* hiding the results from the other.
*
* @return Criteria Final criteria query with all filters applied.
*/
protected Criteria createSecureCriteria() {
Principal principal = principalProvider.get();
Criteria query = currentSession().createCriteria(entityType);
/*
* There are situations where consumer queries are run before there is a principal,
* i.e. during authentication when we're looking up the consumer itself.
*/
if (principal == null) {
return query;
}
// Admins do not need query filtering enabled.
if (principal.hasFullAccess()) {
return query;
}
Criterion finalCriterion = null;
for (Permission perm : principal.getPermissions()) {
Criterion crit = perm.getCriteriaRestrictions(entityType);
if (crit != null) {
log.debug("Got criteria restrictions from permissions {} for {}: {}",
new Object [] {perm, entityType, crit});