diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java
index 0b9e6b1f6a1..920862189dc 100755
--- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java
+++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java
@@ -298,24 +298,17 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
String deviceUuid = (String) requestObject.get(DeviceMappingConstants.JSON_DEVICE_UUID);
String regattaSecret = (String) requestObject.get(DeviceMappingConstants.JSON_REGISTER_SECRET);
Long fromMillis = (Long) requestObject.get(DeviceMappingConstants.JSON_FROM_MILLIS);
-
boolean allowedViaPermission = getSecurityService().hasCurrentUserUpdatePermission(leaderboard);
boolean allowedViaSecret = skipChecksDueToCorrectSecret(leaderboardName, regattaSecret);
-
HasRegattaLike hasRegattaLike = (HasRegattaLike) leaderboard;
-
DomainFactory domainFactory = getService().getDomainObjectFactory().getBaseDomainFactory();
AbstractLogEventAuthor author = new LogEventAuthorImpl(AbstractLogEventAuthor.NAME_COMPATIBILITY,
AbstractLogEventAuthor.PRIORITY_COMPATIBILITY);
-
if (allowedViaPermission || allowedViaSecret) {
-
// don't need the device type and push ID yet - important once we start add support for push notifications
// String deviceType = (String) requestObject.get(DeviceMappingConstants.JSON_DEVICE_TYPE);
// String pushDeviceId = (String) requestObject.get(DeviceMappingConstants.JSON_PUSH_DEVICE_ID);
-
- if ((competitorId == null && boatId == null && markId == null) || deviceUuid == null
- || fromMillis == null) {
+ if ((competitorId == null && boatId == null && markId == null) || deviceUuid == null || fromMillis == null) {
// || deviceType == null
logger.warning("Invalid JSON body in request");
return Response.status(Status.BAD_REQUEST).entity("Invalid JSON body in request")
@@ -398,7 +391,6 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
.build();
}
Response response;
- getSecurityService().checkCurrentUserUpdatePermission(leaderboard);
IsRegattaLike isRegattaLike = ((HasRegattaLike) leaderboard).getRegattaLike();
AbstractLogEventAuthor author = new LogEventAuthorImpl(AbstractLogEventAuthor.NAME_COMPATIBILITY,
AbstractLogEventAuthor.PRIORITY_COMPATIBILITY);
@@ -420,63 +412,70 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
String boatId = (String) requestObject.get(DeviceMappingConstants.JSON_BOAT_ID_AS_STRING);
String markId = (String) requestObject.get(DeviceMappingConstants.JSON_MARK_ID_AS_STRING);
String deviceUuid = (String) requestObject.get(DeviceMappingConstants.JSON_DEVICE_UUID);
+ String regattaSecret = (String) requestObject.get(DeviceMappingConstants.JSON_REGISTER_SECRET);
TimePoint closingTimePointInclusive = new MillisecondsTimePoint(toMillis);
- if (toMillis == null || deviceUuid == null || closingTimePointInclusive == null
- || (competitorId == null && boatId == null && markId == null)) {
- logger.warning("Invalid JSON body in request");
- return Response.status(Status.BAD_REQUEST).entity("Invalid JSON body in request").type(MediaType.TEXT_PLAIN)
- .build();
- }
- final NamedWithID mappedTo;
- if (competitorId != null) {
- final Competitor mappedToCompetitor = getService().getCompetitorAndBoatStore()
- .getExistingCompetitorByIdAsString(competitorId);
- mappedTo = mappedToCompetitor;
- if (mappedToCompetitor == null) {
- logger.warning("No competitor found for id " + competitorId);
- return Response.status(Status.BAD_REQUEST).entity("No competitor found for id " + competitorId)
- .type(MediaType.TEXT_PLAIN).build();
+ boolean allowedViaPermission = getSecurityService().hasCurrentUserUpdatePermission(leaderboard);
+ boolean allowedViaSecret = skipChecksDueToCorrectSecret(leaderboardName, regattaSecret);
+ if (allowedViaPermission || allowedViaSecret) {
+ if (toMillis == null || deviceUuid == null || closingTimePointInclusive == null
+ || (competitorId == null && boatId == null && markId == null)) {
+ logger.warning("Invalid JSON body in request");
+ return Response.status(Status.BAD_REQUEST).entity("Invalid JSON body in request").type(MediaType.TEXT_PLAIN)
+ .build();
}
- } else if (boatId != null) {
- final Boat mappedToBoat = getService().getCompetitorAndBoatStore().getExistingBoatByIdAsString(boatId);
- mappedTo = mappedToBoat;
- if (mappedToBoat == null) {
- logger.warning("No boat found for id " + boatId);
- return Response.status(Status.BAD_REQUEST).entity("No boat found for id " + boatId)
+ final NamedWithID mappedTo;
+ if (competitorId != null) {
+ final Competitor mappedToCompetitor = getService().getCompetitorAndBoatStore()
+ .getExistingCompetitorByIdAsString(competitorId);
+ mappedTo = mappedToCompetitor;
+ if (mappedToCompetitor == null) {
+ logger.warning("No competitor found for id " + competitorId);
+ return Response.status(Status.BAD_REQUEST).entity("No competitor found for id " + competitorId)
+ .type(MediaType.TEXT_PLAIN).build();
+ }
+ } else if (boatId != null) {
+ final Boat mappedToBoat = getService().getCompetitorAndBoatStore().getExistingBoatByIdAsString(boatId);
+ mappedTo = mappedToBoat;
+ if (mappedToBoat == null) {
+ logger.warning("No boat found for id " + boatId);
+ return Response.status(Status.BAD_REQUEST).entity("No boat found for id " + boatId)
+ .type(MediaType.TEXT_PLAIN).build();
+ }
+ } else {
+ // map to mark
+ DomainFactory domainFactory = getService().getDomainObjectFactory().getBaseDomainFactory();
+ final Mark mappedToMark = domainFactory.getExistingMarkById(UUIDHelper.tryUuidConversion(markId));
+ mappedTo = mappedToMark;
+ if (mappedToMark == null) {
+ logger.warning("No mark found for id " + markId);
+ return Response.status(Status.BAD_REQUEST).entity("No mark found for id " + markId)
+ .type(MediaType.TEXT_PLAIN).build();
+ }
+
+ }
+ final String mappedToTypeString;
+ if (competitorId != null) {
+ mappedToTypeString = "competitor";
+ } else {
+ mappedToTypeString = (markId != null) ? "mark" : "boat";
+ }
+ OpenEndedDeviceMappingFinder finder = new OpenEndedDeviceMappingFinder(isRegattaLike.getRegattaLog(), mappedTo,
+ deviceUuid);
+ Serializable deviceMappingEventId = finder.analyze();
+ if (deviceMappingEventId == null) {
+ logger.warning("No corresponding open " + mappedToTypeString + " to device mapping has been found");
+ return Response.status(Status.BAD_REQUEST)
+ .entity("No corresponding open " + mappedToTypeString + " to device mapping has been found")
.type(MediaType.TEXT_PLAIN).build();
}
+ RegattaLogCloseOpenEndedDeviceMappingEventImpl event = new RegattaLogCloseOpenEndedDeviceMappingEventImpl(now,
+ author, deviceMappingEventId, closingTimePointInclusive);
+ isRegattaLike.getRegattaLog().add(event);
+ logger.fine("Successfully checked out " + mappedToTypeString + mappedTo.getName());
+ response = Response.status(Status.OK).build();
} else {
- // map to mark
- DomainFactory domainFactory = getService().getDomainObjectFactory().getBaseDomainFactory();
- final Mark mappedToMark = domainFactory.getExistingMarkById(UUIDHelper.tryUuidConversion(markId));
- mappedTo = mappedToMark;
- if (mappedToMark == null) {
- logger.warning("No mark found for id " + markId);
- return Response.status(Status.BAD_REQUEST).entity("No mark found for id " + markId)
- .type(MediaType.TEXT_PLAIN).build();
- }
-
+ response = Response.status(Status.FORBIDDEN).build();
}
- final String mappedToTypeString;
- if (competitorId != null) {
- mappedToTypeString = "competitor";
- } else {
- mappedToTypeString = (markId != null) ? "mark" : "boat";
- }
- OpenEndedDeviceMappingFinder finder = new OpenEndedDeviceMappingFinder(isRegattaLike.getRegattaLog(), mappedTo,
- deviceUuid);
- Serializable deviceMappingEventId = finder.analyze();
- if (deviceMappingEventId == null) {
- logger.warning("No corresponding open " + mappedToTypeString + " to device mapping has been found");
- return Response.status(Status.BAD_REQUEST)
- .entity("No corresponding open " + mappedToTypeString + " to device mapping has been found")
- .type(MediaType.TEXT_PLAIN).build();
- }
- RegattaLogCloseOpenEndedDeviceMappingEventImpl event = new RegattaLogCloseOpenEndedDeviceMappingEventImpl(now,
- author, deviceMappingEventId, closingTimePointInclusive);
- isRegattaLike.getRegattaLog().add(event);
- logger.fine("Successfully checked out " + mappedToTypeString + mappedTo.getName());
- response = Response.status(Status.OK).build();
return response;
}
diff --git a/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckoutPostDoc.html b/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckoutPostDoc.html
index c09811db1cc..08d2d4efbc4 100644
--- a/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckoutPostDoc.html
+++ b/java/com.sap.sailing.server.gateway/webservices/api/v1/leaderboardCheckoutPostDoc.html
@@ -33,7 +33,9 @@
| Optional parameters: |
- None |
+
+secret: The regatta registration link secret can be included as an alternative to a bearertoken, if it is equal to the one stored in the regatta associated to the leaderboard, the caller will be permitted ignoring all normal permission checks
+ |
| Request method: |
@@ -58,6 +60,7 @@
{
"markId" : "af855a56-9726-4a9c-a77e-da955bd289bg",
"deviceUuid" : "af855a56-9726-4a9c-a77e-da955bd289bf",
+ "secret" : "0257p9;aso8ry;hfdee",
"toMillis" : 1415624564719
}