package com.worth.ifs.assessment.security;


import com.worth.ifs.assessment.dto.Feedback;
import com.worth.ifs.security.PermissionRule;
import com.worth.ifs.security.PermissionRules;
import com.worth.ifs.user.domain.ProcessRole;
import com.worth.ifs.user.domain.User;
import com.worth.ifs.user.domain.UserRoleType;
import com.worth.ifs.user.repository.ProcessRoleRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

@Component
@PermissionRules
public class FeedbackRules {

    @Autowired
    private ProcessRoleRepository processRoleRepository;

    @PermissionRule(value = "READ", description = "An Assessor can read their own feedback")
    public boolean assessorCanReadTheirOwnFeedback(Feedback dto, User user) {
        return isAssessorForApplication(dto, user);
    }

    @PermissionRule(value = "UPDATE", description = "An Assessor can update their own feedback")
    public boolean assessorCanUpdateTheirOwnFeedback(Feedback dto, User user){
        return isAssessorForApplication(dto, user);
    }

    private boolean isAssessorForApplication(Feedback dto, User user) {
        ProcessRole processRole = processRoleRepository.findOne(dto.getAssessorProcessRoleId());
        return processRole.getRole().getName().equals(UserRoleType.ASSESSOR.getName()) &&
                processRole.getUser().equals(user);
    }
}

@@ -1374,16 +1374,105 @@
 etUser()
+ != null &&%0A                user != null &&%0A                processRole.getUser().getId()
 .equals(
@@ -1471,23 +1471,31 @@
 .equals(user
+.getId()
 );%0A    %7D%0A%7D%0A

fix for security failing for feedback