import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * @see org.kuali.rice.krad.service.DocumentDictionaryService#getDocumentAuthorizer(java.lang.String)
 */
public DocumentAuthorizer getDocumentAuthorizer(Document document) {
    if (document == null) {
        throw new IllegalArgumentException("invalid (null) document");
    } else if (document.getDocumentHeader() == null) {
        throw new IllegalArgumentException("invalid (null) document.documentHeader");
    } else if (!document.getDocumentHeader().hasWorkflowDocument()) {
        throw new IllegalArgumentException("invalid (null) document.documentHeader.workflowDocument");
    }

    String documentType = document.getDocumentHeader().getWorkflowDocument().getDocumentTypeName();

    DocumentAuthorizer documentAuthorizer = getDocumentAuthorizer(documentType);

    return documentAuthorizer;
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * This method check to see if the user can create the account maintenance document and set the user session
 *
 * @param String principalId
 * @return boolean
 */

protected boolean isValidUser(String principalId) {

    try {
        Person user = personService.getPerson(principalId);
        DocumentAuthorizer documentAuthorizer = new MaintenanceDocumentAuthorizerBase();
        if (documentAuthorizer.canInitiate(maintenanceDocumentDictionaryService.getDocumentTypeName(Account.class), user)) {
            // set the user session so that the user name can be displayed in the saved document
            GlobalVariables.setUserSession(new UserSession(user.getPrincipalName()));
            return true;
        }
        else {
            return false;
        }
    }
    catch (Exception ex) {

        LOG.error( KcUtils.getErrorMessage(KcConstants.BudgetAdjustmentService.ERROR_KC_DOCUMENT_INVALID_USER, new String[]{principalId}));
        return false;
    }
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Overrides the base implementation to add in new parameters to the return url
 * <ul>
 * <li>{@link KFSConstants.DISPATCH_REQUEST_PARAMETER}</li>
 * <li>{@link KFSConstants.BUSINESS_OBJECT_CLASS_ATTRIBUTE}</li>
 * <li>{@link KFSConstants.OVERRIDE_KEYS}</li>
 * </ul>
 * {@link KFSConstants.DISPATCH_REQUEST_PARAMETER}
 *
 * @see org.kuali.rice.kns.lookup.AbstractLookupableHelperServiceImpl#getReturnUrl(org.kuali.rice.krad.bo.BusinessObject,
 *      java.util.Map, java.lang.String)
 */
@Override
public HtmlData getReturnUrl(BusinessObject businessObject, LookupForm lookupForm, List returnKeys, BusinessObjectRestrictions businessObjectRestrictions) {
    AssetAcquisitionType assetAcquisitionType = (AssetAcquisitionType) businessObject;
    AssetGlobalService assetGlobalService = SpringContext.getBean(AssetGlobalService.class);
    if (initializingAssetGlobal && !assetAcquisitionType.isActive()) {
        // no return URL if we are initializing asset global and the record is inactive
        return getEmptyAnchorHtmlData();

    }
    else if (assetGlobalService.getNewAcquisitionTypeCode().equalsIgnoreCase(assetAcquisitionType.getAcquisitionTypeCode())) {
        // no return if the user is not authorized to initiate 'New' acquisition type.
        DocumentAuthorizer documentAuthorizer = SpringContext.getBean(DocumentDictionaryService.class).getDocumentAuthorizer(CamsConstants.DocumentTypeName.ASSET_ADD_GLOBAL);
        boolean isAuthorized = documentAuthorizer.isAuthorized(businessObject, CamsConstants.CAM_MODULE_CODE, CamsConstants.PermissionNames.USE_ACQUISITION_TYPE_NEW, GlobalVariables.getUserSession().getPerson().getPrincipalId());

        if (!isAuthorized) {
            return getEmptyAnchorHtmlData();
        }
    }
    // return URL
    Properties parameters = generateUrlParameters(businessObject, lookupForm, returnKeys);
    return getReturnAnchorHtmlData(businessObject, parameters, lookupForm, returnKeys, businessObjectRestrictions);

}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
protected void checkAuthorization( HttpServletRequest request ) {
    boolean authorized = false;
    String principalName = ((AuthenticationService) GlobalResourceLoader.getResourceLoader().getService(new QName("kimAuthenticationService"))).getPrincipalName(request);
    if ( LOG.isInfoEnabled() ) {
        LOG.info("Logged In User: " + principalName);
    }
    if ( StringUtils.isNotBlank(principalName) ) {
        Person person = KimApiServiceLocator.getPersonService().getPersonByPrincipalName(principalName);
        if ( person != null ) {
            String principalId = person.getPrincipalId();
            Map<String,String> permissionDetails = new HashMap<String,String>();
            DocumentAuthorizer da = SpringContext.getBean(DocumentDictionaryService.class).getDocumentAuthorizer("GLCP");
            if ( da != null ) {
                authorized = da.canInitiate("GLCP", person);
            }
            if ( !authorized ) {
                da = SpringContext.getBean(DocumentDictionaryService.class).getDocumentAuthorizer("LLCP");
                if ( da != null ) {
                    authorized = da.canInitiate("LLCP", person);
                }
            }
        }
    }
    if ( !authorized ) {
        throw new RuntimeException( "You must be able to initiate the GLCP or LLCP documents to use this page.  (Backdoor users are not recognized.)" );
    }
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
@Override
public boolean isAuthorizedForDocument(String principalId, org.kuali.rice.kew.api.document.Document document) {
    String docTypeName = document.getDocumentTypeName();
    DocumentEntry docEntry = SpringContext.getBean(DataDictionaryService.class).getDataDictionary().getDocumentEntry(docTypeName);
    if (docEntry instanceof FinancialSystemTransactionalDocumentEntry) {
        if (((FinancialSystemTransactionalDocumentEntry)docEntry).isPotentiallySensitive()) {

            WorkflowDocumentService workflowDocService = KewApiServiceLocator.getWorkflowDocumentService();
            List<String> sensitiveDataCodeArray = workflowDocService.getSearchableAttributeStringValuesByKey(document.getDocumentId(),"sensitive");
            if (sensitiveDataCodeArray != null && sensitiveDataCodeArray.size() > 0) {
                List<String> sensitiveDataCode = sensitiveDataCodeArray;
                if ( sensitiveDataCode != null && sensitiveDataCode.contains("Y")) {

                    DocumentAuthorizer docAuthorizer = SpringContext.getBean(DocumentHelperService.class).getDocumentAuthorizer(docTypeName);
                    try {
                        return docAuthorizer.canOpen(KRADServiceLocatorWeb.getDocumentService().getByDocumentHeaderIdSessionless(document.getDocumentId()), KimApiServiceLocator.getPersonService().getPerson(principalId));
                    }
                    catch (WorkflowException ex) {
                        LOG.error( "Exception while testing if user can open document: " + document, ex);
                        return false;
                    }
                }
            }
        }
    }
    return true;
    
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
public boolean validate(AttributedDocumentEvent event) {

        // short circuit if no recurrence object at all
        if (ObjectUtils.isNull(customerInvoiceDocument.getCustomerInvoiceRecurrenceDetails())) {
            return true;
        }
        
        if (customerInvoiceDocument.getNoRecurrenceDataFlag())
            return true;
        
        String initiatorUserIdentifier = customerInvoiceDocument.getCustomerInvoiceRecurrenceDetails().getDocumentInitiatorUserIdentifier();
        if (ObjectUtils.isNull(initiatorUserIdentifier)) {
            GlobalVariables.getMessageMap().putError(DOCUMENT_ERROR_PREFIX + ArPropertyConstants.CustomerInvoiceDocumentFields.INVOICE_DOCUMENT_RECURRENCE_INITIATOR, ArKeyConstants.ERROR_INVOICE_RECURRENCE_INITIATOR_IS_REQUIRED);
            return false;
        }

        DocumentAuthorizer documentAuthorizer = SpringContext.getBean(DocumentHelperService.class).getDocumentAuthorizer("INVR");
        Person person = SpringContext.getBean(PersonService.class).getPerson(initiatorUserIdentifier);
        if (person == null) {
            GlobalVariables.getMessageMap().putError(DOCUMENT_ERROR_PREFIX + ArPropertyConstants.CustomerInvoiceDocumentFields.INVOICE_DOCUMENT_RECURRENCE_INITIATOR, ArKeyConstants.ERROR_INVOICE_RECURRENCE_INITIATOR_DOES_NOT_EXIST);
            return false;
        }
        if (!documentAuthorizer.canInitiate("INVR", person)) {
            GlobalVariables.getMessageMap().putError(DOCUMENT_ERROR_PREFIX + ArPropertyConstants.CustomerInvoiceDocumentFields.INVOICE_DOCUMENT_RECURRENCE_INITIATOR, ArKeyConstants.ERROR_INVOICE_RECURRENCE_INITIATOR_IS_NOT_AUTHORIZED);
            return false;
        }
        return true;
    }
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Uses the presentation controller and the authorizer for the travel auth doc to determine if the current user can edit the doc and if they have full edit edit mode
 * @return true if the doc is editable for the current user, false otherwise
 */
protected boolean canCurrentUserEditDocument(TravelAuthorizationDocument doc) {
    // i hope no one tries to run this validation against something which isn't a TravelAuthDoc.  I mean...even if they do, they won't for very long
    final String documentTypeName = getDocumentDictionaryService().getDocumentTypeByClass(doc.getClass());
    final DocumentPresentationController presController = getDocumentDictionaryService().getDocumentPresentationController(documentTypeName);
    final DocumentAuthorizer authorizer = getDocumentDictionaryService().getDocumentAuthorizer(documentTypeName);
    final Set<String> presControllerEditModes = ((TransactionalDocumentPresentationController)presController).getEditModes(doc);
    final Set<String> editModes = ((TransactionalDocumentAuthorizer)authorizer).getEditModes(doc, GlobalVariables.getUserSession().getPerson(), presControllerEditModes);
    return editModes.contains(TemConstants.TravelEditMode.FULL_ENTRY) && presController.canEdit(doc) && authorizer.canEdit(doc, GlobalVariables.getUserSession().getPerson());
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Attempts to find a DocumentAuthorizer for the given business object.  If the business object is a document, simply looks up
 * its associated authorizer.  Otherwise, it checks to see if there's a maintenance document associated with the business object and uses
 * the document authorizer associated with that
 * @param businessObject the business object to attempt to find a DocumentAuthorizer for
 * @return an instantiated DocumentAuthorizer associated with the business object, or null if none could be found
 */
protected DocumentAuthorizer findDocumentAuthorizerForBusinessObject(BusinessObject businessObject) {
    if (businessObject == null) {
        return null;
    }
    if (businessObject instanceof Document) {
        return getDocumentHelperService().getDocumentAuthorizer( (Document)businessObject );
    }
    final String maintDocType = getMaintenanceDocumentDictionaryService().getDocumentTypeName(businessObject.getClass());
    if (StringUtils.isBlank(maintDocType)) {
        return null;
    }
    return getDocumentHelperService().getDocumentAuthorizer(maintDocType);
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
@Override
public boolean isAuthorizedForDocument(String principalId, org.kuali.rice.kew.api.document.Document document) {
    String docTypeName = document.getDocumentTypeName();
    DocumentEntry docEntry = SpringContext.getBean(DataDictionaryService.class).getDataDictionary().getDocumentEntry(docTypeName);
    if (docEntry instanceof FinancialSystemTransactionalDocumentEntry) {
        if (((FinancialSystemTransactionalDocumentEntry)docEntry).isPotentiallySensitive()) {

            WorkflowDocumentService workflowDocService = KewApiServiceLocator.getWorkflowDocumentService();
            List<String> sensitiveDataCodeArray = workflowDocService.getSearchableAttributeStringValuesByKey(document.getDocumentId(),"sensitive");
            if (sensitiveDataCodeArray != null && sensitiveDataCodeArray.size() > 0) {
                List<String> sensitiveDataCode = sensitiveDataCodeArray;
                if ( sensitiveDataCode != null && sensitiveDataCode.contains("Y")) {

                    DocumentAuthorizer docAuthorizer = SpringContext.getBean(DocumentHelperService.class).getDocumentAuthorizer(docTypeName);
                    try {
                        org.kuali.rice.krad.document.Document kfsDocument = KRADServiceLocatorWeb.getDocumentService().getByDocumentHeaderIdSessionless(document.getDocumentId());

                        if (ObjectUtils.isNull(kfsDocument)) {
                            LOG.error("KFS document is null but exists in rice, returning false from isAuthorizedForDocument. document.getDocumentId()=" + document.getDocumentId());
                            return false;
                        } else {
                            return docAuthorizer.canOpen(kfsDocument, KimApiServiceLocator.getPersonService().getPerson(principalId));
                        }
                    }
                    catch (WorkflowException ex) {
                        LOG.error( "Exception while testing if user can open document: document.getDocumentId()=" + document.getDocumentId(), ex);
                        return false;
                    }
                }
            }
        }
    }
    return true;

}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
protected boolean canEdit(MaintenanceDocument document) {
    DocumentAuthorizer auth = KRADServiceLocatorWeb.getDocumentDictionaryService().getDocumentAuthorizer(document);
    boolean valid = true;
    if (auth != null) {
        valid = auth.canEdit(document, GlobalVariables.getUserSession().getActualPerson());
    }
    if (!valid) {
        this.putFieldError("dataObject.primaryDepartment", "error.primaryDepartment.invalid");
    }
    return valid;

}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 *
 * @param cashDrawer
 * @return
 */
protected boolean isEditOfCashDrawerAuthorized(CashDrawer cashDrawer) {
    String cashDrawerDocType = KRADServiceLocatorWeb.getDocumentDictionaryService().getMaintenanceDocumentTypeName(CashDrawer.class);
    DocumentAuthorizer documentAuthorizer = KRADServiceLocatorWeb.getDocumentDictionaryService().getDocumentAuthorizer(cashDrawerDocType);
    return documentAuthorizer.canInitiate(cashDrawerDocType, GlobalVariables.getUserSession().getPerson());
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * 
 * @param cashDrawer
 * @return
 */
protected boolean isEditOfCashDrawerAuthorized(CashDrawer cashDrawer) {
    String cashDrawerDocType = KRADServiceLocatorWeb.getDocumentDictionaryService().getMaintenanceDocumentTypeName(CashDrawer.class);
    DocumentAuthorizer documentAuthorizer = KRADServiceLocatorWeb.getDocumentDictionaryService().getDocumentAuthorizer(cashDrawerDocType);
    return documentAuthorizer.canInitiate(cashDrawerDocType, GlobalVariables.getUserSession().getPerson());
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Full class name for the {@link DocumentAuthorizer} that will authorize actions for this document
 *
 * @return class name for document authorizer
 */
@BeanTagAttribute(name = "documentAuthorizerClass")
public Class<? extends DocumentAuthorizer> getDocumentAuthorizerClass() {
    return documentAuthorizerClass;
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Setter for the document authorizer class name
 *
 * @param documentAuthorizerClass
 */
public void setDocumentAuthorizerClass(Class<? extends DocumentAuthorizer> documentAuthorizerClass) {
    this.documentAuthorizerClass = documentAuthorizerClass;
}
 

import org.kuali.rice.krad.document.DocumentAuthorizer; //导入依赖的package包/类
/**
 * Retrieves the {@link DocumentAuthorizer} configured on the document entry with the given document type
 * name
 *
 * @param documentType - document type name to retrieve document entry and associated authorizer for
 * @return DocumentAuthorizer authorizer instance
 */
public DocumentAuthorizer getDocumentAuthorizer(String documentType);