DC/dc-project
1
1
Fork 0
Code Issues 25 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

feature #8: Add security for Vote Article

Browse Source
This commit is contained in:
Fabrice Lecomte
2019-08-30 14:34:24 +02:00
parent 3e21884b38
commit d1999d84ca
5 changed files with 77 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
src/main/kotlin/fr/dcproject/security/voter/ConstitutionVoter.kt
View File

@@ -1,8 +1,9 @@
package fr.dcproject.security.voter
import fr.dcproject.entity.Constitution
import fr.dcproject.entity.User
import io.ktor.application.ApplicationCall
import fr.dcproject.entity.Constitution as ConstitutionEntity
import fr.dcproject.entity.Vote as VoteEntity
class ConstitutionVoter: Voter {
enum class Action: ActionI {
@@ -13,7 +14,7 @@ class ConstitutionVoter: Voter {
}
override fun supports(action: ActionI, call: ApplicationCall, subject: Any?): Boolean {
return (action is Action || action is CommentVoter.Action) && subject is Constitution?
return (action is Action || action is CommentVoter.Action) && subject is ConstitutionEntity?
}
override fun vote(action: ActionI, call: ApplicationCall, subject: Any?): Vote {
@@ -34,14 +35,28 @@ class ConstitutionVoter: Voter {
return Vote.GRANTED
}
if (action == Action.DELETE && user is User && subject is Constitution && subject.createdBy?.userId == user.id) {
if (action == Action.DELETE && user is User && subject is ConstitutionEntity && subject.createdBy?.userId == user.id) {
return Vote.GRANTED
}
if (action == Action.UPDATE && user is User && subject is Constitution && subject.createdBy?.userId == user.id) {
if (action == Action.UPDATE && user is User && subject is ConstitutionEntity && subject.createdBy?.userId == user.id) {
return Vote.GRANTED
}
if (action == VoteVoter.Action.CREATE && subject is VoteEntity<*>) {
val target = subject.target
if (target !is ConstitutionEntity) {
return Vote.ABSTAIN
}
if (target.isDeleted()) {
return Vote.DENIED
}
}
if (action is Action) {
return Vote.DENIED
}
return Vote.ABSTAIN
}
}