O3-3002: Queue Module - REST endpoints can be accessed without authentication.

[IamMujuziMoses]

Issue I worked on

see https://issues.openmrs.org/browse/O3-3002

Checklist: I completed these to help reviewers :)

• Added Authorized annotations to the service classes: QueueService, QueueEntryService, QueueRoomService and RoomProviderMapService.
• Created PrivilegeConstants class to contain all privilege names and their descriptions.
• Added liquibase changesets that will add the new privileges and do a default assignment of these privileges to roles.

[mseaton]

I would think the more appropriate check here, would be to execute this only if no one already has the "Get Queue Entries" privilege (which would imply it has already previously been assigned as desired). Then, this also allows you to get rid of the "AND NOT EXISTS..." clause from your insert statement below, right?

The same sort of logic would be applied to all of the changesets below. So:

• If any role already has privilege A, then mark as RAN
• Otherwise, assign privilege A to any role that already has privilege B.

[mseaton]

If you are going to do this, I think you need to ensure you only insert the distict roles from both, so a single sql statement, something like:

INSERT INTO role_privilege (role, privilege)
            SELECT distinct role, 'Manage Queue Entries' from role_privilege rp
            WHERE rp.privilege in ('Add Visits', 'Edit Visits');

[mseaton]

Same comment as above, you need to use something like:

INSERT INTO role_privilege (role, privilege)
            SELECT distinct role, 'Manage Queue Rooms' from role_privilege rp
            WHERE rp.privilege in ('Add Visits', 'Edit Visits');

[mseaton]

This looks ok to me now, thanks! Hopefully no further post-commit issues.