@Test public void getPatientReportsViewAccessWhenEditNotAllowed() throws QueryException { when(this.patientsQuery.execute()).thenReturn(Collections.singletonList(PATIENT_ID)); when(this.access.hasAccess(this.currentUser, Right.EDIT, this.patientReference)).thenReturn(false); JSONObject jsonObject = new JSONObject(); when(this.patient.toJSON()).thenReturn(jsonObject); Response response = this.component.getPatient(ID_LABEL, ID_VALUE); JSONObject links = new JSONObject().accumulate("rel", "self").accumulate("href", "uri") .put("allowedMethods", new JSONArray(Collections.singletonList("GET"))); JSONObject json = new JSONObject().put("links", Collections.singletonList(links)); verify(this.autolinker).withGrantedRight(Right.VIEW); assertTrue(json.similar(response.getEntity())); assertEquals(Response.Status.OK.getStatusCode(), response.getStatus()); }
@Override public Response getPatient(String label, String id) { this.logger.debug("Retrieving patient record with label [{}] and corresponding external ID [{}] via REST", label, id); Patient patient; List<String> patients = getPatientInternalIdentifiersByLabelAndEid(label, id); if (patients.size() == 1) { patient = this.repository.get(patients.get(0)); } else { return returnIfEmptyOrMultipleExistResponse(patients, label, id); } User currentUser = this.users.getCurrentUser(); Right grantedRight; if (!this.access.hasAccess(currentUser, Right.VIEW, patient.getDocumentReference())) { this.logger.debug("View access denied to user [{}] on patient record [{}]", currentUser, patient.getId()); throw new WebApplicationException(Response.Status.FORBIDDEN); } else { grantedRight = Right.VIEW; } if (this.access.hasAccess(currentUser, Right.EDIT, patient.getDocumentReference())) { grantedRight = Right.EDIT; } JSONObject json = patient.toJSON(); json.put("links", this.autolinker.get().forResource(PatientResource.class, this.uriInfo) .withExtraParameters("entity-id", patient.getId()) .withExtraParameters("entity-type", "patients") .withGrantedRight(grantedRight) .build()); return Response.ok(json, MediaType.APPLICATION_JSON_TYPE).build(); }
DefaultPatientByLabeledExternalIdentifierResourceImpl extends XWikiResource implements
    PatientByLabeledExternalIdentifierResource { @Override public Response getPatient(String label, String id) { this.logger.debug("Retrieving patient record with label [{}] and corresponding external ID [{}] via REST", label, id); Patient patient; List<String> patients = getPatientInternalIdentifiersByLabelAndEid(label, id); if (patients.size() == 1) { patient = this.repository.get(patients.get(0)); } else { return returnIfEmptyOrMultipleExistResponse(patients, label, id); } User currentUser = this.users.getCurrentUser(); Right grantedRight; if (!this.access.hasAccess(currentUser, Right.VIEW, patient.getDocumentReference())) { this.logger.debug("View access denied to user [{}] on patient record [{}]", currentUser, patient.getId()); throw new WebApplicationException(Response.Status.FORBIDDEN); } else { grantedRight = Right.VIEW; } if (this.access.hasAccess(currentUser, Right.EDIT, patient.getDocumentReference())) { grantedRight = Right.EDIT; } JSONObject json = patient.toJSON(); json.put("links", this.autolinker.get().forResource(PatientResource.class, this.uriInfo) .withExtraParameters("entity-id", patient.getId()) .withExtraParameters("entity-type", "patients") .withGrantedRight(grantedRight) .build()); return Response.ok(json, MediaType.APPLICATION_JSON_TYPE).build(); } }
DefaultPatientByLabeledExternalIdentifierResourceImpl extends XWikiResource implements
    PatientByLabeledExternalIdentifierResource { @Override public Response getPatient(String label, String id) { this.logger.debug("Retrieving patient record with label [{}] and corresponding external ID [{}] via REST", label, id); Patient patient; List<String> patients = getPatientInternalIdentifiersByLabelAndEid(label, id); if (patients.size() == 1) { patient = this.repository.get(patients.get(0)); } else { return returnIfEmptyOrMultipleExistResponse(patients, label, id); } User currentUser = this.users.getCurrentUser(); Right grantedRight; if (!this.access.hasAccess(currentUser, Right.VIEW, patient.getDocumentReference())) { this.logger.debug("View access denied to user [{}] on patient record [{}]", currentUser, patient.getId()); throw new WebApplicationException(Response.Status.FORBIDDEN); } else { grantedRight = Right.VIEW; } if (this.access.hasAccess(currentUser, Right.EDIT, patient.getDocumentReference())) { grantedRight = Right.EDIT; } JSONObject json = patient.toJSON(); json.put("links", this.autolinker.get().forResource(PatientResource.class, this.uriInfo) .withExtraParameters("entity-id", patient.getId()) .withExtraParameters("entity-type", "patients") .withGrantedRight(grantedRight) .build()); return Response.ok(json, MediaType.APPLICATION_JSON_TYPE).build(); }  }
DefaultPatientByLabeledExternalIdentifierResourceImpl extends XWikiResource implements
    PatientByLabeledExternalIdentifierResource { @Override public Response getPatient(String label, String id) { this.logger.debug("Retrieving patient record with label [{}] and corresponding external ID [{}] via REST", label, id); Patient patient; List<String> patients = getPatientInternalIdentifiersByLabelAndEid(label, id); if (patients.size() == 1) { patient = this.repository.get(patients.get(0)); } else { return returnIfEmptyOrMultipleExistResponse(patients, label, id); } User currentUser = this.users.getCurrentUser(); Right grantedRight; if (!this.access.hasAccess(currentUser, Right.VIEW, patient.getDocumentReference())) { this.logger.debug("View access denied to user [{}] on patient record [{}]", currentUser, patient.getId()); throw new WebApplicationException(Response.Status.FORBIDDEN); } else { grantedRight = Right.VIEW; } if (this.access.hasAccess(currentUser, Right.EDIT, patient.getDocumentReference())) { grantedRight = Right.EDIT; } JSONObject json = patient.toJSON(); json.put("links", this.autolinker.get().forResource(PatientResource.class, this.uriInfo) .withExtraParameters("entity-id", patient.getId()) .withExtraParameters("entity-type", "patients") .withGrantedRight(grantedRight) .build()); return Response.ok(json, MediaType.APPLICATION_JSON_TYPE).build(); }  @Override Response getPatient(String label, String id); @Override Response updatePatient(final String json, final String label, final String id,
        final String policy, final boolean create); @Override Response patchPatient(String json, String label, String id, boolean create); @Override Response deletePatient(String label, String id); }
DefaultPatientByLabeledExternalIdentifierResourceImpl extends XWikiResource implements
    PatientByLabeledExternalIdentifierResource { @Override public Response getPatient(String label, String id) { this.logger.debug("Retrieving patient record with label [{}] and corresponding external ID [{}] via REST", label, id); Patient patient; List<String> patients = getPatientInternalIdentifiersByLabelAndEid(label, id); if (patients.size() == 1) { patient = this.repository.get(patients.get(0)); } else { return returnIfEmptyOrMultipleExistResponse(patients, label, id); } User currentUser = this.users.getCurrentUser(); Right grantedRight; if (!this.access.hasAccess(currentUser, Right.VIEW, patient.getDocumentReference())) { this.logger.debug("View access denied to user [{}] on patient record [{}]", currentUser, patient.getId()); throw new WebApplicationException(Response.Status.FORBIDDEN); } else { grantedRight = Right.VIEW; } if (this.access.hasAccess(currentUser, Right.EDIT, patient.getDocumentReference())) { grantedRight = Right.EDIT; } JSONObject json = patient.toJSON(); json.put("links", this.autolinker.get().forResource(PatientResource.class, this.uriInfo) .withExtraParameters("entity-id", patient.getId()) .withExtraParameters("entity-type", "patients") .withGrantedRight(grantedRight) .build()); return Response.ok(json, MediaType.APPLICATION_JSON_TYPE).build(); }  @Override Response getPatient(String label, String id); @Override Response updatePatient(final String json, final String label, final String id,
        final String policy, final boolean create); @Override Response patchPatient(String json, String label, String id, boolean create); @Override Response deletePatient(String label, String id);  }