Added the ability to check permissions on the current user and use that for the kudos services to check for administer permissions (instead of using the admin role).

Author: ocielliottc

server/src/main/java/com/objectcomputing/checkins/services/kudos/KudosServicesImpl.java

@@ -1,5 +1,6 @@
 package com.objectcomputing.checkins.services.kudos;
 
+import com.objectcomputing.checkins.services.permissions.Permission;
 import com.objectcomputing.checkins.configuration.CheckInsConfiguration;
 import com.objectcomputing.checkins.notifications.email.EmailSender;
 import com.objectcomputing.checkins.notifications.email.MailJetFactory;
@@ -147,7 +148,7 @@ public KudosResponseDTO getById(UUID id) {
 
         if (kudos.getDateApproved() == null) {
             // If not yet approved, only admins and the sender can access the kudos
-            if (!currentUserServices.isAdmin() && !isSender) {
+            if (!hasAdministerKudosPermission() && !isSender) {
                 throw new PermissionException(NOT_AUTHORIZED_MSG);
             }
         } else {
@@ -158,7 +159,7 @@ public KudosResponseDTO getById(UUID id) {
                     .stream()
                     .anyMatch(recipient -> recipient.getMemberId().equals(currentUserId));
 
-            if (!currentUserServices.isAdmin() && !isSender && !isRecipient) {
+            if (!hasAdministerKudosPermission() && !isSender && !isRecipient) {
                 throw new PermissionException(NOT_AUTHORIZED_MSG);
             }
         }
@@ -188,7 +189,7 @@ public List<KudosResponseDTO> findByValues(@Nullable UUID recipientId, @Nullable
         } else if (senderId != null) {
             return findAllFromMember(senderId);
         } else {
-            if (!currentUserServices.isAdmin()) {
+            if (!hasAdministerKudosPermission()) {
                 throw new PermissionException(NOT_AUTHORIZED_MSG);
             }
 
@@ -207,7 +208,7 @@ public List<KudosResponseDTO> getRecent() {
     }
 
     private List<KudosResponseDTO> findByPending(boolean isPending) {
-        if (!currentUserServices.isAdmin()) {
+        if (!hasAdministerKudosPermission()) {
             throw new PermissionException(NOT_AUTHORIZED_MSG);
         }
 
@@ -227,10 +228,10 @@ private List<KudosResponseDTO> findByPending(boolean isPending) {
 
 
     private List<KudosResponseDTO> findAllToMember(UUID memberId) {
-        boolean isAdmin = currentUserServices.isAdmin();
         UUID currentUserId = currentUserServices.getCurrentUser().getId();
 
-        if (!currentUserId.equals(memberId) && !isAdmin) {
+        if (!currentUserId.equals(memberId) &&
+            !hasAdministerKudosPermission()) {
             throw new PermissionException("You are not authorized to retrieve the kudos another user has received");
         }
 
@@ -253,10 +254,10 @@ private List<KudosResponseDTO> findAllToMember(UUID memberId) {
 
     private List<KudosResponseDTO> findAllFromMember(UUID senderId) {
 
-        boolean isAdmin = currentUserServices.isAdmin();
         UUID currentUserId = currentUserServices.getCurrentUser().getId();
 
-        if (!currentUserId.equals(senderId) && !isAdmin) {
+        if (!currentUserId.equals(senderId) &&
+            !hasAdministerKudosPermission()) {
             throw new PermissionException("You are not authorized to retrieve the kudos another user has sent");
         }
 
@@ -378,4 +379,8 @@ private void slackApprovedKudos(Kudos kudos) {
             LOG.error("Unable to POST to Slack: " + httpResponse.reason());
         }
     }
+
+    private boolean hasAdministerKudosPermission() {
+        return currentUserServices.hasPermission(Permission.CAN_ADMINISTER_KUDOS);
+    }
 }

server/src/main/java/com/objectcomputing/checkins/services/memberprofile/currentuser/CurrentUserServices.java

@@ -1,6 +1,7 @@
 package com.objectcomputing.checkins.services.memberprofile.currentuser;
 
 import com.objectcomputing.checkins.services.memberprofile.MemberProfile;
+import com.objectcomputing.checkins.services.permissions.Permission;
 import com.objectcomputing.checkins.services.role.RoleType;
 
 public interface CurrentUserServices {
@@ -9,6 +10,8 @@ public interface CurrentUserServices {
 
     boolean hasRole(RoleType role);
 
+    boolean hasPermission(Permission permission);
+
     boolean isAdmin();
 
     MemberProfile getCurrentUser();

server/src/main/java/com/objectcomputing/checkins/services/memberprofile/currentuser/CurrentUserServicesImpl.java

@@ -2,19 +2,22 @@
 
 import com.objectcomputing.checkins.exceptions.AlreadyExistsException;
 import com.objectcomputing.checkins.exceptions.NotFoundException;
+import com.objectcomputing.checkins.services.permissions.Permission;
 import com.objectcomputing.checkins.services.memberprofile.MemberProfile;
 import com.objectcomputing.checkins.services.memberprofile.MemberProfileRepository;
 import com.objectcomputing.checkins.services.role.Role;
 import com.objectcomputing.checkins.services.role.RoleServices;
 import com.objectcomputing.checkins.services.role.RoleType;
 import com.objectcomputing.checkins.services.role.member_roles.MemberRoleServices;
+import com.objectcomputing.checkins.services.role.role_permissions.RolePermissionServices;
 import io.micronaut.security.authentication.Authentication;
 import io.micronaut.security.utils.SecurityService;
 import jakarta.inject.Singleton;
 import jakarta.validation.constraints.NotNull;
 
 import java.time.LocalDate;
 import java.util.Optional;
+import java.util.List;
 
 @Singleton
 public class CurrentUserServicesImpl implements CurrentUserServices {
@@ -23,14 +26,18 @@ public class CurrentUserServicesImpl implements CurrentUserServices {
     private final SecurityService securityService;
     private final RoleServices roleServices;
     private final MemberRoleServices memberRoleServices;
+    private final RolePermissionServices rolePermissionServices;
 
     public CurrentUserServicesImpl(MemberProfileRepository memberProfileRepository,
                                    RoleServices roleServices,
-                                   SecurityService securityService, MemberRoleServices memberRoleServices) {
+                                   SecurityService securityService,
+                                   MemberRoleServices memberRoleServices,
+                                   RolePermissionServices rolePermissionServices) {
         this.memberProfileRepo = memberProfileRepository;
         this.roleServices = roleServices;
         this.securityService = securityService;
         this.memberRoleServices = memberRoleServices;
+        this.rolePermissionServices = rolePermissionServices;
     }
 
     @Override
@@ -48,6 +55,14 @@ public boolean hasRole(RoleType role) {
         return securityService.hasRole(role.toString());
     }
 
+    @Override
+    public boolean hasPermission(Permission permission) {
+        List<Permission> userPermissions =
+            rolePermissionServices.findUserPermissions(getCurrentUser().getId());
+        return userPermissions.stream().map(Permission::name)
+                              .anyMatch(str -> str.equals(permission.name()));
+    }
+
     @Override
     public boolean isAdmin() {
         return hasRole(RoleType.ADMIN);