package org.innovateuk.ifs.assessment.transactional;

import org.innovateuk.ifs.commons.security.SecuredBySpring;
import org.innovateuk.ifs.commons.service.ServiceResult;
import org.innovateuk.ifs.invite.resource.AssessorInviteSendResource;
import org.innovateuk.ifs.invite.resource.AssessorInvitesToSendResource;
import org.springframework.security.access.prepost.PreAuthorize;
import org.innovateuk.ifs.invite.resource.*;
import org.springframework.data.domain.Pageable;

import java.util.List;


/**
 * Service for managing {@link org.innovateuk.ifs.invite.domain.AssessmentPanelInvite}s.
 */

public interface AssessmentPanelInviteService {


    @SecuredBySpring(value = "GET_ALL_CREATED_INVITES",
            description = "Competition Admins and Project Finance users can get all invites that have been created for an assessment panel on a competition")
    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    ServiceResult<AssessorInvitesToSendResource> getAllInvitesToSend(long competitionId);

    @SecuredBySpring(value = "SEND_ALL_INVITES",
            description = "The Competition Admins and Project Finance users can send all assessment panel invites")
    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    ServiceResult<Void> sendAllInvites(long competitionId, AssessorInviteSendResource assessorInvitesToSendResource);

    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    @SecuredBySpring(value = "READ_ASSESSORS_BY_COMPETITION",
            description = "Competition Admins and Project Finance users can retrieve available assessors by competition",
            additionalComments = "The available assessors must have accepted a competition invite and not have an assessment panel invite")
    ServiceResult<AvailableAssessorPageResource> getAvailableAssessors(long competitionId, Pageable pageable);

    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    @SecuredBySpring(value = "READ_ASSESSORS_BY_COMPETITION",
            description = "Competition Admins and Project Finance can retrieve available assessor ids by competition",
            additionalComments = "The available assessors must have accepted a competition invite and not have an assessment panel invite")
    ServiceResult<List<Long>> getAvailableAssessorIds(long competitionId);

    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    @SecuredBySpring(value = "READ_INVITES_BY_COMPETITION",
            description = "Competition Admins and Project Finance users can retrieve created invites by competition")
    ServiceResult<AssessorCreatedInvitePageResource> getCreatedInvites(long competitionId, Pageable pageable);

    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
    @SecuredBySpring(value = "INVITE_EXISTING_USERS",
            description = "The Competition Admin user and Project Finance users can create assessment panel invites for existing users")
    ServiceResult<Void> inviteUsers(List<ExistingUserStagedInviteResource> existingUserStagedInvites);

//    @PreAuthorize("hasAnyAuthority('comp_admin', 'project_finance')")
//    @SecuredBySpring(value = "GET_ALL_INVITES_FOR_A_USER",
//            description = "The competition admin user and finance users can view all invites for a particular user")
    ServiceResult<List<AssessmentPanelInviteResource>> getAllInvitesByUser(long userId);

}

@@ -299,32 +299,95 @@
 ToSendResource;%0A
+import org.springframework.security.access.prepost.PostFilter;%0A
 import org.sprin
@@ -3134,82 +3134,63 @@
 );%0A%0A
-//
     @P
-reAuthorize(%22hasAnyAuthority('comp_admin', 'project_finance
+ostFilter(%22hasPermission(filterObject, 'READ
 ')%22)%0A
-//
     
@@ -3210,48 +3210,62 @@
 ing(
-value = %22GET_ALL_INVITES_FOR_A_USER
+%0A            value = %22READ_ASSESSMENT_PANEL_INVITES
 %22,%0A
-//
     
@@ -3291,95 +3291,92 @@
  = %22
-The competition admin use
+An Assesso
 r 
+c
 an
-d finance users can view all invites for a particular user
+ view assessor panel invites provided that the invites belong to them
 %22)%0A 

Fix permissions