Filter owning-entities from /category_parameter by permissions

Implemented in CategoryParameterServiceWithRoles and injected
to MaintenanceController, but still reachable because
shouldTreatPermissions() is "false".

Issue-ID: VID-758

Change-Id: I716202ca944af9b0de9c151d75d50b5df41a8171
Signed-off-by: Ittay Stern <ittay.stern@att.com>

2 files changed, 62 insertions, 0 deletions

diff --git a/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceImpl.java b/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceImpl.java
index 98a84c26c..f4d21e842 100644
--- a/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceImpl.java
+++ b/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceImpl.java
@@ -30,6 +30,7 @@ import org.onap.vid.model.CategoryParameterOption;
 import org.onap.portalsdk.core.logging.logic.EELFLoggerDelegate;
 import org.onap.portalsdk.core.service.DataAccessService;
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Primary;
 import org.springframework.stereotype.Service;
 
 import javax.ws.rs.ForbiddenException;
@@ -38,6 +39,7 @@ import java.util.stream.Collectors;
 
 
 @Service
+@Primary
 public class CategoryParameterServiceImpl implements CategoryParameterService {
 
     public static final String OPTION_ALREADY_EXIST_FOR_CATEGORY = "Option %s already exist for category %s";
diff --git a/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceWithRoles.kt b/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceWithRoles.kt
new file mode 100644
index 000000000..f059e590c
--- /dev/null
+++ b/vid-app-common/src/main/java/org/onap/vid/services/CategoryParameterServiceWithRoles.kt
@@ -0,0 +1,60 @@
+package org.onap.vid.services
+
+import com.fasterxml.jackson.annotation.JsonIgnore
+import org.onap.vid.category.CategoryParameterOptionRep
+import org.onap.vid.category.CategoryParametersResponse
+import org.onap.vid.model.CategoryParameter
+import org.onap.vid.roles.RoleProvider
+import org.onap.vid.roles.WithPermissionPropertiesOwningEntity
+import org.springframework.beans.factory.annotation.Qualifier
+import org.springframework.stereotype.Service
+import org.togglz.core.manager.FeatureManager
+import javax.servlet.http.HttpServletRequest
+
+@Service
+@Qualifier("WithRoles")
+class CategoryParameterServiceWithRoles(
+        private val categoryParameterService: CategoryParameterService,
+        private val featureManager: FeatureManager,
+        private val roleProvider: RoleProvider,
+        private val request: HttpServletRequest
+) : CategoryParameterService by categoryParameterService {
+
+    private val owningEntityKey = "owningEntity"
+
+    private fun shouldTreatPermissions() = false
+
+    override fun getCategoryParameters(familyName: CategoryParameter.Family?): CategoryParametersResponse {
+        val categoryParameters =
+                categoryParameterService.getCategoryParameters(familyName)
+
+        return if (shouldTreatPermissions()) {
+            treatPermissions(categoryParameters)
+        } else {
+            categoryParameters
+        }
+    }
+
+    internal fun treatPermissions(categoryParametersResponse: CategoryParametersResponse): CategoryParametersResponse {
+        val extractedCategoryParameters = categoryParametersResponse.categoryParameters
+        val owningEntities = extractedCategoryParameters[owningEntityKey]
+
+        return CategoryParametersResponse(
+                extractedCategoryParameters + (owningEntityKey to removeNonPermitted(owningEntities)))
+    }
+
+    private fun removeNonPermitted(owningEntities: MutableList<CategoryParameterOptionRep>?): List<CategoryParameterOptionRep>? {
+        val userRolesValidator = roleProvider.getUserRolesValidator(request)
+        return owningEntities
+                ?.map { OwningEntityOptionRep(it) }
+                ?.filter { userRolesValidator.isServicePermitted(it) }
+    }
+
+
+    class OwningEntityOptionRep(categoryParameterOptionRep: CategoryParameterOptionRep) :
+            CategoryParameterOptionRep(categoryParameterOptionRep.id, categoryParameterOptionRep.name),
+            WithPermissionPropertiesOwningEntity {
+        override val owningEntityId: String?
+            @JsonIgnore get() = id
+    }
+}