDataForNew(DP params)
                      throws FrameworkException

Description copied from interface: CRUDService

Returns data for a new entity with the given context parameters

Specified by:

getDataForNew in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

FrameworkException

getEntityClass

public java.lang.Class<E> getEntityClass()

hasManageAccess

public final boolean hasManageAccess(E entity)

Returns whether the logged user can manage the given entity

hasViewAccess

public final boolean hasViewAccess(E entity)

Returns whether the logged user can view the given entity

isAccessible

public abstract boolean isAccessible(SessionData sessionData,
                                     E entity)

Must be implemented in order to determine whether the given entity is accessible for the given session data. This method shouldn't check the same condition as hasViewAccess(BaseEntity). If the only condition for an entity is hasViewAccess(BaseEntity), this method should return false.

load

public final DTO load(java.lang.Long id)
               throws EntityNotFoundException

Description copied from interface: CRUDService

Loads a DTO for the entity with the given id, ensuring that the logged user can see the record

Specified by:

load in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

EntityNotFoundException - When the entity with the given id was not found (or not visible)

remove

public final void remove(java.lang.Long id)
                  throws EntityNotFoundException,
                         DataAccessException,
                         ValidationException

Description copied from interface: CRUDService

Removes the entity associated with the given identifier

Specified by:

remove in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

EntityNotFoundException - When the given id is not valid (or represents a not visible entity)

ConstraintViolatedOnRemoveException - When the given id represents an entity which is referenced by other entities, and the delete is not cascaded to them

DataAccessException

ValidationException

removeAll

public final void removeAll(java.util.Collection<java.lang.Long> ids)
                     throws EntityNotFoundException,
                            DataAccessException,
                            ValidationException

Description copied from interface: CRUDService

Removes the entities associated with the given identifiers

Specified by:

removeAll in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

EntityNotFoundException - When any of the given ids are not valid (or represents not visible entities)

ConstraintViolatedOnRemoveException - When any of the given ids represents an entity which is referenced by other entities, and the delete is not cascaded to them

DataAccessException

ValidationException

removeAllWithConfirmationPassword

public final void removeAllWithConfirmationPassword(java.util.Collection<java.lang.Long> ids,
                                                    java.lang.String confirmationPassword)
                                             throws EntityNotFoundException,
                                                    DataAccessException,
                                                    ValidationException

Description copied from interface: CRUDWithConfirmationPasswordService

Removes the entities associated with the given identifiers, checking the confirmation password first (if enabled)

Specified by:

removeAllWithConfirmationPassword in interface CRUDWithConfirmationPasswordService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

EntityNotFoundException

DataAccessException

ValidationException

See Also:

CRUDService.removeAll(Collection)

removeWithConfirmationPassword

public final void removeWithConfirmationPassword(java.lang.Long id,
                                                 java.lang.String confirmationPassword)
                                          throws FrameworkException

Description copied from interface: CRUDWithConfirmationPasswordService

Removes an entity, checking the confirmation password first (if enabled)

Specified by:

removeWithConfirmationPassword in interface CRUDWithConfirmationPasswordService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

FrameworkException

See Also:

CRUDService.remove(Long)

save

public final java.lang.Long save(DTO dto)
                          throws ValidationException,
                                 DataAccessException

Description copied from interface: CRUDService

Saves the given object, returning the generated identifier

Specified by:

save in interface CRUDService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

ValidationException - When the given object has invalid fields

EntityNotFoundException - When the given id is not valid (or represents a not visible entity)

DataAccessException - When a data access error prevented the object of being saved

saveWithConfirmationPassword

public final java.lang.Long saveWithConfirmationPassword(DTO dto,
                                                         java.lang.String confirmationPassword)
                                                  throws FrameworkException

Description copied from interface: CRUDWithConfirmationPasswordService

Saves the given object, returning the generated identifier, checking the confirmation password first (if enabled)

Specified by:

saveWithConfirmationPassword in interface CRUDWithConfirmationPasswordService<DTO extends EntityDTO,D extends EntityData<DTO>,DP>

Throws:

FrameworkException

See Also:

CRUDService.save(EntityDTO)

canViewHistoryLog

protected boolean canViewHistoryLog(E entity)

Subclasses working with entities which generates log can override this method for customization.
The default implementation delegates to EntityLogServiceSecurity.canViewEntityLog(BaseEntity)

checkCreateNew

protected abstract void checkCreateNew(DP params)

Checks whether creating new entities with the given context parameters is allowed, throwing PermissionDeniedException if not

customizeData

protected void customizeData(D data)

Can be overridden in order to process the returned data object for the given entity

doHasManageAccess

protected abstract boolean doHasManageAccess(E entity)

Should be implemented in order to return whether the caller is allowed to manage the given entity, for the given operation

getImplementation

protected abstract CRUDServiceLocal<E,DTO,D,DP> getImplementation()

Should be implemented in order to return the actual implementation of the service

onBeforeSave

protected void onBeforeSave(DTO dto,
                            E entity)

resolveEntityCheck

protected final org.cyclos.impl.access.EntityCheck<E> resolveEntityCheck()

Must be implemented in order to resolve the corresponding EntityCheck for the root entity type

Specified by:

resolveEntityCheck in class BaseServiceSecurity