MK-1208 Status transitions are in accordance with permissions

obiba · Dec 19, 2016 · 88897fb · 88897fb
1 parent 1b095d6
commit 88897fb
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/mica-core/src/main/java/org/obiba/mica/access/service/DataAccessRequestUtilService.java b/mica-core/src/main/java/org/obiba/mica/access/service/DataAccessRequestUtilService.java
@@ -89,9 +89,10 @@ public void checkStatusTransition(DataAccessRequest request, DataAccessRequest.S
    */
   public Iterable<DataAccessRequest.Status> nextStatus(DataAccessRequest request) {
     List<DataAccessRequest.Status> to = Lists.newArrayList();
+    if (!subjectAclService.isPermitted("/data-access-request/" + request.getId(), "EDIT", "_status")) return to;
     switch(request.getStatus()) {
       case OPENED:
-        if (subjectAclService.isCurrentUser(request.getApplicant())) addNextOpenedStatus(to);
+        addNextOpenedStatus(to);
         break;
       case SUBMITTED:
         addNextSubmittedStatus(to);
@@ -100,7 +101,7 @@ public Iterable<DataAccessRequest.Status> nextStatus(DataAccessRequest request)
         addNextReviewedStatus(to);
         break;
       case CONDITIONALLY_APPROVED:
-        if (subjectAclService.isCurrentUser(request.getApplicant())) addNextConditionallyApprovedStatus(to);
+        addNextConditionallyApprovedStatus(to);
         break;
       case APPROVED:
         addNextApprovedStatus(to);