Merge branch 'permission-vertical' into bug4813

Conflicts:
	java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java

java/com.sap.sailing.domain.swisstimingadapter.persistence/src/com/sap/sailing/domain/swisstimingadapter/persistence/impl/SwissTimingAdapterPersistenceImpl.java

@@ -108,7 +108,7 @@ public class SwissTimingAdapterPersistenceImpl implements SwissTimingAdapterPers
 
         final Document updateQuery = new Document(FieldNames.ST_CONFIG_JSON_URL.name(),
                 swissTimingConfiguration.getJsonURL());
-        stConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).updateOne(updateQuery, result,
+        stConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).replaceOne(updateQuery, result,
                 new UpdateOptions().upsert(true));
     }
 
@@ -125,7 +125,7 @@ public class SwissTimingAdapterPersistenceImpl implements SwissTimingAdapterPers
         Document result = new Document();
         result.put(FieldNames.ST_ARCHIVE_JSON_URL.name(), createSwissTimingArchiveConfiguration.getJsonURL());
         
-        stArchiveConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).updateOne(result, result,
+        stArchiveConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).replaceOne(result, result,
                 new UpdateOptions().upsert(true));
     }
 

java/com.sap.sailing.domain.tractracadapter.persistence/src/com/sap/sailing/domain/tractracadapter/persistence/impl/MongoObjectFactoryImpl.java

@@ -39,7 +39,7 @@ public class MongoObjectFactoryImpl implements MongoObjectFactory {
         // Object with given name is updated or created if it does not exist yet
         final Document updateQuery = new Document(FieldNames.TT_CONFIG_JSON_URL.name(),
                 tracTracConfiguration.getJSONURL());
-        ttConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).updateOne(updateQuery, result,
+        ttConfigCollection.withWriteConcern(WriteConcern.ACKNOWLEDGED).replaceOne(updateQuery, result,
                 new UpdateOptions().upsert(true));
     }
 

java/com.sap.sailing.server/SailingServer (No Proxy, winddbTest).launch

@@ -29,9 +29,9 @@
 <stringAttribute key="profilingTraceType-PERFORMANCE_HOTSPOT_TRACE" value="KEY_SESSION_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_USER_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_REQUEST_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_IGNORE_SLEEPING_THREADS%CTX_KEY%true%CTX_ENTRY%KEY_APPLICATION_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_ENABLEMENT%CTX_KEY%false%CTX_ENTRY%"/>
 <stringAttribute key="profilingTraceType-SYNCHRONIZATION_TRACE" value="KEY_SESSION_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_USER_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_REQUEST_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_APPLICATION_FILTER%CTX_KEY%*%CTX_ENTRY%KEY_ENABLEMENT%CTX_KEY%false%CTX_ENTRY%"/>
 <booleanAttribute key="show_selected_only" value="false"/>
-<stringAttribute key="target_bundles" value="com.fasterxml.jackson.core.jackson-annotations@default:default,com.fasterxml.jackson.core.jackson-core@default:default,com.fasterxml.jackson.core.jackson-databind@default:default,com.rabbitmq.client@default:default,com.sun.jersey.contribs.jersey-multipart@default:default,com.sun.jersey@default:default,com.sun.mail.javax.mail@default:default,jackson-core-asl@default:default,jackson-jaxrs@default:default,jackson-mapper-asl@default:default,javax.servlet@default:default,javax.validation@default:default,javax.ws.rs@default:default,jcl.over.slf4j@default:default,lz4-java@default:default,org.apache.commons.beanutils@default:default,org.apache.commons.codec@default:default,org.apache.commons.collections@default:default,org.apache.commons.fileupload@default:default,org.apache.commons.io@default:default,org.apache.commons.lang@default:default,org.apache.commons.math@default:default,org.apache.felix.gogo.command@default:default,org.apache.felix.gogo.runtime@default:default,org.apache.felix.gogo.shell@default:default,org.apache.httpcomponents.httpclient@default:default,org.apache.httpcomponents.httpcore@default:default,org.apache.poi.ooxml.schemas@default:default,org.apache.poi.ooxml@default:default,org.apache.poi@default:default,org.apache.servicemix.bundles.aws-java-sdk@default:default,org.apache.servicemix.bundles.ehcache@default:default,org.apache.servicemix.bundles.scribe@default:default,org.apache.servicemix.bundles.zxing@default:default,org.apache.shiro.core@default:default,org.apache.shiro.ehcache@default:default,org.apache.shiro.web@default:default,org.apache.xmlbeans@default:default,org.dom4j@default:default,org.eclipse.equinox.common@2:true,org.eclipse.equinox.console@default:default,org.eclipse.jetty.client@default:default,org.eclipse.jetty.deploy@default:default,org.eclipse.jetty.http@default:default,org.eclipse.jetty.io@default:default,org.eclipse.jetty.jmx@default:default,org.eclipse.jetty.osgi.boot@3:default,org.eclipse.jetty.security@default:default,org.eclipse.jetty.server@default:default,org.eclipse.jetty.servlet@default:default,org.eclipse.jetty.util@default:default,org.eclipse.jetty.webapp@default:default,org.eclipse.jetty.websocket.api@default:default,org.eclipse.jetty.websocket.client@default:default,org.eclipse.jetty.websocket.common@default:default,org.eclipse.jetty.xml@default:default,org.eclipse.osgi.services@default:default,org.eclipse.osgi@-1:true,org.hyperic.sigar@default:default,org.jdom@default:default,org.jvnet.mimepull@default:default,org.mongodb.mongo-java-driver@default:default,org.objectweb.asm@default:default,routeconverter@default:default,slf4j.api@default:default,slf4j.jdk14@default:false"/>
+<stringAttribute key="target_bundles" value="routeconverter@default:default,org.apache.commons.codec@default:default,org.apache.poi@default:default,org.apache.poi.ooxml@default:default,org.apache.poi.ooxml.schemas@default:default,org.dom4j@default:default,org.apache.xmlbeans@default:default,org.apache.commons.math@default:default,org.apache.httpcomponents.httpclient@default:default,org.apache.httpcomponents.httpcore@default:default,org.objectweb.asm@default:default,org.hyperic.sigar@default:default,com.sun.jersey.contribs.jersey-multipart@default:default,javax.validation@default:default,org.apache.commons.fileupload@default:default,org.jdom@default:default,org.jvnet.mimepull@default:default,org.eclipse.jetty.osgi.boot@3:true,slf4j.jdk14@default:default,org.apache.felix.shell@0:true,org.apache.felix.shell.remote@0:true,lz4-java@default:default,javax.servlet@default:default,org.apache.felix.gogo.command@default:default,org.apache.felix.gogo.runtime@default:default,org.apache.felix.gogo.shell@default:default,org.eclipse.jetty.deploy@4:true,org.eclipse.jetty.http@4:true,org.eclipse.jetty.io@4:true,org.eclipse.jetty.jmx@4:true,org.eclipse.jetty.security@4:true,org.eclipse.jetty.server@4:true,org.eclipse.jetty.servlet@4:true,org.eclipse.jetty.util@4:true,org.eclipse.jetty.webapp@4:true,org.eclipse.jetty.websocket.api@default:default,org.eclipse.jetty.websocket.client@default:default,org.eclipse.jetty.websocket.common@default:default,org.eclipse.jetty.xml@4:true,slf4j.api@default:default,org.apache.servicemix.bundles.zxing@default:default,com.google.gwt.servlet@default:default,com.google.gwt.user@default:default,com.fasterxml.jackson.core.jackson-annotations@default:default,com.fasterxml.jackson.core.jackson-core@default:default,com.fasterxml.jackson.core.jackson-databind@default:default,org.apache.commons.io@default:default,jcl.over.slf4j@default:default,org.apache.servicemix.bundles.aws-java-sdk@default:default,com.sun.mail.javax.mail@default:default,com.rabbitmq.client@default:default,org.apache.commons.lang@default:default,jackson-jaxrs@default:default,com.sun.jersey@default:default,javax.ws.rs@default:default,org.apache.commons.beanutils@default:default,org.apache.servicemix.bundles.ehcache@default:default,org.apache.servicemix.bundles.scribe@default:default,org.apache.shiro.core@default:default,org.apache.shiro.ehcache@default:default,org.apache.shiro.web@default:default,jackson-core-asl@default:default,jackson-mapper-asl@default:default,org.apache.commons.collections@default:default,org.eclipse.jetty.client@default:default,javax.xml@default:default,com.sun.activation.javax.activation@default:default,org.eclipse.equinox.common@2:true,org.eclipse.equinox.console@default:default,org.eclipse.equinox.launcher@default:default,org.eclipse.equinox.simpleconfigurator@2:true,org.eclipse.osgi@default:default,org.eclipse.osgi.services@default:default,org.eclipse.equinox.cm@default:default,com.sun.istack.commons-runtime@default:default,jaxb-api@default:default,com.sun.xml.bind.jaxb-impl@default:default,javax.xml.stream@default:default,javax.xml.ws@default:default,org.eclipse.osgi.util@default:default,org.eclipse.orbit.mongodb@default:default"/>
 <booleanAttribute key="tracing" value="false"/>
 <booleanAttribute key="useCustomFeatures" value="false"/>
 <booleanAttribute key="useDefaultConfigArea" value="false"/>
-<stringAttribute key="workspace_bundles" value="com.google.gwt.servlet@default:default,com.googlecode.java-diff-utils@default:default,com.googlecode.mgwt@default:default,com.sap.sailing.barbados.resultimport@default:default,com.sap.sailing.competitorimport@default:default,com.sap.sailing.dashboards.gwt@5:true,com.sap.sailing.datamining.provider@default:default,com.sap.sailing.datamining.shared@default:default,com.sap.sailing.datamining@default:default,com.sap.sailing.declination@default:default,com.sap.sailing.domain.common@default:default,com.sap.sailing.domain.deckmanadapter@4:true,com.sap.sailing.domain.expeditionadapter@4:true,com.sap.sailing.domain.igtimiadapter.persistence@default:default,com.sap.sailing.domain.igtimiadapter@default:default,com.sap.sailing.domain.persistence@default:default,com.sap.sailing.domain.racelogtrackingadapter@3:default,com.sap.sailing.domain.shared.android@default:default,com.sap.sailing.domain.swisstimingadapter.persistence@default:default,com.sap.sailing.domain.swisstimingadapter@4:true,com.sap.sailing.domain.swisstimingreplayadapter@4:true,com.sap.sailing.domain.tractracadapter.persistence@default:default,com.sap.sailing.domain.tractracadapter@4:true,com.sap.sailing.domain.windfinderadapter@4:true,com.sap.sailing.domain@default:default,com.sap.sailing.ess40.resultimport@default:default,com.sap.sailing.expeditionconnector.common@default:default,com.sap.sailing.expeditionconnector.persistence@3:true,com.sap.sailing.expeditionconnector@default:default,com.sap.sailing.freg.resultimport@default:default,com.sap.sailing.geocoding@default:default,com.sap.sailing.grib@default:default,com.sap.sailing.gwt.ui@5:true,com.sap.sailing.kiworesultimport@default:default,com.sap.sailing.manage2sail.resultimport@default:default,com.sap.sailing.manage2sail@default:default,com.sap.sailing.news@default:default,com.sap.sailing.nmeaconnector@default:default,com.sap.sailing.polars.datamining.shared@default:default,com.sap.sailing.polars.datamining@default:default,com.sap.sailing.polars@4:true,com.sap.sailing.resultimport@default:default,com.sap.sailing.sailwave.resultimport@default:default,com.sap.sailing.server.gateway.serialization.shared.android@default:default,com.sap.sailing.server.gateway.serialization@default:default,com.sap.sailing.server.gateway.test.support@default:default,com.sap.sailing.server.gateway@5:true,com.sap.sailing.server.trackfiles@default:default,com.sap.sailing.server@default:default,com.sap.sailing.simulator@default:default,com.sap.sailing.udpconnector@default:default,com.sap.sailing.velum.resultimport@default:default,com.sap.sailing.www@4:true,com.sap.sailing.xrr.resultimport@default:default,com.sap.sailing.xrr.schema@default:default,com.sap.sailing.xrr.structureimport@default:default,com.sap.sailing.yachtscoring.resultimport@default:default,com.sap.sse.common@default:default,com.sap.sse.datamining.annotations@default:default,com.sap.sse.datamining.shared@default:default,com.sap.sse.datamining.ui@default:default,com.sap.sse.datamining@default:default,com.sap.sse.filestorage@default:default,com.sap.sse.gwt.adminconsole@default:default,com.sap.sse.gwt@default:default,com.sap.sse.mail@4:true,com.sap.sse.mongodb@default:default,com.sap.sse.operationaltransformation@default:default,com.sap.sse.replication@4:true,com.sap.sse.security.common@default:default,com.sap.sse.security.ui@6:true,com.sap.sse.security.userstore.mongodb@4:true,com.sap.sse.security@5:true,com.sap.sse.shared.android@default:default,com.sap.sse@default:default,com.tractrac.clientmodule@default:default,net.sf.marineapi@default:default,org.json.simple@default:default,org.moxieapps.gwt.highcharts@default:default,org.mp4parser.isoparser@default:default"/>
+<stringAttribute key="workspace_bundles" value="com.sap.sailing.geocoding@default:default,com.sap.sailing.domain.common@default:default,com.sap.sailing.domain@default:default,com.sap.sailing.news@4:true,com.sap.sailing.domain.tractracadapter@5:true,com.sap.sailing.expeditionconnector@default:default,com.sap.sailing.domain.windfinderadapter@4:true,com.sap.sailing.server@5:true,com.sap.sailing.server.gateway@5:true,com.tractrac.clientmodule@default:default,com.sap.sailing.declination@default:default,com.sap.sailing.domain.persistence@default:default,com.sap.sailing.domain.swisstimingadapter@5:true,com.sap.sailing.domain.swisstimingadapter.persistence@4:true,com.sap.sailing.domain.swisstimingreplayadapter@4:true,com.sap.sailing.domain.tractracadapter.persistence@4:true,com.sap.sailing.gwt.ui@6:true,com.sap.sailing.udpconnector@default:default,com.sap.sailing.xmlexport@5:true,com.sap.sailing.simulator@default:default,com.sap.sailing.www@5:true,com.sap.sailing.resultimport@4:true,com.sap.sailing.kiworesultimport@4:true,com.sap.sailing.ess40.resultimport@4:true,com.sap.sailing.freg.resultimport@4:true,com.sap.sailing.barbados.resultimport@4:true,com.sap.sailing.sailwave.resultimport@4:true,com.sap.sailing.manage2sail.resultimport@4:true,com.sap.sailing.yachtscoring.resultimport@4:true,com.sap.sailing.velum.resultimport@4:true,com.sap.sailing.monitoring@7:true,com.sap.sailing.xrr.resultimport@4:true,com.sap.sailing.domain.igtimiadapter@4:true,com.sap.sailing.domain.igtimiadapter.persistence@default:default,com.sap.sailing.domain.racelogtrackingadapter@4:true,com.sap.sailing.domain.deckmanadapter@5:true,com.sap.sailing.xrr.structureimport@default:default,com.sap.sailing.server.gateway.serialization.shared.android@default:default,com.sap.sailing.server.gateway.serialization@default:default,com.sap.sailing.dashboards.gwt@6:true,com.sap.sailing.dashboards.gwt@6:true,com.sap.sailing.datamining@5:true,com.sap.sailing.datamining.shared@default:default,com.sap.sailing.polars@5:true,com.sap.sailing.polars.datamining@5:true,com.sap.sailing.domain.shared.android@default:default,com.sap.sailing.manage2sail@default:default,com.sap.sailing.polars.datamining.shared@default:default,com.sap.sailing.xrr.schema@default:default,com.sap.sailing.server.trackfiles@default:default,com.sap.sailing.competitorimport@default:default,com.sap.sailing.datamining.provider@default:default,com.sap.sailing.grib@default:default,com.sap.sailing.nmeaconnector@default:default,com.sap.sailing.domain.expeditionadapter@5:true,com.sap.sailing.expeditionconnector.persistence@4:true,com.sap.sailing.expeditionconnector.common@default:default,com.sap.sailing.domain.bravoadapter@5:true,net.sf.marineapi@default:default,com.sap.sailing.routeconverterjava11extension@default:default,com.sap.sailing.server.interface@default:default,com.sap.sse.datamining.ui@default:default,com.tractrac.clientmodule@default:default,com.sap.sse.gwt@default:default,com.sap.sse.security@default:default,com.sap.sse.security.ui@6:true,com.sap.sse.security.userstore.mongodb@4:true,com.sap.sse@default:default,com.sap.sse.common@default:default,com.sap.sse.datamining@default:default,com.sap.sse.datamining.annotations@default:default,com.sap.sse.datamining.shared@default:default,com.sap.sse.gwt.adminconsole@default:default,com.sap.sse.mongodb@default:default,com.sap.sse.operationaltransformation@default:default,com.sap.sse.replication@6:true,com.sap.sse.filestorage@4:true,com.sap.sse.shared.android@default:default,com.sap.sse.mail@5:true,com.sap.sse.threadmanager@default:default,com.sap.sse.security.common@default:default,org.json.simple@default:default,com.sap.sse.jersey.jaxbdependencyfragment@default:default,org.moxieapps.gwt.highcharts@default:default,com.google.gwt.servlet@default:default,com.googlecode.mgwt@default:default,com.googlecode.java-diff-utils@default:default,com.github.branflake2267.gwt-maps-api@default:default,com.google.gwt.ajaxloader@default:default,org.mp4parser.isoparser@default:default,com.sap.sse.replication.interfaces@default:default"/>
 </launchConfiguration>

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractOwnership.java

@@ -2,7 +2,7 @@ package com.sap.sse.security.shared;
 
 import java.io.Serializable;
 
-public abstract class AbstractOwnership<G extends SecurityUserGroup, U extends SecurityUser<?, ?, ?>>
+public abstract class AbstractOwnership<G extends SecurityUserGroup, U extends UserReference>
         implements Serializable {
     private static final long serialVersionUID = 1L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractRole.java

@@ -12,11 +12,11 @@ import com.sap.sse.common.Util.Triple;
  * 
  * @author Axel Uhl (D043530)
  */
-public abstract class AbstractRole<RD extends RoleDefinition, G extends SecurityUserGroup, U extends SecurityUser<RD, ?, G>>
+public abstract class AbstractRole<RD extends RoleDefinition, G extends SecurityUserGroup, U extends UserReference>
         implements Named {
     private static final String QUALIFIER_SEPARATOR = WildcardPermission.PART_DIVIDER_TOKEN;
     private static final long serialVersionUID = 1243342091492822614L;
-    private RD roleDefinition;
+    protected RD roleDefinition;
     protected G qualifiedForTenant;
     protected U qualifiedForUser;
 
@@ -104,13 +104,19 @@ public abstract class AbstractRole<RD extends RoleDefinition, G extends Security
             return false;
         AbstractRole other = (AbstractRole) obj;
         if (qualifiedForTenant == null) {
-            if (other.qualifiedForTenant != null)
+            if (other.qualifiedForTenant != null) {
                 return false;
+            }
+        } else if (other.qualifiedForTenant == null) {
+            return false;
         } else if (!qualifiedForTenant.getId().equals(other.qualifiedForTenant.getId()))
             return false;
         if (qualifiedForUser == null) {
-            if (other.qualifiedForUser != null)
+            if (other.qualifiedForUser != null) {
                 return false;
+            }
+        } else if (other.qualifiedForUser == null) {
+            return false;
         } else if (!qualifiedForUser.getName().equals(other.qualifiedForUser.getName()))
             return false;
         if (roleDefinition == null) {

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/AbstractUserGroupImpl.java

@@ -9,7 +9,7 @@ import java.util.UUID;
  * @author Axel Uhl (d043530)
  *
  */
-public abstract class AbstractUserGroupImpl<U extends SecurityUser<?, ?, ?>>
+public abstract class AbstractUserGroupImpl<U extends UserReference>
         extends SecurityUserGroupImpl {
     private static final long serialVersionUID = 1L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionChecker.java

@@ -61,7 +61,7 @@ public class PermissionChecker {
      * @param acl
      *            may be {@code null} in which case no ACL-specific checks are performed
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
             WildcardPermission permission, U user, U allUser,
             O ownership, A acl) {
         return isPermitted(permission, user, (Iterable<G>) (user == null ? null : user.getUserGroups()), allUser,
@@ -80,7 +80,7 @@ public class PermissionChecker {
      * @param acl
      *            may be {@code null} in which case no ACL-specific checks are performed
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isPermitted(
             WildcardPermission permission, U user,
             Iterable<G> groupsOfWhichUserIsMember, U allUser,
             Iterable<G> allUserGroupsOfWhichUserIsMember, O ownership, A acl) {
@@ -180,7 +180,7 @@ public class PermissionChecker {
      * complete list for the running system. Otherwise we potentially do not check for all required types if the given
      * {@link WildcardPermission} has a wildcard as type part.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean checkMetaPermission(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean checkMetaPermission(
             WildcardPermission permission,
             Iterable<HasPermissions> allPermissionTypes, U user, U allUser, O ownership) {
         assert permission != null;
@@ -275,7 +275,7 @@ public class PermissionChecker {
      * because only users that have an unqualified version of a permission would pass that permission check. This means
      * we need to check the permission for any possibly existing object ID.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean hasUserAnyPermission(
+    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean hasUserAnyPermission(
             WildcardPermission permission,
             Iterable<HasPermissions> allPermissionTypes, U user, U allUser, O ownership) {
         assert permission != null;
@@ -293,7 +293,7 @@ public class PermissionChecker {
         return false;
     }
     
-    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> PermissionState checkUserPermissions(
+    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> PermissionState checkUserPermissions(
             WildcardPermission permission, U user,
             O ownership, WildcardPermissionChecker permissionChecker,
             boolean matchOnlyNonQualifiedRolesIfNoOwnershipIsGiven) {
@@ -336,7 +336,7 @@ public class PermissionChecker {
      * @param ownership
      *            Ownership of the data object for which the {@code permission} is requested
      */
-    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean implies(
+    private static <RD extends RoleDefinition, R extends AbstractRole<RD, G, UR>, O extends AbstractOwnership<G, UR>, UR extends UserReference, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean implies(
             R role, WildcardPermission permission, O ownership,
             WildcardPermissionChecker permissionChecker,
            boolean matchOnlyNonQualifiedRolesIfNoOwnershipIsGiven) {
@@ -373,8 +373,7 @@ public class PermissionChecker {
     /**
      * There are cases where need to check instances of different implementations if they represent the same user.
      */
-    public static <RD extends RoleDefinition, R extends AbstractRole<RD, G, U>, O extends AbstractOwnership<G, U>, U extends SecurityUser<RD, R, G>, G extends SecurityUserGroup, A extends SecurityAccessControlList<G>> boolean isSameUser(
-            U user1, U user2) {
+    public static boolean isSameUser(UserReference user1, UserReference user2) {
         if (user1 == user2) {
             return true;
         }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/SecurityUser.java

@@ -1,7 +1,6 @@
 package com.sap.sse.security.shared;
 
 import com.sap.sse.common.Named;
-import com.sap.sse.common.NamedWithID;
 import com.sap.sse.common.WithID;
 
 /**
@@ -13,7 +12,7 @@ import com.sap.sse.common.WithID;
  *
  */
 public interface SecurityUser<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup>
-        extends NamedWithID {
+        extends UserReference {
     /**
      * Returns the "raw" permissions explicitly set for this user. This does not include permissions
      * inferred by any {@link PermissionsForRoleProvider} for the {@link #getRoles() roles} that this

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/UserReference.java

@@ -0,0 +1,7 @@
+package com.sap.sse.security.shared;
+
+import com.sap.sse.common.NamedWithID;
+
+public interface UserReference extends NamedWithID {
+
+}

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/AccessControlListDTO.java

@@ -6,7 +6,7 @@ import java.util.Set;
 
 import com.sap.sse.security.shared.impl.AbstractAccessControlList;
 
-public class AccessControlListDTO extends AbstractAccessControlList<StrippedUserGroupDTO, StrippedUserDTO> {
+public class AccessControlListDTO extends AbstractAccessControlList<StrippedUserGroupDTO> {
 
     private static final long serialVersionUID = 2878270565599189728L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/StrippedUserDTO.java

@@ -1,35 +1,17 @@
 package com.sap.sse.security.shared.dto;
 
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
+import com.sap.sse.security.shared.impl.AbstractUserReference;
 
-import com.sap.sse.common.Util;
-import com.sap.sse.security.shared.WildcardPermission;
-import com.sap.sse.security.shared.impl.SecurityUserImpl;
-
-public class StrippedUserDTO extends SecurityUserImpl<RoleDefinitionDTO, RoleDTO, StrippedUserGroupDTO> {
+public class StrippedUserDTO extends AbstractUserReference {
     private static final long serialVersionUID = 1L;
     
-    private Set<RoleDTO> roles;
     
     @Deprecated
     private StrippedUserDTO() {
         super(null);
     }
 
-    public StrippedUserDTO(String name, Iterable<RoleDTO> roles, Iterable<WildcardPermission> permissions) {
-        super(name, permissions);
-        roles = new HashSet<>();
-        Util.addAll(roles, this.getRolesInternal());
-    }
-
     public StrippedUserDTO(String name) {
-        this(name, Collections.<RoleDTO>emptySet(), Collections.<WildcardPermission>emptySet());
-    }
-    
-    @Override
-    protected Set<RoleDTO> getRolesInternal() {
-        return roles;
+        super(name);
     }
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/dto/UserDTO.java

@@ -2,15 +2,18 @@ package com.sap.sse.security.shared.dto;
 
 import java.io.Serializable;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 import com.sap.sse.common.Named;
 import com.sap.sse.common.Util;
 import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
 import com.sap.sse.security.shared.WildcardPermission;
 import com.sap.sse.security.shared.impl.Ownership;
+import com.sap.sse.security.shared.impl.SecurityUserImpl;
 
-public class UserDTO extends StrippedUserDTO
+public class UserDTO extends SecurityUserImpl<RoleDefinitionDTO, RoleDTO, StrippedUserGroupDTO>
         implements Named, Serializable, SecuredDTO {
 
     private static final long serialVersionUID = 7556217539893146187L;
@@ -25,6 +28,8 @@ public class UserDTO extends StrippedUserDTO
     private SecurityInformationDTO securityInformation = new SecurityInformationDTO();
     private StrippedUserGroupDTO defaultTenantForCurrentServer;
 
+    private Set<RoleDTO> roles;
+
     @Deprecated // gwt only
     UserDTO() {
         super(null);
@@ -37,7 +42,7 @@ public class UserDTO extends StrippedUserDTO
             List<AccountDTO> accounts, Iterable<RoleDTO> roles, StrippedUserGroupDTO defaultTenant,
             Iterable<WildcardPermission> permissions,
             Iterable<StrippedUserGroupDTO> groups) {
-        super(name, roles, permissions);
+        super(name, permissions);
         this.defaultTenantForCurrentServer = defaultTenant;
         this.email = email;
         this.fullName = fullName;
@@ -47,6 +52,13 @@ public class UserDTO extends StrippedUserDTO
         this.accounts = accounts;
         this.groups = new ArrayList<>();
         Util.addAll(groups, this.groups);
+        this.roles = new HashSet<>();
+        Util.addAll(roles, this.getRolesInternal());
+    }
+    
+    @Override
+    protected Set<RoleDTO> getRolesInternal() {
+        return roles;
     }
 
     /**
@@ -132,6 +144,10 @@ public class UserDTO extends StrippedUserDTO
     public void setDefaultTenantForCurrentServer(StrippedUserGroupDTO defaultTenant) {
         this.defaultTenantForCurrentServer = defaultTenant;
     }
+    
+    public StrippedUserDTO asStrippedUser() {
+        return new StrippedUserDTO(getName());
+    }
 
     @Override
     public TypeRelativeObjectIdentifier getTypeRelativeObjectIdentifier(String... params) {

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/AbstractAccessControlList.java

@@ -9,11 +9,10 @@ import com.sap.sse.common.Util;
 import com.sap.sse.security.shared.PermissionChecker;
 import com.sap.sse.security.shared.PermissionChecker.PermissionState;
 import com.sap.sse.security.shared.SecurityAccessControlList;
-import com.sap.sse.security.shared.SecurityUser;
 import com.sap.sse.security.shared.SecurityUserGroup;
 import com.sap.sse.security.shared.WildcardPermission;
 
-public abstract class AbstractAccessControlList<G extends SecurityUserGroup, U extends SecurityUser<?, ?, G>>
+public abstract class AbstractAccessControlList<G extends SecurityUserGroup>
         implements SecurityAccessControlList<G> {
     private static final long serialVersionUID = -8587238587604749862L;
 

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/AbstractUserReference.java

@@ -0,0 +1,30 @@
+package com.sap.sse.security.shared.impl;
+
+import java.io.Serializable;
+
+import com.sap.sse.security.shared.UserReference;
+
+public abstract class AbstractUserReference implements UserReference {
+    private static final long serialVersionUID = -3639860207453072248L;
+
+    private String name;
+    
+    public AbstractUserReference(String name) {
+        this.name = name;
+    }
+    
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public Serializable getId() {
+        return getName();
+    }
+
+    @Override
+    public String toString() {
+        return name;
+    }
+}

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/AccessControlList.java

@@ -4,7 +4,7 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 
-public class AccessControlList extends AbstractAccessControlList<UserGroup, User> {
+public class AccessControlList extends AbstractAccessControlList<UserGroup> {
     private static final long serialVersionUID = 1L;
 
     public AccessControlList(Map<UserGroup, Set<String>> permissionMap) {

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecurityUserImpl.java

@@ -1,6 +1,5 @@
 package com.sap.sse.security.shared.impl;
 
-import java.io.Serializable;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
@@ -13,11 +12,9 @@ import com.sap.sse.security.shared.TypeRelativeObjectIdentifier;
 import com.sap.sse.security.shared.WildcardPermission;
 
 public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends AbstractRole<RD, G, ?>, G extends SecurityUserGroup>
-        implements SecurityUser<RD, R, G> {
+        extends AbstractUserReference implements SecurityUser<RD, R, G> {
     private static final long serialVersionUID = -3639860207453072248L;
 
-    private String name;
-    
     private Set<WildcardPermission> permissions;
     
     /**
@@ -28,7 +25,7 @@ public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends Abst
     }
     
     public SecurityUserImpl(String name, Iterable<WildcardPermission> permissions) {
-        this.name = name;
+        super(name);
         this.permissions = new HashSet<>();
         for (WildcardPermission permission : permissions) {
             this.permissions.add(permission);
@@ -36,16 +33,6 @@ public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends Abst
     }
     
     protected abstract Set<R> getRolesInternal();
-    
-    @Override
-    public String getName() {
-        return name;
-    }
-
-    @Override
-    public Serializable getId() {
-        return getName();
-    }
 
     @Override
     public Iterable<R> getRoles() {
@@ -80,7 +67,7 @@ public abstract class SecurityUserImpl<RD extends RoleDefinition, R extends Abst
 
     @Override
     public String toString() {
-        return name+" (roles: "+getRoles()+")";
+        return getName() + " (roles: " + getRoles() + ")";
     }
 
     /**

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/UserService.java

@@ -412,7 +412,7 @@ public class UserService {
             return false;
         }
         return hasPermission(logicalSecuredObjectType.getPermission(DefaultActions.CREATE),
-                new OwnershipDTO(currentUser, getCurrentTenant()));
+                new OwnershipDTO(currentUser == null ? null : currentUser.asStrippedUser(), getCurrentTenant()));
     }
 
     public StrippedUserGroupDTO getCurrentTenant() {
@@ -446,7 +446,7 @@ public class UserService {
         // TODO: Additional check required
         // return hasPermission(SecuredSecurityTypes.SERVER.getPermissionForObjects(ServerActions.CREATE_OBJECT, oid));
         final WildcardPermission createPermission = type.getPermission(DefaultActions.CREATE);
-        final OwnershipDTO ownershipOfNewlyCreatedObject = new OwnershipDTO(currentUser, getCurrentTenant());
+        final OwnershipDTO ownershipOfNewlyCreatedObject = new OwnershipDTO(currentUser == null ? null : currentUser.asStrippedUser(), getCurrentTenant());
         return this.hasCurrentUserAnyPermission(createPermission, ownershipOfNewlyCreatedObject);
     }
     

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/EditOwnershipDialog.java

@@ -155,7 +155,7 @@ public class EditOwnershipDialog extends DataEntryDialog<OwnershipDialogResult>
         userManagementService.getUserByName(usernameBox.getText(), new AsyncCallback<UserDTO>() {
             @Override
             public void onSuccess(UserDTO result) {
-                resolvedUser = result;
+                resolvedUser = result == null ? null : result.asStrippedUser();
                 resolvingUsername = false;
                 validateAndUpdate();
             }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/component/UserGroupDetailPanel.java

@@ -211,7 +211,7 @@ public class UserGroupDetailPanel extends HorizontalPanel implements Handler, Ch
                         }
                         @Override
                         public void onSuccess(Void result) {
-                            tenant.add(user);
+                            tenant.add(user.asStrippedUser());
                             allUsersListDataProvider.updateDisplays();
                                     tenantUsersListDataProvider.updateDisplays();
                         }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/SecurityDTOFactory.java

@@ -20,7 +20,6 @@ import com.sap.sse.security.shared.RoleDefinition;
 import com.sap.sse.security.shared.SecurityUser;
 import com.sap.sse.security.shared.SocialUserAccount;
 import com.sap.sse.security.shared.UsernamePasswordAccount;
-import com.sap.sse.security.shared.WildcardPermission;
 import com.sap.sse.security.shared.dto.AccessControlListAnnotationDTO;
 import com.sap.sse.security.shared.dto.AccessControlListDTO;
 import com.sap.sse.security.shared.dto.AccountDTO;
@@ -85,7 +84,6 @@ public class SecurityDTOFactory {
                 user.getPermissions(),
                 createStrippedUserGroupDTOsFromUserGroups(securityService.getUserGroupsOfUser(user),
                         fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup));
-        fromOriginalToStrippedDownUser.put(user, userDTO);
         userDTO.setDefaultTenantForCurrentServer(createStrippedUserGroupDTOFromUserGroup(
                 securityService.getDefaultTenantForCurrentUser(),
                 fromOriginalToStrippedDownUserGroup));
@@ -279,24 +277,21 @@ public class SecurityDTOFactory {
      * @param fromOriginalToStrippedDownUser 
      * @param fromOriginalToStrippedDownUserGroup 
      */
-    public AccessControlListDTO pruneAccessControlListForUser(AccessControlListDTO acl, StrippedUserDTO filterForUser,
+    public AccessControlListDTO pruneAccessControlListForUser(AccessControlListDTO acl, Iterable<StrippedUserGroupDTO> groupsOfUser,
             Iterable<StrippedUserGroupDTO> allUserGroups) {
         final AccessControlListDTO result;
         // add user groups of filterForUser user
-        final Collection<StrippedUserGroupDTO> userGroups = Util.createSet(filterForUser.getUserGroups());
+        final Collection<StrippedUserGroupDTO> userGroups = new HashSet<>();
+        Util.addAll(groupsOfUser, userGroups);
         // add user groups of alluser
-        if (allUserGroups != null) {
-            userGroups.addAll(Util.createSet(allUserGroups));
-        }
-        // add null user group
-        userGroups.add(null);
+        Util.addAll(allUserGroups, userGroups);
 
         if (acl != null) {
             final Map<StrippedUserGroupDTO, Set<String>> actionsByUserGroup = new HashMap<>();
             for (final Entry<StrippedUserGroupDTO, Set<String>> entry : acl.getActionsByUserGroup().entrySet()) {
-                if (userGroups.contains(entry.getKey())) {
-                    StrippedUserGroupDTO key = entry.getKey();
-                    actionsByUserGroup.put(key, entry.getValue());
+                StrippedUserGroupDTO userGroup = entry.getKey();
+                if (userGroup == null || userGroups.contains(userGroup)) {
+                    actionsByUserGroup.put(userGroup, entry.getValue());
                 }
             }
             result = new AccessControlListDTO(actionsByUserGroup);
@@ -338,18 +333,8 @@ public class SecurityDTOFactory {
             Map<UserGroup, StrippedUserGroupDTO> fromOriginalToStrippedDownUserGroup) {
         StrippedUserDTO mappedUser = fromOriginalToStrippedDownUser.get(user);
         if (mappedUser == null) {
-            Iterable<Role> roles = user.getRoles();
             mappedUser = new StrippedUserDTO(user.getName());
             fromOriginalToStrippedDownUser.put(user, mappedUser);
-            Iterable<RoleDTO> rolesDTO = createRolesDTOs(roles, fromOriginalToStrippedDownUser,
-                    fromOriginalToStrippedDownUserGroup, securityService);
-            for (RoleDTO r : rolesDTO) {
-                mappedUser.addRole(r);
-            }
-            for (WildcardPermission p : user.getPermissions()) {
-                mappedUser.addPermission(p);
-            }
-            fromOriginalToStrippedDownUser.put(user, mappedUser);
         }
         return mappedUser;
     }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/server/SecurityDTOUtil.java

@@ -1,5 +1,6 @@
 package com.sap.sse.security.ui.server;
 
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -25,8 +26,6 @@ public abstract class SecurityDTOUtil {
     private SecurityDTOUtil() {
     }
 
-    private static Iterable<StrippedUserGroupDTO> allUserGroups;
-
     /**
      * Adds {@link AccessControlList access control list} and {@link Ownership ownership} information for the given
      * {@link QualifiedObjectIdentifier qualified object identifier} to the provided {@link NamedSecuredObjectDTO
@@ -109,12 +108,12 @@ public abstract class SecurityDTOUtil {
         } else {
             User user = securityService.getCurrentUser();
             if (user != null) {
-                StrippedUserDTO userDTO = new SecurityDTOFactory().createStrippedUserFromUser(user, securityService,
-                        fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup);
-                final Iterable<StrippedUserGroupDTO> allUserGroups2 = getUserGroupsForAlluser(securityService,
-                        securityDTOFactory);
+                final Iterable<StrippedUserGroupDTO> userGroups = getUserGroupsForUser(securityService,
+                        securityDTOFactory, user);
+                final Iterable<StrippedUserGroupDTO> allUserGroups2 = getUserGroupsForUser(securityService,
+                        securityDTOFactory, securityService.getAllUser());
                 securedObject.setAccessControlList(
-                        securityDTOFactory.pruneAccessControlListForUser(accessControlListDTO, userDTO,
+                        securityDTOFactory.pruneAccessControlListForUser(accessControlListDTO, userGroups,
                                 allUserGroups2));
             }
         }
@@ -123,15 +122,16 @@ public abstract class SecurityDTOUtil {
                 securityDTOFactory.createOwnershipDTO(ownership == null ? null : ownership.getAnnotation(),
                         fromOriginalToStrippedDownUser, fromOriginalToStrippedDownUserGroup));
     }
-
+    
     /** Get the UserGroups for the user alluser. */
-    private static Iterable<StrippedUserGroupDTO> getUserGroupsForAlluser(SecurityService securityService,
-            SecurityDTOFactory securityDTOFactory) {
-        if (allUserGroups == null) {
-            if (securityService.getAllUser() != null) {
+    private static Iterable<StrippedUserGroupDTO> getUserGroupsForUser(SecurityService securityService,
+            SecurityDTOFactory securityDTOFactory, User user) {
+        Iterable<StrippedUserGroupDTO> allUserGroups;
+        if (user != null) {
             allUserGroups = securityDTOFactory.createStrippedUserGroupDTOFromUserGroups(
-                    securityService.getAllUser().getUserGroups(), new HashMap<>());
-            }
+                    user.getUserGroups(), new HashMap<>());
+        } else {
+            allUserGroups = Collections.emptySet();
         }
         return allUserGroups;
     }

wiki/planning/WaypointInferrer.md

@@ -1,11 +1,15 @@
-This page is used to think through the features a Waypoint-inferring mechanism needs to have from a end-to-end perspective.
+This page is used to think through the features a Waypoint-inferring mechanism needs to have from an end-to-end perspective.
 
-### Scenario 1: Starting a race with no information about Marks and Waypoints. 
+### Version 2:
 
-WaypointInferrer should detect possible Marks, decide for the PassingInstructions and then store the Waypoint persistent in the race:
+WaypointInferrer should detect Marks and Waypoins in a tracked race and decide wether to add new ones to the race or update given information about the race (e.g. waypoint list already prepared, positions pinged for all marks except the windward mark, so WaypointInferrer should detect that mark position.)
 
-* If we decide for a Mark position based on a threeshold number of competitors already passed should we take in consideration the upcoming competitors for the final Mark position and if we do so how can we achieve that?
+The WaypointInferrer should be treated similar to the MarkPassingCalculator, the information is only stored in-memory, every reload of a tracked race would need the algorithm to start again.
 
-* First approach is to work only with smartphone tracked races. A check box in Smartphone Tracking connector is needed. Also SailInsight2.0 should have an option to use that feature.
+A checkbox in smartphone tracking connector next to start tracking button is needed. If checked the race is tracked with an instance of WaypointInferrer.
 
-* If that checkbox is checked the inferred marks and waypoints should also appear in CourseLayoutEditor. They can then be updated and/or refined. The EditMarkPositions feature on the RaceMap is then also enabled. 
+
+### Next steps:
+ * Implement the checkbox and the restore functionality.
+ * Improve the WaypointInferrer algorithm to match the desired behaviour.
+ * Create test cases with real data and scenarios.