/*
 * Copyright 2009 The Kuali Foundation.
 * 
 * Licensed under the Educational Community License, Version 1.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 * http://www.opensource.org/licenses/ecl1.php
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.kuali.kfs.sys.document.workflow;

import java.util.Arrays;
import java.util.List;

import org.kuali.kfs.sys.context.SpringContext;
import org.kuali.kfs.sys.document.datadictionary.FinancialSystemTransactionalDocumentEntry;
import org.kuali.rice.kew.doctype.SecurityAttribute;
import org.kuali.rice.kew.exception.WorkflowException;
import org.kuali.rice.kew.service.WorkflowUtility;
import org.kuali.rice.kim.bo.Person;
import org.kuali.rice.kns.datadictionary.DocumentEntry;
import org.kuali.rice.kns.document.Document;
import org.kuali.rice.kns.document.authorization.DocumentAuthorizer;
import org.kuali.rice.kns.service.DataDictionaryService;
import org.kuali.rice.kns.service.DocumentHelperService;
import org.kuali.rice.kns.service.DocumentService;

/**
 * This class...
 */
public class SensitiveDataSecurityAttribute implements SecurityAttribute {

    private WorkflowUtility workflowUtils = SpringContext.getBean(WorkflowUtility.class);
    private DocumentHelperService docHelperService = SpringContext.getBean(DocumentHelperService.class);
    private DocumentService docService = SpringContext.getBean(DocumentService.class);

    /**
     * @see org.kuali.rice.kew.doctype.SecurityAttribute#docSearchAuthorized(org.kuali.rice.kew.doctype.DocumentTypeSecurity, org.kuali.rice.kim.bo.Person, java.util.List, java.lang.String, java.lang.Long, java.lang.String, org.kuali.rice.kew.doctype.SecuritySession)
     */
    public Boolean docSearchAuthorized(Person currentUser, String docTypeName, Long documentId, String initiatorPrincipalId) {

        return isVisable(currentUser, docTypeName, documentId);
        
    }

    /**
     * @see org.kuali.rice.kew.doctype.SecurityAttribute#routeLogAuthorized(org.kuali.rice.kew.doctype.DocumentTypeSecurity, org.kuali.rice.kim.bo.Person, java.util.List, java.lang.String, java.lang.Long, java.lang.String, org.kuali.rice.kew.doctype.SecuritySession)
     */
    public Boolean routeLogAuthorized(Person currentUser, String docTypeName, Long documentId, String initiatorPrincipalId) {

        return isVisable(currentUser, docTypeName, documentId);
    }
    
    private final Boolean isVisable(Person currentUser, String docTypeName, Long documentId) {
        
        final DocumentEntry docEntry = SpringContext.getBean(DataDictionaryService.class).getDataDictionary().getDocumentEntry(docTypeName);
        if (docEntry instanceof FinancialSystemTransactionalDocumentEntry) {
            if (((FinancialSystemTransactionalDocumentEntry)docEntry).isPotentiallySensitive()) {
                String[] sensitiveDataCodeArray = workflowUtils.getSearchableAttributeStringValuesByKey(documentId, "sensitive");
                List<String> sensitiveDataCode = Arrays.asList(sensitiveDataCodeArray);
                if ( sensitiveDataCode != null && sensitiveDataCode.contains("Y")) {

                    DocumentAuthorizer docAuthorizer = docHelperService.getDocumentAuthorizer(docTypeName);
                    Document doc = null;
                    try {
                        doc = docService.getByDocumentHeaderIdSessionless(documentId.toString());
                    } catch(WorkflowException we) {
                        throw new RuntimeException(we);
                    }
                    return docAuthorizer.canOpen(doc, currentUser);
                } 
            }
        }
        return true;
        
    }

}

@@ -3291,16 +3291,111 @@
 tive%22);%0A
+                if (sensitiveDataCodeArray != null && sensitiveDataCodeArray.length %3E 0) %7B%0A    
         
@@ -3486,24 +3486,28 @@
             
+    
 if ( sensiti
@@ -3559,25 +3559,33 @@
 ins(%22Y%22)) %7B%0A
-%0A
+    %0A    
             
@@ -3692,32 +3692,36 @@
                 
+    
 Document doc = n
@@ -3745,16 +3745,20 @@
         
+    
 try %7B%0A  
@@ -3779,16 +3779,20 @@
         
+    
 doc = do
@@ -3877,16 +3877,20 @@
         
+    
 %7D catch(
@@ -3909,24 +3909,28 @@
 ption we) %7B%0A
+    
             
@@ -3985,34 +3985,42 @@
                 
-%7D%0A
+    %7D%0A    
                 
@@ -4087,18 +4087,39 @@
         
-%7D 
+    %7D%0A                %7D
 %0A       

fix sensitive data NPE