#50: BankAccountDao.kt

plugins/org.projectforge.plugins.banking/src/main/kotlin/org/projectforge/plugins/banking/BankAccountDao.kt

Path: ./plugins/.../BankAccountDao.kt · Type: Kotlin DAO · Lines: 77 · Source: GitHub

77 lines · 41 code · 31 comments · 5 blank

What it does

DAO for bank accounts — the parent entity of BankAccountBalanceDO (#46). Same pattern as BankAccountBalanceDao (#45): extends BaseDao, overrides hasAccess() and newInstance(). Called by BankAccountBalanceDao.hasAccess() line 68 as the authorization delegate.

Authorization logic (lines 43-72)

50 if (!accessChecker.isUserMemberOfGroup(user, FINANCE_GROUP))
51   return false                              ← gate: finance group required
53 if (accessChecker.isUserMemberOfAdminGroup(user))
54   return true                               ← bypass: admins always have access
57 if (!accessChecker.isUserMemberOfGroup(user, FINANCE_GROUP))
58   return false                              ← redundant: same check as line 50
61 if (obj == null && oldObj == null)
62   return true                               ← null objects = general read access
65 return BaseUserGroupRightUtils.hasAccess(...)  ← check object-level rights

Lines 50 and 57 are redundant: Both check FINANCE_GROUP membership. Line 57 is unreachable if line 50 passes (line 51 already returned false for non-members). This appears to be defensive copy-paste from calling accessChecker.isUserMemberOfGroup(user, ...) (line 50) vs accessChecker.isLoggedInUserMemberOfGroup(...) (as used in #45 line 58).

Access flow

Is user in FINANCE_GROUP?
├─ NO  → denied
└─ YES → Is user an admin?
    ├─ YES → granted (admin override)
    └─ NO  → Is object null (new record or general query)?
        ├─ YES → granted (read access for all finance members)
        └─ NO  → Check object-level rights via BaseUserGroupRightUtils
            ├─ has rights → granted
            └─ no rights → denied

Key takeaways

77 lines, redundant checks: Lines 50 and 57 duplicate the same FINANCE_GROUP gate — likely from evolving the method over time.
Admin bypass: Unlike BankAccountBalanceDao, this DAO explicitly grants admins unconditional access (line 53-54).
Object-level rights: BaseUserGroupRightUtils.hasAccess() checks per-object permission assignments — beyond simple group membership.
Null object = read access: Finance staff can list all bank accounts even without explicit object rights.