← Index · ← File index · ← Prev · Next → · 📄 source

#896: `AuftragRight.kt`

projectforge-business/src/main/kotlin/org/projectforge/business/fibu/AuftragRight.kt

Type: Access right class (UserRightAccessCheck<AuftragDO?>)

Package: org.projectforge.business.fibu

Full path: projectforge-business/src/main/kotlin/org/projectforge/business/fibu/AuftragRight.kt

174 lines · 113 code · 54 comments · 7 blank

Defines the access control rules for the order book (Auftragsbuch). Extends UserRightAccessCheck<AuftragDO?> and provides fine-grained, multi-level access control based on user group membership and user role assignment. Manages visibility for contact persons, project managers, project assistants, controlling staff, and finance group members, with special rules for fully invoiced orders and the vollstaendigFakturiert flag protection.

Class Definition

class AuftragRight : UserRightAccessCheck<AuftragDO?>(
    UserRightId.PM_ORDER_BOOK, UserRightCategory.PM,
    *UserRightServiceImpl.FALSE_READONLY_PARTLYREADWRITE_READWRITE
)

Right Values

Available values: FALSE, READONLY, PARTLYREADWRITE, READWRITE.

PARTLYREADWRITE special behavior: Users who are members of FIBU_ORGA_GROUPS and PROJECT_MANAGER/PROJECT_ASSISTANT have only access to their own projects (assigned by project manager groups). Choosing READWRITE grants full access to all orders.

`hasSelectAccess(user): Boolean`

Returns true if the user has READONLY, PARTLYREADWRITE, or READWRITE right on the PM_ORDER_BOOK right ID. This determines if the order book is visible as a module at all.

`hasAccess(user, obj, oldObj, operationType): Boolean`

The core access decision method with layered checks:

Layer 1: Controlling Group

Members of CONTROLLING_GROUP have unconditional SELECT access. Other operation types proceed to the next layer.

Layer 2: Basic Right Check

SELECT: requires READONLY, PARTLYREADWRITE, or READWRITE
INSERT/UPDATE/DELETE: requires PARTLYREADWRITE or READWRITE

Layer 3: `vollstaendigFakturiert` Flag Protection

Only members of FINANCE_GROUP may change the vollstaendigFakturiert flag on order positions:

On INSERT: any position with vollstaendigFakturiert == true triggers AccessException
On UPDATE: comparing each position with its database version (oldObj), any change to vollstaendigFakturiert triggers AccessException
Deleted positions are skipped
Newly added positions (no dbPosition) are checked as in INSERT

Layer 4: Project-Based Access

For users who are NOT in FIBU_ORGA_GROUPS with READONLY/READWRITE right (i.e., project managers, project assistants, or PARTLYREADWRITE users):

Direct assignment: User is the order's contactPerson → access granted
Project membership: User belongs to the project's projektManagerGroup, is the project's headOfBusinessManager, or is the project's salesManager → access granted
Fully invoiced restriction: If the order is fully invoiced (isVollstaendigFakturiert), access is limited to orders whose period-of-performance end date (or quote date as fallback) is within MAX_DAYS_OF_VISIBILITY_4_PROJECT_MANGER (1800 days ≈ 5 years)
Not fully invoiced: Full access is granted
If none of the above conditions match, access is denied

Group Right Initialization (`init` block)

Group	Default / Available Values
FIBU_ORGA_PM_GROUPS	FALSE, READONLY, PARTLYREADWRITE, READWRITE (default for project managers and organization groups)
`PROJECT_MANAGER`	PARTLYREADWRITE (default set)
`PROJECT_ASSISTANT`	FALSE, PARTLYREADWRITE
Controlling users	READONLY (via `setReadOnlyForControlling()`)

Constants

Constant	Value	Description
`MAX_DAYS_OF_VISIBILITY_4_PROJECT_MANGER`	`1800`	Orders older than ~5 years are hidden from project managers when fully invoiced

Git History

868d6abb7 2025 -> 2026
63081666f Source file headers: 2024-> 2025.
61f05ce90 Migration stuff in progress...
87dd5b87c AuftragsCache refactored, migration stuff... (all tests OK)
4efcbd0fb Migration stuff in progress...
06828f490 Migration stuff in progress...
b6092df09 Copyright 2023 -> 2024
ab45d51fa Copyright 2001-2022 -> 2001-2023.
73b0be50b org.apache.commons.collections -> org.apache.commons.collections4
d628fc93f Order book: access for head of business unit and sales manager.
5f7ef41b8 Copyright 2021 -> 2022
9aefe1981 AuftragRight: visibility for project managers improved for outdated orders.
7429a0554 AuftragRight -> Kotlin

#896: AuftragRight.kt