@Test public void deletePatientRejectsRequestWhenUserDoesNotHaveAccess() { doReturn(false).when(this.access).hasAccess(this.currentUser, Right.DELETE, this.patientDocument); Response response = this.patientResource.deletePatient(PATIENT_ID); verify(this.logger).debug("Delete access denied to user [{}] on patient record [{}]", this.currentUser, PATIENT_ID); Assert.assertEquals(Status.FORBIDDEN.getStatusCode(), response.getStatus()); }
@Override public Response deletePatient(String id) { this.slf4Jlogger.debug("Deleting patient record [{}] via REST", id); Patient patient = this.repository.get(id); if (patient == null) { this.slf4Jlogger.debug("Patient record [{}] didn't exist", id); return Response.status(Status.NOT_FOUND).build(); } User currentUser = this.users.getCurrentUser(); if (!this.access.hasAccess(currentUser, Right.DELETE, patient.getDocumentReference())) { this.slf4Jlogger.debug("Delete access denied to user [{}] on patient record [{}]", currentUser, id); return Response.status(Status.FORBIDDEN).build(); } try { this.repository.delete(patient); } catch (Exception ex) { this.slf4Jlogger.warn("Failed to delete patient record [{}]: {}", id, ex.getMessage()); throw new WebApplicationException(Status.INTERNAL_SERVER_ERROR); } this.slf4Jlogger.debug("Deleted patient record [{}]", id); return Response.noContent().build(); }
DefaultPatientResourceImpl extends XWikiResource implements PatientResource { @Override public Response deletePatient(String id) { this.slf4Jlogger.debug("Deleting patient record [{}] via REST", id); Patient patient = this.repository.get(id); if (patient == null) { this.slf4Jlogger.debug("Patient record [{}] didn't exist", id); return Response.status(Status.NOT_FOUND).build(); } User currentUser = this.users.getCurrentUser(); if (!this.access.hasAccess(currentUser, Right.DELETE, patient.getDocumentReference())) { this.slf4Jlogger.debug("Delete access denied to user [{}] on patient record [{}]", currentUser, id); return Response.status(Status.FORBIDDEN).build(); } try { this.repository.delete(patient); } catch (Exception ex) { this.slf4Jlogger.warn("Failed to delete patient record [{}]: {}", id, ex.getMessage()); throw new WebApplicationException(Status.INTERNAL_SERVER_ERROR); } this.slf4Jlogger.debug("Deleted patient record [{}]", id); return Response.noContent().build(); } }
DefaultPatientResourceImpl extends XWikiResource implements PatientResource { @Override public Response deletePatient(String id) { this.slf4Jlogger.debug("Deleting patient record [{}] via REST", id); Patient patient = this.repository.get(id); if (patient == null) { this.slf4Jlogger.debug("Patient record [{}] didn't exist", id); return Response.status(Status.NOT_FOUND).build(); } User currentUser = this.users.getCurrentUser(); if (!this.access.hasAccess(currentUser, Right.DELETE, patient.getDocumentReference())) { this.slf4Jlogger.debug("Delete access denied to user [{}] on patient record [{}]", currentUser, id); return Response.status(Status.FORBIDDEN).build(); } try { this.repository.delete(patient); } catch (Exception ex) { this.slf4Jlogger.warn("Failed to delete patient record [{}]: {}", id, ex.getMessage()); throw new WebApplicationException(Status.INTERNAL_SERVER_ERROR); } this.slf4Jlogger.debug("Deleted patient record [{}]", id); return Response.noContent().build(); }  }
DefaultPatientResourceImpl extends XWikiResource implements PatientResource { @Override public Response deletePatient(String id) { this.slf4Jlogger.debug("Deleting patient record [{}] via REST", id); Patient patient = this.repository.get(id); if (patient == null) { this.slf4Jlogger.debug("Patient record [{}] didn't exist", id); return Response.status(Status.NOT_FOUND).build(); } User currentUser = this.users.getCurrentUser(); if (!this.access.hasAccess(currentUser, Right.DELETE, patient.getDocumentReference())) { this.slf4Jlogger.debug("Delete access denied to user [{}] on patient record [{}]", currentUser, id); return Response.status(Status.FORBIDDEN).build(); } try { this.repository.delete(patient); } catch (Exception ex) { this.slf4Jlogger.warn("Failed to delete patient record [{}]: {}", id, ex.getMessage()); throw new WebApplicationException(Status.INTERNAL_SERVER_ERROR); } this.slf4Jlogger.debug("Deleted patient record [{}]", id); return Response.noContent().build(); }  @Override Response getPatient(String id); @Override Response updatePatient(String json, String id, String policy); @Override Response patchPatient(final String json, final String id); @Override Response deletePatient(String id); }
DefaultPatientResourceImpl extends XWikiResource implements PatientResource { @Override public Response deletePatient(String id) { this.slf4Jlogger.debug("Deleting patient record [{}] via REST", id); Patient patient = this.repository.get(id); if (patient == null) { this.slf4Jlogger.debug("Patient record [{}] didn't exist", id); return Response.status(Status.NOT_FOUND).build(); } User currentUser = this.users.getCurrentUser(); if (!this.access.hasAccess(currentUser, Right.DELETE, patient.getDocumentReference())) { this.slf4Jlogger.debug("Delete access denied to user [{}] on patient record [{}]", currentUser, id); return Response.status(Status.FORBIDDEN).build(); } try { this.repository.delete(patient); } catch (Exception ex) { this.slf4Jlogger.warn("Failed to delete patient record [{}]: {}", id, ex.getMessage()); throw new WebApplicationException(Status.INTERNAL_SERVER_ERROR); } this.slf4Jlogger.debug("Deleted patient record [{}]", id); return Response.noContent().build(); }  @Override Response getPatient(String id); @Override Response updatePatient(String json, String id, String policy); @Override Response patchPatient(final String json, final String id); @Override Response deletePatient(String id);  }