Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -136,8 +136,9 @@ public ResponseEntity<?> submitUserAssessmentV3(@Valid @RequestBody Map<String,
@GetMapping("/v1/quml/assessment/read/{assessmentIdentifier}")
public ResponseEntity<SBApiResponse> readAssessment(
@PathVariable("assessmentIdentifier") String assessmentIdentifier,
@RequestHeader(Constants.X_AUTH_TOKEN) String token) throws Exception {
SBApiResponse readResponse = assessmentServiceV2.readAssessment(assessmentIdentifier, token);
@RequestHeader(Constants.X_AUTH_TOKEN) String token,
@RequestHeader(value = Constants.X_AUTH_USER_ORG_ID, required = false) String rootOrgId) throws Exception {
SBApiResponse readResponse = assessmentServiceV2.readAssessment(assessmentIdentifier, token, rootOrgId);
return new ResponseEntity<>(readResponse, readResponse.getResponseCode());
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ public interface AssessmentServiceV2 {
*/
public SBApiResponse submitAssessment(Map<String, Object> data, String userEmail) throws Exception;

public SBApiResponse readAssessment(String assessmentIdentifier, String token) throws Exception;
public SBApiResponse readAssessment(String assessmentIdentifier, String token, String rootOrgId) throws Exception;

public SBApiResponse readQuestionList(Map<String, Object> requestBody, String authUserToken) throws Exception;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ public class AssessmentServiceV2Impl implements AssessmentServiceV2 {
@Autowired
ObjectMapper mapper;

public SBApiResponse readAssessment(String assessmentIdentifier, String token) {
public SBApiResponse readAssessment(String assessmentIdentifier, String token, String rootOrgId) {
logger.info("AssessmentServiceV2Impl::readAssessment... Started");
SBApiResponse response = createDefaultResponse(Constants.API_QUESTIONSET_HIERARCHY_GET);
String errMsg;
Expand All @@ -70,6 +70,13 @@ public SBApiResponse readAssessment(String assessmentIdentifier, String token) {
logger.info("readAssessment.. userId :" + userId);
Map<String, Object> assessmentAllDetail = new HashMap<>();
errMsg = fetchReadHierarchyDetails(assessmentAllDetail, token, assessmentIdentifier);
boolean hasAccess = validateSecureSettings(assessmentAllDetail, rootOrgId);
if (!hasAccess) {
response.getParams().setStatus(Constants.FAILED);
response.getParams().setErrmsg(Constants.USER_DOES_NOT_HAVE_ACCESS);
response.setResponseCode(HttpStatus.NOT_FOUND);
return response;
}
if (errMsg.isEmpty() && !((String) assessmentAllDetail.get(Constants.PRIMARY_CATEGORY)).equalsIgnoreCase(Constants.PRACTICE_QUESTION_SET)) {
logger.info("Fetched assessment Details... for : " + assessmentIdentifier);
List<Map<String, Object>> existingDataList = assessmentRepository.fetchUserAssessmentDataFromDB(userId, assessmentIdentifier);
Expand Down Expand Up @@ -745,4 +752,19 @@ private int calculateAssessmentRetakeCount(List<Map<String, Object>> userAssessm
Iterables.removeIf(values, Predicates.isNull());
return values.size();
}

private boolean validateSecureSettings(Map<String, Object> assessmentAllDetail, String rootOrgId) {
List<String> organizationIds = new ArrayList<>();
Optional.ofNullable((String) assessmentAllDetail.get(Constants.SECURE_SETTINGS))
.ifPresent(jsonString -> {
try {
ObjectMapper objectMapper = new ObjectMapper();
Map<String, Object> secureSettings = objectMapper.readValue(jsonString, Map.class);
organizationIds.addAll((List<String>) secureSettings.get(Constants.ORGANISATION));
} catch (Exception e) {
e.printStackTrace();
}
});
return organizationIds.isEmpty() || organizationIds.contains(rootOrgId);
}
}
3 changes: 3 additions & 0 deletions src/main/java/org/sunbird/common/util/Constants.java
Original file line number Diff line number Diff line change
Expand Up @@ -679,6 +679,9 @@ public class Constants {
public static final String GROUP = "group";
public static final String BULK_USER_CREATE_API_FAILED = "Bulk User Create API Failed";
public static final String BULK_USER_UPDATE_API_FAILED = "Bulk User Update API Failed";
public static final String USER_DOES_NOT_HAVE_ACCESS = "User doesn't have access to this assessment :";
public static final String SECURE_SETTINGS = "secureSettings";
public static final String ORGANISATION = "organisation";
private Constants() {
throw new IllegalStateException("Utility class");
}
Expand Down