Partner permission checks for add/remove institutes

src/main/java/org/genesys/catalog/service/PartnerService.java

@@ -108,9 +108,23 @@ public interface PartnerService {
 	Page<Partner> listPartners(PartnerFilter partnerFilter, Pageable page);
 
 
+	/**
+	 * Adds the institutes to partner
+	 *
+	 * @param partner the partner
+	 * @param instituteCodes the institute codes
+	 * @return the partner
+	 */
 	Partner addInstitutes(Partner partner, Set<String> instituteCodes);
 
-	Partner removeInstitutes(UUID partnerUUID, Set<String> instituteCodes);
+	/**
+	 * Removes the institutes from partner
+	 *
+	 * @param partner the partner
+	 * @param instituteCodes the institute codes
+	 * @return the partner
+	 */
+	Partner removeInstitutes(Partner partner, Set<String> instituteCodes);
 
 	/**
 	 * Method for copy values of source to target.

src/main/java/org/genesys/catalog/service/impl/PartnerServiceImpl.java

@@ -28,6 +28,7 @@ import org.genesys.catalog.model.Partner;
 import org.genesys.catalog.model.filters.PartnerFilter;
 import org.genesys.catalog.persistence.PartnerRepository;
 import org.genesys.catalog.service.PartnerService;
+import org.genesys2.server.exception.NotFoundElement;
 import org.genesys2.server.model.UserRole;
 import org.genesys2.server.model.impl.FaoInstitute;
 import org.genesys2.server.model.impl.QFaoInstitute;
@@ -179,20 +180,23 @@ public class PartnerServiceImpl implements PartnerService, InitializingBean {
 
 	@Override
 	@Transactional
+	@PreAuthorize("hasRole('ADMINISTRATOR')")
 	public Partner addInstitutes(Partner partner, Set<String> instituteCodes) {
+		final Partner savedPartner = loadPartner(partner.getUuid());
 
 		List<FaoInstitute> institutes = instituteRepository.findAllByCodes(instituteCodes);
-		institutes.forEach((inst) -> inst.setOwner(partner));
+		institutes.forEach((inst) -> inst.setOwner(savedPartner));
 		institutes.forEach((institute -> aclService.createOrUpdatePermissions(institute)));
-		partner.getInstitutes().addAll(institutes);
+		savedPartner.getInstitutes().addAll(institutes);
 
-		return lazyLoad(partnerRepository.save(partner));
+		return lazyLoad(partnerRepository.save(savedPartner));
 	}
 
 	@Override
 	@Transactional
-	public Partner removeInstitutes(UUID partnerUuid, Set<String> instituteCodes) {
-		Partner partner = loadPartner(partnerUuid);
+	@PreAuthorize("hasRole('ADMINISTRATOR')")
+	public Partner removeInstitutes(Partner partner, Set<String> instituteCodes) {
+		partner = loadPartner(partner.getUuid());
 
 		List<FaoInstitute> institutesToRemove = instituteRepository.findAllByCodes(instituteCodes);
 		institutesToRemove.forEach((institute -> institute.setOwner(null)));
@@ -208,7 +212,11 @@ public class PartnerServiceImpl implements PartnerService, InitializingBean {
 	 */
 	@Override
 	public Partner loadPartner(final UUID uuid) {
-		return lazyLoad(partnerRepository.findByUuid(uuid));
+		Partner partner = partnerRepository.findByUuid(uuid);
+		if (partner == null) {
+			throw new NotFoundElement("No partner with uuid=" + uuid);
+		}
+		return lazyLoad(partner);
 	}
 
 	@Override

src/main/java/org/genesys2/server/api/v1/PartnerController.java

@@ -112,6 +112,14 @@ public class PartnerController {
 		return partnerService.updatePartner(source);
 	}
 
+	/**
+	 * Adds the institutes to the Partner with provided uuid. Existing
+	 * {@link FaoInstitute#owner} is force-set to this partner.
+	 *
+	 * @param uuid the uuid
+	 * @param instituteCodes the institute codes
+	 * @return the partner
+	 */
 	@PreAuthorize("hasRole('ADMINISTRATOR')")
 	@PostMapping(value = "/addInstitutes/{UUID}")
 	public Partner addInstitutes(@PathVariable("UUID") UUID uuid, @RequestBody Set<String> instituteCodes) {
@@ -119,10 +127,19 @@ public class PartnerController {
 		return partnerService.addInstitutes(partner, instituteCodes);
 	}
 
+	/**
+	 * Removes the institutes from the Partner with provided uuid. Effectively this
+	 * sets {@link FaoInstitute#owner} to null.
+	 *
+	 * @param uuid the uuid
+	 * @param instituteCodes the institute codes
+	 * @return the partner
+	 */
 	@PreAuthorize("hasRole('ADMINISTRATOR')")
 	@PostMapping(value = "/removeInstitutes/{UUID}")
-	public Partner removeInstitutes(@PathVariable("UUID") UUID uuid,@RequestBody Set<String> instituteCodes) {
-		return partnerService.removeInstitutes(uuid, instituteCodes);
+	public Partner removeInstitutes(@PathVariable("UUID") UUID uuid, @RequestBody Set<String> instituteCodes) {
+		Partner partner = partnerService.loadPartner(uuid);
+		return partnerService.removeInstitutes(partner, instituteCodes);
 	}
 
 	/**