<?xml version="1.0" encoding="UTF-8"?>
|
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
|
<mapper namespace="jnpf.dmsMapper.DmsUserFolderPermissionTreeMapper">
|
<resultMap id="TreeRow" type="jnpf.dmsEntity.permission.model.DmsUserFolderPermissionTreeRow">
|
<id column="id" property="id" typeHandler="jnpf.dmsDatabase.DmsUuidTypeHandler"/>
|
<result column="parent_id" property="parentId" typeHandler="jnpf.dmsDatabase.DmsUuidTypeHandler"/>
|
<result column="name" property="name"/>
|
<result column="sort_code" property="sortCode"/>
|
<result column="has_children" property="hasChildren"/>
|
<result column="user_id" property="userId"/>
|
<result column="action_code" property="actionCode"/>
|
</resultMap>
|
|
<!-- Shared by the administrator tree and current-user business queries. -->
|
<sql id="MatchedFolderPermissions">
|
matched_folder_permissions(user_id, folder_id, resource_scope, action_code) AS (
|
SELECT DISTINCT ip.user_id, granted.id, p.resource_scope, p.action_code
|
FROM public.dms_file_permissions p
|
JOIN input_principals ip
|
ON ip.principal_id = p.principal_id
|
AND (
|
(p.principal_type = 'USER' AND ip.principal_kind = 'USER')
|
OR (p.principal_type = 'ORG' AND p.include_child_orgs = FALSE
|
AND ip.principal_kind = 'ORG_DIRECT')
|
OR (p.principal_type = 'ORG' AND p.include_child_orgs = TRUE
|
AND ip.principal_kind = 'ORG_ANCESTOR')
|
OR (p.principal_type = 'POSITION' AND ip.principal_kind = 'POSITION')
|
OR (p.principal_type = 'ROLE' AND ip.principal_kind = 'ROLE')
|
OR (p.principal_type = 'GROUP' AND ip.principal_kind = 'GROUP')
|
)
|
JOIN public.dms_folders granted
|
ON granted.tenant_id = p.tenant_id
|
AND granted.id = p.resource_id
|
AND granted.f_delete_mark IS NULL
|
WHERE p.tenant_id = #{q.tenantId}
|
AND p.resource_type = 'FOLDER'
|
AND p.resource_scope IN ('SELF', 'SUBTREE')
|
AND p.action_code IN ('READ', 'PRINT')
|
AND p.revoked_at IS NULL
|
AND p.valid_from <= CURRENT_TIMESTAMP
|
AND (p.valid_to IS NULL OR CURRENT_TIMESTAMP < p.valid_to)
|
AND (p.max_use_count IS NULL OR p.used_count < p.max_use_count)
|
)
|
</sql>
|
|
<resultMap id="FolderId" type="jnpf.dmsEntity.permission.model.DmsUserFolderPermissionTreeRow">
|
<id column="id" property="id" typeHandler="jnpf.dmsDatabase.DmsUuidTypeHandler"/>
|
</resultMap>
|
|
<!-- Separate personal scope: application grants do not authorize an entire folder. -->
|
<select id="selectWorkflowPrintVersions" resultMap="FolderId">
|
SELECT DISTINCT p.resource_id AS id
|
FROM public.dms_file_permissions p
|
WHERE p.tenant_id = #{tenantId}
|
AND p.principal_type = 'USER' AND p.principal_id = #{userId}
|
AND p.resource_type = 'FILE_VERSION' AND p.resource_scope = 'SELF'
|
AND p.action_code = 'PRINT' AND p.source_type = 'WORKFLOW'
|
AND p.revoked_at IS NULL
|
AND p.valid_from <= CURRENT_TIMESTAMP
|
AND (p.valid_to IS NULL OR CURRENT_TIMESTAMP < p.valid_to)
|
AND (p.max_use_count IS NULL OR p.used_count < p.max_use_count)
|
ORDER BY id
|
</select>
|
|
<select id="selectPrintFolders" resultMap="FolderId">
|
WITH RECURSIVE input_principals(user_id, principal_kind, principal_id) AS (
|
SELECT item ->> 'userId', item ->> 'principalKind', item ->> 'principalId'
|
FROM jsonb_array_elements(CAST(#{q.principalsJson} AS jsonb)) item
|
),
|
<include refid="MatchedFolderPermissions"/>,
|
effective_folders(id, inheritable) AS (
|
SELECT folder_id, resource_scope = 'SUBTREE'
|
FROM matched_folder_permissions WHERE action_code = 'PRINT'
|
UNION
|
SELECT child.id, TRUE
|
FROM effective_folders parent
|
JOIN public.dms_folders child ON child.tenant_id = #{q.tenantId}
|
AND child.parent_id = parent.id AND child.f_delete_mark IS NULL
|
WHERE parent.inheritable
|
)
|
SELECT DISTINCT id FROM effective_folders ORDER BY id
|
</select>
|
|
<select id="selectTree" resultMap="TreeRow">
|
WITH RECURSIVE input_principals(user_id, principal_kind, principal_id) AS (
|
SELECT item ->> 'userId', item ->> 'principalKind', item ->> 'principalId'
|
FROM jsonb_array_elements(CAST(#{q.principalsJson} AS jsonb)) item
|
),
|
parent_ancestors(id, parent_id) AS (
|
<choose>
|
<when test="q.parentId != null">
|
SELECT folder.id, folder.parent_id
|
FROM public.dms_folders folder
|
WHERE folder.tenant_id = #{q.tenantId}
|
AND folder.id = #{q.parentId}
|
AND folder.f_delete_mark IS NULL
|
</when>
|
<otherwise>
|
SELECT NULL::UUID, NULL::UUID WHERE FALSE
|
</otherwise>
|
</choose>
|
UNION
|
SELECT parent.id, parent.parent_id
|
FROM parent_ancestors child
|
JOIN public.dms_folders parent
|
ON parent.tenant_id = #{q.tenantId}
|
AND parent.id = child.parent_id
|
AND parent.f_delete_mark IS NULL
|
),
|
<include refid="MatchedFolderPermissions"/>,
|
navigation_ancestors(id, parent_id) AS (
|
SELECT DISTINCT folder.id, folder.parent_id
|
FROM matched_folder_permissions permission
|
JOIN public.dms_folders folder
|
ON folder.tenant_id = #{q.tenantId}
|
AND folder.id = permission.folder_id
|
AND folder.f_delete_mark IS NULL
|
UNION
|
SELECT parent.id, parent.parent_id
|
FROM navigation_ancestors child
|
JOIN public.dms_folders parent
|
ON parent.tenant_id = #{q.tenantId}
|
AND parent.id = child.parent_id
|
AND parent.f_delete_mark IS NULL
|
),
|
page_folders AS (
|
SELECT folder.id, folder.parent_id, folder.name, folder.sort_code
|
FROM public.dms_folders folder
|
WHERE folder.tenant_id = #{q.tenantId}
|
AND folder.f_delete_mark IS NULL
|
<choose>
|
<when test="q.parentId == null">AND folder.parent_id IS NULL</when>
|
<otherwise>AND folder.parent_id = #{q.parentId}</otherwise>
|
</choose>
|
AND (
|
folder.id IN (SELECT visible.id FROM navigation_ancestors visible)
|
OR EXISTS (
|
SELECT 1
|
FROM matched_folder_permissions inherited
|
WHERE inherited.resource_scope = 'SUBTREE'
|
AND inherited.folder_id IN (SELECT ancestor.id FROM parent_ancestors ancestor)
|
)
|
)
|
<if test="q.cursorSortCode != null">
|
AND (folder.sort_code > #{q.cursorSortCode}
|
OR (folder.sort_code = #{q.cursorSortCode} AND folder.id > #{q.cursorId}))
|
</if>
|
ORDER BY folder.sort_code, folder.id
|
LIMIT #{q.limit}
|
),
|
effective_page_permissions(user_id, folder_id, action_code) AS (
|
SELECT DISTINCT permission.user_id, folder.id, permission.action_code
|
FROM page_folders folder
|
JOIN matched_folder_permissions permission
|
ON permission.folder_id = folder.id
|
OR (
|
permission.resource_scope = 'SUBTREE'
|
AND permission.folder_id IN (
|
SELECT ancestor.id FROM parent_ancestors ancestor
|
)
|
)
|
)
|
SELECT folder.id,
|
folder.parent_id,
|
folder.name,
|
folder.sort_code,
|
EXISTS (
|
SELECT 1
|
FROM public.dms_folders child
|
WHERE child.tenant_id = #{q.tenantId}
|
AND child.parent_id = folder.id
|
AND child.f_delete_mark IS NULL
|
AND (
|
child.id IN (SELECT visible.id FROM navigation_ancestors visible)
|
OR EXISTS (
|
SELECT 1
|
FROM matched_folder_permissions inherited
|
WHERE inherited.resource_scope = 'SUBTREE'
|
AND (
|
inherited.folder_id = folder.id
|
OR inherited.folder_id IN (
|
SELECT ancestor.id FROM parent_ancestors ancestor
|
)
|
)
|
)
|
)
|
) AS has_children,
|
permission.user_id,
|
permission.action_code
|
FROM page_folders folder
|
LEFT JOIN effective_page_permissions permission ON permission.folder_id = folder.id
|
ORDER BY folder.sort_code, folder.id, permission.user_id, permission.action_code
|
</select>
|
</mapper>
|
