Date fromDate;
Date toDate;
Response response = null;
HttpSession httpSession = request.getSession();
User userObject = (User) httpSession.getAttribute("currentUser");
if(null == userObject) {
return new Response(ResponseStatus.FAIL, "You are not logged in!");
}
fromDate = DateOperator.stringToDate(from);
toDate = DateOperator.stringToDate(to);
if( null == fromDate || null == toDate ) {
return (new Response(ResponseStatus.FAIL, "Dates parsing problem" ));
}
else {
try {
EventType eventTypeObject = (EventType) databaseSession.get(EventType.class, this.eventType);
if(null == eventTypeObject)
{
return (new Response(ResponseStatus.FAIL, "Not valid event type"));
}
User eventOwner = (User) databaseSession.get(User.class, this.owner);
EventId eventIdObject = new EventId();
eventIdObject.setFrom(fromDate);
eventIdObject.setTo(toDate);
eventIdObject.setOwner(eventOwner);
eventIdObject.setType(eventTypeObject);
Event eventObject = (Event) databaseSession.get(Event.class, eventIdObject);
if (eventObject == null) {
throw new IllegalArgumentException("Could not locate event in question!");
}
// get current user
User currentUser = (User) request.getSession().getAttribute("currentUser");
// get permission types from database (very very dumb):
PermissionType publicPermission = (PermissionType) databaseSession.get(PermissionType.class, new Long(1));
// get admin role, yep, dumb as well.
Role adminRole = (Role) databaseSession.get(Role.class, new Long(2));
// who can edit the event:
// 1. the owner
// 2. Not owner but admin if the event is public
if ( !( eventObject.getId().getOwner().equals(currentUser)
|| (eventObject.getPermission().equals(publicPermission) && currentUser.getRole().equals(adminRole)) ) ) {
throw new SecurityException("Permission to delete is denied.");
}
Transaction transaction = databaseSession.beginTransaction();
transaction.begin();