/*
 *  (C) Michael Bar-Sinai
 */

package edu.harvard.iq.dataverse.engine.command.impl;

import edu.harvard.iq.dataverse.authorization.DataverseRole;
import edu.harvard.iq.dataverse.DvObject;
import edu.harvard.iq.dataverse.RoleAssignment;
import edu.harvard.iq.dataverse.authorization.Permission;
import edu.harvard.iq.dataverse.authorization.RoleAssignee;
import edu.harvard.iq.dataverse.authorization.users.User;
import edu.harvard.iq.dataverse.engine.command.AbstractCommand;
import edu.harvard.iq.dataverse.engine.command.CommandContext;
import edu.harvard.iq.dataverse.engine.command.RequiredPermissions;
import edu.harvard.iq.dataverse.engine.command.exception.CommandException;

/**
 * Assign a in a dataverse to a user.
 * @author michael
 */
@RequiredPermissions( Permission.AssignRole )
public class AssignRoleCommand extends AbstractCommand<RoleAssignment> {
	
	private final DataverseRole role;
	private final RoleAssignee grantee;
	private final DvObject defPoint;
	
	/**
	 * @param anAssignee The user being granted the role
	 * @param aRole the role being granted to the user
	 * @param assignmentPoint the dataverse on which the role is granted.
	 * @param issuingUser the user issuing the command.
	 */
	public AssignRoleCommand(RoleAssignee anAssignee, DataverseRole aRole, DvObject assignmentPoint, User issuingUser) {
		super(issuingUser, assignmentPoint);
		role = aRole;
		grantee = anAssignee;
		defPoint = assignmentPoint;
	}

	@Override
	public RoleAssignment execute(CommandContext ctxt) throws CommandException {
		// TODO make sure the role is defined on the dataverse.
		RoleAssignment roleAssignment = new RoleAssignment(role, grantee,defPoint);
		return ctxt.roles().save(roleAssignment);
	}
	
}

@@ -26,17 +26,16 @@
 nai%0A */%0A
-%0A
 package 
@@ -81,16 +81,101 @@
 .impl;%0A%0A
+import edu.harvard.iq.dataverse.DataFile;%0Aimport edu.harvard.iq.dataverse.Dataverse;%0A
 import e
@@ -624,76 +624,8 @@
 xt;%0A
-import edu.harvard.iq.dataverse.engine.command.RequiredPermissions;%0A
 impo
@@ -694,16 +694,90 @@
 ception;
+%0Aimport java.util.Collections;%0Aimport java.util.Map;%0Aimport java.util.Set;
 %0A%0A/**%0A *
@@ -812,16 +812,19 @@
 a user.%0A
+ *%0A
  * @auth
@@ -842,53 +842,73 @@
  */%0A
-@RequiredPermissions( Permission.AssignRole )
+// no annotations here, since permissions are dynamically decided
 %0Apub
@@ -977,19 +977,21 @@
 ment%3E %7B%0A
-%09%0A%09
+%0A    
 private 
@@ -1016,17 +1016,20 @@
 e role;%0A
-%09
+    
 private 
@@ -1056,17 +1056,20 @@
 rantee;%0A
-%09
+    
 private 
@@ -1097,16 +1097,21 @@
 nt;%0A
-%09%0A%09/**%0A%09
+%0A    /**%0A    
  * @
@@ -1159,17 +1159,20 @@
 he role%0A
-%09
+    
  * @para
@@ -1214,17 +1214,20 @@
 he user%0A
-%09
+    
  * @para
@@ -1288,17 +1288,20 @@
 ranted.%0A
-%09
+    
  * @para
@@ -1348,14 +1348,20 @@
 nd.%0A
-%09 */%0A%09
+     */%0A    
 publ
@@ -1477,49 +1477,188 @@
 ) %7B%0A
-%09%09super(issuingUser, assignmentPoint);%0A%09%09
+        // for data file check permission on owning dataset%0A        super(issuingUser, assignmentPoint instanceof DataFile ? assignmentPoint.getOwner() : assignmentPoint);%0A        
 role
@@ -1667,18 +1667,24 @@
  aRole;%0A
-%09%09
+        
 grantee 
@@ -1697,18 +1697,24 @@
 signee;%0A
-%09%09
+        
 defPoint
@@ -1737,13 +1737,19 @@
 nt;%0A
-%09%7D%0A%0A%09
+    %7D%0A%0A    
 @Ove
@@ -1754,17 +1754,20 @@
 verride%0A
-%09
+    
 public R
@@ -1835,18 +1835,24 @@
 ption %7B%0A
-%09%09
+        
 // TODO 
@@ -1899,18 +1899,24 @@
 averse.%0A
-%09%09
+        
 RoleAssi
@@ -1972,16 +1972,17 @@
 grantee,
+ 
 defPoint
@@ -1988,10 +1988,16 @@
 t);%0A
-%09%09
+        
 retu
@@ -2038,11 +2038,393 @@
 t);%0A
-%09
+    %7D%0A%0A    @Override%0A    public Map%3CString, Set%3CPermission%3E%3E getRequiredPermissions() %7B%0A        // for data file check permission on owning dataset%0A        return Collections.singletonMap(%22%22,%0A                defPoint instanceof Dataverse ? Collections.singleton(Permission.ManageDataversePermissions)%0A                : Collections.singleton(Permission.ManageDatasetPermissions));%0A    
 %7D%0A
-%09
 %0A%7D%0A

use new, simplified permissions (and set dynamically)