Changeset 1222

Timestamp:

Nov 30, 2010, 2:10:42 PM (13 years ago)

Author:

robert@…

Message:

Implemented improved authorisation to give administrators all permissions (ticket #207)

Location:

trunk/grails-app

Files:

• controllers/RestController.groovy (modified) (2 diffs)
• controllers/dbnp/exporter/ExporterController.groovy (modified) (1 diff)
• controllers/dbnp/studycapturing/StudyController.groovy (modified) (2 diffs)
• controllers/nmc/PilotController.groovy (modified) (2 diffs)
• domain/dbnp/authentication/SecRole.groovy (modified) (1 diff)
• domain/dbnp/studycapturing/Study.groovy (modified) (3 diffs)
• taglib/dbnp/studycapturing/WizardTagLib.groovy (modified) (1 diff)

trunk/grails-app/controllers/RestController.groovy

@@ -256 +256 @@
                         if(study) {
                                 // Check whether the person is allowed to read the data of this study
-                                /*
                                 if( !study.canRead(AuthenticationService.getRemotelyLoggedInUser( params.consumer, params.token ))) {
                                         response.sendError(401)
                                         return false
                                 }
-                                */
 
                                 def assays = []
@@ -283 +281 @@
 
                                 assays.each{ assay ->
-                                        if (assay.module.url.equals(params.consumer )) {
+                                        if (assay.module.url.equals(params.consumer)) {
                                                 if(assay) {
                                                         def map = [:]

trunk/grails-app/controllers/dbnp/exporter/ExporterController.groovy

@@ -45 +45 @@
         def c = dbnp.studycapturing.Study.createCriteria()
 
-        def studies
-        if( user == null ) {
-            studies = c.list {
-                maxResults(max)
-                and {
-                    eq( "published", true )
-                    eq( "publicstudy", true )
-                }
-            }
-        } else {
-            studies = c.list {
-                maxResults(max)
-                or {
-                    eq( "owner", user )
-                    writers {
-                        eq( "id", user.id )
-                    }
-                    and {
-                        readers {
-                            eq( "id", user.id )
-                        }
-                        eq( "published", true )
-                    }
-                }
-            }
-        }
+        def studies = Study.giveReadableStudies(user, max);
         [studyInstanceList: studies, studyInstanceTotal: studies.count()]
     }

trunk/grails-app/controllers/dbnp/studycapturing/StudyController.groovy

@@ -3 +3 @@
 import grails.converters.*
 import grails.plugins.springsecurity.Secured
-
 
 /**
@@ -25 +24 @@
         def max = Math.min(params.max ? params.int('max') : 10, 100)
 
-        def c = Study.createCriteria()
-
-        def studies
-        if( user == null ) {
-            studies = c.list {
-                maxResults(max)
-                and {
-                    eq( "published", true )
-                    eq( "publicstudy", true )
-                }
-            }
-        } else {
-            studies = c.list {
-                maxResults(max)
-                or {
-                    eq( "owner", user )
-                    writers {
-                        eq( "id", user.id )
-                    }
-                    and {
-                        readers {
-                            eq( "id", user.id )
-                        }
-                        eq( "published", true )
-                    }
-                }
-            }
-        }
-        
+        def studies = Study.giveReadableStudies( user, max );
+
         [studyInstanceList: studies, studyInstanceTotal: studies.count(), loggedInUser: user]
     }

trunk/grails-app/controllers/nmc/PilotController.groovy

@@ -16 +16 @@
 
 import dbnp.studycapturing.*;
+import grails.plugins.springsecurity.Secured
+
 
 class PilotController {
@@ -37 +39 @@
    }
         
-    def index = {
+    @Secured(['IS_AUTHENTICATED_REMEMBERED'])
+        def index = {
                 
                 session.pilot = true
-                
+
                 def user = authenticationService.getLoggedInUser()
                 def max = Math.min(params.max ? params.int('max') : 10, 100)
-
-                def c = Study.createCriteria()
-
-                def studies
-                if( user == null ) {
-                        //login and return here...
-                        redirect(controller:"login", action:"auth")
-                        return false
-                        
-                } else {
-                        studies = c.list {
-                                maxResults(max)
-                                or {
-                                        eq( "owner", user )
-                                        writers {
-                                                eq( "id", user.id )
-                                        }
-                                        and {
-                                                readers {
-                                                        eq( "id", user.id )
-                                                }
-                                                eq( "published", true )
-                                        }
-                                }
-                        }
-                }
+                def studies = Study.giveReadableStudies(user, max);
                 
                 def studyInstance = new Study()

trunk/grails-app/domain/dbnp/authentication/SecRole.groovy

@@ -1 +1 @@
 package dbnp.authentication
 
-class SecRole {
+class SecRole implements Serializable {
 
         String authority

trunk/grails-app/domain/dbnp/studycapturing/Study.groovy

@@ -410 +410 @@
         }
 
+                // Administrators are allowed to read every study
+                if( loggedInUser.hasAdminRights() ) {
+                        return true;
+                }
+
         // Owners and writers are allowed to read this study
         if( this.owner == loggedInUser || this.writers.contains(loggedInUser) ) {
@@ -430 +435 @@
             return false;
         }
+
+                // Administrators are allowed to write every study
+                if( loggedInUser.hasAdminRights() ) {
+                        return true;
+                }
+
         return this.owner == loggedInUser || this.writers.contains(loggedInUser)
     }
@@ -443 +454 @@
     }
 
+        /**
+         * Returns a list of studies that are writable for the given user
+         */
+        public static giveWritableStudies(SecUser user, int max) {
+                // User that are not logged in, are not allowed to write to a study
+                if( user == null )
+                        return [];
+                        
+                def c = Study.createCriteria()
+
+                // Administrators are allowed to read everything
+                if( user.hasAdminRights() ) {
+                        return c.list {
+                                maxResults(max)
+                        }
+                }
+
+                return c.list {
+                        maxResults(max)
+                        or {
+                                eq( "owner", user )
+                                writers {
+                                        eq( "id", user.id )
+                                }
+                        }
+                }
+        }
+
+        /**
+         * Returns a list of studies that are readable by the given user
+         */
+        public static giveReadableStudies(SecUser user, int max) {
+                def c = Study.createCriteria()
+
+        // Administrators are allowed to read everything
+                if( user == null ) {
+            return c.list {
+                                maxResults(max)
+                and {
+                    eq( "published", true )
+                    eq( "publicstudy", true )
+                }
+            }
+        } else if( user.hasAdminRights() ) {
+            return c.list {
+                                maxResults(max)
+                        }
+                } else  {
+            return c.list {
+                                maxResults(max)
+                or {
+                    eq( "owner", user )
+                    writers {
+                        eq( "id", user.id )
+                    }
+                    and {
+                        readers {
+                            eq( "id", user.id )
+                        }
+                        eq( "published", true )
+                    }
+                }
+            }
+        }
+        }
 }

trunk/grails-app/taglib/dbnp/studycapturing/WizardTagLib.groovy

@@ -653 +653 @@
          */
         def studySelect = { attrs ->
-                // Find all studies the user has access to
-                def user = AuthenticationService.getLoggedInUser()
-
-                def c = Study.createCriteria()
-                attrs.from = c.list {
-                    or {
-                        eq( "owner", user )
-                        writers {
-                            eq( "id", user.id )
-                        }
-                    }
-                }
+                // Find all studies the user has access to (max 100)
+                attrs.from = Study.giveWritableStudies(AuthenticationService.getLoggedInUser(), 100);
 
                 // got a name?