diff --git a/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/CompetitorTrackWithEstimationDataJsonSerializer.java b/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/CompetitorTrackWithEstimationDataJsonSerializer.java index 7b7d9032416..e593d9e9a81 100644 --- a/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/CompetitorTrackWithEstimationDataJsonSerializer.java +++ b/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/CompetitorTrackWithEstimationDataJsonSerializer.java @@ -8,6 +8,7 @@ import org.json.simple.JSONObject; import com.sap.sailing.domain.base.BoatClass; import com.sap.sailing.domain.base.Competitor; import com.sap.sailing.domain.base.Waypoint; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.domain.common.tracking.GPSFixMoving; import com.sap.sailing.domain.maneuverdetection.impl.ManeuverDetectorImpl; import com.sap.sailing.domain.maneuverdetection.impl.TrackTimeInfo; @@ -19,6 +20,7 @@ import com.sap.sse.common.Duration; import com.sap.sse.common.TimePoint; import com.sap.sse.common.Util; import com.sap.sse.common.impl.MillisecondsDurationImpl; +import com.sap.sse.security.SecurityService; /** * @@ -40,12 +42,13 @@ public class CompetitorTrackWithEstimationDataJsonSerializer extends AbstractTra private final BoatClassJsonSerializer boatClassJsonSerializer; private final CompetitorTrackElementsJsonSerializer elementsJsonSerializer; private final PolarDataService polarDataService; + private final SecurityService securityService; private final Integer startBeforeStartLineInSeconds; private final Integer endBeforeStartLineInSeconds; private final Integer startAfterFinishLineInSeconds; private final Integer endAfterFinishLineInSeconds; - public CompetitorTrackWithEstimationDataJsonSerializer(PolarDataService polarDataService, + public CompetitorTrackWithEstimationDataJsonSerializer(PolarDataService polarDataService, SecurityService securityService, BoatClassJsonSerializer boatClassJsonSerializer, CompetitorTrackElementsJsonSerializer elementsJsonSerializer, Integer startBeforeStartLineInSeconds, Integer endBeforeStartLineInSeconds, Integer startAfterFinishLineInSeconds, @@ -57,6 +60,7 @@ public class CompetitorTrackWithEstimationDataJsonSerializer extends AbstractTra this.endBeforeStartLineInSeconds = endBeforeStartLineInSeconds; this.startAfterFinishLineInSeconds = startAfterFinishLineInSeconds; this.endAfterFinishLineInSeconds = endAfterFinishLineInSeconds; + this.securityService = securityService; } @Override @@ -65,54 +69,58 @@ public class CompetitorTrackWithEstimationDataJsonSerializer extends AbstractTra JSONArray byCompetitorJson = new JSONArray(); result.put(BYCOMPETITOR, byCompetitorJson); for (Competitor competitor : trackedRace.getRace().getCompetitors()) { - ManeuverDetectorImpl maneuverDetector = new ManeuverDetectorImpl(trackedRace, competitor); - TrackTimeInfo trackTimeInfo = maneuverDetector.getTrackTimeInfo(); - if (trackTimeInfo != null) { - TimePoint from = null; - TimePoint to = null; - if (startBeforeStartLineInSeconds != null) { - from = trackTimeInfo.getTrackStartTimePoint() - .minus(new MillisecondsDurationImpl(startBeforeStartLineInSeconds * 1000L)); - } else if (startAfterFinishLineInSeconds != null) { - from = trackTimeInfo.getTrackEndTimePoint() - .plus(new MillisecondsDurationImpl(startAfterFinishLineInSeconds * 1000L)); - } else { - from = trackTimeInfo.getTrackStartTimePoint(); + if (securityService.hasCurrentUserExplictPermissions(competitor, + SecuredDomainType.CompetitorAndBoatActions.LIST)) { + ManeuverDetectorImpl maneuverDetector = new ManeuverDetectorImpl(trackedRace, competitor); + TrackTimeInfo trackTimeInfo = maneuverDetector.getTrackTimeInfo(); + if (trackTimeInfo != null) { + TimePoint from = null; + TimePoint to = null; + if (startBeforeStartLineInSeconds != null) { + from = trackTimeInfo.getTrackStartTimePoint() + .minus(new MillisecondsDurationImpl(startBeforeStartLineInSeconds * 1000L)); + } else if (startAfterFinishLineInSeconds != null) { + from = trackTimeInfo.getTrackEndTimePoint() + .plus(new MillisecondsDurationImpl(startAfterFinishLineInSeconds * 1000L)); + } else { + from = trackTimeInfo.getTrackStartTimePoint(); + } + if (endAfterFinishLineInSeconds != null) { + to = trackTimeInfo.getTrackEndTimePoint() + .plus(new MillisecondsDurationImpl(endAfterFinishLineInSeconds * 1000L)); + } else if (endBeforeStartLineInSeconds != null) { + to = trackTimeInfo.getTrackStartTimePoint() + .minus(new MillisecondsDurationImpl(endBeforeStartLineInSeconds * 1000L)); + } else { + to = trackTimeInfo.getTrackEndTimePoint(); + } + final JSONObject forCompetitorJson = new JSONObject(); + byCompetitorJson.add(forCompetitorJson); + forCompetitorJson.put(COMPETITOR_NAME, competitor.getName()); + forCompetitorJson.put(BOAT_CLASS, boatClassJsonSerializer + .serialize(trackedRace.getRace().getBoatOfCompetitor(competitor).getBoatClass())); + forCompetitorJson.put(FIXES_COUNT_FOR_POLARS, getFixesCountForPolars(trackedRace, competitor)); + Duration averageIntervalBetweenFixes = trackedRace.getTrack(competitor) + .getAverageIntervalBetweenFixes(); + forCompetitorJson.put(AVG_INTERVAL_BETWEEN_FIXES_IN_SECONDS, + averageIntervalBetweenFixes == null ? 0 : averageIntervalBetweenFixes.asSeconds()); + GPSFixTrack track = trackedRace.getTrack(competitor); + Double distanceTravelledInMeters = null; + if (trackTimeInfo.getTrackStartTimePoint() != null + && trackTimeInfo.getTrackEndTimePoint() != null) { + distanceTravelledInMeters = track.getDistanceTraveled(trackTimeInfo.getTrackStartTimePoint(), + trackTimeInfo.getTrackEndTimePoint()).getMeters(); + } + forCompetitorJson.put(DISTANCE_TRAVELLED_IN_METERS, distanceTravelledInMeters); + forCompetitorJson.put(START_TIME_POINT, trackTimeInfo.getTrackStartTimePoint() == null ? null + : trackTimeInfo.getTrackStartTimePoint().asMillis()); + forCompetitorJson.put(END_TIME_POINT, trackTimeInfo.getTrackEndTimePoint() == null ? null + : trackTimeInfo.getTrackEndTimePoint().asMillis()); + forCompetitorJson.put(MARK_PASSINGS_COUNT, getMarkPassingsCount(trackedRace, competitor)); + forCompetitorJson.put(WAYPOINTS_COUNT, getWaypointsCount(trackedRace)); + forCompetitorJson.put(ELEMENTS, + elementsJsonSerializer.serialize(trackedRace, competitor, from, to, trackTimeInfo)); } - if (endAfterFinishLineInSeconds != null) { - to = trackTimeInfo.getTrackEndTimePoint() - .plus(new MillisecondsDurationImpl(endAfterFinishLineInSeconds * 1000L)); - } else if (endBeforeStartLineInSeconds != null) { - to = trackTimeInfo.getTrackStartTimePoint() - .minus(new MillisecondsDurationImpl(endBeforeStartLineInSeconds * 1000L)); - } else { - to = trackTimeInfo.getTrackEndTimePoint(); - } - final JSONObject forCompetitorJson = new JSONObject(); - byCompetitorJson.add(forCompetitorJson); - forCompetitorJson.put(COMPETITOR_NAME, competitor.getName()); - forCompetitorJson.put(BOAT_CLASS, boatClassJsonSerializer - .serialize(trackedRace.getRace().getBoatOfCompetitor(competitor).getBoatClass())); - forCompetitorJson.put(FIXES_COUNT_FOR_POLARS, getFixesCountForPolars(trackedRace, competitor)); - Duration averageIntervalBetweenFixes = trackedRace.getTrack(competitor) - .getAverageIntervalBetweenFixes(); - forCompetitorJson.put(AVG_INTERVAL_BETWEEN_FIXES_IN_SECONDS, - averageIntervalBetweenFixes == null ? 0 : averageIntervalBetweenFixes.asSeconds()); - GPSFixTrack track = trackedRace.getTrack(competitor); - Double distanceTravelledInMeters = null; - if (trackTimeInfo.getTrackStartTimePoint() != null && trackTimeInfo.getTrackEndTimePoint() != null) { - distanceTravelledInMeters = track.getDistanceTraveled(trackTimeInfo.getTrackStartTimePoint(), - trackTimeInfo.getTrackEndTimePoint()).getMeters(); - } - forCompetitorJson.put(DISTANCE_TRAVELLED_IN_METERS, distanceTravelledInMeters); - forCompetitorJson.put(START_TIME_POINT, trackTimeInfo.getTrackStartTimePoint() == null ? null - : trackTimeInfo.getTrackStartTimePoint().asMillis()); - forCompetitorJson.put(END_TIME_POINT, trackTimeInfo.getTrackEndTimePoint() == null ? null - : trackTimeInfo.getTrackEndTimePoint().asMillis()); - forCompetitorJson.put(MARK_PASSINGS_COUNT, getMarkPassingsCount(trackedRace, competitor)); - forCompetitorJson.put(WAYPOINTS_COUNT, getWaypointsCount(trackedRace)); - forCompetitorJson.put(ELEMENTS, - elementsJsonSerializer.serialize(trackedRace, competitor, from, to, trackTimeInfo)); } } return result; diff --git a/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RaceEntriesJsonSerializer.java b/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RaceEntriesJsonSerializer.java index 17862d991c4..2e4fedfc5a4 100644 --- a/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RaceEntriesJsonSerializer.java +++ b/java/com.sap.sailing.server.gateway.serialization/src/com/sap/sailing/server/gateway/serialization/impl/RaceEntriesJsonSerializer.java @@ -9,21 +9,25 @@ import com.sap.sailing.domain.base.Boat; import com.sap.sailing.domain.base.Competitor; import com.sap.sailing.domain.base.RaceDefinition; import com.sap.sailing.domain.base.impl.DynamicBoat; +import com.sap.sailing.domain.common.security.SecuredDomainType; import com.sap.sailing.server.gateway.serialization.JsonSerializer; import com.sap.sse.common.Util.Pair; +import com.sap.sse.security.SecurityService; public class RaceEntriesJsonSerializer implements JsonSerializer { public static final String FIELD_NAME = "name"; public static final String FIELD_COMPETITORS = "competitors"; private final CompetitorAndBoatJsonSerializer competitorAndBoatSerializer; + private final SecurityService securityService; - public RaceEntriesJsonSerializer() { - this(null); + public RaceEntriesJsonSerializer(final SecurityService securityService) { + this(null, securityService); } - public RaceEntriesJsonSerializer(CompetitorAndBoatJsonSerializer competitorAndBoatSerializer) { + public RaceEntriesJsonSerializer(CompetitorAndBoatJsonSerializer competitorAndBoatSerializer, final SecurityService securityService) { this.competitorAndBoatSerializer = competitorAndBoatSerializer; + this.securityService = securityService; } public JSONObject serialize(RaceDefinition race) { @@ -32,8 +36,11 @@ public class RaceEntriesJsonSerializer implements JsonSerializer if(competitorAndBoatSerializer != null) { JSONArray competitorsJson = new JSONArray(); for (Entry competitorAndBoatEntry: race.getCompetitorsAndTheirBoats().entrySet()) { - competitorsJson.add(competitorAndBoatSerializer.serialize(new Pair<>(competitorAndBoatEntry.getKey(), - (DynamicBoat) competitorAndBoatEntry.getValue()))); + Competitor competitor = competitorAndBoatEntry.getKey(); + competitor = (securityService.hasCurrentUserExplictPermissions(competitor, SecuredDomainType.CompetitorAndBoatActions.LIST)) ? competitor : null; + DynamicBoat boat = (DynamicBoat) competitorAndBoatEntry.getValue(); + boat = (securityService.hasCurrentUserExplictPermissions(boat, SecuredDomainType.CompetitorAndBoatActions.LIST)) ? boat : null; + competitorsJson.add(competitorAndBoatSerializer.serialize(new Pair<>(competitor, boat))); } result.put(FIELD_COMPETITORS, competitorsJson); } diff --git a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java index d744a7f55fa..e6d3190a723 100644 --- a/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java +++ b/java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java @@ -302,7 +302,7 @@ public class RegattasResource extends AbstractSailingServerResource { response = getBadRaceErrorResponse(regattaName, raceName); } else { CompetitorAndBoatJsonSerializer competitorAndBoatJsonSerializer = CompetitorAndBoatJsonSerializer.create(); - JsonSerializer raceEntriesSerializer = new RaceEntriesJsonSerializer(competitorAndBoatJsonSerializer); + JsonSerializer raceEntriesSerializer = new RaceEntriesJsonSerializer(competitorAndBoatJsonSerializer, getSecurityService()); JSONObject serializedRaceEntries = raceEntriesSerializer.serialize(race); String json = serializedRaceEntries.toJSONString(); response = Response.ok(json).header("Content-Type", MediaType.APPLICATION_JSON + ";charset=UTF-8").build(); @@ -358,6 +358,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (competitor == null) { response = getBadCompetitorIdResponse(competitorId); } else { + getSecurityService().checkCurrentUserExplicitPermissions(competitor, SecuredDomainType.CompetitorAndBoatActions.LIST, SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC); regatta.registerCompetitor(competitor); response = Response.ok().build(); } @@ -597,6 +598,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (boat == null) { response = Response.status(Status.NOT_FOUND).entity("Boat is not valid").type(MediaType.TEXT_PLAIN).build(); } else { + getSecurityService().checkCurrentUserExplicitPermissions(boat, SecuredDomainType.CompetitorAndBoatActions.LIST, SecuredDomainType.CompetitorAndBoatActions.READ_PUBLIC); response = createAndAddCompetitor(regattaName, nationalityThreeLetterIOCCode, displayColor, timeOnTimeFactor, timeOnDistanceAllowancePerNauticalMileAsMillis, searchTag, competitorName, competitorShortName, competitorEmail, flagImageURI, teamImageURI, t -> boat, deviceUuid, @@ -651,6 +653,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (competitor == null) { response = getBadCompetitorIdResponse(competitorId); } else { + getSecurityService().checkCurrentUserExplicitPermissions(competitor, SecuredDomainType.CompetitorAndBoatActions.LIST); regatta.deregisterCompetitor(competitor); response = Response.ok().build(); } @@ -838,6 +841,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { return getBadRegattaErrorResponse(regattaName); } + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { @@ -958,6 +962,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -997,6 +1002,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1038,6 +1044,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1141,6 +1148,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1175,47 +1183,55 @@ public class RegattasResource extends AbstractSailingServerResource { Regatta regatta = findRegattaByName(regattaName); if (regatta == null) { response = Response.status(Status.NOT_FOUND) - .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) - .build(); - } else if (!((fromtime != null && totime != null) || (fromtimeasmillis != null && totimeasmillis != null))) { - response = Response.status(Status.NOT_FOUND) - .entity("Either the 'fromtime' and 'totime' or the 'fromtimeasmillis' and 'totimeasmillis' parameter must be set.").type(MediaType.TEXT_PLAIN) - .build(); + .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.") + .type(MediaType.TEXT_PLAIN).build(); } else { - RaceDefinition race = findRaceByName(regatta, raceName); - if (race == null) { - response = Response.status(Status.NOT_FOUND) - .entity("Could not find a race with name '" + StringEscapeUtils.escapeHtml(raceName) + "'.").type(MediaType.TEXT_PLAIN) - .build(); + getSecurityService().checkCurrentUserReadPermission(regatta); + if (!((fromtime != null && totime != null) || (fromtimeasmillis != null && totimeasmillis != null))) { + + response = Response.status(Status.NOT_FOUND).entity( + "Either the 'fromtime' and 'totime' or the 'fromtimeasmillis' and 'totimeasmillis' parameter must be set.") + .type(MediaType.TEXT_PLAIN).build(); } else { - TrackedRace trackedRace = findTrackedRace(regattaName, raceName); - - TimePoint from; - TimePoint to; - try { - from = parseTimePoint(fromtime, fromtimeasmillis, - trackedRace.getStartOfRace() == null ? new MillisecondsTimePoint(0) : - /* 24h before race start */new MillisecondsTimePoint(trackedRace.getStartOfRace() - .asMillis() - 24 * 3600 * 1000)); - } catch (InvalidDateException e1) { - return Response.status(Status.INTERNAL_SERVER_ERROR).entity("Could not parse the 'from' time.") + RaceDefinition race = findRaceByName(regatta, raceName); + if (race == null) { + response = Response.status(Status.NOT_FOUND) + .entity("Could not find a race with name '" + StringEscapeUtils.escapeHtml(raceName) + "'.") .type(MediaType.TEXT_PLAIN).build(); - } - try { - to = parseTimePoint(totime, totimeasmillis, MillisecondsTimePoint.now()); - } catch (InvalidDateException e1) { - return Response.status(Status.INTERNAL_SERVER_ERROR).entity("Could not parse the 'to' time.") - .type(MediaType.TEXT_PLAIN).build(); - } - // Crop request interval to startOfTracking / [endOfTracking|timePointOfLastEvent] - final TimePoint finalFrom = Util.getLatestOfTimePoints(from, trackedRace.getStartOfTracking()); - final TimePoint finalTo = Util.getEarliestOfTimePoints(to, Util.getEarliestOfTimePoints(trackedRace.getEndOfTracking(), trackedRace.getTimePointOfNewestEvent())); - TrackedRaceJsonSerializer serializer = new TrackedRaceJsonSerializer( - ws->new DefaultWindTrackJsonSerializer(/* maxNumberOfFixes */ 10000, finalFrom, finalTo, ws), windSource, windSourceId); + } else { + TrackedRace trackedRace = findTrackedRace(regattaName, raceName); - JSONObject jsonWindTracks = serializer.serialize(trackedRace); - String json = jsonWindTracks.toJSONString(); - return Response.ok(json).header("Content-Type", MediaType.APPLICATION_JSON + ";charset=UTF-8").build(); + TimePoint from; + TimePoint to; + try { + from = parseTimePoint(fromtime, fromtimeasmillis, + trackedRace.getStartOfRace() == null ? new MillisecondsTimePoint(0) : + /* 24h before race start */new MillisecondsTimePoint( + trackedRace.getStartOfRace().asMillis() - 24 * 3600 * 1000)); + } catch (InvalidDateException e1) { + return Response.status(Status.INTERNAL_SERVER_ERROR).entity("Could not parse the 'from' time.") + .type(MediaType.TEXT_PLAIN).build(); + } + try { + to = parseTimePoint(totime, totimeasmillis, MillisecondsTimePoint.now()); + } catch (InvalidDateException e1) { + return Response.status(Status.INTERNAL_SERVER_ERROR).entity("Could not parse the 'to' time.") + .type(MediaType.TEXT_PLAIN).build(); + } + // Crop request interval to startOfTracking / [endOfTracking|timePointOfLastEvent] + final TimePoint finalFrom = Util.getLatestOfTimePoints(from, trackedRace.getStartOfTracking()); + final TimePoint finalTo = Util.getEarliestOfTimePoints(to, Util.getEarliestOfTimePoints( + trackedRace.getEndOfTracking(), trackedRace.getTimePointOfNewestEvent())); + TrackedRaceJsonSerializer serializer = new TrackedRaceJsonSerializer( + ws -> new DefaultWindTrackJsonSerializer(/* maxNumberOfFixes */ 10000, finalFrom, finalTo, + ws), + windSource, windSourceId); + + JSONObject jsonWindTracks = serializer.serialize(trackedRace); + String json = jsonWindTracks.toJSONString(); + return Response.ok(json).header("Content-Type", MediaType.APPLICATION_JSON + ";charset=UTF-8") + .build(); + } } } return response; @@ -1234,6 +1250,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1274,6 +1291,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1318,6 +1336,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.") .type(MediaType.TEXT_PLAIN).build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1388,6 +1407,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.") .type(MediaType.TEXT_PLAIN).build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1396,7 +1416,7 @@ public class RegattasResource extends AbstractSailingServerResource { } else { TrackedRace trackedRace = findTrackedRace(regattaName, raceName); CompetitorTrackWithEstimationDataJsonSerializer serializer = new CompetitorTrackWithEstimationDataJsonSerializer( - getService().getPolarDataService(), new DetailedBoatClassJsonSerializer(), + getService().getPolarDataService(), getSecurityService(), new DetailedBoatClassJsonSerializer(), new CompleteManeuverCurvesWithEstimationDataJsonSerializer(getService().getPolarDataService(), new CompleteManeuverCurveWithEstimationDataJsonSerializer( new ManeuverMainCurveWithEstimationDataJsonSerializer(), @@ -1436,6 +1456,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.") .type(MediaType.TEXT_PLAIN).build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1444,7 +1465,7 @@ public class RegattasResource extends AbstractSailingServerResource { } else { TrackedRace trackedRace = findTrackedRace(regattaName, raceName); CompetitorTrackWithEstimationDataJsonSerializer serializer = new CompetitorTrackWithEstimationDataJsonSerializer( - getService().getPolarDataService(), new DetailedBoatClassJsonSerializer(), + getService().getPolarDataService(), getSecurityService(), new DetailedBoatClassJsonSerializer(), new GpsFixesWithEstimationDataJsonSerializer(new GPSFixMovingJsonSerializer(), new ManeuverWindJsonSerializer(), addWind, addNextWaypoint, smoothFixes), getNullableValueFromDefault(startBeforeStartLineInSeconds), @@ -1474,6 +1495,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); JSONObject jsonRaceResults = new JSONObject(); jsonRaceResults.put("regatta", regatta.getName()); JSONArray jsonRaces = new JSONArray(); @@ -1502,6 +1524,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1669,6 +1692,7 @@ public class RegattasResource extends AbstractSailingServerResource { .entity("Could not find a regatta with name '" + StringEscapeUtils.escapeHtml(regattaName) + "'.").type(MediaType.TEXT_PLAIN) .build(); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = Response.status(Status.NOT_FOUND) @@ -1809,6 +1833,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); response = getDataMiningResource().avgSpeedPerCompetitorAndLegType(regattaName); } return response; @@ -1824,6 +1849,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1844,6 +1870,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); response = getDataMiningResource().sumDistanceTraveledPerCompetitorAndLegType(regattaName); } return response; @@ -1859,6 +1886,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1879,6 +1907,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); response = getDataMiningResource().sumManeuversPerCompetitor(regattaName); } return response; @@ -1894,6 +1923,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1914,6 +1944,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); response = getDataMiningResource().avgSpeedPerCompetitor(regattaName); } return response; @@ -1928,6 +1959,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1947,6 +1979,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); response = getDataMiningResource().sumDistanceTraveledPerCompetitor(regattaName); } return response; @@ -1961,6 +1994,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); RaceDefinition race = findRaceByName(regatta, raceName); if (race == null) { response = getBadRaceErrorResponse(regattaName, raceName); @@ -1982,6 +2016,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); final JSONArray jsonResponse = new JSONArray(); final Series series = getSeriesUsingLastAsDefault(regatta, toSeries); if (series == null) { @@ -2015,6 +2050,7 @@ public class RegattasResource extends AbstractSailingServerResource { if (regatta == null) { response = getBadRegattaErrorResponse(regattaName); } else { + getSecurityService().checkCurrentUserReadPermission(regatta); boolean found = false; for (final Series series : regatta.getSeries()) { if (series.getRaceColumnByName(raceColumnName) != null) {