1 files changed, 60 insertions, 48 deletions
diff --git a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java
index ae6d82d..1cd4122 100644
--- a/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java
+++ b/src/main/java/dev/dnpm/oshelper/security/PersonPoolBasedSecurityAspects.java
@@ -21,6 +21,7 @@ package dev.dnpm.oshelper.security;
 
 import de.itc.onkostar.api.Patient;
 import de.itc.onkostar.api.Procedure;
+import java.util.Arrays;
 import org.aspectj.lang.JoinPoint;
 import org.aspectj.lang.annotation.AfterReturning;
 import org.aspectj.lang.annotation.Aspect;
@@ -30,64 +31,75 @@ import org.slf4j.LoggerFactory;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.stereotype.Component;
 
-import java.util.Arrays;
-
 @Component
 @Aspect
 public class PersonPoolBasedSecurityAspects {
 
-    private final Logger logger = LoggerFactory.getLogger(this.getClass());
+  private final Logger logger = LoggerFactory.getLogger(this.getClass());
 
-    private final PersonPoolBasedPermissionEvaluator permissionEvaluator;
+  private final PersonPoolBasedPermissionEvaluator permissionEvaluator;
 
-    public PersonPoolBasedSecurityAspects(PersonPoolBasedPermissionEvaluator permissionEvaluator) {
-        this.permissionEvaluator = permissionEvaluator;
-    }
+  public PersonPoolBasedSecurityAspects(PersonPoolBasedPermissionEvaluator permissionEvaluator) {
+    this.permissionEvaluator = permissionEvaluator;
+  }
 
-    @AfterReturning(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult) ", returning = "patient")
-    public void afterPatient(Patient patient) {
-        if (
-                null != patient
-                        && ! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), patient, PermissionType.READ_WRITE)
-        ) {
-            logger.warn("Rückgabe von Patient blockiert: {}", patient.getId());
-            throw new IllegalSecuredObjectAccessException();
-        }
+  @AfterReturning(
+      value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult) ",
+      returning = "patient")
+  public void afterPatient(Patient patient) {
+    if (null != patient
+        && !permissionEvaluator.hasPermission(
+            SecurityContextHolder.getContext().getAuthentication(),
+            patient,
+            PermissionType.READ_WRITE)) {
+      logger.warn("Rückgabe von Patient blockiert: {}", patient.getId());
+      throw new IllegalSecuredObjectAccessException();
     }
+  }
 
-    @AfterReturning(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult)", returning = "procedure")
-    public void afterProcedure(Procedure procedure) {
-        if (
-                null != procedure
-                        && ! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE)
-        ) {
-            logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId());
-            throw new IllegalSecuredObjectAccessException();
-        }
+  @AfterReturning(
+      value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecuredResult)",
+      returning = "procedure")
+  public void afterProcedure(Procedure procedure) {
+    if (null != procedure
+        && !permissionEvaluator.hasPermission(
+            SecurityContextHolder.getContext().getAuthentication(),
+            procedure,
+            PermissionType.READ_WRITE)) {
+      logger.warn("Rückgabe von Prozedur blockiert: {}", procedure.getId());
+      throw new IllegalSecuredObjectAccessException();
     }
+  }
 
-    @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)")
-    public void beforePatient(JoinPoint jp) {
-        Arrays.stream(jp.getArgs())
-                .filter(arg -> arg instanceof Patient)
-                .forEach(patient -> {
-                    if (! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), patient, PermissionType.READ_WRITE)) {
-                        logger.warn("Zugriff auf Patient blockiert: {}", ((Patient)patient).getId());
-                        throw new IllegalSecuredObjectAccessException();
-                    }
-                });
-    }
-
-    @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)")
-    public void beforeProcedure(JoinPoint jp) {
-        Arrays.stream(jp.getArgs())
-                .filter(arg -> arg instanceof Procedure)
-                .forEach(procedure -> {
-                    if (! permissionEvaluator.hasPermission(SecurityContextHolder.getContext().getAuthentication(), procedure, PermissionType.READ_WRITE)) {
-                        logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure)procedure).getId());
-                        throw new IllegalSecuredObjectAccessException();
-                    }
-                });
-    }
+  @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)")
+  public void beforePatient(JoinPoint jp) {
+    Arrays.stream(jp.getArgs())
+        .filter(arg -> arg instanceof Patient)
+        .forEach(
+            patient -> {
+              if (!permissionEvaluator.hasPermission(
+                  SecurityContextHolder.getContext().getAuthentication(),
+                  patient,
+                  PermissionType.READ_WRITE)) {
+                logger.warn("Zugriff auf Patient blockiert: {}", ((Patient) patient).getId());
+                throw new IllegalSecuredObjectAccessException();
+              }
+            });
+  }
 
+  @Before(value = "@annotation(dev.dnpm.oshelper.security.PersonPoolSecured)")
+  public void beforeProcedure(JoinPoint jp) {
+    Arrays.stream(jp.getArgs())
+        .filter(arg -> arg instanceof Procedure)
+        .forEach(
+            procedure -> {
+              if (!permissionEvaluator.hasPermission(
+                  SecurityContextHolder.getContext().getAuthentication(),
+                  procedure,
+                  PermissionType.READ_WRITE)) {
+                logger.warn("Zugriff auf Prozedur blockiert: {}", ((Procedure) procedure).getId());
+                throw new IllegalSecuredObjectAccessException();
+              }
+            });
+  }
 }