Removed subquery due to issues with MySQL Server 5.6
@@ -50,7 +50,7 @@ import javax.persistence.criteria.CriteriaBuilder;
import javax.persistence.criteria.CriteriaQuery;
import javax.persistence.criteria.Path;
import javax.persistence.criteria.Root;
-import javax.persistence.criteria.Subquery;
+import javax.persistence.criteria.Selection;
/**
* Secures queries by checking whether access to them is allowed by having matching roles for current
@@ -74,17 +74,16 @@ public abstract class FeedAclIndexQueryAugmentor implements QueryAugmentor {
LOG.debug("QueryAugmentor.augment");
return (root, query, criteriaBuilder) -> {
- //and exists (select 1 from JpaFeedOpsAclEntry as x where {root}.id = x.feedId and x.principalName in :#{principal.roleSet})
-
- RoleSetExposingSecurityExpressionRoot userCxt = getUserContext();
- Subquery<Integer> subquery = query.subquery(Integer.class);
- Root<JpaFeedOpsAclEntry> fromAcl = subquery.from(JpaFeedOpsAclEntry.class);
-
- subquery.select(fromAcl.get("feedId"));
+ Root<JpaFeedOpsAclEntry> fromAcl = query.from(JpaFeedOpsAclEntry.class);
+ query.distinct(true);
+ if (query.getSelection() == null) {
+ query.select((Selection) root);
+ }
Path<Object> feedId = getFeedId(entityInformation, root);
javax.persistence.criteria.Predicate rootFeedIdEqualToAclFeedId = criteriaBuilder.equal(feedId, fromAcl.get("feedId"));
+ RoleSetExposingSecurityExpressionRoot userCxt = getUserContext();
javax.persistence.criteria.Predicate aclPrincipalInGroups = fromAcl.get("principalName").in(userCxt.getGroups());
javax.persistence.criteria.Predicate aclPrincipalTypeIsGroup = criteriaBuilder.equal(fromAcl.get("principalType"), PrincipalType.GROUP);
javax.persistence.criteria.Predicate acePrincipalGroupMatch = criteriaBuilder.and(aclPrincipalInGroups, aclPrincipalTypeIsGroup);
@@ -94,15 +93,12 @@ public abstract class FeedAclIndexQueryAugmentor implements QueryAugmentor {
javax.persistence.criteria.Predicate acePrincipalMatch = criteriaBuilder.or(acePrincipalGroupMatch, acePrincipalUserMatch);
javax.persistence.criteria.Predicate feedIdEqualsAndPrincipalMatch = criteriaBuilder.and(rootFeedIdEqualToAclFeedId, acePrincipalMatch);
- subquery.where(feedIdEqualsAndPrincipalMatch);
-
- javax.persistence.criteria.Predicate securingPredicate = criteriaBuilder.exists(subquery);
if (spec != null) {
javax.persistence.criteria.Predicate predicate = spec.toPredicate(root, query, criteriaBuilder);
- return criteriaBuilder.and(predicate, securingPredicate);
+ return criteriaBuilder.and(predicate, feedIdEqualsAndPrincipalMatch);
} else {
- return securingPredicate;
+ return feedIdEqualsAndPrincipalMatch;
}
};
}
@@ -123,7 +119,7 @@ public abstract class FeedAclIndexQueryAugmentor implements QueryAugmentor {
/**
* Generates the Exist expression for the feed to feedacl table
- * @param feedId
+ *
* @return exists expression
*/
private static BooleanExpression generateExistsExpression(QOpsManagerFeedId feedId) {
@@ -131,7 +127,8 @@ public abstract class FeedAclIndexQueryAugmentor implements QueryAugmentor {
RoleSetExposingSecurityExpressionRoot userCxt = getUserContext();
QJpaFeedOpsAclEntry aclEntry = QJpaFeedOpsAclEntry.jpaFeedOpsAclEntry;
- JPQLQuery<JpaFeedOpsAclEntry> subquery = JPAExpressions.selectFrom(aclEntry).where(aclEntry.feed.id.eq(feedId)
+ JPQLQuery<JpaFeedOpsAclEntry> subquery = JPAExpressions.selectFrom(aclEntry)
+ .where(aclEntry.feed.id.eq(feedId)
.and(aclEntry.principalName.in(userCxt.getGroups()).and(aclEntry.principalType.eq(PrincipalType.GROUP))
.or(aclEntry.principalName.eq(userCxt.getName()).and(aclEntry.principalType.eq(PrincipalType.USER))))
);
