@Produces({ MediaType.APPLICATION_JSON })
public JSONObject removeAccess(
@PathParam("userId") Long userId
) {
HealthRecord localHR = getEntity();
Long healthRecordIdToRemove = localHR.getHealthRecordId();
JSONObject jsonResult = new JSONObject();
Boolean returnType = false;
if (healthRecordIdToRemove != null)
{
PersistenceService persistenceSvc = PersistenceService.getInstance();
try {
if (! securityContext.isUserInRole(UserConfig.ROLE_PATIENT)) throw new Exception("Not in patient role for removing access");
EntityManager em = PersistenceService.getInstance().getEntityManager();
User userToDisallow = null;
User removingUser = null;
try {
persistenceSvc.beginTx();
//get user
userToDisallow = getUserById(userId);
removingUser = getAuthenticatedUser();
//TODO check we are owner of HR
//if HR owner == removingUser
//find the correct hr
List<HealthRecord> healthRecords = userToDisallow.getHealthRecords();
boolean shouldRemove = false;
HealthRecord toRemove = null;
//make sure we aren't removing ourself
if (removingUser.getUserId().compareTo(userId) == 0) {
shouldRemove = false;
logger.debug("Preventing self-removal attempt id1 {} id2 {}", userToDisallow.getUserId(), userId);