retrieveRows needs additional filter

it must also filter for action ViewCellValue
campudus · Aug 29, 2019 · c98fc50 · c98fc50
1 parent 326640a
commit c98fc50
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 5 deletions.
diff --git a/src/main/scala/com/campudus/tableaux/database/model/TableauxModel.scala b/src/main/scala/com/campudus/tableaux/database/model/TableauxModel.scala
@@ -693,7 +693,13 @@ class TableauxModel(
   def retrieveRow(table: Table, rowId: RowId): Future[Row] = {
     for {
       columns <- retrieveColumns(table)
-      row <- retrieveRow(table, columns, rowId)
+      filteredColumns = roleModel
+        .filterDomainObjects[ColumnType[_]](ScopeColumn,
+                                            columns,
+                                            ComparisonObjects(table),
+                                            isInternalCall = false,
+                                            ViewCellValue)
+      row <- retrieveRow(table, filteredColumns, rowId)
     } yield row
   }
 
@@ -744,7 +750,13 @@ class TableauxModel(
   def retrieveRows(table: Table, pagination: Pagination): Future[RowSeq] = {
     for {
       columns <- retrieveColumns(table)
-      rows <- retrieveRows(table, columns, pagination)
+      filteredColumns = roleModel
+        .filterDomainObjects[ColumnType[_]](ScopeColumn,
+                                            columns,
+                                            ComparisonObjects(table),
+                                            isInternalCall = false,
+                                            ViewCellValue)
+      rows <- retrieveRows(table, filteredColumns, pagination)
     } yield rows
   }
 

diff --git a/src/main/scala/com/campudus/tableaux/router/auth/permission/RoleModel.scala b/src/main/scala/com/campudus/tableaux/router/auth/permission/RoleModel.scala
@@ -87,7 +87,8 @@ class RoleModel(jsonObject: JsonObject) extends LazyLogging {
       scope: Scope,
       domainObjects: Seq[A],
       parentObjects: ComparisonObjects = ComparisonObjects(),
-      isInternalCall: Boolean
+      isInternalCall: Boolean,
+      action: Action = View
   )(implicit requestContext: RequestContext): Seq[A] = {
 
     if (isInternalCall) {
@@ -105,7 +106,7 @@ class RoleModel(jsonObject: JsonObject) extends LazyLogging {
           case _ => ComparisonObjects()
         }
 
-        isAllowed(userRoles, View, scope, _.isMatching(objects), Filter)
+        isAllowed(userRoles, action, scope, _.isMatching(objects), Filter)
       })
     }
   }
@@ -391,7 +392,8 @@ class RoleModelStub extends RoleModel(Json.emptyObj()) with LazyLogging {
       scope: Scope,
       domainObjects: Seq[A],
       parentObjects: ComparisonObjects,
-      isInternalCall: Boolean
+      isInternalCall: Boolean,
+      action: Action = View
   )(implicit requestContext: RequestContext): Seq[A] = {
     logAuthWarning()
     domainObjects