Package edu.ucsb.cs156.frontiers.config

Class CourseSecurity

java.lang.Object

edu.ucsb.cs156.frontiers.config.CourseSecurity

@Component("CourseSecurity")
public class CourseSecurity
extends Object

CourseSecurity provides methods to check permissions for managing courses and roster students. It uses the CurrentUserService to get the current user and RoleHierarchy to check roles.

The methods defined here are used as annotations (e.g.

Constructor Summary

Constructors

Constructor	Description
CourseSecurity(CurrentUserService currentUserService, org.springframework.security.access.hierarchicalroles.RoleHierarchy roleHierarchy, CourseRepository courseRepository, RosterStudentRepository rosterStudentRepository, DownloadRequestRepository downloadRequestRepository, ApiCourseKeyService apiCourseKeyService)

Method Summary

Modifier and Type	Method	Description
Boolean	baseHasManagePermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Course course)	This is a helper method that checks if the current user has management permissions for the given course.
Boolean	hasDownloadPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Long downloadId)
Boolean	hasInstructorPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Long courseId)	Use this for operations that only an instructor can do, but not a staff member, such as adding or deleting a course staff member.
Boolean	hasManagePermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Long courseId)	Use this when you want to check whether the user is either a staff member, instructor or admin for the course.
Boolean	hasManagePermissionsOrApiKeyAccess(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Long courseId)
Boolean	hasRosterStudentManagementPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations, Long rosterStudentId)	This method checks if the current user has management permissions for the course associated with the given rosterStudent.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CourseSecurity

public CourseSecurity(CurrentUserService currentUserService,
 org.springframework.security.access.hierarchicalroles.RoleHierarchy roleHierarchy,
 CourseRepository courseRepository,
 RosterStudentRepository rosterStudentRepository,
 DownloadRequestRepository downloadRequestRepository,
 ApiCourseKeyService apiCourseKeyService)

Method Details

hasManagePermissions

@PreAuthorize("hasRole(\'ROLE_USER\')")
public Boolean hasManagePermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Long courseId)

Use this when you want to check whether the user is either a staff member, instructor or admin for the course.

Parameters:

operations -

courseId -

Returns:

true if the user has manage permissions for the course, false otherwise.

hasInstructorPermissions

@PreAuthorize("hasRole(\'ROLE_INSTRUCTOR\')")
public Boolean hasInstructorPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Long courseId)

Use this for operations that only an instructor can do, but not a staff member, such as adding or deleting a course staff member.

Parameters:

operations -

courseId -

Returns:

true if the user has instructor permissions for the course, false otherwise.

hasRosterStudentManagementPermissions

@PreAuthorize("hasRole(\'ROLE_USER\')")
public Boolean hasRosterStudentManagementPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Long rosterStudentId)

This method checks if the current user has management permissions for the course associated with the given rosterStudent. This allows us to create endpoints that just take a roster student id, not a course id, and still check permissions. This one works for both staff and instructor permissions.

Parameters:

operations -

rosterStudentId -

Returns:

baseHasManagePermissions

public Boolean baseHasManagePermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Course course)

This is a helper method that checks if the current user has management permissions for the given course.

Parameters:

operations -

course -

Returns:

hasManagePermissionsOrApiKeyAccess

public Boolean hasManagePermissionsOrApiKeyAccess(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Long courseId)

hasDownloadPermissions

@PreAuthorize("hasRole(\'ROLE_USER\')")
public Boolean hasDownloadPermissions(org.springframework.security.access.expression.method.MethodSecurityExpressionOperations operations,
 Long downloadId)