Bug 4816: removed MANAGE_MARK_POSITIONS and replaced permission checks

with leaderboard read permission check

java/com.sap.sailing.domain.common/src/com/sap/sailing/domain/common/security/SecuredDomainType.java

@@ -36,7 +36,6 @@ public class SecuredDomainType extends HasPermissionsImpl {
     
     // AdminConsole permissions
     public static final HasPermissions MANAGE_MARK_PASSINGS = new SecuredDomainType("MANAGE_MARK_PASSINGS");
-    public static final HasPermissions MANAGE_MARK_POSITIONS = new SecuredDomainType("MANAGE_MARK_POSITIONS");
     
     public static final HasPermissions EVENT = new SecuredDomainType("EVENT");
 

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/client/shared/filter/LeaderboardWithSecurityFetcher.java

@@ -0,0 +1,11 @@
+package com.sap.sailing.gwt.ui.client.shared.filter;
+
+import java.util.function.Consumer;
+
+import com.sap.sailing.gwt.ui.shared.StrippedLeaderboardDTOWithSecurity;
+
+public interface LeaderboardWithSecurityFetcher {
+
+    public void getLeaderboardWithSecurity(
+            Consumer<StrippedLeaderboardDTOWithSecurity> consumer);
+}

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/RaceBoardPanel.java

@@ -7,6 +7,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
+import java.util.function.Consumer;
 
 import com.google.gwt.core.client.Scheduler;
 import com.google.gwt.core.client.Scheduler.ScheduledCommand;
@@ -75,6 +76,7 @@ import com.sap.sailing.gwt.ui.client.shared.charts.WindChartLifecycle;
 import com.sap.sailing.gwt.ui.client.shared.charts.WindChartSettings;
 import com.sap.sailing.gwt.ui.client.shared.filter.FilterWithUI;
 import com.sap.sailing.gwt.ui.client.shared.filter.LeaderboardFetcher;
+import com.sap.sailing.gwt.ui.client.shared.filter.LeaderboardWithSecurityFetcher;
 import com.sap.sailing.gwt.ui.client.shared.racemap.RaceCompetitorSet;
 import com.sap.sailing.gwt.ui.client.shared.racemap.RaceMap;
 import com.sap.sailing.gwt.ui.client.shared.racemap.RaceMapLifecycle;
@@ -456,8 +458,28 @@ public class RaceBoardPanel
         mediaPlayerManagerComponent = new MediaPlayerManagerComponent(this, getComponentContext(), mediaPlayerLifecycle,
                 selectedRaceIdentifier, raceTimesInfoProvider, timer, mediaService, userService, stringMessages,
                 errorReporter, userAgent, this, mediaPlayerSettings);
+
+        final LeaderboardWithSecurityFetcher asyncFetcher = new LeaderboardWithSecurityFetcher() {
+            @Override
+            public void getLeaderboardWithSecurity(Consumer<StrippedLeaderboardDTOWithSecurity> consumer) {
+                sailingService.getLeaderboardWithSecurity(leaderboardName,
+                        new AsyncCallback<StrippedLeaderboardDTOWithSecurity>() {
+                            @Override
+                            public void onFailure(Throwable caught) {
+                                errorReporter.reportError(
+                                        stringMessages.errorCommunicatingWithServer() + " " + caught.getMessage());
+                            }
+
+                            @Override
+                            public void onSuccess(StrippedLeaderboardDTOWithSecurity result) {
+                                consumer.accept(result);
+                            }
+                        });
+            }
+        };
         mapViewer = new SideBySideComponentViewer(leaderboardPanel, raceMap, taggingPanel, mediaPlayerManagerComponent,
-                componentsForSideBySideViewer, stringMessages, userService, editMarkPassingPanel, editMarkPositionPanel, maneuverTablePanel);
+                componentsForSideBySideViewer, stringMessages, userService, editMarkPassingPanel, editMarkPositionPanel,
+                maneuverTablePanel, asyncFetcher);
         
         mediaPlayerManagerComponent.addPlayerChangeListener(new PlayerChangeListener() {
             

java/com.sap.sailing.gwt.ui/src/main/java/com/sap/sailing/gwt/ui/raceboard/SideBySideComponentViewer.java

@@ -27,12 +27,14 @@ import com.sap.sailing.gwt.ui.client.media.MediaPlayerManagerComponent;
 import com.sap.sailing.gwt.ui.client.media.MediaSingleSelectionControl;
 import com.sap.sailing.gwt.ui.client.shared.charts.EditMarkPassingsPanel;
 import com.sap.sailing.gwt.ui.client.shared.charts.EditMarkPositionPanel;
+import com.sap.sailing.gwt.ui.client.shared.filter.LeaderboardWithSecurityFetcher;
 import com.sap.sailing.gwt.ui.client.shared.racemap.maneuver.ManeuverTablePanel;
 import com.sap.sailing.gwt.ui.raceboard.TouchSplitLayoutPanel.Splitter;
 import com.sap.sse.common.Util.Pair;
 import com.sap.sse.common.settings.AbstractSettings;
 import com.sap.sse.gwt.client.shared.components.Component;
 import com.sap.sse.gwt.client.shared.components.SettingsDialog;
+import com.sap.sse.security.shared.HasPermissions.DefaultActions;
 import com.sap.sse.security.shared.dto.UserDTO;
 import com.sap.sse.security.ui.client.UserService;
 import com.sap.sse.security.ui.client.UserStatusEventHandler;
@@ -80,12 +82,13 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
 
     private TouchSplitLayoutPanel splitLayoutPanel;
     private final UserService userService;
+    private final LeaderboardWithSecurityFetcher asyncLeaderboardFetcher;
 
     public SideBySideComponentViewer(final Component<?> leftComponentP, final Component<?> centerComponentP,
             final Component<?> rightComponentP, final MediaPlayerManagerComponent mediaPlayerManagerComponent,
             List<Component<?>> components, final StringMessages stringMessages, UserService userService,
             EditMarkPassingsPanel markPassingsPanel, EditMarkPositionPanel markPositionPanel,
-            ManeuverTablePanel maneuverTablePanel) {
+            ManeuverTablePanel maneuverTablePanel, final LeaderboardWithSecurityFetcher asyncLeaderboardFetcher) {
         this.mediaPlayerManagerComponent = mediaPlayerManagerComponent;
         this.stringMessages = stringMessages;
         this.leftComponent = leftComponentP;
@@ -93,6 +96,7 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
         this.rightComponent = rightComponentP;
         this.components = components;
         this.userService = userService;
+        this.asyncLeaderboardFetcher = asyncLeaderboardFetcher;
         this.mediaSelectionButton = createMediaSelectionButton(mediaPlayerManagerComponent);
         this.mediaManagementButton = createMediaManagementButton(mediaPlayerManagerComponent);
         this.markPassingsPanel = markPassingsPanel;
@@ -175,6 +179,7 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
         // ensure that toggle buttons are positioned right
         splitLayoutPanel.lastComponentHasBeenAdded(this, panelForMapAndHorizontalToggleButtons,
                 additionalVerticalButtons);
+        refreshMarkUi();
     }
     
     public void setLeftComponent(Component<?> component) {
@@ -307,37 +312,44 @@ public class SideBySideComponentViewer implements UserStatusEventHandler {
 
     @Override
     public void onUserStatusChange(UserDTO user, boolean preAuthenticated) {
-        final Splitter markPassingsSplitter = splitLayoutPanel.getAssociatedSplitter(markPassingsPanel);
-        final Splitter markPositionSplitter = splitLayoutPanel.getAssociatedSplitter(markPositionPanel);
-        boolean forceLayout = false;
-        if (userService.hasPermission(SecuredDomainType.MANAGE_MARK_PASSINGS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
-            if (markPassingsSplitter != null) { // if the panel is not present, the splitter may not be found
-                markPassingsSplitter.getToggleButton().setVisible(true);
+        refreshMarkUi();
+    }
+
+    private void refreshMarkUi() {
+        asyncLeaderboardFetcher.getLeaderboardWithSecurity(leaderboard -> {
+            final Splitter markPassingsSplitter = splitLayoutPanel.getAssociatedSplitter(markPassingsPanel);
+            final Splitter markPositionSplitter = splitLayoutPanel.getAssociatedSplitter(markPositionPanel);
+            boolean forceLayout = false;
+            if (userService.hasPermission(SecuredDomainType.MANAGE_MARK_PASSINGS.getPermission(),
+                    /* TODO race ownership */ null, /* TODO race acl */ null)) {
+                if (markPassingsSplitter != null) { // if the panel is not present, the splitter may not be found
+                    markPassingsSplitter.getToggleButton().setVisible(true);
+                }
+                forceLayout = true;
+            } else {
+                if (markPassingsSplitter != null) { // if the panel is not present, the splitter may not be found
+                    markPassingsPanel.setVisible(false);
+                    markPassingsSplitter.getToggleButton().setVisible(false);
+                }
             }
-            forceLayout = true;
-        } else {
-            if (markPassingsSplitter != null) { // if the panel is not present, the splitter may not be found
-                markPassingsPanel.setVisible(false);
-                markPassingsSplitter.getToggleButton().setVisible(false);
+            if (userService.hasPermission(leaderboard, DefaultActions.UPDATE)) {
+                if (markPositionSplitter != null) { // if the panel is not present, the splitter may not be found
+                    markPositionSplitter.getToggleButton().setVisible(true);
+                }
+                forceLayout = true;
+            } else {
+                if (markPositionSplitter != null) { // if the panel is not present, the splitter may not be found
+                    markPositionPanel.setVisible(false);
+                    markPositionSplitter.getToggleButton().setVisible(false);
+                }
+                forceLayout();
             }
-        }
-        if (userService.hasPermission(SecuredDomainType.MANAGE_MARK_POSITIONS.getPermission(), /* TODO race ownership */ null, /* TODO race acl */ null)) {
-            if (markPositionSplitter != null) { // if the panel is not present, the splitter may not be found
-                markPositionSplitter.getToggleButton().setVisible(true);
+            if (forceLayout) {
+                forceLayout();
             }
-            forceLayout = true;
-        } else {
-            if (markPositionSplitter != null) { // if the panel is not present, the splitter may not be found
-                markPositionPanel.setVisible(false);
-                markPositionSplitter.getToggleButton().setVisible(false);
-            }
-            forceLayout();
-        }
-        if (forceLayout) {
-            forceLayout();
-        }
-        mediaManagementButton.setVisible(mediaPlayerManagerComponent.getAssignedMediaTracks().stream().anyMatch(
-                track->mediaPlayerManagerComponent.allowsEditing(track.dbId)));
+            mediaManagementButton.setVisible(mediaPlayerManagerComponent.getAssignedMediaTracks().stream()
+                    .anyMatch(track -> mediaPlayerManagerComponent.allowsEditing(track.dbId)));
+        });
     }
     
     /**

java/com.sap.sailing.server.gateway/src/com/sap/sailing/server/gateway/jaxrs/api/MarkRessource.java

@@ -53,6 +53,7 @@ import com.sap.sailing.domain.common.security.SecuredDomainType;
 import com.sap.sailing.domain.common.tracking.GPSFix;
 import com.sap.sailing.domain.common.tracking.impl.GPSFixImpl;
 import com.sap.sailing.domain.leaderboard.Leaderboard;
+import com.sap.sailing.domain.leaderboard.RegattaLeaderboard;
 import com.sap.sailing.domain.racelogtracking.RaceLogTrackingAdapter;
 import com.sap.sailing.domain.racelogtracking.RaceLogTrackingAdapterFactory;
 import com.sap.sailing.domain.regattalike.HasRegattaLike;
@@ -109,7 +110,6 @@ public class MarkRessource extends AbstractSailingServerResource {
     @Produces("application/json;charset=UTF-8")
     public Response addMarkFix(String json)
             throws DoesNotHaveRegattaLogException, ParseException, JsonDeserializationException {
-        SecurityUtils.getSubject().checkPermission(SecuredDomainType.MANAGE_MARK_POSITIONS.getStringPermission(DefaultActions.CREATE));
 
         Object requestBody = JSONValue.parseWithException(json);
         JSONObject requestObject = Helpers.toJSONObjectSafe(requestBody);
@@ -126,6 +126,15 @@ public class MarkRessource extends AbstractSailingServerResource {
                 .getAdapter(getService().getBaseDomainFactory());
         final Leaderboard leaderboard = getService().getLeaderboardByName(leaderboardName);
         if (leaderboard != null) {
+            // check leaderboard update permission
+            SecurityUtils.getSubject()
+                    .checkPermission(leaderboard.getIdentifier().getStringPermission(DefaultActions.UPDATE));
+            // if leaderboard is regatta leaderboard, check regatta update permission
+            if (leaderboard instanceof RegattaLeaderboard) {
+                final Regatta regatta = ((RegattaLeaderboard) leaderboard).getRegatta();
+                SecurityUtils.getSubject()
+                        .checkPermission(regatta.getIdentifier().getStringPermission(DefaultActions.UPDATE));
+            }
             getSecurityService().checkCurrentUserUpdatePermission(leaderboard);
             final RaceColumn raceColumn = leaderboard.getRaceColumnByName(raceColumnName);
             if (raceColumn != null) {

java/com.sap.sailing.server/src/com/sap/sailing/server/impl/RacingEventServiceImpl.java

@@ -999,7 +999,6 @@ public class RacingEventServiceImpl implements RacingEventService, ClearStateTes
         securityService.assumeOwnershipMigrated(SecuredDomainType.MANAGE_MARK_PASSINGS.getName());
         securityService.assumeOwnershipMigrated(SecuredDomainType.RACE_MANAGER_APP_DEVICE_CONFIGURATION.getName());
         securityService.assumeOwnershipMigrated(SecuredDomainType.RESULT_IMPORT_URL.getName());
-        securityService.assumeOwnershipMigrated(SecuredDomainType.MANAGE_MARK_POSITIONS.getName());
         securityService.assumeOwnershipMigrated(SecuredDomainType.REPLICATOR.getName());
 
         for (Event event : getAllEvents()) {