Implementation of basic permission checks.

core/service.h

@@ -13,6 +13,7 @@
 #include "core_global.h"
 #include "context.h"
 #include "iservice.h"
+#include "permissionevaluator.h"
 
 #include "transaction.h"
 
@@ -27,12 +28,17 @@ public:
     }
 
     QList<QSharedPointer<T> > all(const QString &where = "") {
+        QList<QSharedPointer<T> > ret;
+
+        if (!checkPermission(PERM_READ)) {
+            return ret;
+        }
+
         odb::database *db = Context::instance().db();
 
         Q_ASSERT(db);
 
         Transaction tx;
-        QList<QSharedPointer<T> > ret;
 
         try
         {
@@ -62,6 +68,10 @@ public:
     }
 
     void save(QSharedPointer<T> entity) {
+        if (!checkPermission(PERM_ADD)) {
+            return;
+        }
+
         odb::database *db = Context::instance().db();
 
         Q_ASSERT(db);
@@ -84,6 +94,10 @@ public:
     }
 
     void update(QSharedPointer<T> entity) {
+        if (!checkPermission(PERM_EDIT)) {
+            return;
+        }
+
         odb::database *db = Context::instance().db();
 
         Q_ASSERT(db);
@@ -106,12 +120,17 @@ public:
     }
 
     QSharedPointer<T> loadById(int id) {
+        QSharedPointer<T> entity;
+
+        if (!checkPermission(PERM_READ)) {
+            return entity;
+        }
+
         odb::database *db = Context::instance().db();
 
         Q_ASSERT(db);
 
         Transaction tx;
-        QSharedPointer<T> entity;
 
         try
         {
@@ -137,6 +156,10 @@ public:
     }
 
     void erase(QSharedPointer<T> entity) {
+        if (!checkPermission(PERM_DELETE)) {
+            return;
+        }
+
         odb::database *db = Context::instance().db();
 
         Q_ASSERT(db);
@@ -155,12 +178,18 @@ public:
         }
     }
 
-    void setPluginId(const QString &pluginId) {
-        m_pluginId = pluginId;
-    }
+protected:
+    bool checkPermission(const QString &permission) {
+        if (!m_pluginId.isEmpty()) {
+            PermissionEvaluator ev;
+            if (!ev.hasPermission(m_pluginId, permission)) {
+                emit permissionDenied(permission);
+                return false;
+            }
+        }
 
-private:
-    QString m_pluginId;
+        return true;
+    }
 };
 
 #endif // SERVICE_H