Changeset 976 for trunk/grails-app

Timestamp:

Oct 21, 2010, 5:28:04 PM (11 years ago)

Author:

robert@…

Message:

Authentication and authorization for studies is added, according to ticket 118

Location:

trunk/grails-app

Files:

• conf/BaseFilters.groovy (modified) (1 diff)
• conf/BootStrap.groovy (modified) (3 diffs)
• conf/BootStrapStudies.groovy (modified) (3 diffs)
• conf/Config.groovy (modified) (2 diffs)
• controllers/RestController.groovy (modified) (1 diff)
• controllers/dbnp/authentication (added)
• controllers/dbnp/authentication/LoginController.groovy (added)
• controllers/dbnp/authentication/LogoutController.groovy (added)
• controllers/dbnp/authentication/RegisterController.groovy (added)
• controllers/dbnp/authentication/UserRegistrationController.groovy (added)
• controllers/dbnp/importer/ImporterController.groovy (modified) (1 diff)
• controllers/dbnp/studycapturing/StudyController.groovy (modified) (5 diffs)
• controllers/dbnp/studycapturing/WizardController.groovy (modified) (7 diffs)
• domain/dbnp/authentication (added)
• domain/dbnp/authentication/SecRole.groovy (added)
• domain/dbnp/authentication/SecUser.groovy (added)
• domain/dbnp/authentication/SecUserSecRole.groovy (added)
• domain/dbnp/authentication/User.groovy (added)
• domain/dbnp/studycapturing/Study.groovy (modified) (6 diffs)
• domain/dbnp/studycapturing/Template.groovy (modified) (2 diffs)
• domain/dbnp/studycapturing/TemplateEntity.groovy (modified) (1 diff)
• services/dbnp/authentication (added)
• services/dbnp/authentication/AuthenticationService.groovy (added)
• taglib/dbnp/authentication (added)
• taglib/dbnp/studycapturing/WizardTagLib.groovy (modified) (4 diffs)
• views/common/_login_panel.gsp (modified) (2 diffs)
• views/common/_topnav.gsp (modified) (2 diffs)
• views/email (added)
• views/email/_registrationConfirmationAdmin.gsp (added)
• views/email/_registrationConfirmationUser.gsp (added)
• views/login (added)
• views/login/auth.gsp (added)
• views/login/denied.gsp (added)
• views/register (added)
• views/register/forgotPassword.gsp (added)
• views/register/index.gsp (added)
• views/register/resetPassword.gsp (added)
• views/study/list.gsp (modified) (1 diff)
• views/study/show.gsp (modified) (2 diffs)
• views/user (added)
• views/user/create.gsp (added)
• views/user/edit.gsp (added)
• views/user/search.gsp (added)
• views/userRegistration (added)
• views/userRegistration/add.gsp (added)
• views/userRegistration/confirmAdmin.gsp (added)
• views/userRegistration/confirmUser.gsp (added)
• views/userRegistration/index.gsp (added)
• views/wizard/pages/_study.gsp (modified) (1 diff)

trunk/grails-app/conf/BaseFilters.groovy

@@ -29 +29 @@
                         }
                 }
+
         }
 }

trunk/grails-app/conf/BootStrap.groovy

@@ -6 +6 @@
 import org.codehaus.groovy.grails.commons.GrailsApplication
 import grails.util.GrailsUtil
-import org.nmcdsp.plugins.aaaa.SecUser
+import dbnp.authentication.*
 
 
@@ -26 +26 @@
                 System.setProperty('user.timezone', 'CET')
 
-                def user = SecUser.findByUsername('user') ?: new SecUser(
+                def adminRole = SecRole.findByAuthority( 'ROLE_ADMIN' ) ?: new SecRole( authority: 'ROLE_ADMIN' ).save()
+
+                def user = SecUser.findByUsername('user') ?: new SecUser(
                            username: 'user',
-                           password: springSecurityService.encodePassword('useR123!'),
-                           enabled: true).save(failOnError: true)
+                           password: springSecurityService.encodePassword( 'useR123!', 'user' ),
+                           email: 'user@dbnp.org',
+                           userConfirmed: true, adminConfirmed: true).save(failOnError: true)
 
                 def userAdmin = SecUser.findByUsername('admin') ?: new SecUser(
                                 username: 'admin',
-                                password: springSecurityService.encodePassword('admiN123!'),
-                                enabled: true).save(failOnError: true)
+                                password: springSecurityService.encodePassword( 'admiN123!', 'admin' ),
+                                email: 'admin@dbnp.org',
+                                userConfirmed: true, adminConfirmed: true).save(failOnError: true)
+
+                // Make the admin user an administrator
+                SecUserSecRole.create userAdmin, adminRole, true
 
                 def userTest = SecUser.findByUsername('test') ?: new SecUser(
                                 username: 'test',
-                                password: springSecurityService.encodePassword('testT123!'),
-                                enabled: true).save(failOnError: true)
-                
-                println "Done with SpringSecurity bootstrap, created [user, admin, test]."
+                                password: springSecurityService.encodePassword( 'useR123!', 'test' ),
+                                email: 'test@dbnp.org',
+                            userConfirmed: true, adminConfirmed: true).save(failOnError: true)
+
+                println "Done with SpringSecurity bootstrap, created [user, admin, test]."
 
                 // If there are no templates yet in the database
@@ -81 +89 @@
                                 } else {
                                         // general study boostrapping
-                                        BootStrapStudies.addExampleStudies(user)
+                                        BootStrapStudies.addExampleStudies(user, userAdmin)
                                 }
                         }

trunk/grails-app/conf/BootStrapStudies.groovy

@@ -21 +21 @@
          */
 
-        public static void addExampleStudies(org.nmcdsp.plugins.aaaa.SecUser owner) {
+        public static void addExampleStudies(dbnp.authentication.SecUser owner, dbnp.authentication.SecUser otherUser ) {
 
                 // Look up the used ontologies which should be in the database by now
@@ -171 +171 @@
                         ecCode:"2007117.c",
                         startDate: Date.parse('yyyy-MM-dd','2008-01-02'),
-                        owner: owner
+                        owner: owner,
+                        readers: [otherUser]
                 ).with { if (!validate()) { errors.each { println it} } else save()}
 
@@ -378 +379 @@
                         ecCode:"unknown",
                         startDate: Date.parse('yyyy-MM-dd','2008-01-14'),
-                        owner: owner
+                        owner: owner,
+                        writers: [otherUser]
                 )
                 .setFieldValue( 'Description', "Human study performed at RRI; centres involved: RRI, IFR, TUM, Maastricht U." )

trunk/grails-app/conf/Config.groovy

@@ -157 +157 @@
 
 // Needed for the Spring Security Core plugin:
-grails.plugins.springsecurity.userLookup.userDomainClassName = 'org.nmcdsp.plugins.aaaa.SecUser'
-grails.plugins.springsecurity.userLookup.authorityJoinClassName = 'org.nmcdsp.plugins.aaaa.SecUserSecRole'
-grails.plugins.springsecurity.authority.className = 'org.nmcdsp.plugins.aaaa.SecRole'
+grails.plugins.springsecurity.userLookup.userDomainClassName = 'dbnp.authentication.SecUser'
+grails.plugins.springsecurity.userLookup.authorityJoinClassName = 'dbnp.authentication.SecUserSecRole'
+grails.plugins.springsecurity.authority.className = 'dbnp.authentication.SecRole'
+grails.plugins.springsecurity.password.algorithm = 'SHA-256'
+grails.plugins.springsecurity.password.encodeHashAsBase64 = true
+grails.plugins.springsecurity.dao.reflectionSaltSourceProperty = 'username' // Use the persons username as salt for encryption
+grails.plugins.springsecurity.securityConfigType = grails.plugins.springsecurity.SecurityConfigType.Annotation
+
+// Make sure the different controllers provided by springsecurity.ui are only accessible by administrators
+// NB: the RegisterController is used for forgotten passwords. It should be accessible by anyone
+grails.plugins.springsecurity.controllerAnnotations.staticRules = [
+    '/user/**': ['ROLE_ADMIN'],
+    '/role/**': ['ROLE_ADMIN'],
+    '/aclclass/**': ['ROLE_ADMIN'],
+    '/aclentry/**': ['ROLE_ADMIN'],
+    '/aclobjectidentity/**': ['ROLE_ADMIN'],
+    '/aclsid/**': ['ROLE_ADMIN'],
+    '/persistentlogin/**': ['ROLE_ADMIN'],
+    '/registrationcode/**': ['ROLE_ADMIN'],
+    '/requestmap/**': ['ROLE_ADMIN'],
+    '/securityinfo/**': ['ROLE_ADMIN']
+]
+
+
+// Needed for sending emails
+grails {
+    mail {
+        host = "smtp.gmail.com"
+        port = 465
+        username = "gscfproject@gmail.com"
+        password = "gscf2010"
+        props = [
+            "mail.smtp.auth":"true",
+            "mail.smtp.socketFactory.port": '465',
+            "mail.smtp.socketFactory.class": "javax.net.ssl.SSLSocketFactory",
+            "mail.smtp.socketFactory.fallback": "false"
+        ]
+    }
+}
 
 // The OAuth consumer key and secret variables are currently replaced by Jeroen's Continuous Integration script.
@@ -173 +209 @@
         }
 }
+

trunk/grails-app/controllers/RestController.groovy

@@ -18 +18 @@
 import dbnp.studycapturing.Study
 import dbnp.studycapturing.Assay
-import org.nmcdsp.plugins.aaaa.SecUser
+import dbnp.authentication.SecUser
 import grails.converters.*
 import nl.metabolomicscentre.dsp.http.BasicAuthentication

trunk/grails-app/controllers/dbnp/importer/ImporterController.groovy

@@ -31 +31 @@
 import grails.converters.JSON
 import org.apache.poi.hssf.usermodel.HSSFWorkbook
-
+import grails.plugins.springsecurity.Secured
+
+@Secured(['IS_AUTHENTICATED_REMEMBERED'])
 class ImporterController {
     def ImporterService    

trunk/grails-app/controllers/dbnp/studycapturing/StudyController.groovy

@@ -2 +2 @@
 
 import grails.converters.*
+import grails.plugins.springsecurity.Secured
+
 
 /**
@@ -7 +9 @@
  */
 class StudyController {
-
+    def AuthenticationService
+    
     //static allowedMethods = [save: "POST", update: "POST", delete: "POST"]
 
@@ -14 +17 @@
     }
 
+    /**
+     * Shows all studies where the user has access to
+     */
     def list = {
-        params.max = Math.min(params.max ? params.int('max') : 10, 100)
-        [studyInstanceList: Study.list(params), studyInstanceTotal: Study.count()]
+
+        def user = AuthenticationService.getLoggedInUser()
+        def max = Math.min(params.max ? params.int('max') : 10, 100)
+
+        def c = Study.createCriteria()
+
+        def studies
+        if( user == null ) {
+            studies = c.list {
+                maxResults(max)
+                and {
+                    eq( "published", true )
+                    eq( "publicstudy", true )
+                }
+            }
+        } else {
+            studies = c.list {
+                maxResults(max)
+                or {
+                    eq( "owner", user )
+                    writers {
+                        eq( "id", user.id )
+                    }
+                    and {
+                        readers {
+                            eq( "id", user.id )
+                        }
+                        eq( "published", true )
+                    }
+                }
+            }
+        }
+        
+        [studyInstanceList: studies, studyInstanceTotal: studies.count()]
+    }
+
+    /**
+     * Shows studies for which the logged in user is the owner
+     */
+    @Secured(['IS_AUTHENTICATED_REMEMBERED'])
+    def myStudies = {
+        def user = AuthenticationService.getLoggedInUser()
+        def max = Math.min(params.max ? params.int('max') : 10, 100)
+
+        def studies = Study.findAllByOwner(user);
+        render( view: "list", model: [studyInstanceList: studies, studyInstanceTotal: studies.count()] )
     }
 
@@ -43 +93 @@
         }
         else {
+            // Check whether the user may see this study
+            def loggedInUser = AuthenticationService.getLoggedInUser()
+            if( !studyInstance.canRead(loggedInUser) ) {
+                flash.message = "You have no access to this study"
+                redirect(action: "list")
+            }
+
             // The study instance is packed into an array, to be able to
             // use the same view for showing the study and comparing multiple
             // studies
-            [studyList: [ studyInstance ], multipleStudies: false ]
-        }
-    }
-
-        def showByToken = {
+            [studyList: [ studyInstance ], multipleStudies: false, loggedInUser: loggedInUser ]
+        }
+    }
+
+    def showByToken = {
         def studyInstance = Study.findByCode(params.id)
         if (!studyInstance) {
@@ -57 +114 @@
         }
         else {
+            // Check whether the user may see this study
+            def loggedInUser = AuthenticationService.getLoggedInUser()
+            if( !studyInstance.canRead(loggedInUser) ) {
+                flash.message = "You have no access to this study"
+                redirect(action: "list")
+            }
+
             redirect(action: "show", id: studyInstance.id)
         }

trunk/grails-app/controllers/dbnp/studycapturing/WizardController.groovy

@@ -5 +5 @@
 // Grails convertors is imported in order to create JSON objects
 import grails.converters.*
+import grails.plugins.springsecurity.Secured
+import dbnp.authentication.AuthenticationService
+import dbnp.authentication.SecUser
 
 
@@ -12 +15 @@
  * The wizard controller handles the handeling of pages and data flow
  * through the study capturing wizard.
+ *
+ * This controller is only accessible by logged in users.
  *
  * @author Jeroen Wesbeek
@@ -22 +27 @@
  * $Date$
  */
+@Secured(['IS_AUTHENTICATED_REMEMBERED'])
 class WizardController {
+        def AuthenticationService
+        
         /**
          * index method, redirect to the webflow
@@ -790 +798 @@
                                         // save study
                                         println ".saving study"
+
+                                        // Make sure the owner of the study is set right
+                                        flow.study.owner = AuthenticationService.getLoggedInUser()
+                                        
                                         if (!flow.study.save(flush:true)) {
                                                 this.appendErrors(flow.study, flash.errors)
@@ -846 +858 @@
                 try {
                         // load study
-                        flow.study = (params.studyid) ? Study.findById( params.studyid ) : Study.findByTitle( params.study )
-
+                        def study = (params.studyid) ? Study.findById( params.studyid ) : Study.findByTitle( params.study )
+
+                        // Check whether the user is allowed to edit this study. If it is not allowed
+                        // the used should had never seen a link to this page, so he should never get
+                        // here. That's why we just return false
+                        if( !study.canWrite(AuthenticationService.getLoggedInUser()) ) {
+                            return false;
+                        }
+
+                        flow.study = study
                         // set 'quicksave' variable
                         flow.quickSave = true
@@ -903 +923 @@
                 // handle contacts
                 handleContacts(flow, flash, params)
+
+                // handle users (readers, writers)
+                handleUsers(flow, flash, params, 'readers')
+                handleUsers(flow, flash, params, 'writers')
+
+                // handle public checkbox
+                if( params.get( "publicstudy" ) ) {
+                    flow.study.publicstudy = params.get( "publicstudy" )
+                }
 
                 // validate the study
@@ -1016 +1045 @@
 
         }
+
+        /**
+         * re-usable code for handling contacts form data in a web flow
+         * @param Map LocalAttributeMap (the flow scope)
+         * @param Map localAttributeMap (the flash scope)
+         * @param Map GrailsParameterMap (the flow parameters = form data)
+         * @param String    'readers' or 'writers' 
+         * @return boolean
+         */
+        def handleUsers(flow, flash, params, type) {
+                def users = []
+
+                if( type == "readers" ) {
+                    users = flow.study.readers ?: []
+                } else if( type == "writers" ) {
+                    users = flow.study.writers ?: []
+                }
+
+                // Check the ids of the contacts that should be attached
+                // to this study. If they are already attached, keep 'm. If
+                // studies are attached that are not in the selected (i.e. the
+                // user deleted them), remove them
+
+                // Users are saved as user_id
+                def userIDs = params.get( type + '_ids')
+                if (userIDs) {
+                        // Find the individual IDs and make integers
+                        userIDs = userIDs.split(',').collect { Integer.parseInt(it, 10) }
+
+                        // First remove the publication that are not present in the array
+                        users.removeAll { user -> !userIDs.find { id -> id == user.id } }
+
+                        // Add those publications not yet present in the database
+                        userIDs.each { id ->
+                                if (!users.find { user -> id == user.id }) {
+                                        def user = SecUser.get(id)
+                                        if (user) {
+                                            users.add(user)
+                                        } else {
+                                                println('.user with ID ' + id + ' not found in database.')
+                                        }
+                                }
+                        }
+
+                } else {
+                        println('.no users selected.')
+                        users.clear()
+                }
+
+                if( type == "readers" ) {
+                    if( flow.study.readers )
+                        flow.study.readers.clear()
+                    users.each { flow.study.addToReaders( it ) }
+                } else if( type == "writers" ) {
+                    if( flow.study.writers )
+                        flow.study.writers.clear()
+                        
+                    users.each { flow.study.addToWriters( it ) }
+                }
+
+        }
                                                  
         /**

trunk/grails-app/domain/dbnp/studycapturing/Study.groovy

@@ -1 +1 @@
 package dbnp.studycapturing
 
-import org.nmcdsp.plugins.aaaa.SecUser
+import dbnp.authentication.SecUser
 
 /**
@@ -12 +12 @@
  */
 class Study extends TemplateEntity {
-        static searchable = {
-        [only: ['title', 'Description']] // the description field will be searched only if defined in a study template
-    }
+        static searchable = {
+            [only: ['title', 'Description']] // the description field will be searched only if defined in a study template
+        }
 
         SecUser owner           // The owner of the study. A new study is automatically owned by its creator.
@@ -29 +29 @@
         List assays
         boolean published = false // Determines whether a study is private (only accessable by the owner and writers) or published (also visible to readers)
-
+        boolean publicstudy = false  // Determines whether anonymous users are allowed to see this study. This has only effect when published = true
+        
         static hasMany = [              
                 subjects: Subject,
@@ -38 +39 @@
                 assays: Assay,
                 persons: StudyPerson,
-                publications: Publication
+                publications: Publication,
+                readers: SecUser,
+                writers: SecUser
         ]
 
@@ -54 +57 @@
                 // Workaround for bug http://jira.codehaus.org/browse/GRAILS-6754
                 templateTextFields type: 'text'
-                owner column: "studyowner"
-                title column: "studytitle"
-                code column: "studycode"
-                subjects column: "studysubjects"
-                events column: "studyevents"
-                samplingEvents column: "studysamplingevents"
-                eventGroups column: "studyeventgroups"
-                samples column: "studysamples"
-                assays column: "studyassays"
         }
 
@@ -407 +401 @@
                 return msg
         }
+
+    /**
+     * Returns true if the given user is allowed to read this study
+     */
+    public boolean canRead(SecUser loggedInUser) {
+        // Anonymous readers are only given access when published and public
+        if( loggedInUser == null ) {
+            return this.publicstudy && this.published;
+        }
+
+        // Owners and writers are allowed to read this study
+        if( this.owner == loggedInUser || this.writers.contains(loggedInUser) ) {
+            return true
+        }
+            
+        // Readers are allowed to read this study when it is published
+        if( this.readers.contains(loggedInUser) && this.published ) {
+            return true
+        }
+        
+        return false
+    }
+
+    /**
+     * Returns true if the given user is allowed to write this study
+     */
+    public boolean canWrite(SecUser loggedInUser) {
+        if( loggedInUser == null ) {
+            return false;
+        }
+        return this.owner == loggedInUser || this.writers.contains(loggedInUser)
+    }
+
+    /**
+     * Returns true if the given user is the owner of this study
+     */
+    public boolean isOwner(SecUser loggedInUser) {
+        if( loggedInUser == null ) {
+            return false;
+        }
+        return this.owner == loggedInUser
+    }
+
 }

trunk/grails-app/domain/dbnp/studycapturing/Template.groovy

@@ -1 +1 @@
 package dbnp.studycapturing
 
-import org.nmcdsp.plugins.aaaa.SecUser
+import dbnp.authentication.SecUser
 
 /**
@@ -39 +39 @@
 
         static mapping = {
-                name column:"templatename"
-                description column:"templatedescription"
-                entity column:"templateentity"
-                owner column:"templateowner"
-                fields column:"templatefields"
         }
 

trunk/grails-app/domain/dbnp/studycapturing/TemplateEntity.groovy

@@ -70 +70 @@
                 // Make sure that the text fields are really stored as TEXT, so that those Strings can have an arbitrary length.
                 templateTextFields type: 'text'
-
-                template column:"templateentitytemplate"
         }
 

trunk/grails-app/taglib/dbnp/studycapturing/WizardTagLib.groovy

@@ -3 +3 @@
 import org.codehaus.groovy.grails.plugins.web.taglib.JavascriptTagLib
 import dbnp.studycapturing.*
+import dbnp.authentication.SecUser
 import dbnp.data.*
 import cr.co.arquetipos.crypto.Blowfish
@@ -19 +20 @@
  */
 class WizardTagLib extends JavascriptTagLib {
+
+        def AuthenticationService
+        
         // define the tag namespace (e.g.: <wizard:action ... />
         static namespace = "wizard"
@@ -649 +653 @@
          */
         def studySelect = { attrs ->
-                // for now, just fetch all studies
-                attrs.from = Study.findAll()
+                // Find all studies the user has access to
+                def user = AuthenticationService.getLoggedInUser()
+
+                def c = Study.createCriteria()
+                attrs.from = c.list {
+                    or {
+                        eq( "owner", user )
+                        writers {
+                            eq( "id", user.id )
+                        }
+                    }
+                }
 
                 // got a name?
@@ -1311 +1325 @@
                 out << "Role: " + select(selectAttrs)
         }
+
+
+        def UserSelectElement = { attrs, body ->
+                // render list with publications currently available
+                baseElement.call(
+                        '_userList',
+                        attrs,
+                        body
+                )
+
+                attrs.description = '';
+
+                // render 'Add user button'
+                baseElement.call(
+                        '_userAddButton',
+                        attrs,
+                        body
+                )
+        }
+
+        /**
+         * Renders an input box for publications
+         */
+        def userSelect = { attrs, body ->
+                if (attrs.get('value') == null) {
+                        attrs.value = [];
+                }
+                if (attrs.get('description') == null) {
+                        attrs.description = '';
+                }
+                
+                out << '<form id="' + attrs.name + '_form" onSubmit="return false;">';
+                out << select(
+                        name: attrs.get("name"),
+                        value: '',
+                        from: SecUser.list(),
+                        optionValue: 'username',
+                        optionKey: 'id',
+                        style: 'width: 400px;'
+                );
+                out << '</form>';
+        }
+
+        def _userList = { attrs, body ->
+                def display_none = 'none';
+                if (!attrs.get('value') || attrs.get('value').size() == 0) {
+                        display_none = 'inline';
+                }
+
+                // Add a unordered list
+                out << '<ul class="user_list" id="' + attrs.name + '_list">';
+
+                out << '<li>';
+                out << '<span class="user_none" id="' + attrs.name + '_none" style="display: ' + display_none + ';">';
+                out << '-';
+                out << '</span>';
+                out << '</li>';
+
+                out << '</ul>';
+
+                // Add the publications using javascript
+                out << '<script type="text/javascript">'
+                if (attrs.get('value') && attrs.get('value').size() > 0) {
+                        def i = 0;
+                        attrs.get('value').each {
+                                out << 'showUser( ';
+                                out << '  "' + attrs.name + '",';
+                                out << '  ' + it.id + ',';
+                                out << '  "' + it.username + '",';
+                                out << '  ' + i++;
+                                out << ');';
+                        }
+                }
+                out << '</script>';
+
+                def ids;
+                if (attrs.get('value') && attrs.get('value').size() > 0) {
+                        ids = attrs.get('value').id.join(',')
+                } else {
+                        ids = '';
+                }
+                out << '<input type="hidden" name="' + attrs.name + '_ids" value="' + ids + '" id="' + attrs.name + '_ids">';
+        }
+
+        def _userAddButton = { attrs, body ->
+
+                // Output the dialog for the publications
+                out << '<div id="' + attrs.name + '_dialog">';
+                out << '<p>Select a user from the database.</p>';
+                out << userSelect(attrs, body);
+                out << '</div>';
+                out << '<script type="text/javascript">';
+                out << '  createUserDialog( "' + attrs.name + '" );'
+                out << '</script>';
+
+                out << '<input type="button" onClick="openUserDialog(\'' + attrs.name + '\' );" value="Add User">';
+        }
+
 }

trunk/grails-app/views/common/_login_panel.gsp

@@ -14 +14 @@
                                         <h1>Member Login</h1>
                                         <label class="grey" for="username">Username:</label>
-                                        <input class="field" type="text" name="j_username" id="username" value="${username}" size="23" />
+                                        <input class="field" type="text" name="j_username" id="j_username" value="${username}" size="23" />
                                         <label class="grey" for="password">Password:</label>
                                         <input class="field" type="password" name="j_password" id="password" size="23" />
-                                        <label><input type='checkbox' class='chk' name='${rememberMeParameter}' id='remember_me'
-                                        <g:if test='${hasCookie}'>checked='checked'</g:if> /></label>
-                <div class="clear"></div>
+                                        <label><input type='checkbox' class='chk' name='_spring_security_remember_me' id='remember_me'
+                                        <g:if test='${hasCookie}'>checked='checked'</g:if> /> Remember me</label>
+                                        <div class="clear"></div>
                                         <input type="submit" name="submit" value="Login" class="bt_login" />
-                                        <a class="lost-pwd" href="<g:createLink url="[action:'passwordReminder',controller:'auth']" class="lost-pwd" />">Lost your password?</a>
+                                        <a class="lost-pwd" href="<g:createLink url="[action:'forgotPassword',controller:'register']" class="lost-pwd" />">Lost your password?</a>
                                 </g:form>
                         </div>
                         <div class="left right">
-                                <g:form url="[action:'signUp',controller:'auth']" class="clearfix">
+                          <g:form url="[action:'add',controller:'userRegistration']" class="clearfix">
                                         <input type="hidden" name="targetUri" value="${targetUri}" />
                                         <h1>Not a member yet? Sign Up!</h1>
                                         <label class="grey" for="signup">Username:</label>
-                                        <input class="field" type="text" name="signup" id="signup" value="${username}" size="23" />
+                                        <input class="field" type="text" name="username" id="username" value="${username}" size="23" />
                                         <label class="grey" for="email">Email:</label>
                                         <input class="field" type="text" name="email" id="email" value="${email}" size="23" />
-                                        <label>A password will be e-mailed to you.</label>
+                                        <label>A password will be e-mailed to you</label>
+
                                         <input type="submit" name="submit" value="Register" class="bt_register" />
-                                </g:form>
+                            </g:form>
                         </div>
                 </div>
@@ -41 +42 @@
                 <ul class="login">
                         <li class="left">&nbsp;</li>
-                        <li>Hello <authentication:isLoggedIn><authentication:loggedInUsername/></authentication:isLoggedIn>
-                        <authentication:isNotLoggedIn>Guest</authentication:isNotLoggedIn>!</li>
+                        <li>Hello <sec:ifLoggedIn><sec:username/></sec:ifLoggedIn>
+                        <sec:ifNotLoggedIn>Guest</sec:ifNotLoggedIn>!</li>
                         <li class="sep">|</li>
                         <li id="toggle">
-                        <authentication:isLoggedIn><g:link controller="logout" action="index">sign out</g:link></authentication:isLoggedIn>
-                                <authentication:isNotLoggedIn>
-                                 <a id="open" class="open" href="#">Log In | Register</a>
-                                 <a id="close" style="display: none;" class="close" href="#">Close Panel</a>
-                                </authentication:isNotLoggedIn>
+                        <sec:ifLoggedIn><g:link controller="logout" action="index">sign out</g:link></sec:ifLoggedIn>
+                            <sec:ifNotLoggedIn>
+                             <a id="open" class="open" href="#">Log In | Register</a>
+                             <a id="close" style="display: none;" class="close" href="#">Close Panel</a>
+                            </sec:ifNotLoggedIn>
                         </li>
             <li class="right">&nbsp;</li>

trunk/grails-app/views/common/_topnav.gsp

@@ -3 +3 @@
     <ul class="topnav">
      <li><g:link controller="home" action="index">Home</g:link></li>
-<n:isLoggedIn>
-     <li><g:link controller="study" action="list">My studies</g:link></li>
-</n:isLoggedIn>     <li>
+<sec:ifLoggedIn>
+     <li><g:link controller="study" action="myStudies">My studies</g:link></li>
+</sec:ifLoggedIn>     <li>
       <a href="#">Studies</a>
       <ul class="subnav">
@@ -38 +38 @@
      </li>
         </g:if>
-<n:isAdministrator>
+   <sec:ifAllGranted roles="ROLE_ADMIN">
      <li>
           <a href="#">User administation</a>
           <ul class="subnav">
-            <li><g:link controller="admins" action="index" class="icon icon_user_suit">Manage Administrators</g:link></li>
-            <li><g:link controller="user" action="list" class="icon icon_user">List Users</g:link></li>
+            <li><g:link controller="user" class="icon icon_user">List Users</g:link></li>
             <li><g:link controller="user" action="create" class="icon icon_user_add">Create User</g:link></li>
-            <li><g:link controller="role" action="list" class="icon icon_cog">List Roles</g:link></li>
+            <li><g:link controller="role" class="icon icon_cog">List Roles</g:link></li>
             <li><g:link controller="role" action="create" class="icon icon_cog_add">Create Role</g:link></li>
-            <li><g:link controller="group" action="list" class="icon icon_group">List Groups</g:link></li>
-            <li><g:link controller="group" action="create" class="icon icon_group_add">Create Group</g:link></li>
-            <li><g:link controller="auth" action="logout" class="icon icon_cross">Sign out</g:link></li>
+            <li><g:link controller="logout" class="icon icon_cross">Sign out</g:link></li>
           </ul>
      </li>
-</n:isAdministrator>
+   </sec:ifAllGranted>
     </ul>
     <!-- /TOPNAV //-->

trunk/grails-app/views/study/list.gsp

@@ -77 +77 @@
     </div>
     <div class="buttons">
-                <span class="button"><g:link class="create" controller="wizard" params="[jump:'create']"><g:message code="default.new.label" args="[entityName]" /></g:link></span>
+      <sec:ifLoggedIn>
+        <span class="button"><g:link class="create" controller="wizard" params="[jump:'create']"><g:message code="default.new.label" args="[entityName]" /></g:link></span>
+      </sec:ifLoggedIn>
     </div>
     <div class="paginateButtons">

trunk/grails-app/views/study/show.gsp

@@ -273 +273 @@
               </g:each>
             </tr>
-                          <tr>
-                                <td>Owner</td>
-                                <g:each in="${studyList}" var="studyInstance">
-                                  <td>
-                                        <g:if test="${studyInstance.owner}">
-                                                <g:link controller="user" action="show" id="${studyInstance.owner.id}">${studyInstance.owner?.encodeAsHTML()}</g:link>
-                                        </g:if>
-                                        <g:else>
-                                         -
-                                        </g:else>
-                                  </td>
-                                </g:each>
-                          </tr>
             <tr>
-              <td>Members</td>
+              <td>Public</td>
               <g:each in="${studyList}" var="studyInstance">
                 <td>
-                  <% /* <g:if test="${studyInstance.getAllMemberUsers()==0}">
+                   ${studyInstance.publicstudy}
+                </td>
+              </g:each>
+            </tr>
+            <tr>
+              <td>Owner</td>
+              <g:each in="${studyList}" var="studyInstance">
+                <td>
+                   ${studyInstance.owner.username}
+                </td>
+              </g:each>
+            </tr>
+            <tr>
+              <td>Readers</td>
+              <g:each in="${studyList}" var="studyInstance">
+                <td>
+                  <g:if test="${studyInstance.readers.size() == 0}">
                     -
                   </g:if>
                   <g:else>
-                    <g:each in="${studyInstance.getAllMemberUsers()}" var="memberuser" status="i">
-                      <g:if test="${i > 0}">, </g:if>
-                      <g:link controller="user" action="show" id="${memberuser.id}">${memberuser?.encodeAsHTML()}</g:link>
-                    </g:each>
+                    ${studyInstance.readers.username.join( ", " )}
                   </g:else>
-                  */ %>
+                </td>
+              </g:each>
+            </tr>
+            <tr>
+              <td>Writers</td>
+              <g:each in="${studyList}" var="studyInstance">
+                <td>
+                  <g:if test="${studyInstance.writers.size()==0}">
+                    -
+                  </g:if>
+                  <g:else>
+                    ${studyInstance.writers.username.join( ", " )}
+                  </g:else>
                 </td>
               </g:each>
@@ -845 +857 @@
           <g:set var="studyInstance" value="${studyList[0]}" />
           <g:hiddenField name="id" value="${studyInstance?.id}" />
-          <span class="button"><g:link class="edit" controller="wizard" params="[jump:'edit']" id="${studyInstance?.id}">${message(code: 'default.button.edit.label', default: 'Edit')}</g:link></span>
-          <span class="button"><g:actionSubmit class="delete" action="delete" value="${message(code: 'default.button.delete.label', default: 'Delete')}" onclick="return confirm('${message(code: 'default.button.delete.confirm.message', default: 'Are you sure?')}');" /></span>
-        </g:if>
+          <g:if test="${studyInstance.canWrite(loggedInUser)}">
+            <span class="button"><g:link class="edit" controller="wizard" params="[jump:'edit']" id="${studyInstance?.id}">${message(code: 'default.button.edit.label', default: 'Edit')}</g:link></span>
+          </g:if>
+          <g:if test="${studyInstance.isOwner(loggedInUser)}">
+            <span class="button"><g:actionSubmit class="delete" action="delete" value="${message(code: 'default.button.delete.label', default: 'Delete')}" onclick="return confirm('${message(code: 'default.button.delete.confirm.message', default: 'Are you sure?')}');" /></span>
+          </g:if>
+          </g:if>
         <span class="button"><g:link class="backToList" action="list">Back to list</g:link></span>
       </g:form>

trunk/grails-app/views/wizard/pages/_study.gsp

@@ -31 +31 @@
         <wizard:publicationSelectElement name="publication" value="${study?.publications}" />
         <wizard:contactSelectElement name="contacts" value="${study?.persons}" />
-        </g:if>
+
+        <br />
+        <div class="element">
+          <div class="description">Public </div>
+          <div class="input"><g:checkBox name="publicstudy" value="${study?.publicstudy}" /></div>
+        </div>
+
+        <wizard:userSelectElement name="readers" description="Readers" value="${study?.readers}" />
+        <wizard:userSelectElement name="writers" description="Writers" value="${study?.writers}" />
+
+        </g:if>
 
 </wizard:pageContent>