fix: Validate search scope when scheduled event [DHIS2-17335][2.39] (#…

…19460) * fix: Validate search scope when scheduled event [DHIS2-17335][2.39] * fix: Use PSI to figure out if creatable in search scope [DHIS2-17335][2.39]
dhis2 · Dec 13, 2024 · 089ceef · 089ceef
1 parent db160d4
commit 089ceef
Show file tree

Hide file tree

Showing 3 changed files with 71 additions and 5 deletions.
diff --git a/.../java/org/hisp/dhis/tracker/validation/hooks/PreCheckSecurityOwnershipValidationHook.java b/.../java/org/hisp/dhis/tracker/validation/hooks/PreCheckSecurityOwnershipValidationHook.java
@@ -317,7 +317,14 @@ public void validateEvent(ValidationErrorReporter reporter, TrackerBundle bundle
       if (organisationUnit == null) {
         log.warn("ProgramStageInstance " + event.getEvent() + ORG_UNIT_NO_USER_ASSIGNED);
       } else {
-        checkOrgUnitInCaptureScope(reporter, bundle, event, organisationUnit);
+        checkEventOrgUnitWriteAccess(
+            reporter,
+            event,
+            organisationUnit,
+            strategy.isCreate()
+                ? event.isCreatableInSearchScope()
+                : programStageInstance.isCreatableInSearchScope(),
+            bundle.getUser());
       }
     }
 

diff --git a/...ion/src/test/java/org/hisp/dhis/tracker/validation/EventSecurityImportValidationTest.java b/...ion/src/test/java/org/hisp/dhis/tracker/validation/EventSecurityImportValidationTest.java
@@ -27,8 +27,10 @@
  */
 package org.hisp.dhis.tracker.validation;
 
+import static org.hisp.dhis.tracker.Assertions.assertHasError;
 import static org.hisp.dhis.tracker.Assertions.assertHasOnlyErrors;
 import static org.hisp.dhis.tracker.Assertions.assertNoErrors;
+import static org.hisp.dhis.tracker.report.TrackerErrorCode.E1000;
 import static org.hisp.dhis.tracker.validation.Users.USER_3;
 import static org.hisp.dhis.tracker.validation.Users.USER_4;
 import static org.hisp.dhis.tracker.validation.Users.USER_5;
@@ -37,6 +39,7 @@
 import java.util.Calendar;
 import java.util.Date;
 import java.util.HashSet;
+import java.util.Set;
 import org.hisp.dhis.common.IdentifiableObjectManager;
 import org.hisp.dhis.common.ValueType;
 import org.hisp.dhis.dataelement.DataElement;
@@ -201,16 +204,12 @@ private void setupMetadata() {
     trackedEntityProgramOwnerService.updateTrackedEntityProgramOwner(
         maleA.getUid(), programA.getUid(), organisationUnitA.getUid());
     manager.update(programA);
-    User user = userService.getUser(USER_5);
     OrganisationUnit qfUVllTs6cS = organisationUnitService.getOrganisationUnit("QfUVllTs6cS");
-    user.addOrganisationUnit(qfUVllTs6cS);
-    user.addOrganisationUnit(organisationUnitA);
     User adminUser = userService.getUser(ADMIN_USER_UID);
     adminUser.addOrganisationUnit(organisationUnitA);
     Program p = programService.getProgram("prabcdefghA");
     p.addOrganisationUnit(qfUVllTs6cS);
     programService.updateProgram(p);
-    manager.update(user);
     manager.update(adminUser);
   }
 
@@ -259,4 +258,35 @@ void testNoUncompleteEventAuth() throws IOException {
     trackerImportReport = trackerImportService.importTracker(trackerBundleParams);
     assertHasOnlyErrors(trackerImportReport, TrackerErrorCode.E1083);
   }
+
+  @Test
+  void shouldSucceedWhenCreatingScheduledEventFromInsideSearchOrgUnit() throws IOException {
+    TrackerImportParams trackerBundleParams =
+        fromJson("tracker/validations/events-scheduled-with-registration.json");
+    OrganisationUnit orgUnit = organisationUnitService.getOrganisationUnit("QfUVllTs6cS");
+    User user = userService.getUser(USER_5);
+    user.setTeiSearchOrganisationUnits(Set.of(orgUnit));
+    manager.update(user);
+    injectSecurityContext(user);
+    trackerBundleParams.setUser(user);
+
+    TrackerImportReport importReport = trackerImportService.importTracker(trackerBundleParams);
+
+    assertNoErrors(importReport);
+  }
+
+  @Test
+  void shouldFailWhenCreatingScheduledEventFromOutsideSearchOrgUnit() throws IOException {
+    TrackerImportParams trackerBundleParams =
+        fromJson("tracker/validations/events-scheduled-with-registration.json");
+    TrackerImportParams params = TrackerImportParams.builder().build();
+    params.setImportStrategy(TrackerImportStrategy.CREATE);
+    User user = userService.getUser(USER_5);
+    injectSecurityContext(user);
+    trackerBundleParams.setUser(user);
+
+    TrackerImportReport importReport = trackerImportService.importTracker(trackerBundleParams);
+
+    assertHasError(importReport, E1000);
+  }
 }
diff --git a/...ntegration/src/test/resources/tracker/validations/events-scheduled-with-registration.json b/...ntegration/src/test/resources/tracker/validations/events-scheduled-with-registration.json
@@ -0,0 +1,29 @@
+{
+  "events": [
+    {
+      "event": "ZwwuwNp6gVd",
+      "status": "SCHEDULE",
+      "program": {
+        "idScheme": "UID",
+        "identifier": "E8o1E9tAppy"
+      },
+      "programStage": {
+        "idScheme": "UID",
+        "identifier": "Qmqxq907VNz"
+      },
+      "enrollment": "MNWZ6hnuhSw",
+      "orgUnit": {
+        "idScheme": "UID",
+        "identifier": "QfUVllTs6cS"
+      },
+      "orgUnitName": "TA org_unit lvl2",
+      "scheduledAt": "2019-08-19T13:59:13.688",
+      "storedBy": "admin",
+      "deleted": false,
+      "attributeOptionCombo": {
+        "idScheme": "UID",
+        "identifier": "HllvX50cXC0"
+      }
+    }
+  ]
+}