some renames; using optional per-logical-type actions

Change-Id: Ia68de601d563683eed24b65ae2af63e0f5239deb

java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java

@@ -0,0 +1,116 @@
+package com.sap.sailing.domain.common.security;
+
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+import com.sap.sailing.domain.common.ScoreCorrectionProvider;
+import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.impl.HasPermissionsImpl;
+import com.sap.sse.security.shared.impl.WildcardPermissionEncoder;
+
+/**
+ * Logical domain types in the "sailing" domain that require the user to have certain permissions
+ * in order to use their actions. These types are defined here in the "common" bundle so that
+ * the server as well as the client can check them.
+ * 
+ * @author Axel Uhl (d043530)
+ *
+ */
+public class SecuredDomainType extends HasPermissionsImpl {
+    private static final long serialVersionUID = -7072719056136061490L;
+    private static final Set<HasPermissions> allInstances = new HashSet<>();
+    
+    public SecuredDomainType(String logicalTypeName, Action... availableActions) {
+        super(logicalTypeName, availableActions);
+        allInstances.add(this);
+    }
+    public SecuredDomainType(String logicalTypeName) {
+        super(logicalTypeName);
+        allInstances.add(this);
+    }
+    
+    public static Iterable<HasPermissions> getAllInstances() {
+        return Collections.unmodifiableSet(allInstances);
+    }
+    
+    // AdminConsole permissions
+    public static final HasPermissions MANAGE_STRUCTURE_IMPORT_URLS = new SecuredDomainType("MANAGE_STRUCTURE_IMPORT_URLS");
+    public static final HasPermissions MANAGE_MARK_PASSINGS = new SecuredDomainType("MANAGE_MARK_PASSINGS");
+    public static final HasPermissions MANAGE_MARK_POSITIONS = new SecuredDomainType("MANAGE_MARK_POSITIONS");
+    public static final HasPermissions CAN_REPLAY_DURING_LIVE_RACES = new SecuredDomainType("CAN_REPLAY_DURING_LIVE_RACES");
+    public static final HasPermissions DETAIL_TIMER = new SecuredDomainType("DETAIL_TIMER"); // TODO this is not a valid "HasPermission" instance; it's more an operation the user may be granted on objects of the TimePanel type
+    
+    /**
+     * type-relative identifier is the event ID's string representation}
+     */
+    public static final HasPermissions EVENT = new SecuredDomainType("EVENT");
+
+    /**
+     * type-relative identifier is the regatta name
+     */
+    public static final HasPermissions REGATTA = new SecuredDomainType("REGATTA");
+
+    /**
+     * type-relative identifier is the leaderboard name
+     */
+    public static final HasPermissions LEADERBOARD = new SecuredDomainType("LEADERBOARD");
+
+    /**
+     * type-relative identifier is the leaderboard group ID's string representation
+     */
+    public static final HasPermissions LEADERBOARD_GROUP = new SecuredDomainType("LEADERBOARD_GROUP");
+
+    /**
+     * type-relative identifier is the regatta name followed by a "/" as the separator and then the race definition name
+     */
+    public static final HasPermissions TRACKED_RACE = new SecuredDomainType("TRACKED_RACE");
+    
+    /**
+     * type-relative identifier is the media track's "DB ID"
+     */
+    public static final HasPermissions MEDIA_TRACK = new SecuredDomainType("MEDIA_TRACK");
+    
+    /**
+     * the import URLs can be protected such that they take effect only for those users who can read them; type-relative
+     * identifier is the {@link ScoreCorrectionProvider#getName() name of the score correction provider} and the URL,
+     * encoded using the {@link WildcardPermissionEncoder#encodeStringList(String...)} method
+     */
+    public static final HasPermissions RESULT_IMPORT_URL = new SecuredDomainType("RESULT_IMPORT_URL");
+
+    /**
+     * Describes access permissions to {@code ExpeditionDeviceConfiguration} objects. Type-relative
+     * object identifier is the {@code ExpeditionDeviceConfiguration.deviceUuid} property as string.
+     */
+    public static final HasPermissions EXPEDITION_DEVICE_CONFIGURATION = new SecuredDomainType("EXPEDITION_DEVICE_CONFIGURATION");
+    
+    /**
+     * Describes access permissions to Igtimi account objects. Type-relative
+     * object identifier is the e-mail address string representing the account.
+     */
+    public static final HasPermissions IGTIMI_ACCOUNT = new SecuredDomainType("IGTIMI_ACCOUNT");
+    
+    public static enum ReplicatorActions implements Action { START, STOP, DROP_CONNECTION };
+    /**
+     * type-relative identifier is the server name
+     */
+    public static final HasPermissions REPLICATOR = new SecuredDomainType("REPLICATOR", ReplicatorActions.values());
+    
+    /**
+     * type-relative identifier is the server name
+     */
+    public static final HasPermissions DATA_MINING = new SecuredDomainType("DATA_MINING");
+
+    /**
+     * type-relative identifier is the device configuration name
+     */
+    public static final HasPermissions RACE_MANAGER_APP_DEVICE_CONFIGURATION = new SecuredDomainType("RACE_MANAGER_APP_DEVICE_CONFIGURATION");
+    
+    public static enum ServerActions implements Action { CONFIGURE_FILE_STORAGE, CONFIGURE_LOCAL_SERVER, CONFIGURE_REMOTE_INSTANCES, IMPORT_MASTER_DATA }
+    
+    /**
+     * represents the logical server which may consist of a master and multiple replicas and has a unique server name;
+     * type-relative identifier is the server name
+     */
+    public static final HasPermissions SERVER = new SecuredDomainType("SERVER"); 
+}

java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainTypes.java

@@ -1,65 +0,0 @@
-package com.sap.sailing.domain.common.security;
-
-import java.util.Collections;
-import java.util.HashSet;
-import java.util.Set;
-
-import com.sap.sse.security.shared.HasPermissions;
-import com.sap.sse.security.shared.impl.HasPermissionsImpl;
-
-/**
- * Logical domain types in the "sailing" domain that require the user to have certain permissions
- * in order to use their actions. These types are defined here in the "common" bundle so that
- * the server as well as the client can check them.
- * 
- * @author Axel Uhl (d043530)
- *
- */
-public class SecuredDomainTypes extends HasPermissionsImpl {
-    private static final long serialVersionUID = -7072719056136061490L;
-    private static final Set<HasPermissions> allInstances = new HashSet<>();
-    
-    public SecuredDomainTypes(String logicalTypeName, Action... availableActions) {
-        super(logicalTypeName, availableActions);
-        allInstances.add(this);
-    }
-    public SecuredDomainTypes(String logicalTypeName) {
-        super(logicalTypeName);
-        allInstances.add(this);
-    }
-    
-    public static Iterable<HasPermissions> getAllInstances() {
-        return Collections.unmodifiableSet(allInstances);
-    }
-    
-    // AdminConsole permissions
-    public static final HasPermissions MANAGE_IGTIMI_ACCOUNTS = new SecuredDomainTypes("MANAGE_IGTIMI_ACCOUNTS");
-    public static final HasPermissions MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS = new SecuredDomainTypes("MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS");
-    public static final HasPermissions MANAGE_LEADERBOARDS = new SecuredDomainTypes("MANAGE_LEADERBOARDS");
-    public static final HasPermissions MANAGE_LEADERBOARD_RESULTS = new SecuredDomainTypes("MANAGE_LEADERBOARD_RESULTS");
-    public static final HasPermissions MANAGE_LEADERBOARD_GROUPS = new SecuredDomainTypes("MANAGE_LEADERBOARD_GROUPS");
-    public static final HasPermissions MANAGE_RESULT_IMPORT_URLS = new SecuredDomainTypes("MANAGE_RESULT_IMPORT_URLS");
-    public static final HasPermissions MANAGE_STRUCTURE_IMPORT_URLS = new SecuredDomainTypes("MANAGE_STRUCTURE_IMPORT_URLS");
-    public static final HasPermissions MANAGE_MEDIA = new SecuredDomainTypes("MANAGE_MEDIA");
-    public static final HasPermissions MANAGE_SAILING_SERVER_INSTANCES = new SecuredDomainTypes("MANAGE_SAILING_SERVER_INSTANCES");
-    public static final HasPermissions MANAGE_LOCAL_SERVER_INSTANCE = new SecuredDomainTypes("MANAGE_LOCAL_SERVER_INSTANCE");
-    public static final HasPermissions MANAGE_REPLICATION = new SecuredDomainTypes("MANAGE_REPLICATION");
-    public static final HasPermissions MANAGE_MASTERDATA_IMPORT = new SecuredDomainTypes("MANAGE_MASTERDATA_IMPORT");
-    public static final HasPermissions MANAGE_USERS = new SecuredDomainTypes("MANAGE_USERS");
-    public static final HasPermissions MANAGE_ROLES = new SecuredDomainTypes("MANAGE_ROLES");
-    public static final HasPermissions MANAGE_FILE_STORAGE = new SecuredDomainTypes("MANAGE_FILE_STORAGE");
-    public static final HasPermissions MANAGE_MARK_PASSINGS = new SecuredDomainTypes("MANAGE_MARK_PASSINGS");
-    public static final HasPermissions MANAGE_MARK_POSITIONS = new SecuredDomainTypes("MANAGE_MARK_POSITIONS");
-    public static final HasPermissions CAN_REPLAY_DURING_LIVE_RACES = new SecuredDomainTypes("CAN_REPLAY_DURING_LIVE_RACES");
-    public static final HasPermissions DETAIL_TIMER = new SecuredDomainTypes("DETAIL_TIMER"); // TODO this is not a valid "HasPermission" instance; it's more an operation the user may be granted on objects of the TimePanel type
-    
-    // back-end permissions
-    public static final HasPermissions EVENT = new SecuredDomainTypes("EVENT");
-    public static final HasPermissions REGATTA = new SecuredDomainTypes("REGATTA");
-    public static final HasPermissions LEADERBOARD = new SecuredDomainTypes("LEADERBOARD");
-    public static final HasPermissions LEADERBOARD_GROUP = new SecuredDomainTypes("LEADERBOARD_GROUP");
-    public static final HasPermissions TRACKED_RACE = new SecuredDomainTypes("TRACKED_RACE");
-    public static final HasPermissions DATA_MINING = new SecuredDomainTypes("DATA_MINING");
-    public static final HasPermissions RACE_MANAGER_APP_DEVICE_CONFIGURATION = new SecuredDomainTypes("RACE_MANAGER_APP_DEVICE_CONFIGURATION");
-    public static final HasPermissions SERVER = new SecuredDomainTypes("SERVER"); // represents the logical server which may consist of a master and multiple replicas and has a unique server name 
-}

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/AdminConsoleEntryPoint.java

@@ -11,7 +11,8 @@ import com.google.gwt.user.client.rpc.ServiceDefTarget;
 import com.google.gwt.user.client.ui.HeaderPanel;
 import com.google.gwt.user.client.ui.RootLayoutPanel;
 import com.google.gwt.user.client.ui.Widget;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
+import com.sap.sailing.domain.common.security.SecuredDomainType.ReplicatorActions;
 import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication;
 import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication;
 import com.sap.sailing.gwt.ui.client.AbstractSailingEntryPoint;
@@ -41,6 +42,7 @@ import com.sap.sse.gwt.client.controls.filestorage.FileStoragePanel;
 import com.sap.sse.gwt.client.panels.HorizontalTabLayoutPanel;
 import com.sap.sse.gwt.resources.Highcharts;
 import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.shared.impl.SecuredSecurityTypes;
 import com.sap.sse.security.ui.authentication.decorator.AuthorizedContentDecorator;
 import com.sap.sse.security.ui.authentication.decorator.WidgetFactory;
@@ -130,7 +132,8 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 fillLeaderboards();
             }
-        }, getStringMessages().leaderboards()); // no permissions required; we show those leaderboard the user may read
+        }, getStringMessages().leaderboards(), SecuredDomainType.LEADERBOARD.getPermission(DefaultActions.UPDATE),
+                SecuredDomainType.LEADERBOARD.getPermission(DefaultActions.CREATE));
         regattasDisplayers.add(leaderboardConfigPanel);
         leaderboardsDisplayers.add(leaderboardConfigPanel);
 
@@ -251,7 +254,7 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
         IgtimiAccountsPanel igtimiAccountsPanel = new IgtimiAccountsPanel(getSailingService(), this, getStringMessages());
         igtimiAccountsPanel.ensureDebugId("IgtimiAccounts");
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<IgtimiAccountsPanel>(igtimiAccountsPanel),
-                getStringMessages().igtimiAccounts(), SecuredDomainTypes.MANAGE_IGTIMI_ACCOUNTS);
+                getStringMessages().igtimiAccounts()); // Igtimi accounts are displayed based on permissions
         
         ExpeditionDeviceConfigurationsPanel expeditionDeviceConfigurationsPanel = new ExpeditionDeviceConfigurationsPanel(getSailingService(), this, getStringMessages());
         expeditionDeviceConfigurationsPanel.ensureDebugId("ExpeditionDeviceConfigurations");
@@ -260,16 +263,17 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 expeditionDeviceConfigurationsPanel.refresh();
             }
-        }, getStringMessages().expeditionDeviceConfigurations(), SecuredDomainTypes.MANAGE_EXPEDITION_DEVICE_CONFIGURATIONS); // TODO bug4754 use server name as type-relative object identifier
+        }, getStringMessages().expeditionDeviceConfigurations()); // Expedition device configurations are displayed based on individual user permissions
 
         ResultImportUrlsManagementPanel resultImportUrlsManagementPanel = new ResultImportUrlsManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<ResultImportUrlsManagementPanel>(resultImportUrlsManagementPanel),
-                getStringMessages().resultImportUrls(), SecuredDomainTypes.MANAGE_RESULT_IMPORT_URLS);
+                getStringMessages().resultImportUrls()); // result import URLs have ownerships and are displayed as the user can see / update / delete them
         
         StructureImportManagementPanel structureImportUrlsManagementPanel = new StructureImportManagementPanel(
                 getSailingService(), getUserService(), this, getStringMessages(), this, eventManagementPanel);
         panel.addToTabPanel(connectorsTabPanel, new DefaultRefreshableAdminConsolePanel<StructureImportManagementPanel>(structureImportUrlsManagementPanel),
-                getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(), SecuredDomainTypes.MANAGE_STRUCTURE_IMPORT_URLS); // TODO bug4754 use server name as type-relative object identifier
+                getStringMessages().manage2Sail() + " " + getStringMessages().regattaStructureImport(),
+                SecuredDomainType.REGATTA.getPermission(DefaultActions.CREATE)); // TODO bug4763 provide the default CREATE ownership for REGATTA / EVENT
 
         /* ADVANCED */
         
@@ -281,27 +285,32 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
             public void refreshAfterBecomingVisible() {
                 replicationPanel.updateReplicaList();
             }
-        }, getStringMessages().replication(), SecuredDomainTypes.MANAGE_REPLICATION); // TODO bug4754 use server name as type-relative object identifier
+        }, getStringMessages().replication(), SecuredDomainType.REPLICATOR.getPermission(ReplicatorActions.START),
+                SecuredDomainType.REPLICATOR.getPermission(ReplicatorActions.STOP),
+                SecuredDomainType.REPLICATOR.getPermission(ReplicatorActions.DROP_CONNECTION)); // TODO bug4754 use server name as type-relative object identifier
 
         final MasterDataImportPanel masterDataImportPanel = new MasterDataImportPanel(getStringMessages(), getSailingService(),
                 this, eventManagementPanel, this, this, mediaPanel);
         masterDataImportPanel.ensureDebugId("MasterDataImport");
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<MasterDataImportPanel>(masterDataImportPanel),
-                getStringMessages().masterDataImportPanel(), SecuredDomainTypes.MANAGE_MASTERDATA_IMPORT); // TODO bug4754 use server name as type-relative object identifier
+                getStringMessages().masterDataImportPanel(), SecuredDomainType.SERVER.getPermissionForObjects(
+                        SecuredDomainType.ServerActions.IMPORT_MASTER_DATA, getServerName()));
 
         RemoteServerInstancesManagementPanel remoteServerInstancesManagementPanel = new RemoteServerInstancesManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<RemoteServerInstancesManagementPanel>(remoteServerInstancesManagementPanel),
-                getStringMessages().remoteServerInstances(), SecuredDomainTypes.MANAGE_SAILING_SERVER_INSTANCES); // TODO bug4754 use server name as type-relative object identifier
+                getStringMessages().remoteServerInstances(),
+                SecuredDomainType.SERVER.getPermissionForObjects(SecuredDomainType.ServerActions.CONFIGURE_LOCAL_SERVER, getServerName()));
 
         LocalServerManagementPanel localServerInstancesManagementPanel = new LocalServerManagementPanel(getSailingService(), this, getStringMessages());
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<LocalServerManagementPanel>(localServerInstancesManagementPanel),
-                getStringMessages().localServer(), SecuredDomainTypes.MANAGE_LOCAL_SERVER_INSTANCE); // TODO bug4754 use server name as type-relative object identifier
+                getStringMessages().localServer(),
+                SecuredDomainType.SERVER.getPermissionForObjects(SecuredDomainType.ServerActions.CONFIGURE_LOCAL_SERVER, getServerName()));
 
         final Set<HasPermissions> allSecuredTypes = new HashSet<>();
-        Util.addAll(SecuredDomainTypes.getAllInstances(), allSecuredTypes);
+        Util.addAll(SecuredDomainType.getAllInstances(), allSecuredTypes);
         Util.addAll(SecuredSecurityTypes.getAllInstances(), allSecuredTypes);
         final UserManagementPanel<AdminConsoleTableResources> userManagementPanel = new UserManagementPanel<>(getUserService(), StringMessages.INSTANCE,
-                SecuredDomainTypes.getAllInstances(), this, tableResources);
+                SecuredDomainType.getAllInstances(), this, tableResources);
         panel.addToTabPanel(advancedTabPanel,
                 new DefaultRefreshableAdminConsolePanel<UserManagementPanel<AdminConsoleTableResources>>(userManagementPanel) {
                     @Override
@@ -331,7 +340,8 @@ public class AdminConsoleEntryPoint extends AbstractSailingEntryPoint implements
 
         final FileStoragePanel fileStoragePanel = new FileStoragePanel(getSailingService(), this);
         panel.addToTabPanel(advancedTabPanel, new DefaultRefreshableAdminConsolePanel<FileStoragePanel>(fileStoragePanel),
-                getStringMessages().fileStorage(), SecuredDomainTypes.MANAGE_FILE_STORAGE); // TODO bug4754 use server name as type-relative object identifier
+                getStringMessages().fileStorage(), SecuredDomainType.SERVER.getPermissionForObjects(
+                        SecuredDomainType.ServerActions.CONFIGURE_FILE_STORAGE, getServerName()));
         panel.initUI();
         fillRegattas();
         fillLeaderboardGroups();

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/EventListComposite.java

@@ -36,7 +36,7 @@ import com.google.gwt.user.client.ui.SimplePanel;
 import com.google.gwt.user.client.ui.VerticalPanel;
 import com.google.gwt.view.client.ListDataProvider;
 import com.google.gwt.view.client.SelectionChangeEvent;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.adminconsole.LeaderboardGroupDialog.LeaderboardGroupDescriptor;
 import com.sap.sailing.gwt.ui.client.EntryPointLinkFactory;
 import com.sap.sailing.gwt.ui.client.EventsRefresher;
@@ -152,7 +152,7 @@ public class EventListComposite extends Composite implements EventsRefresher, Le
             }
         });
         eventControlsPanel.add(createEventBtn);
-        if (!userService.getCurrentUser().hasPermission(SecuredDomainTypes.EVENT.getStringPermission(DefaultActions.CREATE))) {
+        if (!userService.getCurrentUser().hasPermission(SecuredDomainType.EVENT.getStringPermission(DefaultActions.CREATE))) {
             createEventBtn.setVisible(false);
         }
 
@@ -343,7 +343,7 @@ public class EventListComposite extends Composite implements EventsRefresher, Le
         };
         
         final SecuredObjectCompositeConfig<EventDTO> securedObjectConfig = new SecuredObjectCompositeConfig<>(
-                userService, errorReporter, stringMessages, SecuredDomainTypes.EVENT, event -> event.id.toString());
+                userService, errorReporter, stringMessages, SecuredDomainType.EVENT, event -> event.id.toString());
         securedObjectConfig.addAction(DefaultActions.UPDATE, this::openEditEventDialog);
         securedObjectConfig.addAction(DefaultActions.DELETE, event -> {
             if (Window.confirm(stringMessages.doYouReallyWantToRemoveEvent(event.getName()))) {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/RegattaListComposite.java

@@ -25,7 +25,7 @@ import com.google.gwt.view.client.ListDataProvider;
 import com.google.gwt.view.client.SelectionChangeEvent;
 import com.sap.sailing.domain.common.RegattaIdentifier;
 import com.sap.sailing.domain.common.RegattaName;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.RegattaRefresher;
 import com.sap.sailing.gwt.ui.client.RegattasDisplayer;
 import com.sap.sailing.gwt.ui.client.SailingServiceAsync;
@@ -229,7 +229,7 @@ public class RegattaListComposite extends Composite implements RegattasDisplayer
         });
 
         final SecuredObjectCompositeConfig<RegattaDTO> securedObjectConfig = new SecuredObjectCompositeConfig<>(
-                userService, errorReporter, stringMessages, SecuredDomainTypes.REGATTA, RegattaDTO::getName);
+                userService, errorReporter, stringMessages, SecuredDomainType.REGATTA, RegattaDTO::getName);
         securedObjectConfig.addAction(DefaultActions.UPDATE, this::editRegatta);
         securedObjectConfig.addAction(DefaultActions.DELETE, regatta -> {
             if (Window.confirm(stringMessages.doYouReallyWantToRemoveRegatta(regatta.getName()))) {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/ResultImportUrlsManagementPanel.java

@@ -126,7 +126,7 @@ public class ResultImportUrlsManagementPanel extends FlowPanel {
     
     private void refreshUrlList() {
         String selectedProviderName = getSelectedProviderName();
-        if(selectedProviderName != null) {
+        if (selectedProviderName != null) {
             sailingService.getResultImportUrls(selectedProviderName, new AsyncCallback<List<String>>() {
                 @Override
                 public void onFailure(Throwable caught) {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/adminconsole/SecuredObjectCompositeConfig.java

@@ -58,7 +58,7 @@ public class SecuredObjectCompositeConfig<T extends NamedSecuredObjectDTO> {
      * @param stringMessages
      *            {@link StringMessages} instance to use
      * @param permission
-     *            {@link SecuredDomainTypes} specifying the scope of required permissions to modify the secured object
+     *            {@link SecuredDomainType} specifying the scope of required permissions to modify the secured object
      * @param idFactory
      *            {@link Function factory} to get a {@link String type relative identifier} for the secured object
      */

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/RaceTimePanel.java

@@ -7,7 +7,7 @@ import java.util.Map;
 import java.util.Set;
 
 import com.sap.sailing.domain.common.RegattaAndRaceIdentifier;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.common.client.DateAndTimeFormatterUtil;
 import com.sap.sailing.gwt.ui.shared.MarkPassingTimesDTO;
 import com.sap.sailing.gwt.ui.shared.RaceTimesInfoDTO;
@@ -60,7 +60,7 @@ public class RaceTimePanel extends TimePanel<RaceTimePanelSettings> implements R
         @Override
         public void onUserStatusChange(UserDTO user, boolean preAuthenticated) {
             RaceTimePanel.this.hasCanReplayDuringLiveRacesPermission = user != null && user.hasPermission(
-                    SecuredDomainTypes.CAN_REPLAY_DURING_LIVE_RACES.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null);
+                    SecuredDomainType.CAN_REPLAY_DURING_LIVE_RACES.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null);
         }
     };
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages.java

@@ -2108,4 +2108,6 @@ public interface StringMessages extends com.sap.sse.gwt.client.StringMessages,
     String automaticResizeNeedsStorageService();
     String changeOwnership();
     String errorUpdatingOwnership(String nameOfOwnedObject);
+    String soundOff();
+    String turnOffAllSoundChannels();
 }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages.properties

@@ -2104,4 +2104,6 @@ resizeUnsuccessfull=Resizing not possible
 setUpStorageService=Please set up a file storage service first
 automaticResizeNeedsStorageService=Automatic Resizing needs a working FileStorageService.
 changeOwnership=Change ownership
-errorUpdatingOwnership=Error updating ownership of object {0}
+errorUpdatingOwnership=Error updating ownership of object {0}
+soundOff=Sound off
+turnOffAllSoundChannels=Turn off all sound channels

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/StringMessages_de.properties

@@ -2099,4 +2099,6 @@ resizeUnsuccessfull=Skalierung nicht möglich
 setUpStorageService=Bitte setze zuerst einen Datei Speicher auf
 automaticResizeNeedsStorageService=Die automatische Skalierung benötigt einen funktionierenden FileStorageService.
 changeOwnership=Besitzer wechseln
-errorUpdatingOwnership=Fehler beim Setzen des Eigners für Objekt {0}
+errorUpdatingOwnership=Fehler beim Setzen des Eigners für Objekt {0}
+soundOff=Ton aus
+turnOffAllSoundChannels=Alle Tonkanäle abschalten

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/TimePanelSettingsDialogComponent.java

@@ -5,7 +5,7 @@ import com.google.gwt.user.client.ui.FlowPanel;
 import com.google.gwt.user.client.ui.FocusWidget;
 import com.google.gwt.user.client.ui.Label;
 import com.google.gwt.user.client.ui.Widget;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sse.gwt.client.dialog.DataEntryDialog;
 import com.sap.sse.gwt.client.dialog.DataEntryDialog.Validator;
 import com.sap.sse.gwt.client.shared.components.SettingsDialogComponent;
@@ -62,7 +62,7 @@ public class TimePanelSettingsDialogComponent<T extends TimePanelSettings> imple
             public String getErrorMessage(TimePanelSettings valueToValidate) {
                 String errorMessage = null;
                 if (userService.getCurrentUser() != null
-                        && userService.getCurrentUser().hasPermission(SecuredDomainTypes.DETAIL_TIMER.name())) {
+                        && userService.getCurrentUser().hasPermission(SecuredDomainType.DETAIL_TIMER.name())) {
                     if (valueToValidate.getRefreshInterval() < 50) {
                         errorMessage = stringMessages.refreshIntervalMustBeGreaterThanXSeconds("0.05");
                     }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaManagementControl.java

@@ -59,7 +59,7 @@ public class MediaManagementControl extends AbstractMediaSelectionControl implem
     private void addNewMediaButtonsTo(Panel grid) {
         HorizontalPanel controlButtons = new HorizontalPanel();
         controlButtons.setWidth("100%");
-        if (mediaPlayerManager.allowsEditing()) {
+        if (mediaPlayerManager.allowsCreating()) {
             Button addButton = new Button(stringMessages.add(), new ClickHandler() {
                 @Override
                 public void onClick(ClickEvent event) {
@@ -136,7 +136,7 @@ public class MediaManagementControl extends AbstractMediaSelectionControl implem
             }
         });
 
-        if (mediaPlayerManager.allowsEditing()) {
+        if (mediaPlayerManager.allowsEditing(videoTrack.dbId)) {
             HorizontalPanel panel = new HorizontalPanel();
             panel.setWidth("100%");
             panel.add(videoCheckBox);
@@ -227,8 +227,8 @@ public class MediaManagementControl extends AbstractMediaSelectionControl implem
     }
 
     private Widget createAudioButton(final MediaTrack audioTrack) {
-        String label = audioTrack != null ? audioTrack.title : "Sound off";
-        String title = audioTrack != null ? audioTrack.toString() : "Turn off all sound channels.";
+        String label = audioTrack != null ? audioTrack.title : stringMessages.soundOff();
+        String title = audioTrack != null ? audioTrack.toString() : stringMessages.turnOffAllSoundChannels();
         RadioButton audioButton = new RadioButton("group-name", label);
         audioButton.setTitle(title);
         audioButton.setValue(audioTrack == mediaPlayerManager.getPlayingAudioTrack());
@@ -246,11 +246,10 @@ public class MediaManagementControl extends AbstractMediaSelectionControl implem
             }
         });
 
-        if (mediaPlayerManager.allowsEditing() && audioTrack != null) {
+        if (mediaPlayerManager.allowsEditing(audioTrack.dbId) && audioTrack != null) {
             HorizontalPanel panel = new HorizontalPanel();
             panel.setWidth("100%");
             panel.add(audioButton);
-
             Button deleteButton = createDeleteButton(audioTrack);
             panel.add(deleteButton);
             panel.setCellHorizontalAlignment(deleteButton, HasHorizontalAlignment.ALIGN_RIGHT);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManager.java

@@ -54,7 +54,9 @@ public interface MediaPlayerManager {
     
     boolean deleteMediaTrack(MediaTrack mediaTrack);
     
-    boolean allowsEditing();
+    boolean allowsEditing(String mediaTrackDbId);
+
+    boolean allowsCreating();
 
     void playDefault();
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaPlayerManagerComponent.java

@@ -25,7 +25,7 @@ import com.google.gwt.user.client.ui.SimplePanel;
 import com.google.gwt.user.client.ui.Widget;
 import com.sap.sailing.domain.common.RegattaAndRaceIdentifier;
 import com.sap.sailing.domain.common.media.MediaTrack;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.MediaServiceAsync;
 import com.sap.sailing.gwt.ui.client.RaceTimesInfoProvider;
 import com.sap.sailing.gwt.ui.client.StringMessages;
@@ -51,6 +51,7 @@ import com.sap.sse.gwt.client.shared.components.Component;
 import com.sap.sse.gwt.client.shared.components.SettingsDialogComponent;
 import com.sap.sse.gwt.client.shared.settings.ComponentContext;
 import com.sap.sse.gwt.client.useragent.UserAgentDetails;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.ui.client.UserService;
 import com.sap.sse.security.ui.shared.UserDTO;
 
@@ -564,10 +565,18 @@ public class MediaPlayerManagerComponent extends AbstractComponent<MediaPlayerSe
     }
 
     @Override
-    public boolean allowsEditing() {
+    public boolean allowsEditing(String mediaTrackDbId) {
         UserDTO currentUser = userService.getCurrentUser();
         return currentUser != null
-                && currentUser.hasPermission(SecuredDomainTypes.MANAGE_MEDIA.getPermission(), /* TODO race ownership */ null, /* TODO race ACL */ null);
+                && currentUser.hasPermission(SecuredDomainType.MEDIA_TRACK.getPermissionForObjects(DefaultActions.UPDATE, mediaTrackDbId),
+                        /* TODO media track ownership */ null, /* TODO media track ACL */ null);
+    }
+
+    @Override
+    public boolean allowsCreating() {
+        UserDTO currentUser = userService.getCurrentUser();
+        return currentUser != null
+                && currentUser.hasCreatePermission(SecuredDomainType.MEDIA_TRACK);
     }
 
     @Override

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/media/MediaSynchControl.java

@@ -14,10 +14,11 @@ import com.google.gwt.user.client.ui.FocusWidget;
 import com.google.gwt.user.client.ui.TextBox;
 import com.google.gwt.user.client.ui.Widget;
 import com.sap.sailing.domain.common.media.MediaTrack;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.MediaServiceAsync;
 import com.sap.sailing.gwt.ui.client.media.MediaSynchAdapter.EditFlag;
 import com.sap.sse.gwt.client.ErrorReporter;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.ui.client.UserService;
 import com.sap.sse.security.ui.client.UserStatusEventHandler;
 import com.sap.sse.security.ui.shared.UserDTO;
@@ -42,6 +43,7 @@ public class MediaSynchControl implements EditFlag {
     private final Button previewButton;
     private final Button saveButton;
     private final Button discardButton;
+    private final String mediaTrackDbId;
 
     private boolean isEditing = false;
     private UserService userservice;
@@ -63,6 +65,7 @@ public class MediaSynchControl implements EditFlag {
         this.mediaSynchAdapter = mediaSynchAdapter;
         this.errorReporter = errorReporter;
         MediaTrack videoTrack = this.mediaSynchAdapter.getMediaTrack();
+        mediaTrackDbId = videoTrack.dbId;
         backupVideoTrack = new MediaTrack(videoTrack.title, videoTrack.url, videoTrack.startTime, videoTrack.duration,
                 videoTrack.mimeType, videoTrack.assignedRaces);
         this.userservice = userservice;
@@ -255,9 +258,9 @@ public class MediaSynchControl implements EditFlag {
     }
 
     private boolean hasRightToEdit() {
-        UserDTO currentUser = userservice.getCurrentUser(); // TODO should there be userservice.getGroups(SecurityUser)?
+        UserDTO currentUser = userservice.getCurrentUser();
         return currentUser != null
-                && currentUser.hasPermission(SecuredDomainTypes.MANAGE_MEDIA.getPermission(),
+                && currentUser.hasPermission(SecuredDomainType.MEDIA_TRACK.getPermissionForObjects(DefaultActions.UPDATE, mediaTrackDbId),
                         /* TODO ownership */ null);
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/shared/racemap/maneuver/ManeuverTablePanel.java

@@ -31,7 +31,7 @@ import com.google.gwt.view.client.SelectionChangeEvent.Handler;
 import com.google.gwt.view.client.SingleSelectionModel;
 import com.sap.sailing.domain.common.RegattaAndRaceIdentifier;
 import com.sap.sailing.domain.common.dto.CompetitorDTO;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.actions.GetManeuversForCompetitorsAction;
 import com.sap.sailing.gwt.ui.client.CompetitorSelectionChangeListener;
 import com.sap.sailing.gwt.ui.client.ManeuverTypeFormatter;
@@ -99,7 +99,7 @@ public class ManeuverTablePanel extends AbstractCompositeComponent<ManeuverTable
             @Override
             public void onUserStatusChange(UserDTO user, boolean preAuthenticated) {
                 hasCanReplayDuringLiveRacesPermission = user != null
-                        && user.hasPermission(SecuredDomainTypes.CAN_REPLAY_DURING_LIVE_RACES.getStringPermission());
+                        && user.hasPermission(SecuredDomainType.CAN_REPLAY_DURING_LIVE_RACES.getStringPermission());
             }
         };
         userService.addUserStatusEventHandler(userStatusChangeHandler);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/datamining/DataMiningEntryPoint.java

@@ -9,7 +9,7 @@ import com.google.gwt.user.client.ui.DockLayoutPanel;
 import com.google.gwt.user.client.ui.RootLayoutPanel;
 import com.google.gwt.user.client.ui.SplitLayoutPanel;
 import com.google.gwt.user.client.ui.Widget;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication;
 import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication;
 import com.sap.sailing.gwt.ui.client.AbstractSailingEntryPoint;
@@ -29,6 +29,7 @@ import com.sap.sse.datamining.ui.client.selection.QueryDefinitionProviderWithCon
 import com.sap.sse.gwt.client.EntryPointHelper;
 import com.sap.sse.gwt.client.shared.components.ComponentResources;
 import com.sap.sse.gwt.resources.Highcharts;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.ui.authentication.decorator.AuthorizedContentDecorator;
 import com.sap.sse.security.ui.authentication.decorator.WidgetFactory;
 import com.sap.sse.security.ui.authentication.generic.GenericAuthentication;
@@ -58,9 +59,8 @@ public class DataMiningEntryPoint extends AbstractSailingEntryPoint {
                 header.getAuthenticationMenuView());
         AuthorizedContentDecorator authorizedContentDecorator = new GenericAuthorizedContentDecorator(
                 genericSailingAuthentication);
-        authorizedContentDecorator.setPermissionToCheck(SecuredDomainTypes.DATA_MINING);
+        authorizedContentDecorator.setPermissionToCheck(SecuredDomainType.DATA_MINING.getPermissionForObjects(DefaultActions.READ, getServerName()));
         authorizedContentDecorator.setContentWidgetFactory(new WidgetFactory() {
-            
             private QueryDefinitionProviderWithControls queryDefinitionProvider;
             private SimpleQueryRunner queryRunner;
             private final DataMiningSettingsInfoManager settingsManager = new DataMiningSettingsInfoManagerImpl(

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/leaderboardedit/LeaderboardEditPage.java

@@ -13,7 +13,7 @@ import com.google.gwt.user.client.ui.RootPanel;
 import com.google.gwt.user.client.ui.ScrollPanel;
 import com.google.gwt.user.client.ui.Widget;
 import com.sap.sailing.domain.common.DetailType;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.common.authentication.FixedSailingAuthentication;
 import com.sap.sailing.gwt.common.authentication.SAPSailingHeaderWithAuthentication;
 import com.sap.sailing.gwt.common.communication.routing.ProvidesLeaderboardRouting;
@@ -23,6 +23,7 @@ import com.sap.sailing.gwt.ui.leaderboard.LeaderboardEntryPoint;
 import com.sap.sse.gwt.client.async.AsyncActionsExecutor;
 import com.sap.sse.gwt.client.async.MarkedAsyncCallback;
 import com.sap.sse.gwt.settings.SettingsToUrlSerializer;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.ui.authentication.decorator.AuthorizedContentDecorator;
 import com.sap.sse.security.ui.authentication.decorator.WidgetFactory;
 import com.sap.sse.security.ui.authentication.generic.GenericAuthentication;
@@ -46,7 +47,6 @@ public class LeaderboardEditPage extends AbstractSailingEntryPoint implements Pr
             public void onSuccess(List<String> leaderboardNames) {
                 if (leaderboardNames.contains(leaderboardName)) {
                     getSailingService().getAvailableDetailTypesForLeaderboard(leaderboardName, null, new AsyncCallback<Iterable<DetailType>>() {
-
                         @Override
                         public void onFailure(Throwable caught) {
                             logger.log(Level.SEVERE, "Could not load detailtypes", caught);
@@ -57,7 +57,7 @@ public class LeaderboardEditPage extends AbstractSailingEntryPoint implements Pr
                             SAPHeaderWithAuthentication header = initHeader();
                             GenericAuthentication genericSailingAuthentication = new FixedSailingAuthentication(getUserService(), header.getAuthenticationMenuView());
                             AuthorizedContentDecorator authorizedContentDecorator = new GenericAuthorizedContentDecorator(genericSailingAuthentication);
-                    authorizedContentDecorator.setPermissionToCheck(SecuredDomainTypes.MANAGE_LEADERBOARD_RESULTS);
+                    authorizedContentDecorator.setPermissionToCheck(SecuredDomainType.LEADERBOARD.getPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
                             authorizedContentDecorator.setContentWidgetFactory(new WidgetFactory() {
                                 @Override
                                 public Widget get() {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SideBySideComponentViewer.java

@@ -17,7 +17,7 @@ import com.google.gwt.user.client.ui.RequiresResize;
 import com.google.gwt.user.client.ui.ScrollPanel;
 import com.google.gwt.user.client.ui.Widget;
 import com.google.gwt.user.client.ui.WidgetCollection;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.StringMessages;
 import com.sap.sailing.gwt.ui.client.media.MediaManagementControl;
 import com.sap.sailing.gwt.ui.client.media.MediaPlayerManager;
@@ -123,7 +123,9 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
                 }
                 mediaSelectionButton.setText(caption);
                 mediaSelectionButton.setTitle(tooltip);
-                mediaManagementButton.setVisible(mediaPlayerManagerComponent.allowsEditing());
+                mediaManagementButton.setVisible(
+                        mediaPlayerManagerComponent.getAssignedMediaTracks().stream().anyMatch(
+                                track->mediaPlayerManagerComponent.allowsEditing(track.dbId)));
             }
         });
         this.leftScrollPanel = new ScrollPanel();
@@ -280,7 +282,7 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
         final Splitter markPassingsSplitter = splitLayoutPanel.getAssociatedSplitter(markPassingsPanel);
         final Splitter markPositionSplitter = splitLayoutPanel.getAssociatedSplitter(markPositionPanel);
         boolean forceLayout = false;
-        if (user != null && user.hasPermission(SecuredDomainTypes.MANAGE_MARK_PASSINGS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
+        if (user != null && user.hasPermission(SecuredDomainType.MANAGE_MARK_PASSINGS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
             if (markPassingsSplitter != null) { // if the panel is not present, the splitter may not be found
                 markPassingsSplitter.getToggleButton().setVisible(true);
             }
@@ -291,7 +293,7 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
                 markPassingsSplitter.getToggleButton().setVisible(false);
             }
         }
-        if (user != null && user.hasPermission(SecuredDomainTypes.MANAGE_MARK_POSITIONS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
+        if (user != null && user.hasPermission(SecuredDomainType.MANAGE_MARK_POSITIONS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
             if (markPositionSplitter != null) { // if the panel is not present, the splitter may not be found
                 markPositionSplitter.getToggleButton().setVisible(true);
             }
@@ -306,7 +308,8 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
         if (forceLayout) {
             forceLayout();
         }
-        mediaManagementButton.setVisible(mediaPlayerManagerComponent.allowsEditing());
+        mediaManagementButton.setVisible(mediaPlayerManagerComponent.getAssignedMediaTracks().stream().anyMatch(
+                track->mediaPlayerManagerComponent.allowsEditing(track.dbId)));
     }
     
     /**

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SliceRaceHandler.java

@@ -13,7 +13,7 @@ import com.google.gwt.user.client.ui.Button;
 import com.google.gwt.user.client.ui.TextBox;
 import com.google.gwt.user.client.ui.Widget;
 import com.sap.sailing.domain.common.RegattaAndRaceIdentifier;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.SailingServiceAsync;
 import com.sap.sailing.gwt.ui.client.StringMessages;
 import com.sap.sailing.gwt.ui.client.shared.charts.ChartZoomChangedEvent;
@@ -126,8 +126,8 @@ public class SliceRaceHandler {
     private boolean allowsEditing() {
         final UserDTO currentUser = userService.getCurrentUser();
         return currentUser != null
-                && currentUser.hasPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, selectedRaceIdentifier.getRegattaName()))
-                && currentUser.hasPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+                && currentUser.hasPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, selectedRaceIdentifier.getRegattaName()))
+                && currentUser.hasPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
     }
 
     private void doSlice() {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/DataMiningServiceImpl.java

@@ -19,7 +19,7 @@ import org.osgi.framework.BundleContext;
 import org.osgi.util.tracker.ServiceTracker;
 
 import com.google.gwt.user.server.rpc.RemoteServiceServlet;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.server.RacingEventService;
 import com.sap.sse.common.settings.SerializableSettings;
 import com.sap.sse.datamining.DataMiningServer;
@@ -81,13 +81,13 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
 
     @Override
     public Date getComponentsChangedTimepoint() {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         return getDataMiningServer().getComponentsChangedTimepoint();
     }
     
     @Override
     public FunctionDTO getIdentityFunction(String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         DataMiningServer server = getDataMiningServer();
         Locale locale = ResourceBundleStringMessages.Util.getLocaleFor(localeInfoName);
         return dtoFactory.createFunctionDTO(server.getIdentityFunction(), server.getStringMessages(), locale);
@@ -95,7 +95,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
 
     @Override
     public HashSet<FunctionDTO> getAllStatistics(String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         Iterable<Function<?>> statistics = getDataMiningServer().getAllStatistics();
         return functionsAsDTOs(statistics, localeInfoName);
     }
@@ -104,7 +104,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     public HashSet<FunctionDTO> getStatisticsFor(DataRetrieverChainDefinitionDTO retrieverChainDefinition,
             String localeInfoName) {
         SecurityUtils.getSubject().checkPermission(
-                SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, retrieverChainDefinition.getName()));
+                SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, retrieverChainDefinition.getName()));
         Class<?> retrievedDataType = getDataMiningServer()
                 .getDataRetrieverChainDefinitionForDTO(retrieverChainDefinition).getRetrievedDataType();
         Iterable<Function<?>> statistics = getDataMiningServer().getStatisticsFor(retrievedDataType);
@@ -113,7 +113,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
 
     @Override
     public HashSet<AggregationProcessorDefinitionDTO> getAggregatorDefinitions(String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         Iterable<AggregationProcessorDefinition<?, ?>> definitions = getDataMiningServer()
                 .getAllAggregationProcessorDefinitions();
         return aggregatorDefinitionsAsDTOs(definitions, localeInfoName);
@@ -123,7 +123,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     public HashSet<AggregationProcessorDefinitionDTO> getAggregatorDefinitionsFor(FunctionDTO extractionFunction,
             String localeInfoName) {
         SecurityUtils.getSubject().checkPermission(
-                SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, extractionFunction.getFunctionName()));
+                SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, extractionFunction.getFunctionName()));
         Class<?> returnType = getReturnType(extractionFunction);
         @SuppressWarnings("unchecked")
         Iterable<AggregationProcessorDefinition<?, ?>> definitions = (Iterable<AggregationProcessorDefinition<?, ?>>) (Iterable<?>) getDataMiningServer()
@@ -150,7 +150,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     @Override
     public HashSet<FunctionDTO> getDimensionsFor(DataRetrieverChainDefinitionDTO dataRetrieverChainDefinitionDTO,
             String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 dataRetrieverChainDefinitionDTO.getName()));
         Class<?> retrievedType = getDataMiningServer()
                 .getDataRetrieverChainDefinitionForDTO(dataRetrieverChainDefinitionDTO).getRetrievedDataType();
@@ -161,7 +161,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     @Override
     public ReducedDimensionsDTO getReducedDimensionsMappedByLevelFor(
             DataRetrieverChainDefinitionDTO dataRetrieverChainDefinitionDTO, String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 dataRetrieverChainDefinitionDTO.getName()));
         DataRetrieverChainDefinition<?, ?> dataRetrieverChainDefinition = getDataMiningServer()
                 .getDataRetrieverChainDefinitionForDTO(dataRetrieverChainDefinitionDTO);
@@ -202,7 +202,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
 
     @Override
     public ArrayList<DataRetrieverChainDefinitionDTO> getDataRetrieverChainDefinitions(String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         Iterable<DataRetrieverChainDefinition<?, ?>> dataRetrieverChainDefinitions = getDataMiningServer()
                 .getDataRetrieverChainDefinitions();
         return dataRetrieverChainDefinitionsAsDTOs(dataRetrieverChainDefinitions, localeInfoName);
@@ -211,7 +211,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     @Override
     public ArrayList<DataRetrieverChainDefinitionDTO> getDataRetrieverChainDefinitionsFor(
             FunctionDTO statisticToCalculate, String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 statisticToCalculate.getFunctionName()));
         Class<?> baseDataType = getBaseDataType(statisticToCalculate);
         @SuppressWarnings("unchecked")
@@ -245,7 +245,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
             HashMap<DataRetrieverLevelDTO, SerializableSettings> retrieverSettingsDTO,
             HashMap<DataRetrieverLevelDTO, HashMap<FunctionDTO, HashSet<? extends Serializable>>> filterSelectionDTO,
             String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 dataRetrieverChainDefinitionDTO.getName()));
         DataMiningServer dataMiningServer = getDataMiningServer();
         DataRetrieverChainDefinition<RacingEventService, ?> retrieverChainDefinition = dataMiningServer
@@ -345,7 +345,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     @Override
     public <ResultType extends Serializable> QueryResultDTO<ResultType> runQuery(DataMiningSession session,
             StatisticQueryDefinitionDTO queryDefinitionDTO) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 queryDefinitionDTO.getDataRetrieverChainDefinition().getName()));
         DataMiningServer dataMiningServer = getDataMiningServer();
         StatisticQueryDefinition<RacingEventService, ?, ?, ResultType> queryDefinition = dataMiningServer
@@ -357,7 +357,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
 
     @Override
     public HashSet<PredefinedQueryIdentifier> getPredefinedQueryIdentifiers() {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ));
         HashSet<PredefinedQueryIdentifier> predefinedQueryNames = new HashSet<PredefinedQueryIdentifier>();
         for (PredefinedQueryIdentifier predefinedQueryName : getDataMiningServer().getPredefinedQueryIdentifiers()) {
             predefinedQueryNames.add(predefinedQueryName);
@@ -368,7 +368,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     @Override
     public StatisticQueryDefinitionDTO getPredefinedQueryDefinition(PredefinedQueryIdentifier identifier, String localeInfoName) {
         SecurityUtils.getSubject().checkPermission(
-                SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, identifier.getIdentifier()));
+                SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, identifier.getIdentifier()));
         return localize(getDataMiningServer().getPredefinedQueryDefinitionDTO(identifier), localeInfoName);
     }
 
@@ -376,7 +376,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     public <ResultType extends Serializable> QueryResultDTO<ResultType> runPredefinedQuery(DataMiningSession session,
             PredefinedQueryIdentifier identifier, String localeInfoName) {
         SecurityUtils.getSubject().checkPermission(
-                SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, identifier.getIdentifier()));
+                SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ, identifier.getIdentifier()));
         DataMiningServer dataMiningServer = getDataMiningServer();
         ModifiableStatisticQueryDefinitionDTO queryDefinitionDTO = dataMiningServer
                 .getPredefinedQueryDefinitionDTO(identifier);
@@ -389,7 +389,7 @@ public class DataMiningServiceImpl extends RemoteServiceServlet implements DataM
     
     @Override
     public StatisticQueryDefinitionDTO localize(StatisticQueryDefinitionDTO queryDefinitionDTO, String localeInfoName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.DATA_MINING.getStringPermissionForObjects(DefaultActions.READ,
                 queryDefinitionDTO.getDataRetrieverChainDefinition().getName()));
         DataMiningServer dataMiningServer = getDataMiningServer();
         StatisticQueryDefinition<?, ?, ?, ?> queryDefinition = dataMiningServer.getQueryDefinitionForDTO(queryDefinitionDTO);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/MediaServiceImpl.java

@@ -52,7 +52,7 @@ import com.google.gwt.user.server.rpc.RemoteServiceServlet;
 import com.sap.sailing.domain.common.RegattaAndRaceIdentifier;
 import com.sap.sailing.domain.common.dto.VideoMetadataDTO;
 import com.sap.sailing.domain.common.media.MediaTrack;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.gwt.ui.client.MediaService;
 import com.sap.sailing.server.RacingEventService;
 import com.sap.sse.common.Duration;
@@ -100,13 +100,9 @@ public class MediaServiceImpl extends RemoteServiceServlet implements MediaServi
         return racingEventService().getAllMediaTracks();
     }
     
-    private void ensureUserCanManageMedia() {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.MANAGE_MEDIA.getStringPermissionForObjects(DefaultActions.UPDATE));
-    }
-
     @Override
     public String addMediaTrack(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.MEDIA_TRACK.getStringPermissionForObjects(DefaultActions.CREATE));
         if (mediaTrack.dbId != null) {
             throw new IllegalStateException("Property dbId must not be null for newly created media track.");
         }
@@ -116,43 +112,46 @@ public class MediaServiceImpl extends RemoteServiceServlet implements MediaServi
 
     @Override
     public void deleteMediaTrack(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.MEDIA_TRACK.getStringPermissionForObjects(DefaultActions.DELETE, mediaTrack.dbId));
         racingEventService().mediaTrackDeleted(mediaTrack);
     }
 
     @Override
     public void updateTitle(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        ensureUserCanUpdateMediaTrack(mediaTrack);
         racingEventService().mediaTrackTitleChanged(mediaTrack);
     }
 
     @Override
     public void updateUrl(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        ensureUserCanUpdateMediaTrack(mediaTrack);
         racingEventService().mediaTrackUrlChanged(mediaTrack);
     }
 
     @Override
     public void updateStartTime(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        ensureUserCanUpdateMediaTrack(mediaTrack);
         racingEventService().mediaTrackStartTimeChanged(mediaTrack);
     }
 
     @Override
     public void updateDuration(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        ensureUserCanUpdateMediaTrack(mediaTrack);
         racingEventService().mediaTrackDurationChanged(mediaTrack);
     }
 
+    private void ensureUserCanUpdateMediaTrack(MediaTrack mediaTrack) {
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.MEDIA_TRACK.getStringPermissionForObjects(DefaultActions.UPDATE, mediaTrack.dbId));
+    }
+
     @Override
     public void updateRace(MediaTrack mediaTrack) {
-        ensureUserCanManageMedia();
+        ensureUserCanUpdateMediaTrack(mediaTrack);
         racingEventService().mediaTrackAssignedRacesChanged(mediaTrack);
     }
 
     @Override
     public VideoMetadataDTO checkMetadata(String url) {
-        ensureUserCanManageMedia();
         VideoMetadataDTO response = null;
         try {
             URL input = new URL(url);
@@ -243,7 +242,6 @@ public class MediaServiceImpl extends RemoteServiceServlet implements MediaServi
 
     @Override
     public VideoMetadataDTO checkMetadata(byte[] start, byte[] end, Long skipped) {
-        ensureUserCanManageMedia();
         File tmp = null;
         boolean spherical = false;
         Duration duration = null;
@@ -377,7 +375,6 @@ public class MediaServiceImpl extends RemoteServiceServlet implements MediaServi
 
     @Override
     public VideoMetadataDTO checkYoutubeMetadata(String videoId) throws UnsupportedEncodingException {
-        ensureUserCanManageMedia();
         boolean canDownload = false;
         String message = "";
         Duration duration = null;

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/server/SailingServiceImpl.java

@@ -65,6 +65,7 @@ import org.apache.http.client.ClientProtocolException;
 import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authz.AuthorizationException;
 import org.apache.shiro.authz.UnauthorizedException;
+import org.apache.shiro.subject.Subject;
 import org.osgi.framework.BundleContext;
 import org.osgi.framework.InvalidSyntaxException;
 import org.osgi.framework.ServiceReference;
@@ -286,7 +287,7 @@ import com.sap.sailing.domain.common.racelog.tracking.NotDenotableForRaceLogTrac
 import com.sap.sailing.domain.common.racelog.tracking.NotDenotedForRaceLogTrackingException;
 import com.sap.sailing.domain.common.racelog.tracking.RaceLogTrackingState;
 import com.sap.sailing.domain.common.racelog.tracking.TransformationException;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.common.sharding.ShardingType;
 import com.sap.sailing.domain.common.tracking.BravoFix;
 import com.sap.sailing.domain.common.tracking.GPSFix;
@@ -587,6 +588,7 @@ import com.sap.sse.security.shared.OwnershipAnnotation;
 import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.security.shared.SecurityUser;
 import com.sap.sse.security.shared.UserGroup;
+import com.sap.sse.security.shared.impl.WildcardPermissionEncoder;
 import com.sap.sse.security.ui.server.SecurityDTOFactory;
 import com.sap.sse.shared.media.ImageDescriptor;
 import com.sap.sse.shared.media.MediaUtils;
@@ -1013,7 +1015,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
         regattaDTO.canBoatsOfCompetitorsChangePerRace = regatta.canBoatsOfCompetitorsChangePerRace();
         regattaDTO.configuration = convertToRegattaConfigurationDTO(regatta.getRegattaConfiguration());
         regattaDTO.rankingMetricType = regatta.getRankingMetricType();
-        this.addSecurityInformation(regattaDTO, SecuredDomainTypes.REGATTA.getQualifiedObjectIdentifier(regatta.getName()));
+        this.addSecurityInformation(regattaDTO, SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regatta.getName()));
         return regattaDTO;
     }
 
@@ -2651,14 +2653,14 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public StrippedLeaderboardDTO updateLeaderboard(String leaderboardName, String newLeaderboardName, String newLeaderboardDisplayName, int[] newDiscardingThresholds, UUID newCourseAreaId) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         Leaderboard updatedLeaderboard = getService().apply(new UpdateLeaderboard(leaderboardName, newLeaderboardName, newLeaderboardDisplayName, newDiscardingThresholds, newCourseAreaId));
         return createStrippedLeaderboardDTO(updatedLeaderboard, false, false);
     }
     
     @Override
     public void removeLeaderboards(Collection<String> leaderboardNames) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.DELETE, leaderboardNames.toArray(new String[0])));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.DELETE, leaderboardNames.toArray(new String[0])));
         for (String leaderoardName : leaderboardNames) {
             removeLeaderboard(leaderoardName);
         }
@@ -2666,25 +2668,25 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void removeLeaderboard(String leaderboardName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.DELETE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.DELETE, leaderboardName));
         getService().apply(new RemoveLeaderboard(leaderboardName));
     }
 
     @Override
     public void renameLeaderboard(String leaderboardName, String newLeaderboardName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new RenameLeaderboard(leaderboardName, newLeaderboardName));
     }
 
     @Override
     public void addColumnToLeaderboard(String columnName, String leaderboardName, boolean medalRace) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new AddColumnToLeaderboard(columnName, leaderboardName, medalRace));
     }
 
     @Override
     public void addColumnsToLeaderboard(String leaderboardName, List<com.sap.sse.common.Util.Pair<String, Boolean>> columnsToAdd) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         for(com.sap.sse.common.Util.Pair<String, Boolean> columnToAdd: columnsToAdd) {
             getService().apply(new AddColumnToLeaderboard(columnToAdd.getA(), leaderboardName, columnToAdd.getB()));
         }
@@ -2692,7 +2694,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void removeLeaderboardColumns(String leaderboardName, List<String> columnsToRemove) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         for (String columnToRemove : columnsToRemove) {
             getService().apply(new RemoveLeaderboardColumn(columnToRemove, leaderboardName));
         }
@@ -2700,32 +2702,32 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void removeLeaderboardColumn(String leaderboardName, String columnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new RemoveLeaderboardColumn(columnName, leaderboardName));
     }
 
     @Override
     public void renameLeaderboardColumn(String leaderboardName, String oldColumnName, String newColumnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new RenameLeaderboardColumn(leaderboardName, oldColumnName, newColumnName));
     }
 
     @Override
     public void updateLeaderboardColumnFactor(String leaderboardName, String columnName, Double newFactor) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new UpdateLeaderboardColumnFactor(leaderboardName, columnName, newFactor));
     }
 
     @Override
     public void suppressCompetitorInLeaderboard(String leaderboardName, String competitorIdAsString, boolean suppressed) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new SetSuppressedFlagForCompetitorInLeaderboard(leaderboardName, competitorIdAsString, suppressed));
     }
 
     @Override
     public boolean connectTrackedRaceToLeaderboardColumn(String leaderboardName, String raceColumnName,
             String fleetName, RegattaAndRaceIdentifier raceIdentifier) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         Object principal = SessionUtils.getPrincipal();
         if (principal != null) {
             logger.info(String.format("%s linked race column %s %s (%s) with tracked race %s.", principal.toString(),
@@ -2739,7 +2741,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public Map<String, RegattaAndRaceIdentifier> getRegattaAndRaceNameOfTrackedRaceConnectedToLeaderboardColumn(String leaderboardName, String raceColumnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.READ, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.READ, leaderboardName));
         Map<String, RegattaAndRaceIdentifier> result = new HashMap<String, RegattaAndRaceIdentifier>();
         Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName);
         if (leaderboard != null) {
@@ -2760,20 +2762,20 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void disconnectLeaderboardColumnFromTrackedRace(String leaderboardName, String raceColumnName, String fleetName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new DisconnectLeaderboardColumnFromTrackedRace(leaderboardName, raceColumnName, fleetName));
     }
 
     @Override
     public void updateLeaderboardCarryValue(String leaderboardName, String competitorIdAsString, Double carriedPoints) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new UpdateLeaderboardCarryValue(leaderboardName, competitorIdAsString, carriedPoints));
     }
 
     @Override
     public com.sap.sse.common.Util.Triple<Double, Double, Boolean> updateLeaderboardMaxPointsReason(String leaderboardName, String competitorIdAsString, String raceColumnName,
             MaxPointsReason maxPointsReason, Date date) throws NoWindException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         return getService().apply(
                 new UpdateLeaderboardMaxPointsReason(leaderboardName, raceColumnName, competitorIdAsString,
                         maxPointsReason, new MillisecondsTimePoint(date)));
@@ -2782,7 +2784,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     @Override
     public com.sap.sse.common.Util.Triple<Double, Double, Boolean> updateLeaderboardScoreCorrection(String leaderboardName,
             String competitorIdAsString, String columnName, Double correctedScore, Date date) throws NoWindException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         return getService().apply(
                 new UpdateLeaderboardScoreCorrection(leaderboardName, columnName, competitorIdAsString, correctedScore,
                         new MillisecondsTimePoint(date)));
@@ -2790,7 +2792,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void updateLeaderboardScoreCorrectionMetadata(String leaderboardName, Date timePointOfLastCorrectionValidity, String comment) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(
                 new UpdateLeaderboardScoreCorrectionMetadata(leaderboardName,
                         timePointOfLastCorrectionValidity == null ? null : new MillisecondsTimePoint(timePointOfLastCorrectionValidity),
@@ -2799,7 +2801,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void updateLeaderboardScoreCorrectionsAndMaxPointsReasons(BulkScoreCorrectionDTO updates) throws NoWindException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, updates.getLeaderboardName()));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, updates.getLeaderboardName()));
         Date dateForResults = new Date(); // we don't care about the result date/time here; use current date as default
         for (Map.Entry<String, Map<String, Double>> e : updates.getScoreUpdatesForRaceColumnByCompetitorIdAsString().entrySet()) {
             for (Map.Entry<String, Double> raceColumnNameAndCorrectedScore : e.getValue().entrySet()) {
@@ -2817,25 +2819,25 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void updateCompetitorDisplayNameInLeaderboard(String leaderboardName, String competitorIdAsString, String displayName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new UpdateCompetitorDisplayNameInLeaderboard(leaderboardName, competitorIdAsString, displayName));
     }
 
     @Override
     public void moveLeaderboardColumnUp(String leaderboardName, String columnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new MoveLeaderboardColumnUp(leaderboardName, columnName));
     }
 
     @Override
     public void moveLeaderboardColumnDown(String leaderboardName, String columnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new MoveLeaderboardColumnDown(leaderboardName, columnName));
     }
 
     @Override
     public void updateIsMedalRace(String leaderboardName, String columnName, boolean isMedalRace) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         getService().apply(new UpdateIsMedalRace(leaderboardName, columnName, isMedalRace));
     }
 
@@ -3791,7 +3793,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     @Override
     public void updateLeaderboardGroup(String oldName, String newName, String newDescription, String newDisplayName,
             List<String> leaderboardNames, int[] overallLeaderboardDiscardThresholds, ScoringSchemeType overallLeaderboardScoringSchemeType) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.UPDATE, oldName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.UPDATE, oldName));
         getService().apply(
                 new UpdateLeaderboardGroup(oldName, newName, newDescription, newDisplayName,
                         leaderboardNames, overallLeaderboardDiscardThresholds, overallLeaderboardScoringSchemeType));
@@ -3848,7 +3850,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public List<EventDTO> getEvents() throws MalformedURLException {
         List<EventDTO> result = new ArrayList<EventDTO>();
         for (Event event : getService().getAllEvents()) {
-            if (SecurityUtils.getSubject().isPermitted(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.READ, event.getId().toString()))) {
+            if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.READ, event.getId().toString()))) {
                 EventDTO eventDTO = convertToEventDTO(event, false);
                 eventDTO.setBaseURL(getEventBaseURLFromEventOrRequest(event));
                 eventDTO.setIsOnRemoteServer(false);
@@ -3933,7 +3935,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             VenueDTO venue, boolean isPublic, Iterable<UUID> leaderboardGroupIds, String officialWebsiteURLString, String baseURLAsString,
             Map<String, String> sailorsInfoWebsiteURLsByLocaleName, Iterable<ImageDTO> images, Iterable<VideoDTO> videos,
             Iterable<String> windFinderReviewedSpotCollectionIds) throws MalformedURLException, UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()))) {
+        if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()))) {
             TimePoint startTimePoint = startDate != null ? new MillisecondsTimePoint(startDate) : null;
             TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
             URL officialWebsiteURL = officialWebsiteURLString != null ? new URL(officialWebsiteURLString) : null;
@@ -3958,11 +3960,11 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             throws MalformedURLException, UnauthorizedException {
         final EventDTO result;
         UUID eventUuid = UUID.randomUUID();
-        getSecurityService().setOwnership(SecuredDomainTypes.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()),
+        getSecurityService().setOwnership(SecuredDomainType.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()),
                 getSecurityService().getUserByName((String) SecurityUtils.getSubject().getPrincipal()),
                 getSecurityService().getUserGroupByName(tenantOwnerName), eventName);
         try {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventUuid.toString()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventUuid.toString()));
             TimePoint startTimePoint = startDate != null ?  new MillisecondsTimePoint(startDate) : null;
             TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
             URL officialWebsiteURL = officialWebsiteURLAsString != null ? new URL(officialWebsiteURLAsString) : null;
@@ -3978,7 +3980,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             return result;
         } catch (AuthorizationException e) {
             // revert ownership creation, then re-throw
-            getSecurityService().deleteOwnership(SecuredDomainTypes.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()));
+            getSecurityService().deleteOwnership(SecuredDomainType.EVENT.getQualifiedObjectIdentifier(eventUuid.toString()));
             throw e;
         }
     }
@@ -4018,10 +4020,10 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void removeEvent(UUID eventId) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.DELETE, eventId.toString()))) {
+        if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.DELETE, eventId.toString()))) {
             getService().apply(new RemoveEvent(eventId));
-            getSecurityService().deleteAccessControlList(SecuredDomainTypes.EVENT.getQualifiedObjectIdentifier(eventId.toString()));
-            getSecurityService().deleteOwnership(SecuredDomainTypes.EVENT.getQualifiedObjectIdentifier(eventId.toString()));
+            getSecurityService().deleteAccessControlList(SecuredDomainType.EVENT.getQualifiedObjectIdentifier(eventId.toString()));
+            getSecurityService().deleteOwnership(SecuredDomainType.EVENT.getQualifiedObjectIdentifier(eventId.toString()));
         } else {
             throw new UnauthorizedException("You are not permitted to remove event " + eventId);
         }
@@ -4029,7 +4031,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public void renameEvent(UUID eventId, String newName) throws UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()))) {
+        if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()))) {
             getService().apply(new RenameEvent(eventId, newName));
         } else {
             throw new UnauthorizedException("You are not permitted to edit event " + eventId);
@@ -4038,7 +4040,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public EventDTO getEventById(UUID id, boolean withStatisticalData) throws MalformedURLException, UnauthorizedException {
-        if (SecurityUtils.getSubject().isPermitted(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.READ, id.toString()))) {
+        if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.READ, id.toString()))) {
             EventDTO result = null;
             Event event = getService().getEvent(id);
             if (event != null) {
@@ -4237,7 +4239,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
                     windFinderTrackerFactory, /* useCachedSpotsForTrackedRaces */ false));
         }
 
-        this.addSecurityInformation(eventDTO, SecuredDomainTypes.EVENT.getQualifiedObjectIdentifier(event.getId().toString()));
+        this.addSecurityInformation(eventDTO, SecuredDomainType.EVENT.getQualifiedObjectIdentifier(event.getId().toString()));
         return eventDTO;
     }
 
@@ -4405,7 +4407,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             RegattaConfigurationDTO configurationDTO, Double buoyZoneRadiusInHullLengths, boolean useStartTimeInference, boolean controlTrackingFromStartAndFinishTimes) {
         Regatta regatta = getService().getRegatta(regattaName);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         TimePoint startTimePoint = startDate != null ?  new MillisecondsTimePoint(startDate) : null;
         TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
@@ -4418,7 +4420,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             List<Pair<String, Integer>> columnNamesWithInsertIndex) {
         Regatta regatta = getService().getRegatta(regattaIdentifier);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         List<RaceColumnInSeriesDTO> result = new ArrayList<RaceColumnInSeriesDTO>();
         for (Pair<String, Integer> columnNameAndInsertIndex : columnNamesWithInsertIndex) {
@@ -4438,7 +4440,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             Integer maximumNumberOfDiscards, List<FleetDTO> fleets) {
         Regatta regatta = getService().getRegatta(regattaIdentifier);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         getService().apply(
                 new UpdateSeries(regattaIdentifier, seriesName, newSeriesName, isMedal, isFleetsCanRunInParallel, resultDiscardingThresholds,
@@ -4450,7 +4452,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public void removeRaceColumnsFromSeries(RegattaIdentifier regattaIdentifier, String seriesName, List<String> columnNames) {
         Regatta regatta = getService().getRegatta(regattaIdentifier);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         for(String columnName: columnNames) {
             getService().apply(new RemoveColumnFromSeries(regattaIdentifier, seriesName, columnName));
@@ -4461,7 +4463,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public void moveRaceColumnInSeriesUp(RegattaIdentifier regattaIdentifier, String seriesName, String columnName) {
         Regatta regatta = getService().getRegatta(regattaIdentifier);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         getService().apply(new MoveColumnInSeriesUp(regattaIdentifier, seriesName, columnName));
     }
@@ -4470,7 +4472,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public void moveRaceColumnInSeriesDown(RegattaIdentifier regattaIdentifier, String seriesName, String columnName) {
         Regatta regatta = getService().getRegatta(regattaIdentifier);
         if (regatta != null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         }
         getService().apply(new MoveColumnInSeriesDown(regattaIdentifier, seriesName, columnName));
     }
@@ -4480,7 +4482,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
             RegattaCreationParametersDTO seriesNamesWithFleetNamesAndFleetOrderingAndMedal,
             boolean persistent, ScoringSchemeType scoringSchemeType, UUID defaultCourseAreaId, Double buoyZoneRadiusInHullLengths, boolean useStartTimeInference,
             boolean controlTrackingFromStartAndFinishTimes, RankingMetrics rankingMetricType) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
         TimePoint startTimePoint = startDate != null ?  new MillisecondsTimePoint(startDate) : null;
         TimePoint endTimePoint = endDate != null ?  new MillisecondsTimePoint(endDate) : null;
         Regatta regatta = getService().apply(
@@ -4608,8 +4610,13 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
         ResultUrlRegistry resultUrlRegistry = getResultUrlRegistry();
         if (urlBasedScoreCorrectionProvider != null) {
             Iterable<URL> allUrls = resultUrlRegistry.getResultUrls(resultProviderName);
+            final Subject subject = SecurityUtils.getSubject();
+            final WildcardPermissionEncoder wildcardPermissionEncoder = new WildcardPermissionEncoder();
             for (URL url : allUrls) {
-                result.add(url.toString());
+                if (subject.isPermitted(SecuredDomainType.RESULT_IMPORT_URL.getStringPermissionForObjects(DefaultActions.READ,
+                        wildcardPermissionEncoder.encodeStringList(resultProviderName, url.toString())))) {
+                    result.add(url.toString());
+                }
             }
         }
         return result;
@@ -4735,7 +4742,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     }
     
     private void createRegattaFromRegattaDTO(RegattaDTO regatta) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regatta.getName()));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regatta.getName()));
         this.createRegatta(regatta.getName(), regatta.boatClass.getName(), regatta.canBoatsOfCompetitorsChangePerRace, regatta.startDate, regatta.endDate,
                         new RegattaCreationParametersDTO(getSeriesCreationParameters(regatta)), 
                         true, regatta.scoringScheme, regatta.defaultCourseAreaUuid, regatta.buoyZoneRadiusInHullLengths, regatta.useStartTimeInference,
@@ -4782,7 +4789,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
      * when this method is called.
      */
     private void addRaceColumnsToRegattaSeries(RegattaDTO regatta) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
         for (SeriesDTO series : regatta.series) {
             List<Pair<String, Integer>> raceNamesAndInsertIndex = new ArrayList<>();
             int insertIndex = 0;
@@ -4821,7 +4828,7 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
         // create Leaderboard Group
         if (getService().getLeaderboardGroupByName(eventName) == null) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.CREATE, eventName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.CREATE, eventName));
             CreateLeaderboardGroup createLeaderboardGroupOp = new CreateLeaderboardGroup(eventName, description,
                     eventName, false, leaderboardNames, null, null);
             leaderboardGroupDTO = convertToLeaderboardGroupDTO(getService().apply(createLeaderboardGroupOp), false,
@@ -5721,7 +5728,10 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public Iterable<String> getAllIgtimiAccountEmailAddresses() {
         List<String> result = new ArrayList<String>();
         for (Account account : getIgtimiConnectionFactory().getAllAccounts()) {
-            result.add(account.getUser().getEmail());
+            final String email = account.getUser().getEmail();
+            if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObjects(DefaultActions.READ, email))) {
+                result.add(email);
+            }
         }
         return result;
     }
@@ -5745,12 +5755,30 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
 
     @Override
     public boolean authorizeAccessToIgtimiUser(String eMailAddress, String password) throws Exception {
-        Account account = getIgtimiConnectionFactory().createAccountToAccessUserData(eMailAddress, password);
+        final Account existingAccount = getIgtimiConnectionFactory().getExistingAccountByEmail(eMailAddress);
+        final Account account;
+        if (existingAccount != null) {
+            final QualifiedObjectIdentifier igtimiAccountId = SecuredDomainType.IGTIMI_ACCOUNT.getQualifiedObjectIdentifier(eMailAddress);
+            getSecurityService().setOwnership(getSecurityService().createDefaultOwnershipForNewObject(igtimiAccountId));
+            try {
+                SecurityUtils.getSubject().checkPermission(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObjects(
+                    DefaultActions.CREATE, eMailAddress));
+                account = getIgtimiConnectionFactory().createAccountToAccessUserData(eMailAddress, password);
+            } catch (AuthorizationException e) {
+                getSecurityService().deleteOwnership(igtimiAccountId); // revert preliminary ownership allocation
+                throw e;
+            }
+        } else {
+            logger.warning("Igtimi account "+eMailAddress+" already exists.");
+            account = null; // account with that e-mail already exists
+        }
         return account != null;
     }
 
     @Override
     public void removeIgtimiAccount(String eMailOfAccountToRemove) {
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObjects(
+                DefaultActions.DELETE, eMailOfAccountToRemove));
         getIgtimiConnectionFactory().removeAccount(eMailOfAccountToRemove);
     }
 
@@ -5771,15 +5799,19 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
         }
         Map<RegattaAndRaceIdentifier, Integer> numberOfWindFixesImportedPerRace = new HashMap<RegattaAndRaceIdentifier, Integer>();
         for (Account account : igtimiConnectionFactory.getAllAccounts()) {
-            IgtimiConnection conn = igtimiConnectionFactory.connect(account);
-            Map<TrackedRace, Integer> resultsForAccounts = conn.importWindIntoRace(trackedRaces, correctByDeclination);
-            for (Entry<TrackedRace, Integer> resultForAccount : resultsForAccounts.entrySet()) {
-                RegattaAndRaceIdentifier key = resultForAccount.getKey().getRaceIdentifier();
-                Integer i = numberOfWindFixesImportedPerRace.get(key);
-                if (i == null) {
-                    i = 0;
+            // filter account based on used permissions to read account:
+            if (SecurityUtils.getSubject().isPermitted(SecuredDomainType.IGTIMI_ACCOUNT.getStringPermissionForObjects(
+                    DefaultActions.READ, account.getUser().getEmail()))) {
+                IgtimiConnection conn = igtimiConnectionFactory.connect(account);
+                Map<TrackedRace, Integer> resultsForAccounts = conn.importWindIntoRace(trackedRaces, correctByDeclination);
+                for (Entry<TrackedRace, Integer> resultForAccount : resultsForAccounts.entrySet()) {
+                    RegattaAndRaceIdentifier key = resultForAccount.getKey().getRaceIdentifier();
+                    Integer i = numberOfWindFixesImportedPerRace.get(key);
+                    if (i == null) {
+                        i = 0;
+                    }
+                    numberOfWindFixesImportedPerRace.put(key, i+resultForAccount.getValue());
                 }
-                numberOfWindFixesImportedPerRace.put(key, i+resultForAccount.getValue());
             }
         }
         for (final TrackedRace trackedRace : trackedRaces) {
@@ -7331,8 +7363,14 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     public List<ExpeditionDeviceConfiguration> getExpeditionDeviceConfigurations() {
         final List<ExpeditionDeviceConfiguration> result = new ArrayList<>();
         final ExpeditionTrackerFactory expeditionConnector = expeditionConnectorTracker.getService();
+        final Subject subject = SecurityUtils.getSubject();
         if (expeditionConnector != null) {
-            Util.addAll(expeditionConnector.getDeviceConfigurations(), result);
+            for (final ExpeditionDeviceConfiguration config : expeditionConnector.getDeviceConfigurations()) {
+                if (subject.isPermitted(SecuredDomainType.EXPEDITION_DEVICE_CONFIGURATION.getStringPermissionForObjects(DefaultActions.READ,
+                        config.getDeviceUuid().toString()))) {
+                    result.add(config);
+                }
+            }
         }
         return result;
     }
@@ -7641,8 +7679,8 @@ public class SailingServiceImpl extends ProxiedRemoteServiceServlet implements S
     @Override
     public RegattaAndRaceIdentifier sliceRace(RegattaAndRaceIdentifier raceIdentifier, String newRaceColumnName,
             TimePoint sliceFrom, TimePoint sliceTo) throws ServiceException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, raceIdentifier.getRegattaName()));
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, raceIdentifier.getRegattaName()));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, raceIdentifier.getRegattaName()));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, raceIdentifier.getRegattaName()));
         final Locale locale = getClientLocale();
         if (!canSliceRace(raceIdentifier)) {
             throw new ServiceException(serverStringMessages.get(locale, "slicingCannotSliceRace"));

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/impl/rc/AddEntryToRaceLogJsonPostServlet.java

@@ -23,7 +23,7 @@ import com.sap.sailing.domain.abstractlog.race.RaceLogEvent;
 import com.sap.sailing.domain.base.Fleet;
 import com.sap.sailing.domain.base.RaceColumn;
 import com.sap.sailing.domain.common.racelog.RaceLogServletConstants;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
 import com.sap.sailing.server.RacingEventService;
 import com.sap.sailing.server.gateway.AbstractJsonHttpServlet;
@@ -72,7 +72,7 @@ public class AddEntryToRaceLogJsonPostServlet extends AbstractJsonHttpServlet {
                     String.format("Missing parameter '%s'.", RaceLogServletConstants.PARAMS_LEADERBOARD_NAME));
             return;
         }
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
 
         String raceColumnName = request.getParameter(RaceLogServletConstants.PARAMS_RACE_COLUMN_NAME);
         if (raceColumnName == null) {

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/EventsResource.java

@@ -55,7 +55,7 @@ import com.sap.sailing.domain.common.dto.FleetDTO;
 import com.sap.sailing.domain.common.dto.RegattaCreationParametersDTO;
 import com.sap.sailing.domain.common.dto.SeriesCreationParametersDTO;
 import com.sap.sailing.domain.common.impl.DegreePosition;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
 import com.sap.sailing.domain.leaderboard.LeaderboardGroup;
 import com.sap.sailing.domain.leaderboard.RegattaLeaderboard;
@@ -134,7 +134,7 @@ public class EventsResource extends AbstractSailingServerResource {
             @FormParam("canBoatsOfCompetitorsChangePerRace") boolean canBoatsOfCompetitorsChangePerRace) throws ParseException, NotFoundException,
             NumberFormatException, IOException, org.json.simple.parser.ParseException, InvalidDateException {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermission(DefaultActions.CREATE));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermission(DefaultActions.CREATE));
         }
         final Response response;
         if (venueNameParam == null && (venueLat == null || venueLng == null)) {
@@ -188,7 +188,7 @@ public class EventsResource extends AbstractSailingServerResource {
             @FormParam("numberofraces") String numberOfRacesParam) throws ParseException, NotFoundException,
             NumberFormatException, IOException, org.json.simple.parser.ParseException, InvalidDateException {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventId));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventId));
         }
         final Response response;
         UUID id;
@@ -433,7 +433,7 @@ public class EventsResource extends AbstractSailingServerResource {
             List<Integer> overallLeaderboardDiscardThresholdsParam, String overallLeaderboardScoringSchemeTypeParam)
             throws NotFoundException {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.CREATE, leaderboardGroupName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD_GROUP.getStringPermissionForObjects(DefaultActions.CREATE, leaderboardGroupName));
         }
         ScoringSchemeType overallLeaderboardScoringSchemeType = overallLeaderboardScoringSchemeTypeParam == null
                 ? null : getScoringSchemeType(overallLeaderboardScoringSchemeTypeParam);
@@ -467,7 +467,7 @@ public class EventsResource extends AbstractSailingServerResource {
 
     private void updateSeries(String regattaName, SeriesCreationParametersDTO defaultSeries) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         }
         getService().apply(new UpdateSeries(new RegattaName(regattaName), "Default", "Default", defaultSeries.isMedal(),
                 defaultSeries.isFleetsCanRunInParallel(), defaultSeries.getDiscardingThresholds(),
@@ -489,7 +489,7 @@ public class EventsResource extends AbstractSailingServerResource {
 
     private RaceColumnInSeries addRaceColumn(String regattaName, String seriesName, String columnName) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         }
         return getService().apply(new AddColumnToSeries(new RegattaName(regattaName), seriesName, columnName));
     }
@@ -499,7 +499,7 @@ public class EventsResource extends AbstractSailingServerResource {
             List<UUID> leaderboardGroupIds, UUID eventId, Map<Locale, URL> sailorsInfoWebsiteURLs,
             Iterable<ImageDescriptor> images, Iterable<VideoDescriptor> videos) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.CREATE, eventName));
         }
         return getService()
                 .apply(new CreateEvent(eventName, eventDescription, startDate, endDate, venueName, isPublic, eventId,
@@ -508,7 +508,7 @@ public class EventsResource extends AbstractSailingServerResource {
     
     private void updateEvent(Event event, LeaderboardGroup leaderboardGroup){
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, event.getId().toString()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, event.getId().toString()));
         }
         List<UUID> newLeaderboardGroupIds = new ArrayList<>();
         StreamSupport.stream(event.getLeaderboardGroups().spliterator(), false)
@@ -522,7 +522,7 @@ public class EventsResource extends AbstractSailingServerResource {
 
     private CourseArea addCourseArea(UUID eventId, String courseAreaName) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.EVENT.getStringPermissionForObjects(DefaultActions.UPDATE, eventId.toString()));
         }
         String[] courseAreaNames = new String[] { courseAreaName };
         UUID[] courseAreaIds = new UUID[] { UUID.randomUUID() };
@@ -535,7 +535,7 @@ public class EventsResource extends AbstractSailingServerResource {
             RankingMetrics rankingMetric, UUID regattaId, RegattaCreationParametersDTO regattaCreationParametersDTO,
             int[] leaderboardDiscardThresholds, int numberOfRaces) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
         }
         Regatta regatta = getService().apply(new AddSpecificRegatta(regattaName, boatClassName, canBoatsOfCompetitorsChangePerRace, startDate, endDate, regattaId,
                 regattaCreationParametersDTO, /* isPersistent */ true, scoringScheme, courseAreaId, buoyZoneRadiusInHullLengths,
@@ -589,7 +589,7 @@ public class EventsResource extends AbstractSailingServerResource {
 
     private RegattaLeaderboard createRegattaLeaderboard(String regattaName, int[] discardThresholds) {
         if (enforceSecurityChecks) {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.CREATE, regattaName));
         }
         return getService()
                 .apply(new CreateRegattaLeaderboard(new RegattaName(regattaName), regattaName, discardThresholds));

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/LeaderboardsResource.java

@@ -88,7 +88,7 @@ import com.sap.sailing.domain.common.racelog.tracking.DeviceMappingConstants;
 import com.sap.sailing.domain.common.racelog.tracking.NotDenotableForRaceLogTrackingException;
 import com.sap.sailing.domain.common.racelog.tracking.NotDenotedForRaceLogTrackingException;
 import com.sap.sailing.domain.common.scalablevalue.impl.ScalableBearing;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.common.sharding.ShardingType;
 import com.sap.sailing.domain.common.tracking.GPSFix;
 import com.sap.sailing.domain.common.tracking.GPSFixMoving;
@@ -537,7 +537,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
             @QueryParam("startoftrackingasmillis") Long startOfTrackingAsMillis,
             @QueryParam("endoftracking") String endOfTrackingAsISO,
             @QueryParam("endoftrackingasmillis") Long endOfTrackingAsMillis) throws InvalidDateException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         final LeaderboardAndRaceColumnAndFleetAndResponse leaderboardAndRaceColumnAndFleetAndResponse = getLeaderboardAndRaceColumnAndFleet(leaderboardName, raceColumnName, fleetName);
         final Response result;
         if (leaderboardAndRaceColumnAndFleetAndResponse.getFleet() != null) {
@@ -570,7 +570,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
             @QueryParam(RaceLogServletConstants.PARAMS_TRACK_WIND) Boolean trackWind,
             @QueryParam(RaceLogServletConstants.PARAMS_CORRECT_WIND_DIRECTION_BY_MAGNETIC_DECLINATION) Boolean correctWindDirectionByMagneticDeclination)
                     throws NotDenotedForRaceLogTrackingException, Exception {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         final LeaderboardAndRaceColumnAndFleetAndResponse leaderboardAndRaceColumnAndFleetAndResponse = getLeaderboardAndRaceColumnAndFleet(leaderboardName, raceColumnName, fleetName);
         final Response result;
         if (leaderboardAndRaceColumnAndFleetAndResponse.getFleet() != null) {
@@ -637,7 +637,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
     public Response setAutoCourse(@PathParam("leaderboardName") String leaderboardName,
             @QueryParam(RaceLogServletConstants.PARAMS_RACE_COLUMN_NAME) String raceColumnName,
             @QueryParam(RaceLogServletConstants.PARAMS_RACE_FLEET_NAME) String fleetName) throws MalformedURLException, IOException, InterruptedException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         final LeaderboardAndRaceColumnAndFleetAndResponse leaderboardAndRaceColumnAndFleetAndResponse = getLeaderboardAndRaceColumnAndFleet(leaderboardName, raceColumnName, fleetName);
         final Response result;
         if (leaderboardAndRaceColumnAndFleetAndResponse.getFleet() != null) {
@@ -851,7 +851,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
     public Response stopTracking(@PathParam("leaderboardName") String leaderboardName,
             @QueryParam(RaceLogServletConstants.PARAMS_RACE_COLUMN_NAME) String raceColumnName,
             @QueryParam(RaceLogServletConstants.PARAMS_RACE_FLEET_NAME) String fleetName) throws MalformedURLException, IOException, InterruptedException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         final Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName);
         final Response result;
         if (leaderboard == null) {
@@ -1231,7 +1231,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
                     .entity("Could not find a leaderboard with name '" + StringEscapeUtils.escapeHtml(leaderboardName) + "'.")
                     .type(MediaType.TEXT_PLAIN).build();
         } else {
-            SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboard.getName()));
+            SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboard.getName()));
             final RaceColumn raceColumn;
             raceColumn = leaderboard.getRaceColumnByName(raceColumnName);
             if (raceColumn == null) {
@@ -1253,7 +1253,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
             @QueryParam("raceColumnName") String raceColumnName, @QueryParam("fleetName") String fleetName,
             @QueryParam("raceName") String raceName) throws NotFoundException, NotDenotableForRaceLogTrackingException {
         Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName);
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         if (leaderboard == null) {
             throw new NotFoundException("leaderboard with name " + leaderboardName + " not found");
         }
@@ -1277,7 +1277,7 @@ public class LeaderboardsResource extends AbstractLeaderboardsResource {
             @QueryParam("raceColumnName") String raceColumnName, @QueryParam("fleetName") String fleetName,
             @QueryParam("raceName") String raceName) throws NotFoundException, NotDenotableForRaceLogTrackingException {
         Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName);
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         if (leaderboard == null) {
             throw new NotFoundException("leaderboard with name " + leaderboardName + " not found");
         }

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/MarkRessource.java

@@ -46,7 +46,7 @@ import com.sap.sailing.domain.common.NotFoundException;
 import com.sap.sailing.domain.common.PassingInstruction;
 import com.sap.sailing.domain.common.racelog.tracking.CompetitorRegistrationOnRaceLogDisabledException;
 import com.sap.sailing.domain.common.racelog.tracking.DoesNotHaveRegattaLogException;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.common.tracking.GPSFix;
 import com.sap.sailing.domain.common.tracking.impl.GPSFixImpl;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
@@ -80,7 +80,7 @@ public class MarkRessource extends AbstractSailingServerResource {
         UUID markId = UUID.randomUUID();
         Mark mark = getService().getBaseDomainFactory().getOrCreateMark(markId, markName);
         String regattaName = (String) requestObject.get("regattaName");
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         RegattaLog regattaLog = getRegattaLogInternal(regattaName);
         RegattaLogDefineMarkEventImpl event = new RegattaLogDefineMarkEventImpl(MillisecondsTimePoint.now(),
                 getService().getServerAuthor(), MillisecondsTimePoint.now(), UUID.randomUUID(), mark);
@@ -97,7 +97,7 @@ public class MarkRessource extends AbstractSailingServerResource {
     @Produces("application/json;charset=UTF-8")
     public Response addMarkFix(String json)
             throws DoesNotHaveRegattaLogException, ParseException, JsonDeserializationException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.MANAGE_MARK_POSITIONS.getStringPermission(DefaultActions.CREATE));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.MANAGE_MARK_POSITIONS.getStringPermission(DefaultActions.CREATE));
 
         Object requestBody = JSONValue.parseWithException(json);
         JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);
@@ -143,7 +143,7 @@ public class MarkRessource extends AbstractSailingServerResource {
         Object requestBody = JSONValue.parseWithException(json);
         JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);
         String leaderboardName = (String) requestObject.get("leaderboardName");
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         String raceColumnName = (String) requestObject.get("raceColumnName");
         String fleetName = (String) requestObject.get("fleetName");
         RaceLog raceLog = getRaceLog(leaderboardName, raceColumnName, fleetName);
@@ -216,7 +216,7 @@ public class MarkRessource extends AbstractSailingServerResource {
         JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);
 
         String leaderboardName = (String) requestObject.get("leaderboardName");
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.LEADERBOARD.getStringPermissionForObjects(DefaultActions.UPDATE, leaderboardName));
         String raceColumnName = (String) requestObject.get("raceColumnName");
         String fleetName = (String) requestObject.get("fleetName");
 

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/RegattasResource.java

@@ -56,7 +56,7 @@ import com.sap.sailing.domain.common.Tack;
 import com.sap.sailing.domain.common.TargetTimeInfo;
 import com.sap.sailing.domain.common.WindSource;
 import com.sap.sailing.domain.common.dto.FleetDTO;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.common.tracking.GPSFix;
 import com.sap.sailing.domain.common.tracking.GPSFixMoving;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
@@ -294,7 +294,7 @@ public class RegattasResource extends AbstractSailingServerResource {
     public Response addCompetitor(@PathParam("regattaname") String regattaName,
             @PathParam("competitorid") String competitorIdAsString) {
         final Subject subject = SecurityUtils.getSubject();
-        subject.checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        subject.checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         Response response;
         Regatta regatta = findRegattaByName(regattaName);
         if (regatta == null) {
@@ -329,7 +329,7 @@ public class RegattasResource extends AbstractSailingServerResource {
             @QueryParam("searchtag") String searchTag, @QueryParam("competitorName") String competitorName,
             @QueryParam("competitorEmail") String competitorEmail) {
         final Subject subject = SecurityUtils.getSubject();
-        subject.checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        subject.checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         Response response;
         Regatta regatta = findRegattaByName(regattaName);
         if (regatta == null) {
@@ -384,7 +384,7 @@ public class RegattasResource extends AbstractSailingServerResource {
     public Response removeCompetitor(@PathParam("regattaname") String regattaName,
             @PathParam("competitorid") String competitorIdAsString) {
         final Subject subject = SecurityUtils.getSubject();
-        subject.checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        subject.checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         Response response;
         Regatta regatta = findRegattaByName(regattaName);
         if (regatta == null) {
@@ -1672,7 +1672,7 @@ public class RegattasResource extends AbstractSailingServerResource {
     @Path("{regattaname}/removeracecolumn")
     public Response addRaceColumns(@PathParam("regattaname") String regattaName,
             @QueryParam("racecolumn") String raceColumnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         final Response response;
         Regatta regatta = findRegattaByName(regattaName);
         if (regatta == null) {
@@ -1717,7 +1717,7 @@ public class RegattasResource extends AbstractSailingServerResource {
     }
 
     private RaceColumnInSeries addRaceColumn(String regattaName, String seriesName, String columnName) {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regattaName));
         return getService().apply(new AddColumnToSeries(new RegattaName(regattaName), seriesName, columnName));
     }
 
@@ -1748,7 +1748,7 @@ public class RegattasResource extends AbstractSailingServerResource {
         Regatta regatta = getService().getRegattaByName(regattaName);
         if (regatta != null) {
             SecurityUtils.getSubject()
-                    .checkPermission(SecuredDomainTypes.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
+                    .checkPermission(SecuredDomainType.REGATTA.getStringPermissionForObjects(DefaultActions.UPDATE, regatta.getName()));
             String seriesName = (String) requestObject.get("seriesName");
             String seriesNameNew = (String) requestObject.get("seriesNameNew");
             boolean isMedal = (boolean) requestObject.get("isMedal");

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/WindResource.java

@@ -17,7 +17,7 @@ import com.sap.sailing.domain.common.Wind;
 import com.sap.sailing.domain.common.WindSource;
 import com.sap.sailing.domain.common.WindSourceType;
 import com.sap.sailing.domain.common.impl.WindSourceWithAdditionalID;
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.tracking.DynamicTrackedRace;
 import com.sap.sailing.server.gateway.deserialization.JsonDeserializationException;
 import com.sap.sailing.server.gateway.deserialization.JsonDeserializer;
@@ -35,7 +35,7 @@ public class WindResource extends AbstractSailingServerResource {
     @Consumes(MediaType.APPLICATION_JSON)
     @Path("putWind")
     public Response putWind(String json) throws ParseException, JsonDeserializationException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainTypes.TRACKED_RACE.getStringPermission(DefaultActions.UPDATE));
+        SecurityUtils.getSubject().checkPermission(SecuredDomainType.TRACKED_RACE.getStringPermission(DefaultActions.UPDATE));
 
         Object requestBody = JSONValue.parseWithException(json);
         JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);

java/com.sap.sse.gwt.adminconsole/src/com/sap/sse/gwt/adminconsole/AdminConsolePanel.java

@@ -80,7 +80,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      */
     private final LinkedHashSet<Triple<VerticalOrHorizontalTabLayoutPanel, Widget, String>> roleSpecificTabs;
     
-    private final Map<Widget, Set<HasPermissions>> permissionsAnyOfWhichIsRequiredToSeeWidget;
+    private final Map<Widget, Set<WildcardPermission>> permissionsAnyOfWhichIsRequiredToSeeWidget;
     
     private final SelectionHandler<Integer> tabSelectionHandler;
     
@@ -106,7 +106,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * automatically create a role that implies all those permissions for users to have full access to the
      * admin console and its panels.
      */
-    private final Iterable<? extends HasPermissions> acceptablePermissionsRequiredToSeeWidgets;
+    private final Iterable<? extends WildcardPermission> acceptablePermissionsRequiredToSeeWidgets;
     
     /**
      * Generic selection handler that forwards selected tabs to a refresher that ensures that data gets reloaded. If
@@ -169,7 +169,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
     public AdminConsolePanel(UserService userService,
             ServerInfoRetriever buildVersionRetriever, String releaseNotesAnchorLabel,
             String releaseNotesURL, ErrorReporter errorReporter, LoginPanelCss loginPanelCss, StringMessages stringMessages,
-            Iterable<? extends HasPermissions> acceptablePermissionsRequiredToSeeWidgets) {
+            Iterable<? extends WildcardPermission> acceptablePermissionsRequiredToSeeWidgets) {
         this.acceptablePermissionsRequiredToSeeWidgets = acceptablePermissionsRequiredToSeeWidgets;
         this.permissionsAnyOfWhichIsRequiredToSeeWidget = new HashMap<>();
         this.userService = userService;
@@ -272,7 +272,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * @return the horizontal tab panel that was created and added to the top-level vertical tab panel; the panel returned can be specified
      * as argument to {@link #addToTabPanel(TabLayoutPanel, Widget, String, AdminConsoleFeatures)}.
      */
-    public HorizontalTabLayoutPanel addVerticalTab(String tabTitle, String tabDebugId, HasPermissions... requiresAnyOfThesePermissions) {
+    public HorizontalTabLayoutPanel addVerticalTab(String tabTitle, String tabDebugId, WildcardPermission... requiresAnyOfThesePermissions) {
         final HorizontalTabLayoutPanel newTabPanel = new HorizontalTabLayoutPanel(2.5, Unit.EM);
         AbstractEntryPoint.setTabPanelSize(newTabPanel, "100%", "100%");
         newTabPanel.addSelectionHandler(tabSelectionHandler);
@@ -286,7 +286,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * This is useful for panels that form a top-level category of its own but don't require multiple panels to represent this
      * top-level category.
      */
-    public void addToVerticalTabPanel(final RefreshableAdminConsolePanel panelToAdd, String tabTitle, HasPermissions... requiresAnyOfThesePermissions) {
+    public void addToVerticalTabPanel(final RefreshableAdminConsolePanel panelToAdd, String tabTitle, WildcardPermission... requiresAnyOfThesePermissions) {
         addToTabPanel(topLevelTabPanelWrapper, panelToAdd, tabTitle, requiresAnyOfThesePermissions);
     }
 
@@ -297,7 +297,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
         return scrollPanel;
     }
 
-    public void addToTabPanel(final HorizontalTabLayoutPanel tabPanel, RefreshableAdminConsolePanel panelToAdd, String tabTitle, HasPermissions... requiresAnyOfThesePermissions) {
+    public void addToTabPanel(final HorizontalTabLayoutPanel tabPanel, RefreshableAdminConsolePanel panelToAdd, String tabTitle, WildcardPermission... requiresAnyOfThesePermissions) {
         VerticalOrHorizontalTabLayoutPanel wrapper = new VerticalOrHorizontalTabLayoutPanel() {
             @Override
             public void add(Widget child, String text, boolean asHtml) {
@@ -339,7 +339,7 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * a hook so that when the <code>panelToAdd</code>'s widget is selected then the {@link RefreshableAdminConsolePanel#refreshAfterBecomingVisible()}
      * method can be called.
      */
-    private void addToTabPanel(VerticalOrHorizontalTabLayoutPanel tabPanel, RefreshableAdminConsolePanel panelToAdd, String tabTitle, HasPermissions... requiresAnyOfThesePermissions) {
+    private void addToTabPanel(VerticalOrHorizontalTabLayoutPanel tabPanel, RefreshableAdminConsolePanel panelToAdd, String tabTitle, WildcardPermission... requiresAnyOfThesePermissions) {
         remeberWidgetLocationAndPermissions(tabPanel, wrapInScrollPanel(panelToAdd.getWidget()), tabTitle, requiresAnyOfThesePermissions);
         panelsByWidget.put(panelToAdd.getWidget(), panelToAdd);
     }
@@ -356,9 +356,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      *            will be shown the widget.
      */
     private void remeberWidgetLocationAndPermissions(VerticalOrHorizontalTabLayoutPanel tabPanel, Widget widgetToAdd,
-            String tabTitle, HasPermissions... requiresAnyOfThesePermissions) {
+            String tabTitle, WildcardPermission... requiresAnyOfThesePermissions) {
         if (acceptablePermissionsRequiredToSeeWidgets != null) {
-            for (final HasPermissions requiredPermission : requiresAnyOfThesePermissions) {
+            for (final WildcardPermission requiredPermission : requiresAnyOfThesePermissions) {
                 if (!Util.contains(acceptablePermissionsRequiredToSeeWidgets, requiredPermission)) {
                     throw new RuntimeException("Internal error: permission "+requiredPermission+
                             " missing from the set of acceptable admin console permissions "+acceptablePermissionsRequiredToSeeWidgets);
@@ -366,9 +366,9 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
             }
         }
         roleSpecificTabs.add(new Triple<VerticalOrHorizontalTabLayoutPanel, Widget, String>(tabPanel, widgetToAdd, tabTitle));
-        final HashSet<HasPermissions> permissionsAsSet = new HashSet<>(Arrays.asList(requiresAnyOfThesePermissions));
+        final Set<WildcardPermission> permissionsAsSet = new HashSet<>(Arrays.asList(requiresAnyOfThesePermissions));
         permissionsAnyOfWhichIsRequiredToSeeWidget.put(widgetToAdd, permissionsAsSet);
-        Set<HasPermissions> permissionsForTabPanel = permissionsAnyOfWhichIsRequiredToSeeWidget.get(tabPanel.getPanel());
+        Set<WildcardPermission> permissionsForTabPanel = permissionsAnyOfWhichIsRequiredToSeeWidget.get(tabPanel.getPanel());
         if (permissionsForTabPanel == null) {
             permissionsForTabPanel = new HashSet<>();
             permissionsAnyOfWhichIsRequiredToSeeWidget.put(tabPanel.getPanel(), permissionsForTabPanel);
@@ -468,14 +468,14 @@ public class AdminConsolePanel extends HeaderPanel implements HandleTabSelectabl
      * is also implied.
      */
     private boolean userHasPermissionsToSeeWidget(UserDTO user, Widget widget) {
-        final Set<HasPermissions> permissionsRequired = permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget);
+        final Set<WildcardPermission> permissionsRequired = permissionsAnyOfWhichIsRequiredToSeeWidget.get(widget);
         boolean hasPermission;
         if (permissionsRequired.isEmpty()) {
             hasPermission = true;
         } else {
             hasPermission = false;
-            for (HasPermissions requiredStringPermission : permissionsRequired) {
-                WildcardPermission requiredPermission = requiredStringPermission.getPermission();
+            for (WildcardPermission requiredPermission : permissionsRequired) {
+                // TODO bug4763: obtain ownership and ACL through a provider pattern; providers may be passed to this panel's constructor
                 if (PermissionChecker.isPermitted(requiredPermission, user, user.getUserGroups(), /* ownership */ null, /* acl */ null)) {
                     hasPermission = true;
                     break;

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/HasPermissions.java

@@ -70,14 +70,12 @@ public interface HasPermissions {
     WildcardPermission getPermissionForObjects(Action action, String... objectIdentifiers);
 
     public static interface Action {
-        String name();
-
         /**
          * Returns the action as represented in the second part of a {@link WildcardPermission}. This shall be a string
          * that will not need further encoding such as by a {@link WildcardPermissionEncoder} so that it can be used
          * in a {@link WildcardPermission} immediately and without change.
          */
-        String getStringPermission();
+        String name();
     }
 
     /**
@@ -88,11 +86,6 @@ public interface HasPermissions {
      */
     public enum DefaultActions implements Action {
         CREATE, READ, UPDATE, DELETE, CHANGE_OWNERSHIP;
-
-        @Override
-        public String getStringPermission() {
-            return name();
-        }
     }
 
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/PermissionStringEncoder.java

@@ -25,4 +25,22 @@ public interface PermissionStringEncoder<PermissionType> {
      * Put formally, {@code this.decodePermissionPart(this.encodeAsPermissionPart(s)).equals(s)}
      */
     String decodePermissionPart(String permissionPart);
+    
+    /**
+     * Encodes a list of {@link String}s using {@link #encodeAsPermissionPart(String)} and concatenates them using
+     * a separator character that is not legal in any permission string of the {@code PermissionType}. Then, the concatenated
+     * result is again encoded using {@link #encodeAsPermissionPart(String)}.
+     * 
+     * @param strings must not be {@code null}
+     * 
+     * @see #decodeStrings(String)
+     */
+    String encodeStringList(String... strings);
+
+    /**
+     * Decodes a list of {@link String}s that were previously encoded using {@link #encodeStringList(String...)}.
+     * 
+     * @return a non-{@code null} array which is empty if and only if {@code stringEncodedWithEncodeStringList} is empty
+     */
+    String[] decodeStrings(String stringEncodedWithEncodeStringList);
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/HasPermissionsImpl.java

@@ -59,7 +59,7 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions {
         }
         return false;
     }
-
+    
     @Override
     public String getStringPermission(com.sap.sse.security.shared.HasPermissions.Action... actions) {
         final String result;
@@ -75,7 +75,7 @@ public class HasPermissionsImpl extends NamedImpl implements HasPermissions {
                 } else {
                     modesString.append(',');
                 }
-                modesString.append(action.getStringPermission());
+                modesString.append(action.name());
             }
             result = name()+":"+modesString.toString();
         }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/SecuredSecurityTypes.java

@@ -5,6 +5,9 @@ import java.util.HashSet;
 import java.util.Set;
 
 import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.RoleDefinition;
+import com.sap.sse.security.shared.User;
+import com.sap.sse.security.shared.UserGroup;
 
 /**
  * The basic types of logical objects provided by the security bundle that themselves have permissions governing how
@@ -30,6 +33,18 @@ public class SecuredSecurityTypes extends HasPermissionsImpl {
         return Collections.unmodifiableSet(allInstances);
     }
 
+    /**
+     * type-relative identifier is the {@link User#getName() username}.
+     */
     public static final HasPermissions USER = new SecuredSecurityTypes("USER");
+
+    /**
+     * type-relative identifier is the {@link RoleDefinition#getId() role ID's} string representation
+     */
+    public static final HasPermissions ROLE_DEFINITION = new SecuredSecurityTypes("ROLE_DEFINITION");
+    
+    /**
+     * type-relative identifier is the {@link UserGroup#getId() group ID's} string representation
+     */
     public static final HasPermissions USER_GROUP = new SecuredSecurityTypes("USER_GROUP");
 }

java/com.sap.sse.security.common/src/com/sap/sse/security/shared/impl/WildcardPermissionEncoder.java

@@ -1,5 +1,6 @@
 package com.sap.sse.security.shared.impl;
 
+import com.sap.sse.common.Util;
 import com.sap.sse.security.shared.PermissionStringEncoder;
 import com.sap.sse.security.shared.WildcardPermission;
 
@@ -89,4 +90,26 @@ public class WildcardPermissionEncoder implements PermissionStringEncoder<Wildca
         }
         return result.toString();
     }
+
+    @Override
+    public String encodeStringList(String... strings) {
+        final String[] firstPassResult = new String[strings.length];
+        for (int i=0; i<strings.length; i++) {
+            firstPassResult[i] = encodeAsPermissionPart(strings[i]);
+        }
+        final String concatenatedFirstPassResult = Util.join(WildcardPermission.PART_DIVIDER_TOKEN, firstPassResult);
+        return encodeAsPermissionPart(concatenatedFirstPassResult);
+    }
+
+    @Override
+    public String[] decodeStrings(String stringEncodedWithEncodeStringList) {
+        final String decodedPartList = decodePermissionPart(stringEncodedWithEncodeStringList);
+        final String[] parts = decodedPartList.split(WildcardPermission.PART_DIVIDER_TOKEN);
+        final String[] result = new String[parts.length];
+        for (int i=0; i<result.length; i++) {
+            result[i] = decodePermissionPart(parts[i]);
+        }
+        return result;
+    }
+
 }

java/com.sap.sse.security.test/src/com/sap/sse/security/test/PermissionCheckerTest.java

@@ -16,7 +16,7 @@ import org.apache.shiro.subject.PrincipalCollection;
 import org.junit.Before;
 import org.junit.Test;
 
-import com.sap.sailing.domain.common.security.SecuredDomainTypes;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sse.security.AbstractCompositeAuthorizingRealm;
 import com.sap.sse.security.AccessControlStore;
 import com.sap.sse.security.UserStore;
@@ -42,7 +42,7 @@ import com.sap.sse.security.userstore.mongodb.UserStoreImpl;
 
 public class PermissionCheckerTest {
     private final UUID eventId = UUID.randomUUID();
-    private final WildcardPermission eventReadPermission = SecuredDomainTypes.EVENT.getPermissionForObjects(DefaultActions.READ, eventId.toString());
+    private final WildcardPermission eventReadPermission = SecuredDomainType.EVENT.getPermissionForObjects(DefaultActions.READ, eventId.toString());
     private final UUID userTenantId = UUID.randomUUID();
     private UserGroup adminTenant;
     private SecurityUser adminUser;
@@ -100,12 +100,12 @@ public class PermissionCheckerTest {
     }
     
     /**
-     * {@link SecuredDomainTypes} objects may specify an object ID in their third part. When checking a permission,
+     * {@link SecuredDomainType} objects may specify an object ID in their third part. When checking a permission,
      * ownership information needs to be obtained for the object(s) in question because it affects the
      * permission check. For example, a user may have a role that applies its permissions only to objects
      * that the user owns or where the user belongs to the group that owns the object. Therefore, it must be
      * possible to look up the ownership information based on the object ID provided in the third part of the
-     * {@link SecuredDomainTypes} object. This test sets up objects of different kinds, specifies ownerships for them,
+     * {@link SecuredDomainType} object. This test sets up objects of different kinds, specifies ownerships for them,
      * sets up users and roles with qualifications and then validates that the correct permissions emerge based
      * on a successful ownership lookup with the object ID provided by the permission.
      */
@@ -113,21 +113,21 @@ public class PermissionCheckerTest {
     public void testPermissionsImpliedByOwnershipConstrainedRole() throws UserManagementException {
         final String leaderboardName = "My:Leaderboard, the only one ";
         final String regattaName = " My:Regatta, the only one ";
-        WildcardPermission leaderboardPermission = SecuredDomainTypes.LEADERBOARD.getPermissionForObjects(DefaultActions.READ, leaderboardName);
-        WildcardPermission regattaPermission = SecuredDomainTypes.REGATTA.getPermissionForObjects(DefaultActions.READ, regattaName);
+        WildcardPermission leaderboardPermission = SecuredDomainType.LEADERBOARD.getPermissionForObjects(DefaultActions.READ, leaderboardName);
+        WildcardPermission regattaPermission = SecuredDomainType.REGATTA.getPermissionForObjects(DefaultActions.READ, regattaName);
         assertFalse(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
         assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString()));
         // let leaderboard be owned by user
-        accessControlStore.setOwnership(SecuredDomainTypes.LEADERBOARD.getQualifiedObjectIdentifier(leaderboardName), user,
+        accessControlStore.setOwnership(SecuredDomainType.LEADERBOARD.getQualifiedObjectIdentifier(leaderboardName), user,
                 /* tenantOwner */ null, leaderboardName);
         // let regatta be owned by admin
-        accessControlStore.setOwnership(SecuredDomainTypes.REGATTA.getQualifiedObjectIdentifier(regattaName), adminUser,
+        accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaName), adminUser,
                 /* tenantOwner */ null, regattaName);
         // grant user the admin role, but only for objects owned by the user (leaderboard, but not regatta)
         userStore.addRoleForUser(user.getName(), new RoleImpl(AdminRole.getInstance(), /* qualifiedForTenant */ null, /* qualifiedForUser */ user));
         assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
         assertFalse(realm.isPermitted(principalCollection, regattaPermission.toString()));
-        accessControlStore.setOwnership(SecuredDomainTypes.REGATTA.getQualifiedObjectIdentifier(regattaName), /* userOwner */ null,
+        accessControlStore.setOwnership(SecuredDomainType.REGATTA.getQualifiedObjectIdentifier(regattaName), /* userOwner */ null,
                 /* groupOwner */ userTenant, leaderboardName);
         assertTrue(realm.isPermitted(principalCollection, leaderboardPermission.toString()));
         // only adding the group owner doesn't grant permission yet:

java/com.sap.sse.security.test/src/com/sap/sse/security/test/WildcardPermissionEncoderTest.java

@@ -1,5 +1,6 @@
 package com.sap.sse.security.test;
 
+import static org.junit.Assert.assertArrayEquals;
 import static org.junit.Assert.assertEquals;
 
 import org.junit.Test;
@@ -17,6 +18,37 @@ public class WildcardPermissionEncoderTest {
         assertEquals(s, encoder.decodePermissionPart(permission.getParts().get(2).iterator().next()));
     }
     
+    private void testPartList(String... s) {
+        final String encoded = encoder.encodeStringList(s);
+        assertArrayEquals(s, encoder.decodeStrings(encoded));
+        final WildcardPermission permission = new WildcardPermission("TYPE:MODE:"+encoded);
+        assertArrayEquals(s, encoder.decodeStrings(permission.getParts().get(2).iterator().next()));
+    }
+    
+    @Test
+    public void testSimpleList() {
+        testPartList("a", "b", "c");
+    }
+    
+    @Test
+    public void testListWithBlanks() {
+        testPartList("a ", " b", " c ");
+    }
+    
+    @Test
+    public void testListWithPartSeparator() {
+        testPartList("a"+WildcardPermission.PART_DIVIDER_TOKEN, WildcardPermission.PART_DIVIDER_TOKEN+"b",
+                WildcardPermission.PART_DIVIDER_TOKEN+"c"+WildcardPermission.PART_DIVIDER_TOKEN);
+    }
+    
+    @Test
+    public void testListWithPartAndSubpartSeparators() {
+        testPartList("a"+WildcardPermission.PART_DIVIDER_TOKEN,
+                WildcardPermission.PART_DIVIDER_TOKEN+"b"+WildcardPermission.SUBPART_DIVIDER_TOKEN,
+                WildcardPermission.SUBPART_DIVIDER_TOKEN+WildcardPermission.PART_DIVIDER_TOKEN+"c"+
+                        WildcardPermission.PART_DIVIDER_TOKEN+WildcardPermission.SUBPART_DIVIDER_TOKEN);
+    }
+    
     @Test
     public void testSimpleString() {
         test("abc");

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/authentication/decorator/AuthorizedContentDecorator.java

@@ -8,7 +8,7 @@ import com.google.gwt.user.client.ui.ProvidesResize;
 import com.google.gwt.user.client.ui.RequiresResize;
 import com.google.gwt.user.client.ui.SimplePanel;
 import com.google.gwt.user.client.ui.Widget;
-import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.WildcardPermission;
 import com.sap.sse.security.ui.authentication.app.AuthenticationContext;
 import com.sap.sse.security.ui.authentication.app.NeedsAuthenticationContext;
 import com.sap.sse.security.ui.client.i18n.StringMessages;
@@ -23,14 +23,12 @@ public class AuthorizedContentDecorator extends Composite implements RequiresRes
     private Widget content;
     private WidgetFactory contentWidgetFactory;
     private final NotLoggedInView notLoggedInView;
-    private String permissionToCheck;
+    private WildcardPermission permissionToCheck;
 
     public AuthorizedContentDecorator(NotLoggedInPresenter presenter, NotLoggedInView notLoggedInView) {
         this.notLoggedInView = notLoggedInView;
-
         notLoggedInView.setPresenter(presenter);
         notLoggedInView.setSignInText(StringMessages.INSTANCE.signIn());
-
         initWidget(contentHolder);
     }
 
@@ -89,15 +87,12 @@ public class AuthorizedContentDecorator extends Composite implements RequiresRes
         boolean isAuthenticated = authenticationContext.isLoggedIn();
         boolean isPermitted = isPermitted(authenticationContext);
         boolean maySeeRealContent = isAuthenticated && isPermitted;
-
         IsWidget isWidget = maySeeRealContent ? getContentWidget() : notLoggedInView;
-
         if (!maySeeRealContent) {
             String message = !isAuthenticated ? StringMessages.INSTANCE.youAreNotSignedIn() : StringMessages.INSTANCE
                     .youDontHaveRequiredPermission();
             notLoggedInView.setMessage(message);
         }
-
         Widget widget = isWidget.asWidget();
         if (widget instanceof RequiresResize) {
             widget.setSize("100%", "100%");
@@ -118,16 +113,7 @@ public class AuthorizedContentDecorator extends Composite implements RequiresRes
      * 
      * @param permissionToCheck the permission to check
      */
-    public void setPermissionToCheck(String permissionToCheck) {
+    public void setPermissionToCheck(WildcardPermission permissionToCheck) {
         this.permissionToCheck = permissionToCheck;
     }
-
-    /**
-     * Setting a permission causes that the user not only needs to be logged in but also needs to have the given permission.
-     * 
-     * @param permissionToCheck the permission to check
-     */
-    public void setPermissionToCheck(HasPermissions permissionToCheck) {
-        setPermissionToCheck(permissionToCheck.getStringPermission());
-    }
 }

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/client/usermanagement/UserEditDialog.java

@@ -32,6 +32,7 @@ import com.sap.sse.gwt.client.async.MarkedAsyncCallback;
 import com.sap.sse.gwt.client.controls.listedit.StringListEditorComposite;
 import com.sap.sse.gwt.client.dialog.DataEntryDialog;
 import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.HasPermissions.Action;
 import com.sap.sse.security.shared.Role;
 import com.sap.sse.security.shared.RoleDefinition;
 import com.sap.sse.security.shared.RoleImpl;
@@ -99,8 +100,10 @@ public class UserEditDialog extends DataEntryDialog<Pair<UserDTO, Iterable<Tripl
         this.fullName = createTextBox(userToEdit.getFullName());
         this.company = createTextBox(userToEdit.getCompany());
         List<String> defaultPermissionNames = new ArrayList<>();
-        for (HasPermissions permission : additionalPermissions) {
-            defaultPermissionNames.add(permission.getStringPermission());
+        for (final HasPermissions permission : additionalPermissions) {
+            for (final Action action : permission.getAvailableActions()) {
+                defaultPermissionNames.add(permission.getStringPermission(action));
+            }
         }
         permissionsEditor = new StringListEditorComposite(userToEdit==null?Collections.<String>emptySet():userToEdit.getStringPermissions(), stringMessages,
                 com.sap.sse.gwt.client.IconResources.INSTANCE.removeIcon(), defaultPermissionNames,

java/com.sap.sse.security.ui/src/main/java/com/sap/sse/security/ui/shared/UserDTO.java

@@ -6,10 +6,13 @@ import java.util.List;
 import com.google.gwt.user.client.rpc.IsSerializable;
 import com.sap.sse.common.Util;
 import com.sap.sse.security.shared.AccessControlList;
+import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.shared.Ownership;
 import com.sap.sse.security.shared.Role;
 import com.sap.sse.security.shared.UserGroup;
 import com.sap.sse.security.shared.WildcardPermission;
+import com.sap.sse.security.shared.impl.OwnershipImpl;
 import com.sap.sse.security.shared.impl.SecurityUserImpl;
 
 public class UserDTO extends SecurityUserImpl implements IsSerializable {
@@ -100,6 +103,16 @@ public class UserDTO extends SecurityUserImpl implements IsSerializable {
         return hasPermission(permission, ownership, getUserGroups(), acl);
     }
     
+    /**
+     * Checks whether the user has permission to {@link DefaultActions#CREATE create} an object of the logical type
+     * specified, assuming that it will be created with this user as the {@link Ownership#getUserOwner() user owner} and
+     * this user's {@link #getDefaultTenant() default group} as the {@link Ownership#getTenantOwner() group owner}.
+     */
+    public boolean hasCreatePermission(HasPermissions logicalSecuredObjectType) {
+        return hasPermission(logicalSecuredObjectType.getPermission(DefaultActions.CREATE),
+                new OwnershipImpl(this, getDefaultTenant()));
+    }
+    
     public List<AccountDTO> getAccounts() {
         return accounts;
     }