Skip to content

🐛: FIX: #13830: National user cannot assign case or event #13995

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SORMAS-JanBoehme merged 3 commits into from
Jun 19, 2026
Merged

🐛: FIX: #13830: National user cannot assign case or event #13995

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
226f7d0
🐛: FIX: #13830: National user cannot assign case even though it's ena…
Pa-Touche Jun 19, 2026
30ca14d
invalid logic
Pa-Touche Jun 19, 2026
7e09339
✅ added test
Pa-Touche Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 36 additions & 29 deletions sormas-backend/src/main/java/de/symeda/sormas/backend/user/UserService.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,31 +15,15 @@
package de.symeda.sormas.backend.user;

import java.text.MessageFormat;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Random;
import java.util.Set;
import java.util.*;
import java.util.stream.Collectors;

import javax.ejb.EJB;
import javax.ejb.LocalBean;
import javax.ejb.Stateless;
import javax.inject.Inject;
import javax.persistence.TypedQuery;
import javax.persistence.criteria.CriteriaBuilder;
import javax.persistence.criteria.CriteriaQuery;
import javax.persistence.criteria.Expression;
import javax.persistence.criteria.From;
import javax.persistence.criteria.Join;
import javax.persistence.criteria.JoinType;
import javax.persistence.criteria.ParameterExpression;
import javax.persistence.criteria.Predicate;
import javax.persistence.criteria.Root;
import javax.persistence.criteria.Subquery;
import javax.persistence.criteria.*;
import javax.transaction.Transactional;

import org.apache.commons.collections4.CollectionUtils;
Expand All @@ -48,13 +32,7 @@
import de.symeda.sormas.api.infrastructure.InfrastructureHelper;
import de.symeda.sormas.api.infrastructure.facility.FacilityType;
import de.symeda.sormas.api.infrastructure.region.RegionReferenceDto;
import de.symeda.sormas.api.user.JurisdictionLevel;
import de.symeda.sormas.api.user.NotificationProtocol;
import de.symeda.sormas.api.user.NotificationType;
import de.symeda.sormas.api.user.UserCriteria;
import de.symeda.sormas.api.user.UserRight;
import de.symeda.sormas.api.user.UserRoleDto;
import de.symeda.sormas.api.user.UserRoleReferenceDto;
import de.symeda.sormas.api.user.*;
import de.symeda.sormas.api.utils.DataHelper;
import de.symeda.sormas.api.utils.DefaultEntityHelper;
import de.symeda.sormas.api.utils.PasswordHelper;
Expand Down Expand Up @@ -254,11 +232,21 @@ public List<UserReference> getUserReferences(
boolean userEntityJoinUsed = false;

if (CollectionUtils.isNotEmpty(regionUuids)) {
logger.debug("regionUuids: [{}]", regionUuids);
Join<User, Region> regionJoin = userRoot.join(User.REGION, JoinType.LEFT);
filter = CriteriaBuilderHelper.and(cb, filter, cb.in(regionJoin.get(AbstractDomainObject.UUID)).value(regionUuids));

filter = CriteriaBuilderHelper.and(
cb,
filter,
CriteriaBuilderHelper.or(
cb,
cb.in(regionJoin.get(AbstractDomainObject.UUID)).value(regionUuids),
createUserHasNationJurisdictionFilter(cb, userRoot)));
userEntityJoinUsed = true;
}
if (CollectionUtils.isNotEmpty(districtUuids)) {
logger.debug("districtUuids: [{}]", districtUuids);

Join<User, District> districtJoin = userRoot.join(User.DISTRICT, JoinType.LEFT);
Join<User, Region> userRegionJoin = userRoot.join(User.REGION, JoinType.LEFT);
Join<Region, District> districtRegionJoin = userRegionJoin.join(Region.DISTRICTS, JoinType.LEFT);
Expand All @@ -269,11 +257,17 @@ public List<UserReference> getUserReferences(
cb.in(districtRegionJoin.get(AbstractDomainObject.UUID)).value(districtUuids),
cb.equal(root.get(UserReference.JURISDICTION_LEVEL), JurisdictionLevel.REGION)));

filter = CriteriaBuilderHelper.and(cb, filter, districtFilter);
filter = CriteriaBuilderHelper
.and(cb, filter, CriteriaBuilderHelper.or(cb, districtFilter, createUserHasNationJurisdictionFilter(cb, userRoot)));
userEntityJoinUsed = true;
}
if (!hasRight(UserRight.SEE_PERSONAL_DATA_OUTSIDE_JURISDICTION)) {
filter = CriteriaBuilderHelper.and(cb, filter, createCurrentUserJurisdictionFilter(cb, userRoot));
logger.debug("Not looking for user right [SEE_PERSONAL_DATA_OUTSIDE_JURISDICTION]");

filter = CriteriaBuilderHelper.and(
cb,
filter,
CriteriaBuilderHelper.or(cb, createCurrentUserJurisdictionFilter(cb, userRoot), createUserHasNationJurisdictionFilter(cb, userRoot)));
userEntityJoinUsed = true;
}

Expand All @@ -298,12 +292,20 @@ public List<UserReference> getUserReferences(

//exlude users with limited diseases
if (excludeLimitedDiseaseUsers) {
logger.debug("Search will be limited to diseases of the user");
filter = CriteriaBuilderHelper.and(cb, filter, cb.isNull(userRoot.get(User.LIMITED_DISEASES)));
}

if (CollectionUtils.isNotEmpty(communityUuids)) {
logger.debug("communityUuids: [{}]", communityUuids);
Join<User, Community> communityJoin = userRoot.join(User.COMMUNITY, JoinType.LEFT);
filter = CriteriaBuilderHelper.and(cb, filter, cb.in(communityJoin.get(AbstractDomainObject.UUID)).value(communityUuids));
filter = CriteriaBuilderHelper.and(
cb,
filter,
CriteriaBuilderHelper.or(
cb,
cb.in(communityJoin.get(AbstractDomainObject.UUID)).value(communityUuids),
createUserHasNationJurisdictionFilter(cb, userRoot)));
}

if (filter != null) {
Expand Down Expand Up @@ -725,9 +727,14 @@ public Predicate createCurrentUserJurisdictionFilter(CriteriaBuilder cb, From<?,
}
}

public Predicate createUserHasNationJurisdictionFilter(CriteriaBuilder cb, From<?, User> from) {
return cb.equal(from.get(User.JURISDICTION_LEVEL), JurisdictionLevel.NATION);
}

public Predicate buildUserRightsFilter(Root<User> from, Collection<UserRight> userRights) {

if (userRights != null && !userRights.isEmpty()) {
logger.debug("Requested user rights: [{}]", userRights);
Join<User, UserRole> rolesJoin = from.join(User.USER_ROLES, JoinType.LEFT);
Join<UserRole, UserRight> rightsJoin = rolesJoin.join(UserRole.USER_RIGHTS, JoinType.LEFT);
return rightsJoin.in(Collections.singletonList(userRights));
Expand Down
99 changes: 64 additions & 35 deletions sormas-backend/src/test/java/de/symeda/sormas/backend/user/UserFacadeEjbTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,46 +1,21 @@
package de.symeda.sormas.backend.user;

import static de.symeda.sormas.api.user.DefaultUserRole.ADMIN_SUPERVISOR;
import static de.symeda.sormas.api.user.DefaultUserRole.CASE_OFFICER;
import static de.symeda.sormas.api.user.DefaultUserRole.CONTACT_OFFICER;
import static de.symeda.sormas.api.user.DefaultUserRole.CONTACT_SUPERVISOR;
import static de.symeda.sormas.api.user.DefaultUserRole.DISTRICT_OBSERVER;
import static de.symeda.sormas.api.user.DefaultUserRole.NATIONAL_USER;
import static de.symeda.sormas.api.user.DefaultUserRole.POE_INFORMANT;
import static de.symeda.sormas.api.user.DefaultUserRole.REST_EXTERNAL_VISITS_USER;
import static de.symeda.sormas.api.user.DefaultUserRole.SURVEILLANCE_OFFICER;
import static de.symeda.sormas.api.user.DefaultUserRole.SURVEILLANCE_SUPERVISOR;
import static de.symeda.sormas.api.user.DefaultUserRole.*;
import static org.hamcrest.CoreMatchers.equalTo;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.contains;
import static org.hamcrest.Matchers.containsInAnyOrder;
import static org.hamcrest.Matchers.hasItem;
import static org.hamcrest.Matchers.hasItems;
import static org.hamcrest.Matchers.hasSize;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.nullValue;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
import static org.hamcrest.Matchers.*;
import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.mockStatic;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.Set;
import java.util.UUID;
import java.util.*;
import java.util.stream.Collectors;

import javax.persistence.EntityNotFoundException;
import javax.validation.ValidationException;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.mockito.MockedStatic;
Expand All @@ -50,12 +25,9 @@
import de.symeda.sormas.api.AuthProvider;
import de.symeda.sormas.api.Disease;
import de.symeda.sormas.api.EntityDto;
import de.symeda.sormas.api.ReferenceDto;
import de.symeda.sormas.api.infrastructure.region.RegionReferenceDto;
import de.symeda.sormas.api.user.UserCriteria;
import de.symeda.sormas.api.user.UserDto;
import de.symeda.sormas.api.user.UserFacade;
import de.symeda.sormas.api.user.UserReferenceDto;
import de.symeda.sormas.api.user.UserRight;
import de.symeda.sormas.api.user.*;
import de.symeda.sormas.api.utils.AccessDeniedException;
import de.symeda.sormas.api.utils.SortProperty;
import de.symeda.sormas.backend.AbstractBeanTest;
Expand Down Expand Up @@ -309,6 +281,27 @@ public void testGetUserRefsByDistrictsWithLimitedDiseaseUsers() {

}

@Test
public void testGetUserRefsByRegionForResponsibleSurveillanceOfficer() {
RDCF rdcf = creator.createRDCF();
RDCF rdcfOther = creator.createRDCF("otherRegion", "oderDistrict", "otherCommunity", "otherFacility");

UserDto surveilanceOfficerDefault = creator.createSurveillanceOfficer(rdcf);
UserDto surveilanceSupervisorDefault = creator.createSurveillanceSupervisor(rdcf);
UserDto adminSupervisorDefault = creator.createUser(rdcf, "Admin", "Supervisor", creator.getUserRoleReference(ADMIN_SUPERVISOR));
UserDto adminSupervisorOther = creator.createUser(rdcfOther, "Admin", "Supervisor Other", creator.getUserRoleReference(ADMIN_SUPERVISOR));

List<UserReferenceDto> userReferenceDtos =
getUserFacade().getUsersByRegionAndRights(rdcf.region, Disease.CORONAVIRUS, UserRight.CASE_RESPONSIBLE);
assertNotNull(userReferenceDtos);
assertEquals(3, userReferenceDtos.size());
List<String> userReferenceUUIDs = userReferenceDtos.stream().map(u -> u.getUuid()).collect(Collectors.toList());
assertTrue(userReferenceUUIDs.contains(surveilanceOfficerDefault.getUuid()));
assertTrue(userReferenceUUIDs.contains(surveilanceSupervisorDefault.getUuid()));
assertTrue(userReferenceUUIDs.contains(adminSupervisorDefault.getUuid()));
assertFalse(userReferenceUUIDs.contains(adminSupervisorOther.getUuid()));
}

@Test
public void testGetUserRefsByDistrictsForResponsibleSurveillanceOfficer() {
RDCF rdcf = creator.createRDCF();
Expand All @@ -329,6 +322,42 @@ public void testGetUserRefsByDistrictsForResponsibleSurveillanceOfficer() {
assertFalse(userReferenceUUIDs.contains(adminSupervisorOther.getUuid()));
}

@Test
public void testGetUserRefsByDistrictsForResponsibleSurveillanceOfficer_national_user() {
RDCF rdcf = creator.createRDCF();

UserDto surveilanceOfficerDefault = creator.createSurveillanceOfficer(rdcf);
UserDto surveilanceSupervisorDefault = creator.createSurveillanceSupervisor(rdcf);
UserDto nationalUser = creator.createUser(rdcf, "national", "user", creator.getUserRoleReference(NATIONAL_USER));

List<UserReferenceDto> userReferenceDtos = getUserFacade().getUserRefsByDistricts(Arrays.asList(rdcf.district), Disease.CORONAVIRUS);
List<String> userReferenceUUIDs = userReferenceDtos.stream().map(ReferenceDto::getUuid).collect(Collectors.toList());

Assertions.assertAll(
() -> assertEquals(4, userReferenceDtos.size()),
() -> assertTrue(userReferenceUUIDs.contains(surveilanceOfficerDefault.getUuid())),
() -> assertTrue(userReferenceUUIDs.contains(surveilanceSupervisorDefault.getUuid())),
() -> assertTrue(userReferenceUUIDs.contains(nationalUser.getUuid())));
}

@Test
public void testGetUserRefsByRegionForResponsibleSurveillanceOfficer_national_user() {
RDCF rdcf = creator.createRDCF();

UserDto surveilanceOfficerDefault = creator.createSurveillanceOfficer(rdcf);
UserDto surveilanceSupervisorDefault = creator.createSurveillanceSupervisor(rdcf);
UserDto nationalUser = creator.createUser(rdcf, "national", "user", creator.getUserRoleReference(NATIONAL_USER));

List<UserReferenceDto> userReferenceDtos = getUserFacade().getUsersByRegionAndRights(rdcf.region, Disease.CORONAVIRUS);
List<String> userReferenceUUIDs = userReferenceDtos.stream().map(ReferenceDto::getUuid).collect(Collectors.toList());

Assertions.assertAll(
() -> assertEquals(4, userReferenceDtos.size()),
() -> assertTrue(userReferenceUUIDs.contains(surveilanceOfficerDefault.getUuid())),
() -> assertTrue(userReferenceUUIDs.contains(surveilanceSupervisorDefault.getUuid())),
() -> assertTrue(userReferenceUUIDs.contains(nationalUser.getUuid())));
}

@Test
public void testGetUserRefsByDistrictsWithLimitedDiseaseUsersSingleDistrict() {

Expand Down
Loading