/**
* From user list
*
* @param id
* @param model
* @param request
* @param response
* @param locale
* @return
* @throws Exception
*/
@PreAuthorize("hasRole('AUTH')")
@RequestMapping(value = "/admin/users/displayStoreUser.html", method = RequestMethod.GET)
public String displayUserEdit(
@ModelAttribute("id") Long id,
Model model,
HttpServletRequest request,
HttpServletResponse response,
Locale locale)
throws Exception {
User dbUser = userService.getById(id);
if (dbUser == null) {
LOGGER.info("User is null for id " + id);
return "redirect://admin/users/list.html";
}
return displayUser(dbUser, model, request, response, locale);
}
@PreAuthorize("hasRole('AUTH')")
@RequestMapping(
value = "/admin/users/remove.html",
method = RequestMethod.POST,
produces = "application/json")
public @ResponseBody String removeUser(HttpServletRequest request, Locale locale)
throws Exception {
// do not remove super admin
String sUserId = request.getParameter("userId");
AjaxResponse resp = new AjaxResponse();
String userName = request.getRemoteUser();
User remoteUser = userService.getByUserName(userName);
try {
Long userId = Long.parseLong(sUserId);
User user = userService.getById(userId);
/** In order to remove a User the logged in ser must be STORE_ADMIN or SUPER_USER */
if (user == null) {
resp.setStatusMessage(messages.getMessage("message.unauthorized", locale));
resp.setStatus(AjaxResponse.RESPONSE_STATUS_FAIURE);
return resp.toJSONString();
}
if (!request.isUserInRole(Constants.GROUP_ADMIN)) {
resp.setStatusMessage(messages.getMessage("message.unauthorized", locale));
resp.setStatus(AjaxResponse.RESPONSE_STATUS_FAIURE);
return resp.toJSONString();
}
// check if the user removed has group ADMIN
boolean isAdmin = false;
if (UserUtils.userInGroup(remoteUser, Constants.GROUP_ADMIN)
|| UserUtils.userInGroup(remoteUser, Constants.GROUP_SUPERADMIN)) {
isAdmin = true;
}
if (!isAdmin) {
resp.setStatusMessage(
messages.getMessage("message.security.caanotremovesuperadmin", locale));
resp.setStatus(AjaxResponse.RESPONSE_STATUS_FAIURE);
return resp.toJSONString();
}
userService.delete(user);
resp.setStatus(AjaxResponse.RESPONSE_OPERATION_COMPLETED);
} catch (Exception e) {
LOGGER.error("Error while deleting product price", e);
resp.setStatus(AjaxResponse.RESPONSE_STATUS_FAIURE);
resp.setErrorMessage(e);
}
String returnString = resp.toJSONString();
return returnString;
}
