Changeset 5507

Timestamp:

07/31/14 13:13:46 (10 years ago)

Author:

Twan Goosen

Message:

Admin can now edit, delete and publish any user's private collections
Refs #589

Location:

VirtualCollectionRegistry/trunk/VirtualCollectionRegistry/src/main/java/eu/clarin/cmdi/virtualcollectionregistry

Files:

• AdminUsersServiceImpl.java (modified) (1 diff)
• VirtualCollectionRegistry.java (modified) (5 diffs)

VirtualCollectionRegistry/trunk/VirtualCollectionRegistry/src/main/java/eu/clarin/cmdi/virtualcollectionregistry/AdminUsersServiceImpl.java

@@ -28 +28 @@
     @Override
     public final boolean isAdmin(String user) {
+        logger.debug("Checking admin rights of {}", user);
         return adminUsers.contains(user);
     }

VirtualCollectionRegistry/trunk/VirtualCollectionRegistry/src/main/java/eu/clarin/cmdi/virtualcollectionregistry/VirtualCollectionRegistry.java

@@ -48 +48 @@
     @Autowired
     private VirtualCollectionValidatorFactory validatorFactory;
+    @Autowired
+    private AdminUsersService adminUsersService;
 
     private static final Logger logger
@@ -167 +169 @@
                 throw new VirtualCollectionNotFoundException(id);
             }
-            if (!c.getOwner().equalsPrincipal(principal)) {
+            if (!isAllowedToModify(principal, c)) {
                 throw new VirtualCollectionRegistryPermissionException(
                         "permission denied for user \""
@@ -212 +214 @@
                 throw new VirtualCollectionNotFoundException(id);
             }
-            if (!vc.getOwner().equalsPrincipal(principal)) {
+            if (!isAllowedToModify(principal, vc)) {
                 logger.debug("virtual collection (id={}) not owned by "
                         + "user '{}'", id, principal.getName());
@@ -298 +300 @@
                 throw new VirtualCollectionNotFoundException(id);
             }
-            if (!vc.getOwner().equalsPrincipal(principal)) {
+            if (!isAllowedToModify(principal, vc)) {
                 logger.debug("virtual collection (id={}) not owned by "
                         + "user '{}'", id, principal.getName());
@@ -684 +686 @@
         });
     }
+    
+    private boolean isAllowedToModify(Principal principal, VirtualCollection c) {
+        // admin and owner are allowed to modify collections
+        return adminUsersService.isAdmin(principal.getName())
+                || c.getOwner().equalsPrincipal(principal);
+    }
 
 } // class VirtualCollectionRegistry