@Override public List<Patient> getMembers() { List<Patient> members = this.family.getMembers(); return members.stream() .map(SecurePatient::new) .collect(Collectors.toCollection(LinkedList::new)); }
/** * returns information about the family in JSON format. * * @param family family * @return JSON object with family information */ public JSONObject toJSON(Family family) { JSONObject familyJSON = new JSONObject(); familyJSON.put(FAMILY_ID, family.getId()); familyJSON.put(FAMILY_EXTERNAL_ID, family.getExternalId()); familyJSON.put(FAMILY_WARNING, family.getWarningMessage()); JSONArray patientsJSONArray = new JSONArray(); for (Patient patient : family.getMembers()) { JSONObject patientJSON = getPatientInformationAsJSON(patient); patientsJSONArray.put(patientJSON); } familyJSON.put(FAMILY_MEMBERS, patientsJSONArray); return familyJSON; }
/** * returns information about the family in JSON format. * * @param family family * @return JSON object with family information */ public JSONObject toJSON(Family family) { JSONObject familyJSON = new JSONObject(); familyJSON.put(FAMILY_ID, family.getId()); familyJSON.put(FAMILY_EXTERNAL_ID, family.getExternalId()); familyJSON.put(FAMILY_HAS_SENSITIVE_DATA, family.containsSensitiveData()); familyJSON.put(FAMILY_SENSITIVE_DATA_MESSAGE, family.getWarningMessage()); JSONArray patientsJSONArray = new JSONArray(); for (Patient patient : family.getMembers()) { JSONObject patientJSON = getPatientInformationAsJSON(patient); patientsJSONArray.put(patientJSON); } familyJSON.put(FAMILY_MEMBERS, patientsJSONArray); return familyJSON; }
/** * Create PrincipalRepresentation of entity family members and add to the list of principals. * * @param entity to whom we create principal representations * @param addedPrincipals cash of already added principals with access levels * @param result REST representation for a list of principals that have access to the {@link PrimaryEntity} */ private void addFamilyMembers(PrimaryEntity entity, Map<String, Pair<PrincipalRepresentation, AccessLevel>> addedPrincipals, PrincipalsRepresentation result) { Family family = this.familyRepository.get(entity.getId()); List<Patient> members = family.getMembers(); for (Patient member : members) { addEntity(member, "patients", addedPrincipals, result, true); } }
@Override public boolean forceRemoveAllMembers(Family family, User updatingUser) { if (!this.authorizationService.hasAccess(updatingUser, Right.EDIT, family.getDocumentReference())) { return false; } try { for (Patient patient : family.getMembers()) { // remove the member without updating family document (use "batch mode") // since we don't care about it as it will be removed anyway this.removeMember(family, patient, updatingUser, true); } return true; } catch (PTException ex) { this.logger.error("Failed to unlink all patients for the family [{}]: {}", family.getId(), ex.getMessage()); return false; } }
@Override public boolean forceRemoveAllMembers(Family family, User updatingUser) { if (!this.authorizationService.hasAccess(updatingUser, Right.EDIT, family.getDocumentReference())) { return false; } try { for (Patient patient : family.getMembers()) { // remove the member without updating family document (use "batch mode") // since we don't care about it as it will be removed anyway this.removeMember(family, patient, updatingUser, true); } return true; } catch (PTException ex) { this.logger.error("Failed to unlink all patients for the family [{}]: {}", family.getId(), ex.getMessage()); return false; } }
@Override public Boolean hasAccess(User user, Right access, EntityReference entity) { if (!ObjectUtils.allNotNull(user, access, entity) || !(access == Right.VIEW || access == Right.EDIT)) { return null; } Family family = this.familyRepository.get(entity.toString()); if (family == null) { return null; } for (Patient member : family.getMembers()) { AccessLevel grantedAccess = this.manager.getAccessLevel(member, user.getProfileDocument()); Right grantedRight = grantedAccess.getGrantedRight(); if (grantedRight != null && (grantedRight.equals(access) || (grantedRight.getImpliedRights() != null && grantedRight.getImpliedRights().contains(access)))) { return true; } } return null; } }
@Override public synchronized boolean deleteFamily(Family family, User updatingUser, boolean deleteAllMembers) { if (!canDeleteFamily(family, updatingUser, deleteAllMembers, false)) { return false; } if (deleteAllMembers) { for (Patient patient : family.getMembers()) { if (!this.patientRepository.delete(patient)) { this.logger.error("Failed to delete patient [{}] - deletion of family [{}] aborted", patient.getId(), family.getId()); return false; } } } else if (!this.forceRemoveAllMembers(family, updatingUser)) { return false; } try { XWikiContext context = this.provider.get(); XWiki xwiki = context.getWiki(); xwiki.deleteDocument(xwiki.getDocument(family.getDocument(), context), context); } catch (XWikiException ex) { this.logger.error("Failed to delete family document [{}]: {}", family.getId(), ex.getMessage()); return false; } return true; }
@Override public synchronized boolean delete(final Family family, boolean deleteAllMembers) { // TODO: Should there be a SecureFamilyRepository to perform these checks (similar to SecurePatientRepository)? final User currentUser = this.userManager.getCurrentUser(); if (!canDeleteFamily(family, currentUser, deleteAllMembers, false)) { return false; } if (deleteAllMembers) { for (Patient patient : family.getMembers()) { if (!this.patientRepository.delete(patient)) { this.logger.error("Failed to delete patient [{}] - deletion of family [{}] aborted", patient.getId(), family.getId()); return false; } } } else if (!this.forceRemoveAllMembers(family, currentUser)) { return false; } return super.delete(family); }
List<Patient> members = family.getMembers(); if (members.isEmpty()) { return null;
List<Patient> members = family.getMembers(); if (members.isEmpty()) { return null;
@Override public boolean canDeleteFamily(Family family, User updatingUser, boolean deleteAllMembers, boolean throwException) throws PTException { try { if (family == null) { if (throwException) { throw new PTInvalidFamilyIdException(null); } return false; } if (!this.authorizationService.hasAccess(updatingUser, Right.DELETE, family.getDocumentReference())) { throw new PTNotEnoughPermissionsOnFamilyException(Right.DELETE, family.getId()); } if (deleteAllMembers) { // check permissions on all patients for (Patient patient : family.getMembers()) { if (!this.authorizationService.hasAccess(updatingUser, Right.DELETE, patient.getDocument())) { throw new PTNotEnoughPermissionsOnPatientException(Right.DELETE, patient.getId()); } } } return true; } catch (PTException ex) { if (throwException) { throw ex; } return false; } }
/** * For every family member, read users and groups that have either view or edit edit access on the patient, then * gives the sam elevel of access on the family for those users and groups. After performing this method, if p is a * member of the family, and x has level y access on p, x has level y access on the family. The user who is the * owner of the family always has full access to the family. Note that the document is not saved to disk, changes * are only made for the provided Family object and its in-memory copy of the corresponding XWiki document. * * @param family to update permissions * @param context XWiki context to be used. The documnt will not be saved to disk, only changes in memory for the * family document given will be made */ public void updatePermissions(Family family, XWikiContext context) { XWiki wiki = context.getWiki(); List<Patient> members = family.getMembers(); this.updatePermissionsForOneRightLevel(VIEW_RIGHTS, members, family.getDocument(), wiki, context); // setting view-edit rights after view rights makes sure if a user has edit rights on one patient // and view rights on another the user still gets edit permissions for the family this.updatePermissionsForOneRightLevel(VIEWEDIT_RIGHTS, members, family.getDocument(), wiki, context); DocumentReference creatorReference = family.getDocument().getCreatorReference(); this.setOwnerPermissionsForUser(creatorReference == null ? "" : creatorReference.toString(), family.getDocument(), context); }
for (Patient patient : family.getMembers()) { if (!this.authorizationService.hasAccess( updatingUser, Right.DELETE, patient.getDocumentReference())) {