/**
 * Licensed to Jasig under one or more contributor license
 * agreements. See the NOTICE file distributed with this work
 * for additional information regarding copyright ownership.
 * Jasig licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file
 * except in compliance with the License. You may obtain a
 * copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on
 * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

package org.jasig.portal.security.remoting;

import javax.servlet.http.HttpServletRequest;

import org.jasig.portal.portlet.registry.IPortletDefinitionRegistry;
import org.jasig.portal.security.IAuthorizationPrincipal;
import org.jasig.portal.security.IAuthorizationService;
import org.jasig.portal.security.IPerson;
import org.jasig.portal.security.IPersonManager;
import org.jasig.portal.security.ISecurityContext;
import org.jasig.portal.security.provider.AuthorizationImpl;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.beans.factory.annotation.Autowired;

public abstract class AbstractPermissionsController implements InitializingBean {
    
    /**
     * Specifying the fName of a channel here pretty much violates the DRY 
     * principal;  perhaps we can think of a better way in the future.
     */
    private static final String PERMISSIONS_ADMIN_PORTLET_FNAME = "permissionsmanager";
    
    private IPortletDefinitionRegistry portletDefinitionRegistry;
    private String portletId = null;
    private IPersonManager personManager;
    
    @Autowired
    public void setPortletDefinitionRegistry(IPortletDefinitionRegistry portletDefinitionRegistry) {
        this.portletDefinitionRegistry = portletDefinitionRegistry;
    }

    @Autowired
    public void setPersonManager(IPersonManager personManager) {
        this.personManager = personManager;
    }

    /*
     * Protected API.
     */

    protected final boolean isAuthorized(HttpServletRequest req) throws Exception {
        
        /*
         * This is sensitive data;  we must verify that the user 
         * has the appropriate level of access to see it... 
         */

        // STEP (1):  Is there an IPerson?  
        final IPerson person = personManager.getPerson((HttpServletRequest) req);
        if (person != null) {
            
            // STEP (2):  Is the person authenticated?
            final ISecurityContext securityContext = person.getSecurityContext();
            if (securityContext != null && securityContext.isAuthenticated()) {
               
                // STEP (3):  Does this user have SUBSCRIBE permission for permissionsAdminChannel?
                IAuthorizationService authServ = AuthorizationImpl.singleton();
                IAuthorizationPrincipal principal = authServ.newPrincipal((String) person.getAttribute(IPerson.USERNAME), IPerson.class);
                if (authServ.canPrincipalSubscribe(principal, this.portletId)) {
                    return true;
                }

            }
        }

        return false;

    }

    public void afterPropertiesSet() throws Exception {
        this.portletId = portletDefinitionRegistry.getPortletDefinitionByFname(PERMISSIONS_ADMIN_PORTLET_FNAME).getPortletDefinitionId().getStringId();
    }
    
}

@@ -857,16 +857,71 @@
 quest;%0A%0A
+import org.jasig.portal.portlet.om.IPortletDefinition;%0A
 import o
@@ -1302,67 +1302,8 @@
 pl;%0A
-import org.springframework.beans.factory.InitializingBean;%0A
 impo
@@ -1418,36 +1418,8 @@
 ler 
-implements InitializingBean 
 %7B%0A  
@@ -1747,45 +1747,8 @@
 ry;%0A
-    private String portletId = null;%0A
     
@@ -3135,397 +3135,573 @@
     
-if (authServ.canPrincipalSubscribe(principal, this.portletId)) %7B%0A                    return true;%0A                %7D%0A%0A            %7D%0A        %7D%0A%0A        return false;%0A%0A
+%0A                final IPortletDefinition permissionsAdminPortlet = portletDefinitionRegistry.getPortletDefinitionByFname(PERMISSIONS_ADMIN_PORTLET_FNAME);%0A                if (permissionsAdminPortlet == null) %7B%0A                    return false;%0A                %7D%0A            
     
-%7D%0A
 %0A    
-public void afterPropertiesSet() throws Exception %7B%0A        this.portletId = portletDefinitionRegistry.getPortletDefinitionByFname(PERMISSIONS_ADMIN_PORTLET_FNAME).getPortletDefinitionId().getStringId();%0A    %7D%0A    
+            final String portletId = permissionsAdminPortlet.getPortletDefinitionId().getStringId();%0A                if (authServ.canPrincipalSubscribe(principal, portletId)) %7B%0A                    return true;%0A                %7D%0A%0A            %7D%0A        %7D%0A%0A        return false;%0A%0A    %7D
 %0A%7D%0A

Move DAO access out of afterPropertiesSet