initial security check implementation for Home&Dispatch

java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/EventBase.java

@@ -8,13 +8,14 @@ import com.sap.sse.common.NamedWithID;
 import com.sap.sse.common.Renamable;
 import com.sap.sse.common.TimePoint;
 import com.sap.sse.common.media.ImageSize;
+import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
 import com.sap.sse.shared.media.WithMedia;
 
 /**
  * Base interface for an Event consisting of all static information, which might be shared
  * by the server and an Android application.
  */
-public interface EventBase extends NamedWithID, WithDescription, Renamable, WithMedia {
+public interface EventBase extends NamedWithID, WithDescription, Renamable, WithMedia, WithQualifiedObjectIdentifier {
 
     void setDescription(String description);
     

java/com.sap.sailing.domain.shared.android/src/com/sap/sailing/domain/base/impl/EventBaseImpl.java

@@ -13,6 +13,7 @@ import java.util.concurrent.ConcurrentLinkedQueue;
 
 import com.sap.sailing.domain.base.EventBase;
 import com.sap.sailing.domain.base.Venue;
+import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sse.common.TimePoint;
 import com.sap.sse.common.Util;
 import com.sap.sse.common.Util.Pair;
@@ -20,6 +21,8 @@ import com.sap.sse.common.media.ImageSize;
 import com.sap.sse.common.media.MediaTagConstants;
 import com.sap.sse.common.media.MimeType;
 import com.sap.sse.concurrent.CopyOnWriteHashMap;
+import com.sap.sse.security.shared.HasPermissions;
+import com.sap.sse.security.shared.QualifiedObjectIdentifier;
 import com.sap.sse.shared.media.ImageDescriptor;
 import com.sap.sse.shared.media.MediaDescriptor;
 import com.sap.sse.shared.media.MediaUtils;
@@ -368,4 +371,14 @@ public abstract class EventBaseImpl implements EventBase {
         }
         return false;
     }
+
+    @Override
+    public QualifiedObjectIdentifier getIdentifier() {
+        return getType().getQualifiedObjectIdentifier(getId().toString());
+    }
+
+    @Override
+    public HasPermissions getType() {
+        return SecuredDomainType.EVENT;
+    }
 }

java/com.sap.sailing.domain/src/com/sap/sailing/domain/base/Event.java

@@ -4,11 +4,7 @@ import java.util.UUID;
 
 import com.sap.sailing.domain.common.WindSource;
 import com.sap.sailing.domain.common.WindSourceType;
-import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.leaderboard.LeaderboardGroup;
-import com.sap.sse.security.shared.HasPermissions;
-import com.sap.sse.security.shared.QualifiedObjectIdentifier;
-import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
 
 /**
  * An event is a group of {@link Regatta regattas} carried out at a common venue within a common time frame. For
@@ -18,7 +14,7 @@ import com.sap.sse.security.shared.WithQualifiedObjectIdentifier;
  * @author Axel Uhl (D043530)
  * 
  */
-public interface Event extends EventBase, WithQualifiedObjectIdentifier {
+public interface Event extends EventBase {
     
     /**
      * For events, the ID is always a UUID.
@@ -74,14 +70,4 @@ public interface Event extends EventBase, WithQualifiedObjectIdentifier {
      * logo / link on the event's UI representation.
      */
     void setWindFinderReviewedSpotsCollection(Iterable<String> reviewedSpotsCollectionIds);
-
-    @Override
-    default QualifiedObjectIdentifier getIdentifier() {
-        return getType().getQualifiedObjectIdentifier(getId().toString());
-    }
-
-    @Override
-    default HasPermissions getType() {
-        return SecuredDomainType.EVENT;
-    }
 }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/SailingDispatchContext.java

@@ -9,6 +9,7 @@ import com.sap.sailing.news.EventNewsService;
 import com.sap.sailing.server.RacingEventService;
 import com.sap.sailing.server.statistics.TrackedRaceStatisticsCache;
 import com.sap.sse.gwt.dispatch.client.system.DispatchContext;
+import com.sap.sse.security.SecurityService;
 
 /**
  * {@link DispatchContext} implementation, which is passed to backend-side {@link SailingAction} executions to provide
@@ -36,6 +37,9 @@ public interface SailingDispatchContext extends DispatchContext {
     @GwtIncompatible
     Date getCurrentClientTime();
     
+    @GwtIncompatible
+    SecurityService getSecurityService();
+
     <T> T getPreferenceForCurrentUser(String preferenceKey);
     
     void setPreferenceForCurrentUser(String preferenceKey, Object preference);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/anniversary/GetAnniversariesAction.java

@@ -51,7 +51,8 @@ public class GetAnniversariesAction implements SailingAction<ResultWithTTL<Anniv
         });
 
         TimeToLiveCalculator timeToLiveCalculator = new TimeToLiveCalculator();
-        HomeServiceUtil.forAllPublicEvents(service, context.getRequest(), timeToLiveCalculator);
+        HomeServiceUtil.forAllPublicEventsWithReadPermission(service, context.getRequest(), context.getSecurityService(),
+                timeToLiveCalculator);
         return new ResultWithTTL<AnniversariesDTO>(timeToLiveCalculator.getTimeToLive(), anniversaries);
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetCompetitionFormatRacesAction.java

@@ -49,8 +49,12 @@ public class GetCompetitionFormatRacesAction implements
     @Override
     @GwtIncompatible
     public ResultWithTTL<ListResult<RaceCompetitionFormatSeriesDTO>> execute(SailingDispatchContext context) throws DispatchException {
+        context.getSecurityService()
+                .checkCurrentUserReadPermission(context.getRacingEventService().getLeaderboardByName(regattaId));
+        context.getSecurityService()
+                .checkCurrentUserReadPermission(context.getRacingEventService().getRegattaByName(regattaId));
         RaceCompetitionFormatDataCalculator competitionFormatDataCalculator = new RaceCompetitionFormatDataCalculator();
-        EventActionUtil.forRacesOfRegatta(context, eventId, regattaId, competitionFormatDataCalculator);
+        EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaId, competitionFormatDataCalculator);
         Duration timeToLive = EventActionUtil.getEventStateDependentTTL(context, eventId, Duration.ONE_MINUTE);
         return new ResultWithTTL<>(timeToLive, new ListResult<>(competitionFormatDataCalculator.getResult()));
     }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventListViewAction.java

@@ -19,7 +19,8 @@ public class GetEventListViewAction implements SailingAction<EventListViewDTO>,
     @GwtIncompatible
     public EventListViewDTO execute(SailingDispatchContext context) {
         EventListDataCalculator eventListDataCalculator = new EventListDataCalculator(context.getRacingEventService());
-        HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(),
+        HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(),
+                context.getSecurityService(),
                 eventListDataCalculator);
         return eventListDataCalculator.getResult();
     }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetEventViewAction.java

@@ -61,6 +61,7 @@ public class GetEventViewAction implements SailingAction<EventViewDTO>, IsClient
         if (event == null) {
             throw new RuntimeException("Event not found");
         }
+        context.getSecurityService().checkCurrentUserReadPermission(event);
 
         final EventViewDTO dto = new EventViewDTO();
         HomeServiceUtil.mapToMetadataDTO(event, dto, context.getRacingEventService());
@@ -89,16 +90,16 @@ public class GetEventViewAction implements SailingAction<EventViewDTO>, IsClient
         final Set<RegattaMetadataDTO> regattasOfEvent = new HashSet<>();
         final Set<LeaderboardGroup> relevantLeaderboardGroupsOfEvent = new HashSet<>();
         
-        EventActionUtil.forLeaderboardsOfEvent(context, event, new LeaderboardCallback() {
+        EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, event, new LeaderboardCallback() {
             @Override
-            public void doForLeaderboard(LeaderboardContext context) {
+            public void doForLeaderboard(LeaderboardContext lcontext) {
                 try {
-                    Util.addAll(context.getLeaderboardGroups(), relevantLeaderboardGroupsOfEvent);
-                    RegattaMetadataDTO regattaDTO = context.asRegattaMetadataDTO();
+                    Util.addAll(lcontext.getLeaderboardGroups(), relevantLeaderboardGroupsOfEvent);
+                    RegattaMetadataDTO regattaDTO = lcontext.asRegattaMetadataDTO();
                     regattasOfEvent.add(regattaDTO);
                     dto.getRegattas().add(regattaDTO);
                 } catch (Exception e) {
-                    logger.log(Level.SEVERE, "Catched exception while reading data for leaderboard " + context.getLeaderboardName(), e);
+                    logger.log(Level.SEVERE, "Catched exception while reading data for leaderboard " + lcontext.getLeaderboardName(), e);
                 }
             }
         });

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetFinishedRacesAction.java

@@ -50,7 +50,7 @@ public class GetFinishedRacesAction implements SailingAction<ResultWithTTL<ListR
     @GwtIncompatible
     public ResultWithTTL<ListResult<RaceListRaceDTO>> execute(SailingDispatchContext context) {
         RaceListDataCalculator raceListDataCalculator = new RaceListDataCalculator();
-        EventActionUtil.forRacesOfRegatta(context, eventId, regattaId, raceListDataCalculator);
+        EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaId, raceListDataCalculator);
         
         return new ResultWithTTL<>(EventActionUtil.getEventStateDependentTTL(context, eventId,
                 Duration.ONE_MINUTE.times(5)), new ListResult<>(raceListDataCalculator.getResult()));

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForEventAction.java

@@ -50,11 +50,11 @@ public class GetLiveRacesForEventAction implements SailingAction<ResultWithTTL<S
     @Override
     @GwtIncompatible
     public ResultWithTTL<SortedSetResult<LiveRaceDTO>> execute(final SailingDispatchContext context) {
-        return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent<SortedSetResult<LiveRaceDTO>>() {
+        return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent<SortedSetResult<LiveRaceDTO>>() {
             @Override
             public ResultWithTTL<SortedSetResult<LiveRaceDTO>> calculateWithEvent(Event event) {
                 LiveRaceCalculator liveRaceCalculator = new LiveRaceCalculator();
-                EventActionUtil.forRacesOfEvent(context, eventId, liveRaceCalculator);
+                EventActionUtil.forRacesOfEventWithReadPermissions(context, eventId, liveRaceCalculator);
                 return liveRaceCalculator.getResult();
             }
         });

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetLiveRacesForRegattaAction.java

@@ -53,11 +53,11 @@ public class GetLiveRacesForRegattaAction implements SailingAction<ResultWithTTL
     @Override
     @GwtIncompatible
     public ResultWithTTL<SortedSetResult<LiveRaceDTO>> execute(final SailingDispatchContext context) {
-        return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent<SortedSetResult<LiveRaceDTO>>() {
+        return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent<SortedSetResult<LiveRaceDTO>>() {
             @Override
             public ResultWithTTL<SortedSetResult<LiveRaceDTO>> calculateWithEvent(Event event) {
                 LiveRaceCalculator liveRaceCalculator = new LiveRaceCalculator();
-                EventActionUtil.forRacesOfRegatta(context, eventId, regattaName, liveRaceCalculator);
+                EventActionUtil.forRacesOfRegattaWithReadPermissions(context, eventId, regattaName, liveRaceCalculator);
                 return liveRaceCalculator.getResult();
             }
         });

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaListViewAction.java

@@ -48,8 +48,9 @@ public class GetRegattaListViewAction implements SailingAction<ResultWithTTL<Sor
     @Override
     @GwtIncompatible
     public ResultWithTTL<SortedSetResult<RegattaWithProgressDTO>> execute(final SailingDispatchContext context) {
+        context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId));
         final List<RegattaWithProgressDTO> result = new LinkedList<>();
-        EventActionUtil.forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() {
+        EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() {
             @Override
             public void doForLeaderboard(LeaderboardContext leaderboardContext) {
                 result.add(leaderboardContext.getRegattaWithProgress());

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaStatisticsAction.java

@@ -46,7 +46,7 @@ public class GetRegattaStatisticsAction implements SailingAction<ResultWithTTL<E
     @GwtIncompatible
     public ResultWithTTL<EventStatisticsDTO> execute(SailingDispatchContext context) throws DispatchException {
         StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache());
-        statisticsCalculator.doForLeaderboard(EventActionUtil.getLeaderboardContext(context, eventId, regattaId));
+        statisticsCalculator.doForLeaderboard(EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, regattaId));
         return statisticsCalculator.getResult();
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattaWithProgressAction.java

@@ -48,8 +48,11 @@ public class GetRegattaWithProgressAction implements SailingAction<ResultWithTTL
     @Override
     @GwtIncompatible
     public ResultWithTTL<RegattaWithProgressDTO> execute(SailingDispatchContext context) {
+        context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId));
+        context.getSecurityService()
+                .checkCurrentUserReadPermission(context.getRacingEventService().getRegattaByName(regattaId));
         return new ResultWithTTL<>(EventActionUtil.getEventStateDependentTTL(context, eventId, Duration.ONE_MINUTE.times(5)),
-                EventActionUtil.getLeaderboardContext(context, eventId, regattaId).getRegattaWithProgress());
+                EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, regattaId).getRegattaWithProgress());
     }
 
     @Override

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetRegattasAndLiveRacesForEventAction.java

@@ -52,12 +52,13 @@ public class GetRegattasAndLiveRacesForEventAction implements SailingAction<Resu
     @Override
     @GwtIncompatible
     public ResultWithTTL<RegattasAndLiveRacesDTO> execute(SailingDispatchContext context) {
+        context.getSecurityService().checkCurrentUserReadPermission(context.getRacingEventService().getEvent(eventId));
         final Map<String, RegattaMetadataDTO> regattas = mapRegattas(context);
         final TreeMap<RegattaMetadataDTO, TreeSet<LiveRaceDTO>> regattasWithRaces = new TreeMap<>();
         final TreeSet<RegattaMetadataDTO> regattasWithoutRaces = new TreeSet<>();
         final RaceRefreshCalculator refreshCalculator = new RaceRefreshCalculator();
 
-        EventActionUtil.forRacesOfEvent(context, eventId, raceContent -> {
+        EventActionUtil.forRacesOfEventWithReadPermissions(context, eventId, raceContent -> {
             Optional<LiveRaceDTO> liveRace = Optional.ofNullable(raceContent.getLiveRaceOrNull());
             liveRace.ifPresent(r -> ensureRegatta(raceContent, regattas, regattasWithRaces).add(r));
             refreshCalculator.doForRace(raceContent);
@@ -66,13 +67,13 @@ public class GetRegattasAndLiveRacesForEventAction implements SailingAction<Resu
                 .forEach(regattasWithoutRaces::add);
         RegattasAndLiveRacesDTO dto = new RegattasAndLiveRacesDTO(regattasWithRaces, regattasWithoutRaces);
         ResultWithTTL<RegattasAndLiveRacesDTO> result = new ResultWithTTL<>(refreshCalculator.getTTL(), dto);
-        return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, event -> result, dto);
+        return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, event -> result, dto);
     }
 
     @GwtIncompatible
     private Map<String, RegattaMetadataDTO> mapRegattas(SailingDispatchContext context) {
         final Map<String, RegattaMetadataDTO> result = new HashMap<>();
-        EventActionUtil.forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() {
+        EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() {
             @Override
             public void doForLeaderboard(LeaderboardContext context) {
                 result.put(context.getLeaderboardName(), context.asRegattaMetadataDTO());

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/GetSeriesStatisticsAction.java

@@ -45,7 +45,12 @@ public class GetSeriesStatisticsAction implements SailingAction<ResultWithTTL<Ev
     public ResultWithTTL<EventStatisticsDTO> execute(SailingDispatchContext context) throws DispatchException {
         StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache());
         final LeaderboardGroup leaderboardGroupByID = context.getRacingEventService().getLeaderboardGroupByID(seriesLeaderboardGroupId);
-        leaderboardGroupByID.getLeaderboards().forEach(statisticsCalculator::addLeaderboard);
+        context.getSecurityService().checkCurrentUserReadPermission(leaderboardGroupByID);
+        leaderboardGroupByID.getLeaderboards().forEach(t -> {
+            if (context.getSecurityService().hasCurrentUserReadPermission(t)) {
+                statisticsCalculator.addLeaderboard(t);
+            }
+        });
         return statisticsCalculator.getResult();
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniLeaderbordAction.java

@@ -64,7 +64,7 @@ public class GetMiniLeaderbordAction implements SailingAction<ResultWithTTL<GetM
     @Override
     @GwtIncompatible
     public ResultWithTTL<GetMiniLeaderboardDTO> execute(SailingDispatchContext context) {
-        return EventActionUtil.getLeaderboardContext(context, eventId, leaderboardName).calculateMiniLeaderboard(context.getRacingEventService(), limit);
+        return EventActionUtil.getLeaderboardContextWithReadPermissions(context, eventId, leaderboardName).calculateMiniLeaderboard(context.getRacingEventService(), limit);
     }
 
     @Override

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/minileaderboard/GetMiniOverallLeaderbordAction.java

@@ -4,6 +4,7 @@ import java.util.UUID;
 
 import com.google.gwt.core.shared.GwtIncompatible;
 import com.sap.sailing.domain.base.Event;
+import com.sap.sailing.domain.leaderboard.Leaderboard;
 import com.sap.sailing.domain.leaderboard.LeaderboardGroup;
 import com.sap.sailing.gwt.common.communication.routing.ProvidesLeaderboardRouting;
 import com.sap.sailing.gwt.home.communication.SailingAction;
@@ -63,11 +64,16 @@ public class GetMiniOverallLeaderbordAction implements SailingAction<ResultWithT
     @GwtIncompatible
     public ResultWithTTL<GetMiniLeaderboardDTO> execute(SailingDispatchContext context) {
         LeaderboardGroup leaderboardGroup = context.getRacingEventService().getLeaderboardGroupByID(leaderboardGroupUUID);
+        context.getSecurityService().checkCurrentUserReadPermission(leaderboardGroup);
         if(leaderboardGroup == null) {
             throw new RuntimeException("Invalid leaderboardGroupID");
         }
         Event event = HomeServiceUtil.determineBestMatchingEvent(context.getRacingEventService(), leaderboardGroup);
-        LeaderboardContext lctx = new LeaderboardContext(context, event, event.getLeaderboardGroups(), leaderboardGroup.getOverallLeaderboard());
+        context.getSecurityService().checkCurrentUserReadPermission(event);
+        Leaderboard overallLeaderBoard = leaderboardGroup.getOverallLeaderboard();
+        context.getSecurityService().checkCurrentUserReadPermission(overallLeaderBoard);
+        LeaderboardContext lctx = new LeaderboardContext(context, event, event.getLeaderboardGroups(),
+                overallLeaderBoard);
         return lctx.calculateMiniLeaderboard(context.getRacingEventService(), limit);
         
     }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/news/GetEventOverviewNewsAction.java

@@ -73,7 +73,7 @@ public class GetEventOverviewNewsAction implements SailingAction<ResultWithTTL<L
     @Override
     @GwtIncompatible
     public ResultWithTTL<ListResult<NewsEntryDTO>> execute(final SailingDispatchContext context) {
-        return EventActionUtil.withLiveRaceOrDefaultSchedule(context, eventId, new CalculationWithEvent<ListResult<NewsEntryDTO>>() {
+        return EventActionUtil.withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, new CalculationWithEvent<ListResult<NewsEntryDTO>>() {
             @Override
             public ResultWithTTL<ListResult<NewsEntryDTO>> calculateWithEvent(Event event) {
                 return new ResultWithTTL<>(Duration.ONE_MINUTE.times(2), new ListResult<NewsEntryDTO>(getNews(context, event)));

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/event/statistics/GetEventStatisticsAction.java

@@ -42,7 +42,7 @@ public class GetEventStatisticsAction implements SailingAction<ResultWithTTL<Eve
     @GwtIncompatible
     public ResultWithTTL<EventStatisticsDTO> execute(SailingDispatchContext context) throws DispatchException {
         StatisticsCalculator statisticsCalculator = new StatisticsCalculator(context.getTrackedRaceStatisticsCache());
-        EventActionUtil.forLeaderboardsOfEvent(context, eventId, statisticsCalculator);
+        EventActionUtil.forLeaderboardsOfEventWithReadPermissions(context, eventId, statisticsCalculator);
         return statisticsCalculator.getResult();
     }
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetRecentEventsAction.java

@@ -41,7 +41,8 @@ public class GetRecentEventsAction implements SailingAction<ListResult<EventQuic
     @GwtIncompatible
     public ListResult<EventQuickfinderDTO> execute(final SailingDispatchContext context) throws DispatchException {
         final SortedSet<EventQuickfinderDTO> events = new TreeSet<>();
-        HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), new EventVisitor() {
+        HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(),
+                context.getSecurityService(), new EventVisitor() {
             @Override
             public void visit(EventBase event, boolean onRemoteServer, URL baseURL) {
                 EventQuickfinderDTO dto = new EventQuickfinderDTO();

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStagedEventsAction.java

@@ -36,7 +36,8 @@ public class GetStagedEventsAction implements SailingAction<ListResult<EventStag
     @GwtIncompatible
     public ListResult<EventStageDTO> execute(final SailingDispatchContext context) throws DispatchException {
         EventStageCandidateCalculator stageCandidateCalculator = new EventStageCandidateCalculator();
-        HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(),
+        HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(),
+                context.getSecurityService(),
                 stageCandidateCalculator);
         ListResult<EventStageDTO> result = new ListResult<>();
         int count = 0;

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/communication/start/GetStartViewAction.java

@@ -47,7 +47,8 @@ public class GetStartViewAction implements SailingAction<StartViewDTO>, IsClient
     public StartViewDTO execute(SailingDispatchContext context) {
         EventStageCandidateCalculator stageCandidateCalculator = new EventStageCandidateCalculator();
         RecentEventsCalculator recentEventsCalculator = new RecentEventsCalculator();
-        HomeServiceUtil.forAllPublicEvents(context.getRacingEventService(), context.getRequest(), stageCandidateCalculator, recentEventsCalculator);
+        HomeServiceUtil.forAllPublicEventsWithReadPermission(context.getRacingEventService(), context.getRequest(),
+                context.getSecurityService(), stageCandidateCalculator, recentEventsCalculator);
         StartViewDTO result = new StartViewDTO();
         int count = 0;
         for (Pair<StageEventType, EventHolder> pair : stageCandidateCalculator.getFeaturedEvents()) {

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/EventActionUtil.java

@@ -65,17 +65,23 @@ public final class EventActionUtil {
         return new LeaderboardContext(context, event, event.getLeaderboardGroups(), overallLeaderboard);
     }
     
-    public static LeaderboardContext getLeaderboardContext(SailingDispatchContext context, UUID eventId, String leaderboardId) {
+    public static LeaderboardContext getLeaderboardContextWithReadPermissions(SailingDispatchContext context, UUID eventId, String leaderboardId) {
         RacingEventService service = context.getRacingEventService();
         Event event = service.getEvent(eventId);
+        context.getSecurityService().checkCurrentUserReadPermission(event);
         final LinkedHashSet<LeaderboardGroup> leaderboardGroups = new LinkedHashSet<>();
         Leaderboard leaderboard = null;
         for (LeaderboardGroup leaderboardGroup : event.getLeaderboardGroups()) {
-            for (Leaderboard l : leaderboardGroup.getLeaderboards()) {
-                if (l.getName().equals(leaderboardId)) {
-                    leaderboardGroups.add(leaderboardGroup);
-                    leaderboard = l;
+            if (context.getSecurityService().hasCurrentUserReadPermission(leaderboardGroup)) {
+                for (Leaderboard l : leaderboardGroup.getLeaderboards()) {
+                    if (context.getSecurityService().hasCurrentUserReadPermission(l)) {
+                        if (l.getName().equals(leaderboardId)) {
+                            leaderboardGroups.add(leaderboardGroup);
+                            leaderboard = l;
+                        }
+                    }
                 }
+
             }
         }
         if (leaderboardGroups.isEmpty()) {
@@ -110,14 +116,15 @@ public final class EventActionUtil {
         return calculateTtlForNonLiveEvent(event, eventState);
     }
 
-    public static <T extends DTO> ResultWithTTL<T> withLiveRaceOrDefaultSchedule(SailingDispatchContext context,
+    public static <T extends DTO> ResultWithTTL<T> withLiveRaceOrDefaultScheduleWithReadPermissions(SailingDispatchContext context,
             UUID eventId, CalculationWithEvent<T> callback) {
-        return withLiveRaceOrDefaultSchedule(context, eventId, callback, null);
+        return withLiveRaceOrDefaultScheduleWithReadPermissions(context, eventId, callback, null);
     }
 
-    public static <T extends DTO> ResultWithTTL<T> withLiveRaceOrDefaultSchedule(SailingDispatchContext context,
+    public static <T extends DTO> ResultWithTTL<T> withLiveRaceOrDefaultScheduleWithReadPermissions(SailingDispatchContext context,
             UUID eventId, CalculationWithEvent<T> callback, T defaultResult) {
         Event event = context.getRacingEventService().getEvent(eventId);
+        context.getSecurityService().checkCurrentUserReadPermission(event);
         EventState eventState = HomeServiceUtil.calculateEventState(event);
         if (eventState == EventState.FINISHED) {
             return new ResultWithTTL<T>(calculateTtlForNonLiveEvent(event, eventState), defaultResult);
@@ -167,25 +174,29 @@ public final class EventActionUtil {
         return Duration.NULL;
     }
     
-    public static void forLeaderboardsOfEvent(SailingDispatchContext context, UUID eventId, LeaderboardCallback callback) {
+    public static void forLeaderboardsOfEventWithReadPermissions(SailingDispatchContext context, UUID eventId, LeaderboardCallback callback) {
         RacingEventService service = context.getRacingEventService();
         Event event = service.getEvent(eventId);
         if (event == null) {
             throw new RuntimeException("Event not found");
         }
-        forLeaderboardsOfEvent(context, event, callback);
+        forLeaderboardsOfEventWithReadPermissions(context, event, callback);
     }
 
-    public static void forLeaderboardsOfEvent(SailingDispatchContext context, Event event, LeaderboardCallback callback) {
+    public static void forLeaderboardsOfEventWithReadPermissions(SailingDispatchContext context, Event event, LeaderboardCallback callback) {
         final Map<Leaderboard, LinkedHashSet<LeaderboardGroup>> leaderboardGroupsForLeaderboard = new HashMap<>();
         for (LeaderboardGroup leaderboardGroup : event.getLeaderboardGroups()) {
-            for (Leaderboard leaderboard : leaderboardGroup.getLeaderboards()) {
-                LinkedHashSet<LeaderboardGroup> set = leaderboardGroupsForLeaderboard.get(leaderboard);
-                if (set == null) {
-                    set = new LinkedHashSet<>();
-                    leaderboardGroupsForLeaderboard.put(leaderboard, set);
+            if (context.getSecurityService().hasCurrentUserReadPermission(leaderboardGroup)) {
+                for (Leaderboard leaderboard : leaderboardGroup.getLeaderboards()) {
+                    if (context.getSecurityService().hasCurrentUserReadPermission(leaderboard)) {
+                        LinkedHashSet<LeaderboardGroup> set = leaderboardGroupsForLeaderboard.get(leaderboard);
+                        if (set == null) {
+                            set = new LinkedHashSet<>();
+                            leaderboardGroupsForLeaderboard.put(leaderboard, set);
+                        }
+                        set.add(leaderboardGroup);
+                    }
                 }
-                set.add(leaderboardGroup);
             }
         }
         for (Entry<Leaderboard, LinkedHashSet<LeaderboardGroup>> e : leaderboardGroupsForLeaderboard.entrySet()) {
@@ -203,16 +214,16 @@ public final class EventActionUtil {
         }
     }
     
-    public static void forRacesOfEvent(final SailingDispatchContext context, UUID eventId, final RaceCallback callback) {
-        forLeaderboardsOfEvent(context, eventId, new LeaderboardCallback() {
+    public static void forRacesOfEventWithReadPermissions(final SailingDispatchContext context, UUID eventId, final RaceCallback callback) {
+        forLeaderboardsOfEventWithReadPermissions(context, eventId, new LeaderboardCallback() {
             @Override
             public void doForLeaderboard(LeaderboardContext leaderboardContext) {
-                leaderboardContext.forRaces(callback);
+                leaderboardContext.forRacesWithReadPermissions(callback);
             }
         });
     }
     
-    public static void forRacesOfRegatta(SailingDispatchContext context, UUID eventId, String regattaName, RaceCallback callback) {
-        getLeaderboardContext(context, eventId, regattaName).forRaces(callback);
+    public static void forRacesOfRegattaWithReadPermissions(SailingDispatchContext context, UUID eventId, String regattaName, RaceCallback callback) {
+        getLeaderboardContextWithReadPermissions(context, eventId, regattaName).forRacesWithReadPermissions(callback);
     }
 }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/LeaderboardContext.java

@@ -23,6 +23,7 @@ import com.sap.sailing.domain.leaderboard.FlexibleLeaderboard;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
 import com.sap.sailing.domain.leaderboard.LeaderboardGroup;
 import com.sap.sailing.domain.leaderboard.RegattaLeaderboard;
+import com.sap.sailing.domain.tracking.TrackedRace;
 import com.sap.sailing.gwt.home.communication.SailingDispatchContext;
 import com.sap.sailing.gwt.home.communication.event.EventSeriesReferenceDTO;
 import com.sap.sailing.gwt.home.communication.event.EventState;
@@ -44,6 +45,7 @@ import com.sap.sse.common.impl.MillisecondsTimePoint;
 import com.sap.sse.gwt.dispatch.shared.commands.DTO;
 import com.sap.sse.gwt.dispatch.shared.commands.ResultWithTTL;
 import com.sap.sse.gwt.dispatch.shared.exceptions.DispatchException;
+import com.sap.sse.security.SecurityService;
 
 /**
  * This class aggregates {@link Leaderboard} information by preparing {@link DTO}s for different components representing
@@ -57,20 +59,26 @@ public class LeaderboardContext {
     private final Iterable<LeaderboardGroup> leaderboardGroups;
     private final Leaderboard leaderboard;
     private final RacingEventService service;
+    private SecurityService securityService;
     private Boolean hasMultipleFleets = null;
 
+
     public LeaderboardContext(SailingDispatchContext dispatchContext, Event event, Iterable<LeaderboardGroup> leaderboardGroup, Leaderboard leaderboard) {
         this.service = dispatchContext.getRacingEventService();
+        this.securityService = dispatchContext.getSecurityService();
         this.event = event;
         this.leaderboardGroups = leaderboardGroup;
         this.leaderboard = leaderboard;
     }
     
-    public void forRaces(RaceCallback callback) {
+    public void forRacesWithReadPermissions(RaceCallback callback) {
         for (RaceColumn raceColumn : leaderboard.getRaceColumns()) {
             if (!raceColumn.isCarryForward()) {
                 for (Fleet fleet : raceColumn.getFleets()) {
-                    callback.doForRace(new RaceContext(service, event, this, raceColumn, fleet, service));
+                    TrackedRace tRaceOrNull = raceColumn.getTrackedRace(fleet);
+                    if (tRaceOrNull == null || securityService.hasCurrentUserReadPermission(tRaceOrNull)) {
+                        callback.doForRace(new RaceContext(service, event, this, raceColumn, fleet, service));
+                    }
                 }
             }
         }
@@ -78,7 +86,7 @@ public class LeaderboardContext {
     
     public RegattaWithProgressDTO getRegattaWithProgress() {
         RegattaProgressCalculator regattaProgressCalculator = new RegattaProgressCalculator();
-        forRaces(regattaProgressCalculator);
+        forRacesWithReadPermissions(regattaProgressCalculator);
         RegattaWithProgressDTO regattaDTO = new RegattaWithProgressDTO(regattaProgressCalculator.getResult());
         fillRegattaFields(regattaDTO);
         return regattaDTO;
@@ -86,8 +94,6 @@ public class LeaderboardContext {
     
     public ResultWithTTL<GetMiniLeaderboardDTO> calculateMiniLeaderboard(RacingEventService service, int limit) {
         GetMiniLeaderboardDTO result = new GetMiniLeaderboardDTO();
-        if (leaderboard == null) {
-        }
         try {
             LeaderboardDTO leaderboardDTO = leaderboard.getLeaderboardDTO(null, Collections.<String> emptyList(), true,
                     service, service.getBaseDomainFactory(), false);
@@ -122,7 +128,7 @@ public class LeaderboardContext {
 
     private boolean hasLiveRace() {
         OverallRacesStateCalculator racesStateCalculator = new OverallRacesStateCalculator();
-        forRaces(racesStateCalculator);
+        forRacesWithReadPermissions(racesStateCalculator);
         return racesStateCalculator.hasLiveRace();
     }
     
@@ -149,7 +155,7 @@ public class LeaderboardContext {
         
         // Using the race states to calculate the real state for running events/regattas
         OverallRacesStateCalculator racesStateCalculator = new OverallRacesStateCalculator();
-        forRaces(racesStateCalculator);
+        forRacesWithReadPermissions(racesStateCalculator);
         if(racesStateCalculator.hasLiveRace()) {
             return RegattaState.RUNNING;
         }
@@ -268,7 +274,7 @@ public class LeaderboardContext {
         regattaDTO.setFlexibleLeaderboard(leaderboard instanceof FlexibleLeaderboard);
         
         RegattaRaceDataInfoCalculator regattaRaceDataInfoCalculator = new RegattaRaceDataInfoCalculator();
-        forRaces(regattaRaceDataInfoCalculator);
+        forRacesWithReadPermissions(regattaRaceDataInfoCalculator);
         regattaDTO.setRaceDataInfo(regattaRaceDataInfoCalculator.getRaceDataInfo());
         regattaDTO.setBuoyZoneRadius(getRegattaBuoyZoneRadius());
     }

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/home/server/SailingDispatchContextImpl.java

@@ -87,6 +87,11 @@ public class SailingDispatchContextImpl implements SailingDispatchContext {
         return request;
     }
     
+    @Override
+    public SecurityService getSecurityService() {
+        return securityService;
+    }
+
     @Override
     public URL getRequestBaseURL() throws DispatchException {
         return HomeServiceUtil.getRequestBaseURL(request);

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/server/HomeServiceUtil.java

@@ -52,6 +52,7 @@ import com.sap.sse.gwt.client.media.ImageDTO;
 import com.sap.sse.gwt.client.media.VideoDTO;
 import com.sap.sse.gwt.dispatch.shared.exceptions.DispatchException;
 import com.sap.sse.gwt.dispatch.shared.exceptions.ServerDispatchException;
+import com.sap.sse.security.SecurityService;
 import com.sap.sse.shared.media.ImageDescriptor;
 import com.sap.sse.shared.media.MediaDescriptor;
 import com.sap.sse.shared.media.VideoDescriptor;
@@ -454,11 +455,12 @@ public final class HomeServiceUtil {
         return courseArea == null ? null : courseArea.getId().toString();
     }
     
-    public static void forAllPublicEvents(RacingEventService service, HttpServletRequest request,
+    public static void forAllPublicEventsWithReadPermission(RacingEventService service, HttpServletRequest request,
+            SecurityService securityService,
             EventVisitor... visitors) throws DispatchException {
         URL requestedBaseURL = getRequestBaseURL(request);
         for (Event event : service.getAllEvents()) {
-            if(event.isPublic()) {
+            if (event.isPublic() && securityService.hasCurrentUserReadPermission(event)) {
                 for(EventVisitor visitor : visitors) {
                     visitor.visit(event, false, requestedBaseURL);
                 }
@@ -472,7 +474,7 @@ public final class HomeServiceUtil {
             URL baseURL = getBaseURL(serverRef.getURL());
             if (remoteEvents != null) {
                 for (EventBase remoteEvent : remoteEvents) {
-                    if(remoteEvent.isPublic()) {
+                    if (remoteEvent.isPublic() && securityService.hasCurrentUserReadPermission(remoteEvent)) {
                         for(EventVisitor visitor : visitors) {
                             visitor.visit(remoteEvent, true, baseURL);
                         }

java/com.sap.sailing.server.testsupport/META-INF/MANIFEST.MF

@@ -34,5 +34,6 @@ Require-Bundle: com.sap.sailing.server,
  com.sap.sse.security,
  org.apache.shiro.web;bundle-version="1.2.2",
  org.apache.shiro.core;bundle-version="1.2.2",
- javax.servlet;bundle-version="3.1.0"
+ javax.servlet;bundle-version="3.1.0",
+ com.sap.sse.security.common
 Automatic-Module-Name: com.sap.sailing.server.testsupport

java/com.sap.sse.gwt/META-INF/MANIFEST.MF

@@ -12,7 +12,8 @@ Require-Bundle: com.google.gwt.user;bundle-version="2.8.2";resolution:=optional,
  com.sap.sse.common,
  com.sap.sse.filestorage
 Bundle-ActivationPolicy: lazy
-Import-Package: javax.servlet;version="3.1.0",
+Import-Package: com.sap.sse.security,
+ javax.servlet;version="3.1.0",
  javax.servlet.descriptor;version="3.1.0",
  javax.servlet.http;version="3.1.0",
  org.apache.commons.io,

mobile/com.sap.sailing.android.shared/.classpath

@@ -13,5 +13,6 @@
 	<classpathentry kind="lib" path="/google-play-services_lib/libs/google-play-services.jar"/>
 	<classpathentry combineaccessrules="false" exported="true" kind="src" path="/org.json.simple"/>
 	<classpathentry exported="true" kind="var" path="ANDROID_HOME/extras/android/m2repository/com/android/support/support-annotations/22.2.1/support-annotations-22.2.1.jar"/>
+	<classpathentry combineaccessrules="false" exported="true" kind="src" path="/com.sap.sse.security.common"/>
 	<classpathentry kind="output" path="bin/classes"/>
 </classpath>