package com.bls.dao;

import javax.validation.ValidationException;

import com.bls.core.poi.Poi;
import com.bls.core.user.User;
import com.google.common.base.Optional;

public interface PoiDao<P extends Poi> extends CommonDao<P> {

    default P createWithOwner(final P entity, final User user) {
        entity.setOwner(user);
        return create(entity);
    }

    default P findByIdSafe(final User user, final String id) {
        final Optional<P> entity = findById(id);

        if (!entity.isPresent()) {
            throw new ValidationException(String.format("Poi with id: %s not found", id));
        }

        final boolean userIsPoiOwner = entity.get().getOwner().getId().equals(user.getId());
        if (!userIsPoiOwner) {
            throw new ValidationException(String.format("Poi with id: %s not found", id));
        }
        return entity.get();
    }

    default P updateSafe(final User user, final String id, final P entity) {
        entity.setId(findByIdSafe(user, id).getId());
        entity.setOwner(user);
        return update(entity);
    }
}

@@ -503,24 +503,72 @@
 resent()) %7B%0A
+            // TODO security: hide core problem%0A
             
@@ -629,32 +629,49 @@
 id: %25s not found
+ - missing entity
 %22, id));%0A       
@@ -692,26 +692,14 @@
 nal 
-boolean userIsPoiO
+User o
 wner
@@ -724,16 +724,268 @@
 tOwner()
+;%0A        if (owner == null) %7B%0A            // TODO security: hide core problem%0A            throw new ValidationException(String.format(%22Poi with id: %25s not found - missing owner for entity%22, id));%0A        %7D%0A%0A        final boolean userIsPoiOwner = owner
 .getId()
@@ -1034,24 +1034,72 @@
 PoiOwner) %7B%0A
+            // TODO security: hide core problem%0A
             
@@ -1168,16 +1168,39 @@
 ot found
+ - user is not an owner
 %22, id));

Fix for NPE when entity hasn't got an owner