@Transactional(readOnly = true, propagation = Propagation.SUPPORTS) public List<ProjektDO> getKundenProjekte(final Integer kundeId) { if (kundeId == null) { return null; } final QueryFilter queryFilter = new QueryFilter(); queryFilter.add(Restrictions.eq("kunde.id", kundeId)); queryFilter.addOrder(Order.asc("nummer")); return getList(queryFilter); }
@Override protected List<ProjektDO> getChoices(final String input) { final BaseSearchFilter filter = new BaseSearchFilter(); filter.setSearchFields("id", "name", "identifier", "nummer"); filter.setSearchString(input); final List<ProjektDO> list = projektDao.getList(filter); return list; }
/** * @param user * @return List of all projects of which the given user is member of the project manager group. */ public static Collection<ProjektDO> getProjectsOfManager(final PFUserDO user) { final Collection<ProjektDO> result = new LinkedList<ProjektDO>(); final ProjektFilter filter = new ProjektFilter(); if (projektDao == null) { projektDao = ApplicationContextProvider.getApplicationContext().getBean(ProjektDao.class); } final List<ProjektDO> projects = projektDao.getList(filter); if (CollectionUtils.isEmpty(projects) == true) { return result; } final UserGroupCache userGroupCache = TenantRegistryMap.getInstance().getTenantRegistry().getUserGroupCache(); for (final ProjektDO project : projects) { final Integer groupId = project.getProjektManagerGroupId(); if (groupId == null) { // No manager group defined. continue; } if (userGroupCache.isUserMemberOfGroup(user, groupId) == false) { continue; } result.add(project); } return result; } }
private void checkNoAccess(Serializable id, String who) { try { ProjektFilter filter = new ProjektFilter(); projektDao.getList(filter); fail("AccessException expected: " + who + " users should not have select list access to projects."); } catch (AccessException ex) { // OK } }
@Override @Transactional(readOnly = true, propagation = Propagation.SUPPORTS) public List<ProjektDO> getList(final BaseSearchFilter filter) { final ProjektFilter myFilter; if (filter instanceof ProjektFilter) { myFilter = (ProjektFilter) filter; } else { myFilter = new ProjektFilter(filter); } final QueryFilter queryFilter = new QueryFilter(myFilter); if (myFilter.isEnded() == true) { queryFilter.add(Restrictions.eq("status", ProjektStatus.ENDED)); } else if (myFilter.isNotEnded() == true) { queryFilter.add(Restrictions.or(Restrictions.ne("status", ProjektStatus.ENDED), Restrictions.isNull("status"))); } queryFilter.addOrder(Order.asc("internKost2_4")).addOrder(Order.asc("kunde.id")).addOrder(Order.asc("nummer")); return getList(queryFilter); }
@Test public void checkAccess() { logon(TEST_FINANCE_USER); final GroupDO group = initTestDB.addGroup("ProjektDaoTest.ProjectManagers", TEST_PROJECT_ASSISTANT_USER); ProjektDO projekt = new ProjektDO(); projekt.setName("ACME - Webportal"); projekt.setProjektManagerGroup(group); Serializable id = projektDao.save(projekt); projekt = projektDao.getById(id); projekt.setDescription("Test"); projektDao.update(projekt); logon(TEST_CONTROLLING_USER); checkNoWriteAccess(id, projekt, "Controlling"); logon(TEST_USER); checkNoAccess(id, "Other"); checkNoAccess(id, projekt, "Other"); logon(TEST_PROJECT_MANAGER_USER); projektDao.getList(new ProjektFilter()); checkNoAccess(id, projekt, "Project manager"); logon(TEST_PROJECT_ASSISTANT_USER); projektDao.getList(new ProjektFilter()); checkNoWriteAccess(id, projekt, "Project assistant"); checkNoHistoryAccess(id, projekt, "Project assistant"); logon(TEST_ADMIN_USER); checkNoAccess(id, projekt, "Admin "); checkNoAccess(id, projekt, "Project manager"); }