Handle access rights. (#136)

Signed-off-by: AAJELLAL <[email protected]>

Author: AAJELLAL

src/main/java/org/gridsuite/directory/server/DirectoryController.java

@@ -23,8 +23,6 @@
 import java.util.List;
 import java.util.UUID;
 
-import static org.gridsuite.directory.server.DirectoryException.Type.NOT_ALLOWED;
-
 /**
  * @author Nicolas Noir <nicolas.noir at rte-france.com>
  * @author Slimane Amar <slimane.amar at rte-france.com>
@@ -91,14 +89,8 @@ public ResponseEntity<Void> createElementInDirectoryPath(@RequestParam("director
     @ApiResponses(value = {@ApiResponse(responseCode = "200", description = "List info of an element and its parents in order to get its path"),
         @ApiResponse(responseCode = "403", description = "Access forbidden for the element"),
         @ApiResponse(responseCode = "404", description = "The searched element was not found")})
-    public ResponseEntity<List<ElementAttributes>> getPath(@PathVariable("elementUuid") UUID elementUuid,
-                                                                        @RequestHeader("userId") String userId) {
-
-        List<ElementAttributes> path = service.getPath(elementUuid);
-        if (!service.isPathAccessible(userId, path)) {
-            throw new DirectoryException(NOT_ALLOWED);
-        }
-        return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON).body(path);
+    public ResponseEntity<List<ElementAttributes>> getPath(@PathVariable("elementUuid") UUID elementUuid) {
+        return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON).body(service.getPath(elementUuid));
     }
 
     @DeleteMapping(value = "/elements/{elementUuid}")
@@ -178,12 +170,13 @@ public ResponseEntity<List<ElementAttributes>> getElements(@RequestParam("ids")
     @ApiResponses(value = {
         @ApiResponse(responseCode = "200", description = "All elements are accessible"),
         @ApiResponse(responseCode = "404", description = "At least one element was not found"),
-        @ApiResponse(responseCode = "403", description = "Access forbidden for at least one element")
+        @ApiResponse(responseCode = "204", description = "Access forbidden for at least one element")
     })
     public ResponseEntity<Void> areElementsAccessible(@RequestParam("ids") List<UUID> elementUuids,
-                                                            @RequestHeader("userId") String userId) {
-        service.areElementsAccessible(userId, elementUuids);
-        return ResponseEntity.ok().build();
+                                                      @RequestParam(value = "forDeletion", required = false, defaultValue = "false") Boolean forDeletion,
+                                                      @RequestHeader("userId") String userId) {
+        boolean result = Boolean.TRUE.equals(forDeletion) ? service.areDirectoryElementsDeletable(elementUuids, userId) : service.areDirectoryElementsAccessible(elementUuids, userId);
+        return result ? ResponseEntity.ok().build() : ResponseEntity.noContent().build();
     }
 
     @PutMapping(value = "/elements/{elementUuid}", consumes = MediaType.APPLICATION_JSON_VALUE)
@@ -207,11 +200,11 @@ public ResponseEntity<Void> updateElement(@PathVariable("elementUuid") UUID elem
         @ApiResponse(responseCode = "404", description = "The elements or the targeted directory was not found"),
         @ApiResponse(responseCode = "403", description = "Not authorized execute this update")
     })
-    public ResponseEntity<Void> updateElementsDirectory(
+    public ResponseEntity<Void> moveElementsDirectory(
             @RequestParam UUID targetDirectoryUuid,
             @RequestBody List<UUID> elementsUuids,
             @RequestHeader("userId") String userId) {
-        service.updateElementsDirectory(elementsUuids, targetDirectoryUuid, userId);
+        service.moveElementsDirectory(elementsUuids, targetDirectoryUuid, userId);
         return ResponseEntity.ok().build();
     }
 
@@ -262,9 +255,8 @@ public ResponseEntity<Void> reindexAllElements() {
     @Operation(summary = "Search elements in elasticsearch")
     @ApiResponses(value = {@ApiResponse(responseCode = "200", description = "List of elements found")})
     public ResponseEntity<List<DirectoryElementInfos>> searchElements(
-            @Parameter(description = "User input") @RequestParam(value = "userInput") String userInput,
-            @RequestHeader("userId") String userId) {
+            @Parameter(description = "User input") @RequestParam(value = "userInput") String userInput) {
         return ResponseEntity.ok().contentType(MediaType.APPLICATION_JSON)
-                .body(service.searchElements(userInput, userId));
+                .body(service.searchElements(userInput));
     }
 }