#129: `IHKRight.java`

plugins/org.projectforge.plugins.ihk/src/main/java/org/projectforge/plugins/ihk/IHKRight.java Access control, plugins/org.projectforge.plugins.ihk/src/main/java/org/projectforge/plugins/ihk/IHKRight.java 59 lines · 26 code · 28 comments · 5 blank

Access-right check for the IHK plugin. Extends UserRightAccessCheck<TimesheetDO> to enforce that users can only view and export their own timesheets via the IHK training report.

Architecture

IHKRight is registered in IHKPlugin.initialize() via registerRight(new IHKRight()) and governs all access to timesheet data within the IHK module context.

Constructor

public IHKRight() {
    super(IHKPluginUserRightId.IHK, UserRightCategory.PLUGINS, UserRightValue.TRUE);
}

Binds to the IHKPluginUserRightId.IHK enum value (id "PLUGIN_IHK"), categorized under PLUGINS, with default value TRUE (enabled for all users by default). This means the right appears in the user administration UI under the Plugins category and is initially granted to everyone.

Access Logic

The hasAccess(PFUserDO user, TimesheetDO obj, TimesheetDO oldObj, OperationType operationType) method implements a simple ownership check:

If both obj and oldObj are null, returns true — general insert/select access is granted by default.
Otherwise, compares user.getId() with timesheet.getUserId() using Objects.equals() — only the timesheet's owner can access it through the IHK module.

Design Decisions

Default-enabled right: Using UserRightValue.TRUE means all users have the IHK right by default. Administrators can revoke it per-user or per-group in the access management UI, but the typical trainee doesn't need explicit assignment.
Owner-only access: The check is deliberately simple. A trainee can only export their own timesheets. There's no manager/supervisor override within this class — broader access would be granted via other ProjectForge access mechanisms (e.g., TimesheetDao's own access checks).
Null-safe: Uses oldObj != null ? oldObj : obj to handle update scenarios where the original object might carry the relevant user ID.

Dependencies

Class	Role
`UserRightAccessCheck<T>`	Abstract base providing the right registration framework
`IHKPluginUserRightId.IHK`	Enum constant identifying this right in the system
`TimesheetDO`	Domain object this right protects

Git History

868d6abb7 2025 -> 2026
63081666f Source file headers: 2024-> 2025.
4efcbd0fb Migration stuff in progress...
b6092df09 Copyright 2023 -> 2024
ab45d51fa Copyright 2001-2022 -> 2001-2023.
5f7ef41b8 Copyright 2021 -> 2022
ceb63e8a1 Source code header: (C) 2001-2021.
7c79f1922 Copyright of source header -> 2020.
45cad02e9 IHK-Plugin added (Will replace "Ihk-Export"-Plugin in the long run)