CollectionService.findSeriesWithPricesBySlug(): restrict access by only an owner who is also a paid user.

Fix #891

Author: php-coder

pom.xml

@@ -754,6 +754,8 @@
 					<showWarnings>true</showWarnings>
 					<debug>false</debug>
 					<failOnWarning>true</failOnWarning>
+					<!-- Required for using method's parameters inside of @PreAuthorize expressions -->
+					<parameters>true</parameters>
 				</configuration>
 			</plugin>
 

src/main/java/ru/mystamps/web/service/CollectionServiceImpl.java

@@ -152,10 +152,9 @@ public List<LinkEntityDto> findRecentlyCreated(int quantity) {
 	}
 
 	// @todo #884 CollectionService.findSeriesWithPricesBySlug(): add unit tests
-	// @todo #884 CollectionService.findSeriesWithPricesBySlug(): restrict access by only an owner
 	@Override
 	@Transactional(readOnly = true)
-	@PreAuthorize(HasAuthority.ADD_SERIES_PRICE)
+	@PreAuthorize(HasAuthority.ADD_SERIES_PRICE_AND_COLLECTION_OWNER)
 	public List<SeriesInCollectionWithPriceDto> findSeriesWithPricesBySlug(
 		String slug,
 		String lang) {

src/main/java/ru/mystamps/web/support/spring/security/HasAuthority.java

@@ -21,7 +21,9 @@
 public final class HasAuthority {
 	// Constants sorted in an ascending order.
 	public static final String ADD_PARTICIPANT = "hasAuthority('" + StringAuthority.ADD_PARTICIPANT + "')";
-	public static final String ADD_SERIES_PRICE = "hasAuthority('" + StringAuthority.ADD_SERIES_PRICE + "')";
+	@SuppressWarnings("PMD.LongVariable")
+	public static final String ADD_SERIES_PRICE_AND_COLLECTION_OWNER
+		= "hasAuthority('" + StringAuthority.ADD_SERIES_PRICE + "') and principal?.userCollectionSlug == #slug";
 	public static final String ADD_SERIES_SALES = "hasAuthority('" + StringAuthority.ADD_SERIES_SALES + "')";
 	public static final String CREATE_CATEGORY = "hasAuthority('" + StringAuthority.CREATE_CATEGORY + "')";
 	public static final String CREATE_COUNTRY = "hasAuthority('" + StringAuthority.CREATE_COUNTRY + "')";