// Copyright (C) 2016 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package com.googlesource.gerrit.plugins.javamelody;

import com.google.gerrit.extensions.annotations.PluginName;
import com.google.gerrit.server.CurrentUser;
import com.google.gerrit.server.account.CapabilityControl;
import com.google.inject.Inject;
import com.google.inject.Provider;

public class CapabilityChecker {
  private final Provider<CurrentUser> userProvider;
  private final String capabilityName;

  @Inject
  CapabilityChecker(Provider<CurrentUser> userProvider, @PluginName String pluginName) {
    this.userProvider = userProvider;
    this.capabilityName = String.format("%s-%s", pluginName, MonitoringCapability.ID);
  }

  public boolean canMonitor() {
    if (userProvider.get().isIdentifiedUser()) {
      CapabilityControl ctl = userProvider.get().getCapabilities();
      return ctl.canAdministrateServer() || ctl.canPerform(capabilityName);
    }
    return false;
  }
}

@@ -655,16 +655,63 @@
 elody;%0A%0A
+import com.google.common.collect.ImmutableSet;%0A
 import c
@@ -791,85 +791,347 @@
 rit.
-server.CurrentUser;%0Aimport com.google.gerrit.server.account.CapabilityControl
+extensions.api.access.PluginPermission;%0Aimport com.google.gerrit.extensions.restapi.AuthException;%0Aimport com.google.gerrit.server.CurrentUser;%0Aimport com.google.gerrit.server.permissions.GlobalPermission;%0Aimport com.google.gerrit.server.permissions.PermissionBackend;%0Aimport com.google.gerrit.server.permissions.PermissionBackendException
 ;%0Aim
@@ -1196,16 +1196,63 @@
 ovider;%0A
+import com.google.inject.Singleton;%0A%0A@Singleton
 %0Apublic 
@@ -1277,16 +1277,69 @@
 ecker %7B%0A
+  private final PermissionBackend permissionBackend;%0A
   privat
@@ -1405,26 +1405,22 @@
  String 
-capability
+plugin
 Name;%0A%0A 
@@ -1448,16 +1448,66 @@
 Checker(
+%0A      PermissionBackend permissionBackend,%0A      
 Provider
@@ -1533,16 +1533,22 @@
 rovider,
+%0A     
  @Plugin
@@ -1586,262 +1586,389 @@
 his.
-userProvider = userProvider;%0A    this.capabilityName = String.format(%22%25s-%25s%22, pluginName, MonitoringCapability.ID);%0A  %7D%0A%0A  public boolean canMonitor() %7B%0A    if (userProvider.get().isIdentifiedUser()) %7B%0A      CapabilityControl ctl = userProvider.get().get
+permissionBackend = permissionBackend;%0A    this.userProvider = userProvider;%0A    this.pluginName = pluginName;%0A  %7D%0A%0A  public boolean canMonitor() %7B%0A    try %7B%0A      permissionBackend%0A          .user(userProvider)%0A          .checkAny(%0A              ImmutableSet.of(%0A                  GlobalPermission.ADMINISTRATE_SERVER,%0A                  new PluginPermission(pluginName, Monitoring
 Capa
@@ -1976,12 +1976,14 @@
 ilit
-ies(
+y.ID))
 );%0A 
@@ -1998,77 +1998,77 @@
 urn 
-ctl.canAdministrateServer() %7C%7C ctl.canPerform(capabilityName);%0A    %7D%0A
+true;%0A    %7D catch (AuthException %7C PermissionBackendException e) %7B%0A  
     
@@ -2081,14 +2081,20 @@
  false;%0A
+    %7D%0A
   %7D%0A%7D%0A

Migrate to using permission backend