src/main/kotlin/application/Converters.kt

@@ -52,14 +52,6 @@ val converters: ConverterDeclaration = {
         }
     }
 
-    convert<CitizenRef> {
-        decode { values, _ ->
-            values.singleOrNull()?.let {
-                CitizenRef(UUID.fromString(it))
-            } ?: throw NotFoundException("""UUID "$values" is not valid for Citizen""")
-        }
-    }
-
     convert<OpinionChoice> {
         decode { values, _ ->
             val id = values.singleOrNull()?.let { UUID.fromString(it) }

src/main/kotlin/component/follow/routes/constitution/GetMyFollowsConstitution.kt

@@ -11,11 +11,14 @@ import io.ktor.locations.Location
 import io.ktor.locations.get
 import io.ktor.response.respond
 import io.ktor.routing.Route
+import java.util.UUID
 
 @KtorExperimentalLocationsAPI
 object GetMyFollowsConstitution {
     @Location("/citizens/{citizen}/follows/constitutions")
-    class CitizenFollowConstitutionRequest(val citizen: CitizenRef)
+    class CitizenFollowConstitutionRequest(citizen: UUID) {
+        val citizen = CitizenRef(citizen)
+    }
 
     fun Route.getMyFollowsConstitution(repo: FollowConstitutionRepository, ac: FollowAccessControl) {
         get<CitizenFollowConstitutionRequest> {

src/main/kotlin/component/opinion/OpinionAccessControl.kt

@@ -1,7 +1,9 @@
 package fr.dcproject.component.opinion
 
 import fr.dcproject.common.entity.HasTarget
+import fr.dcproject.common.entity.TargetRef
 import fr.dcproject.component.citizen.CitizenI
+import fr.dcproject.component.opinion.entity.Opinion
 import fr.dcproject.component.opinion.entity.OpinionI
 import fr.dcproject.security.AccessControl
 import fr.dcproject.security.AccessResponse
@@ -22,10 +24,14 @@ class OpinionAccessControl : AccessControl() {
         }
     }
 
-    fun <S : OpinionI, SS : List<S>> canView(subjects: SS, citizen: CitizenI?): AccessResponse =
+    fun <S, SS : List<S>, C: CitizenI> canView(subjects: SS, citizen: CitizenI?): AccessResponse where S : OpinionI, S : EntityCreatedBy<C> =
         canAll(subjects) { canView(it, citizen) }
 
-    fun <S : OpinionI> canView(subject: S, citizen: CitizenI?): AccessResponse = granted()
+    fun <S, C: CitizenI> canView(subject: S, citizen: CitizenI?): AccessResponse where S : OpinionI, S : EntityCreatedBy<C> = when {
+        citizen == null -> denied("You must be connected to delete opinion", "opinion.delete.notConnected")
+        subject.createdBy.id != citizen.id -> denied("You cannot view opinions of other citizen", "opinion.view.otherCitizen")
+        else -> granted()
+    }
 
     fun <S, C : CitizenI> canDelete(subject: S, citizen: CitizenI?): AccessResponse where S : EntityCreatedBy<C>, S : OpinionI = when {
         citizen == null -> denied("You must be connected to delete opinion", "opinion.delete.notConnected")

src/main/kotlin/component/opinion/routes/GetMyOpinionsArticle.kt

@@ -1,12 +1,16 @@
 package fr.dcproject.component.opinion.routes
 
+import fr.dcproject.common.entity.TargetRef
 import fr.dcproject.component.auth.citizen
 import fr.dcproject.component.auth.citizenOrNull
+import fr.dcproject.component.citizen.CitizenBasicI
 import fr.dcproject.component.citizen.CitizenRef
 import fr.dcproject.component.opinion.OpinionAccessControl
+import fr.dcproject.component.opinion.entity.Opinion
 import fr.dcproject.routes.PaginatedRequest
 import fr.dcproject.routes.PaginatedRequestI
 import fr.dcproject.security.assert
+import fr.postgresjson.connexion.Paginated
 import io.ktor.application.call
 import io.ktor.locations.KtorExperimentalLocationsAPI
 import io.ktor.locations.Location
@@ -14,6 +18,7 @@ import io.ktor.locations.get
 import io.ktor.response.respond
 import io.ktor.routing.Route
 import fr.dcproject.component.opinion.OpinionRepositoryArticle as OpinionArticleRepository
+import java.util.UUID
 
 @KtorExperimentalLocationsAPI
 object GetMyOpinionsArticle {
@@ -22,14 +27,16 @@ object GetMyOpinionsArticle {
      */
     @Location("/citizens/{citizen}/opinions/articles")
     class CitizenOpinionsArticleRequest(
-        val citizen: CitizenRef,
+        citizen: UUID,
         page: Int = 1,
         limit: Int = 50
-    ) : PaginatedRequestI by PaginatedRequest(page, limit)
+    ) : PaginatedRequestI by PaginatedRequest(page, limit) {
+        val citizen = CitizenRef(citizen)
+    }
 
     fun Route.getMyOpinionsArticle(repo: OpinionArticleRepository, ac: OpinionAccessControl) {
         get<CitizenOpinionsArticleRequest> {
-            val opinions = repo.findCitizenOpinions(citizen, it.page, it.limit)
+            val opinions: Paginated<Opinion<TargetRef>> = repo.findCitizenOpinions(citizen, it.page, it.limit)
             ac.assert { canView(opinions.result, citizenOrNull) }
             call.respond(opinions)
         }