Fix reports to filter projects by user permissions

FEA: ItEr76S30PermissionsEnhancements

libreplan-business/src/main/java/org/libreplan/business/orders/daos/IOrderDAO.java

@@ -76,7 +76,7 @@ public interface IOrderDAO extends IIntegrationEntityDAO<Order> {
      */
     List<Order> getOrdersByWriteAuthorization(User user);
 
-    List<Order> getOrdersByReadAuthorizationByScenario(User user,
+    List<Order> getOrdersByReadAuthorizationByScenario(String username,
             Scenario scenario);
 
     /**
@@ -105,4 +105,5 @@ public interface IOrderDAO extends IIntegrationEntityDAO<Order> {
 
     List<CostExpenseSheetDTO> getCostExpenseSheet(List<Order> orders, Date startingDate,
             Date endingDate, List<Criterion> criterions);
+
 }

libreplan-business/src/main/java/org/libreplan/business/orders/daos/OrderDAO.java

@@ -48,6 +48,7 @@ import org.libreplan.business.reports.dtos.OrderCostsPerResourceDTO;
 import org.libreplan.business.resources.entities.Criterion;
 import org.libreplan.business.scenarios.entities.Scenario;
 import org.libreplan.business.users.daos.IOrderAuthorizationDAO;
+import org.libreplan.business.users.daos.IUserDAO;
 import org.libreplan.business.users.entities.OrderAuthorization;
 import org.libreplan.business.users.entities.OrderAuthorizationType;
 import org.libreplan.business.users.entities.User;
@@ -80,6 +81,9 @@ public class OrderDAO extends IntegrationEntityDAO<Order> implements
     @Autowired
     private IOrderAuthorizationDAO orderAuthorizationDAO;
 
+    @Autowired
+    private IUserDAO userDAO;
+
     @Autowired
     private IAdHocTransactionService transactionService;
 
@@ -262,8 +266,14 @@ public class OrderDAO extends IntegrationEntityDAO<Order> implements
     }
 
     @Override
-    public List<Order> getOrdersByReadAuthorizationByScenario(User user,
+    public List<Order> getOrdersByReadAuthorizationByScenario(String username,
             Scenario scenario) {
+        User user;
+        try {
+            user = userDAO.findByLoginName(username);
+        } catch (InstanceNotFoundException e) {
+            throw new RuntimeException(e);
+        }
         return existsInScenario(getOrdersByReadAuthorization(user), scenario);
     }
 

libreplan-webapp/src/main/java/org/libreplan/web/orders/OrderModel.java

@@ -213,19 +213,10 @@ public class OrderModel extends IntegrationEntityModel implements IOrderModel {
     @Override
     @Transactional(readOnly = true)
     public List<Order> getOrders() {
-
-        User user;
-        try {
-            user = userDAO.findByLoginName(SecurityUtils.getSessionUserLoginName());
-        }
-        catch(InstanceNotFoundException e) {
-            //this case shouldn't happen, because it would mean that there isn't a logged user
-            //anyway, if it happenned we return an empty list
-            return new ArrayList<Order>();
-        }
         getLabelsOnConversation().reattachLabels();
         List<Order> orders = orderDAO.getOrdersByReadAuthorizationByScenario(
-                user, scenarioManager.getCurrent());
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
 
         initializeOrders(orders);
         return orders;

libreplan-webapp/src/main/java/org/libreplan/web/planner/company/CompanyPlanningModel.java

@@ -673,18 +673,9 @@ public class CompanyPlanningModel implements ICompanyPlanningModel {
 
     private List<TaskElement> retainOnlyTopLevel(IPredicate predicate) {
         List<TaskElement> result = new ArrayList<TaskElement>();
-        User user;
 
-        try {
-            user = userDAO.findByLoginName(SecurityUtils.getSessionUserLoginName());
-        }
-        catch(InstanceNotFoundException e) {
-            //this case shouldn't happen, because it would mean that there isn't a logged user
-            //anyway, if it happenned we return an empty list
-            return result;
-        }
         List<Order> list = orderDAO.getOrdersByReadAuthorizationByScenario(
-                user, currentScenario);
+                SecurityUtils.getSessionUserLoginName(), currentScenario);
         for (Order order : list) {
             order.useSchedulingDataFor(currentScenario, false);
             TaskGroup associatedTaskElement = order.getAssociatedTaskElement();
@@ -708,20 +699,12 @@ public class CompanyPlanningModel implements ICompanyPlanningModel {
     @Override
     @Transactional(readOnly = true)
     public IPredicate getDefaultPredicate(Boolean includeOrderElements) {
-        User user;
         if (currentScenario == null) {
             currentScenario = scenarioManager.getCurrent();
         }
-        try {
+
-            user = userDAO.findByLoginName(SecurityUtils.getSessionUserLoginName());
-        }
-        catch(InstanceNotFoundException e) {
-            //this case shouldn't happen, because it would mean that there isn't a logged user
-            //anyway, if it happened we return an empty list
-            return null;
-        }
         List<Order> list = orderDAO.getOrdersByReadAuthorizationByScenario(
-                user, currentScenario);
+                SecurityUtils.getSessionUserLoginName(), currentScenario);
         Date startDate = null;
         Date endDate = null;
         for (Order each : list) {

libreplan-webapp/src/main/java/org/libreplan/web/reports/CompletedEstimatedHoursPerTaskModel.java

@@ -22,6 +22,7 @@
 package org.libreplan.web.reports;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.Date;
 import java.util.HashSet;
 import java.util.Iterator;
@@ -47,6 +48,7 @@ import org.libreplan.business.resources.entities.Criterion;
 import org.libreplan.business.resources.entities.CriterionType;
 import org.libreplan.business.resources.entities.ResourceEnum;
 import org.libreplan.business.scenarios.IScenarioManager;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -116,7 +118,12 @@ public class CompletedEstimatedHoursPerTaskModel implements ICompletedEstimatedH
     @Override
     @Transactional(readOnly = true)
     public List<Order> getOrders() {
-        return orderDAO.getOrdersByScenario(scenarioManager.getCurrent());
+        List<Order> result = orderDAO.getOrdersByReadAuthorizationByScenario(
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
+
+        Collections.sort(result);
+        return result;
     }
 
     private void initializeOrderElements(List<OrderElement> orderElements) {

libreplan-webapp/src/main/java/org/libreplan/web/reports/OrderCostsPerResourceModel.java

@@ -58,8 +58,10 @@ import org.libreplan.business.resources.entities.Criterion;
 import org.libreplan.business.resources.entities.CriterionType;
 import org.libreplan.business.resources.entities.ResourceEnum;
 import org.libreplan.business.resources.entities.Worker;
+import org.libreplan.business.scenarios.IScenarioManager;
 import org.libreplan.business.workingday.EffortDuration;
 import org.libreplan.business.workreports.entities.WorkReportLine;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -90,6 +92,9 @@ public class OrderCostsPerResourceModel implements IOrderCostsPerResourceModel {
     @Autowired
     private IConfigurationDAO configurationDAO;
 
+    @Autowired
+    private IScenarioManager scenarioManager;
+
     private List<Order> selectedOrders = new ArrayList<Order>();
 
     private List<Label> selectedLabels = new ArrayList<Label>();
@@ -262,7 +267,10 @@ public class OrderCostsPerResourceModel implements IOrderCostsPerResourceModel {
     }
 
     private void loadAllOrders() {
-        this.allOrders = orderDAO.getOrders();
+        this.allOrders = orderDAO.getOrdersByReadAuthorizationByScenario(
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
+
         Collections.sort(this.allOrders);
     }
 

libreplan-webapp/src/main/java/org/libreplan/web/reports/SchedulingProgressPerOrderModel.java

@@ -48,6 +48,7 @@ import org.libreplan.business.planner.entities.Task;
 import org.libreplan.business.planner.entities.TaskElement;
 import org.libreplan.business.reports.dtos.SchedulingProgressPerOrderDTO;
 import org.libreplan.business.scenarios.IScenarioManager;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -87,8 +88,9 @@ public class SchedulingProgressPerOrderModel implements ISchedulingProgressPerOr
     }
 
     private void loadAllOrders() {
-        allOrders = orderDAO.getOrdersByScenario(scenarioManager
+        allOrders = orderDAO.getOrdersByReadAuthorizationByScenario(
-                .getCurrent());
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
 
         Collections.sort(allOrders);
 

libreplan-webapp/src/main/java/org/libreplan/web/reports/TimeLineRequiredMaterialModel.java

@@ -47,6 +47,7 @@ import org.libreplan.business.planner.entities.TaskElement;
 import org.libreplan.business.reports.dtos.TimeLineRequiredMaterialDTO;
 import org.libreplan.business.scenarios.IScenarioManager;
 import org.libreplan.business.scenarios.entities.Scenario;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -106,7 +107,9 @@ public class TimeLineRequiredMaterialModel implements
     }
 
     private void loadAllOrders() {
-        allOrders = orderDAO.getOrdersByScenario(scenarioManager.getCurrent());
+        allOrders = orderDAO.getOrdersByReadAuthorizationByScenario(
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
         Collections.sort(allOrders);
     }
 

libreplan-webapp/src/main/java/org/libreplan/web/reports/WorkingArrangementsPerOrderModel.java

@@ -57,6 +57,7 @@ import org.libreplan.business.scenarios.IScenarioManager;
 import org.libreplan.business.scenarios.entities.Scenario;
 import org.libreplan.business.workreports.daos.IWorkReportLineDAO;
 import org.libreplan.business.workreports.entities.WorkReportLine;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -132,7 +133,9 @@ public class WorkingArrangementsPerOrderModel implements
     public List<Order> getOrders() {
         Scenario currentScenario = scenarioManager.getCurrent();
         final List<Order> orders = orderDAO
-                .getOrdersByScenario(currentScenario);
+                .getOrdersByReadAuthorizationByScenario(
+                        SecurityUtils.getSessionUserLoginName(),
+                        currentScenario);
         for (Order each: orders) {
             initializeOrderElements(each.getOrderElements());
             each.useSchedulingDataFor(currentScenario);

libreplan-webapp/src/main/java/org/libreplan/web/reports/WorkingProgressPerTaskModel.java

@@ -47,6 +47,7 @@ import org.libreplan.business.resources.entities.Criterion;
 import org.libreplan.business.resources.entities.CriterionType;
 import org.libreplan.business.resources.entities.ResourceEnum;
 import org.libreplan.business.scenarios.IScenarioManager;
+import org.libreplan.web.security.SecurityUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.context.annotation.Scope;
@@ -104,8 +105,10 @@ public class WorkingProgressPerTaskModel implements IWorkingProgressPerTaskModel
     @Override
     @Transactional(readOnly = true)
     public List<Order> getOrders() {
-        List<Order> result = orderDAO.getOrdersByScenario(scenarioManager
+        List<Order> result = orderDAO.getOrdersByReadAuthorizationByScenario(
-                .getCurrent());
+                SecurityUtils.getSessionUserLoginName(),
+                scenarioManager.getCurrent());
+
         Collections.sort(result);
         return result;
     }