private void checkPermissions(ComponentDto baseComponent) {
String projectUuid = firstNonNull(baseComponent.projectUuid(), baseComponent.uuid());
if (!userSession.hasComponentUuidPermission(UserRole.ADMIN, projectUuid)
&& !userSession.hasComponentUuidPermission(UserRole.USER, projectUuid)) {
throw insufficientPrivilegesException();
}
}
public List<Transition> listTransitions(DefaultIssue issue) {
String projectUuid = requireNonNull(issue.projectUuid());
return workflow
.outTransitions(issue)
.stream()
.filter(
transition ->
isBlank(transition.requiredProjectPermission())
|| userSession.hasComponentUuidPermission(
transition.requiredProjectPermission(), projectUuid))
.collect(Collectors.toList());
}
/**
* Never return null, but an empty list if the issue does not exist. No security check is done
* since it should already have been done to get the issue
*/
public List<Transition> listTransitions(@Nullable Issue issue) {
if (issue == null) {
return Collections.emptyList();
}
List<Transition> outTransitions = workflow.outTransitions(issue);
List<Transition> allowedTransitions = new ArrayList<>();
for (Transition transition : outTransitions) {
String projectUuid = issue.projectUuid();
if (userSession.isLoggedIn() && StringUtils.isBlank(transition.requiredProjectPermission())
|| (projectUuid != null
&& userSession.hasComponentUuidPermission(
transition.requiredProjectPermission(), projectUuid))) {
allowedTransitions.add(transition);
}
}
return allowedTransitions;
}
public static boolean isAllowedOnComponentUuid(UserSession userSession, String componentUuid) {
return userSession.hasPermission(GlobalPermissions.SYSTEM_ADMIN)
|| userSession.hasComponentUuidPermission(UserRole.ADMIN, componentUuid);
}