/*
 * Copyright 2009 The Kuali Foundation
 *
 * Licensed under the Educational Community License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 * http://www.opensource.org/licenses/ecl2.php
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.kuali.kfs.sys.document.workflow;

import java.util.List;

import org.kuali.kfs.sys.context.SpringContext;
import org.kuali.kfs.sys.document.datadictionary.FinancialSystemTransactionalDocumentEntry;
import org.kuali.rice.kew.api.document.WorkflowDocumentService;
import org.kuali.rice.kew.framework.document.security.DocumentSecurityAttribute;
import org.kuali.rice.kim.api.services.KimApiServiceLocator;
import org.kuali.rice.kns.service.DataDictionaryService;
import org.kuali.rice.kns.service.DocumentHelperService;
import org.kuali.rice.krad.datadictionary.DocumentEntry;
import org.kuali.rice.krad.document.DocumentAuthorizer;

/**
 * This class...
 */
public class SensitiveDataSecurityAttribute implements DocumentSecurityAttribute {

    private DocumentHelperService docHelperService = SpringContext.getBean(DocumentHelperService.class);

    @Override
    public boolean isAuthorizedForDocument(String principalId, org.kuali.rice.kew.api.document.Document document) {
        String docTypeName = document.getDocumentTypeName();
        DocumentEntry docEntry = SpringContext.getBean(DataDictionaryService.class).getDataDictionary().getDocumentEntry(docTypeName);
        if (docEntry instanceof FinancialSystemTransactionalDocumentEntry) {
            if (((FinancialSystemTransactionalDocumentEntry)docEntry).isPotentiallySensitive()) {

                WorkflowDocumentService workflowDocService = SpringContext.getBean(WorkflowDocumentService.class);
                List<String> sensitiveDataCodeArray = workflowDocService.getSearchableAttributeStringValuesByKey(document.getDocumentId(),"sensitive");
                if (sensitiveDataCodeArray != null && sensitiveDataCodeArray.size() > 0) {
                    List<String> sensitiveDataCode = sensitiveDataCodeArray;
                    if ( sensitiveDataCode != null && sensitiveDataCode.contains("Y")) {

                        DocumentAuthorizer docAuthorizer = docHelperService.getDocumentAuthorizer(docTypeName);
                        return docAuthorizer.canOpen(document, KimApiServiceLocator.getPersonService().getPerson(principalId));
                    }
                }
            }
        }
        return true;

    }

}

@@ -875,32 +875,91 @@
 ocumentService;%0A
+import org.kuali.rice.kew.api.exception.WorkflowException;%0A
 import org.kuali
@@ -1310,16 +1310,129 @@
 horizer;
+%0Aimport org.kuali.rice.krad.service.KRADServiceLocator;%0Aimport org.kuali.rice.krad.service.KRADServiceLocatorWeb;
 %0A%0A/**%0A *
@@ -1533,17 +1533,16 @@
 ibute %7B%0A
-%0A
     priv
@@ -1549,91 +1549,114 @@
 ate 
-DocumentHelperService docHelperService = SpringContext.getBean(DocumentHelperServic
+static final org.apache.log4j.Logger LOG = org.apache.log4j.Logger.getLogger(SensitiveDataSecurityAttribut
 e.cl
@@ -1660,16 +1660,21 @@
 .class);
+%0A    
 %0A%0A    @O
@@ -2753,19 +2753,46 @@
 rizer = 
-doc
+SpringContext.getBean(Document
 HelperSe
@@ -2797,16 +2797,23 @@
 Service.
+class).
 getDocum
@@ -2868,111 +2868,497 @@
     
-return docAuthorizer.canOpen(document, KimApiServiceLocator.getPersonService().getPerson(principalId));
+try %7B%0A                            return docAuthorizer.canOpen(KRADServiceLocatorWeb.getDocumentService().getByDocumentHeaderIdSessionless(document.getDocumentId()), KimApiServiceLocator.getPersonService().getPerson(principalId));%0A                        %7D%0A                        catch (WorkflowException ex) %7B%0A                            LOG.error( %22Exception while testing if user can open document: %22 + document, ex);%0A                            return false;%0A                        %7D
 %0A   

Fix for sensitive data workflow attribute.