Metadata template field security

src/main/java/ca/corefacility/bioinformatics/irida/ria/web/linelist/LineListController.java

@@ -78,7 +78,7 @@ public List<UISampleMetadata> getProjectSamplesMetadataEntries(@RequestParam lon
 		List<Long> lockedSamplesInProject = sampleService.getLockedSamplesInProject(project);
 
 		List<MetadataTemplateField> metadataTemplateFields = metadataTemplateService.getPermittedFieldsForCurrentUser(
-				project);
+				project, true);
 
 		Map<Long, Set<MetadataEntry>> metadataForProject;
 
@@ -238,11 +238,13 @@ private List<AgGridColumn> formatTemplateForUI(MetadataTemplate template, List<A
 		4. Create an AgGridColumn for the field and add it to the template.
 		 */
 		for (MetadataTemplateField field : template.getFields()) {
-			int index = allFieldsLabels.indexOf(field.getFieldKey());
-			allFieldsAgGridColumns.remove(index);
-			allFieldsLabels.remove(index);
-			// Need to add parameter for if they have permissions to edit.
-			templateAgGridColumns.add(mapFieldToColumn(field, canEdit));
+			if(allFieldsLabels.contains(field.getFieldKey())) {
+				int index = allFieldsLabels.indexOf(field.getFieldKey());
+				allFieldsAgGridColumns.remove(index);
+				allFieldsLabels.remove(index);
+				// Need to add parameter for if they have permissions to edit.
+				templateAgGridColumns.add(mapFieldToColumn(field, canEdit));
+			}
 		}
 
 		// Add the "icon" to the template columns
@@ -325,14 +327,11 @@ public List<AgGridColumn> getProjectMetadataTemplateFields(@RequestParam long pr
 		Project project = projectService.read(projectId);
 
 		List<MetadataTemplateField> permittedFieldsForCurrentUser = metadataTemplateService.getPermittedFieldsForCurrentUser(
-				project);
+				project, true);
 
 		Set<MetadataTemplateField> fieldSet = permittedFieldsForCurrentUser.stream()
 				.collect(Collectors.toSet());
 
-		// Need to get all the fields from the templates too!
-		List<ProjectMetadataTemplateJoin> templateJoins = metadataTemplateService.getMetadataTemplatesForProject(
-				project);
 
 		/*
 		IGNORED TEMPLATE FIELDS:
@@ -343,20 +342,6 @@ public List<AgGridColumn> getProjectMetadataTemplateFields(@RequestParam long pr
 		 */
 		List<StaticMetadataTemplateField> staticMetadataFields = metadataTemplateService.getStaticMetadataFields();
 
-		//TODO: fields in templates here will be added to the fields list even if a user isn't permitted to read them.  Needs refactored
-		/*
-		Get all unique fields from the templates.
-		 */
-		for (ProjectMetadataTemplateJoin join : templateJoins) {
-			MetadataTemplate template = join.getObject();
-			List<MetadataTemplateField> templateFields = template.getFields();
-			for (MetadataTemplateField field : templateFields) {
-				if (!staticMetadataFields.contains(field)) {
-					fieldSet.add(field);
-				}
-			}
-		}
-
 		List<AgGridColumn> fields = fieldSet.stream()
 				.map(f -> new UIMetadataField(f, false, true))
 				.sorted((f1, f2) -> f1.getHeaderName()

src/main/java/ca/corefacility/bioinformatics/irida/ria/web/services/UIMetadataService.java

@@ -118,7 +118,7 @@ public String deleteMetadataTemplate(Long templateId, Long projectId, Locale loc
 	 */
 	public List<ProjectMetadataField> getMetadataFieldsForProject(Long projectId) {
 		Project project = projectService.read(projectId);
-		List<MetadataTemplateField> fields = templateService.getPermittedFieldsForCurrentUser(project);
+		List<MetadataTemplateField> fields = templateService.getPermittedFieldsForCurrentUser(project, true);
 		return addRestrictionsToMetadataFields(project, fields);
 	}
 

src/main/java/ca/corefacility/bioinformatics/irida/service/impl/sample/MetadataTemplateServiceImpl.java

@@ -239,10 +239,25 @@ public MetadataRestriction setMetadataRestriction(Project project, MetadataTempl
 	 */
 	@PreAuthorize("hasPermission(#project, 'isProjectOwner')")
 	@Override
-	public List<MetadataTemplateField> getPermittedFieldsForRole(Project project, ProjectRole role) {
+	public List<MetadataTemplateField> getPermittedFieldsForRole(Project project, ProjectRole role,
+			boolean includeTemplateFields) {
 		//get all fields for the project
 		List<MetadataTemplateField> metadataFieldsForProject = fieldRepository.getMetadataFieldsForProject(project);
 
+		if (includeTemplateFields) {
+			//add all the metadata template fields to the list of fields to restrict
+			List<ProjectMetadataTemplateJoin> templatesForProject = getMetadataTemplatesForProject(project);
+			for (ProjectMetadataTemplateJoin join : templatesForProject) {
+				MetadataTemplate template = join.getObject();
+				List<MetadataTemplateField> templateFields = template.getFields();
+				for (MetadataTemplateField field : templateFields) {
+					if (!metadataFieldsForProject.contains(field)) {
+						metadataFieldsForProject.add(field);
+					}
+				}
+			}
+		}
+
 		//get all restrictions for the project
 		List<MetadataRestriction> restrictionForProject = metadataRestrictionRepository.getRestrictionForProject(
 				project);
@@ -282,7 +297,8 @@ public List<MetadataTemplateField> getPermittedFieldsForRole(Project project, Pr
 	 */
 	@PreAuthorize("hasPermission(#project, 'canReadProject')")
 	@Override
-	public List<MetadataTemplateField> getPermittedFieldsForCurrentUser(Project project) {
+	public List<MetadataTemplateField> getPermittedFieldsForCurrentUser(Project project,
+			boolean includeTemplateFields) {
 		final UserDetails loggedInDetails = (UserDetails) SecurityContextHolder.getContext()
 				.getAuthentication()
 				.getPrincipal();
@@ -300,7 +316,8 @@ public List<MetadataTemplateField> getPermittedFieldsForCurrentUser(Project proj
 			projectRole = projectJoinForUser.getProjectRole();
 		}
 
-		List<MetadataTemplateField> permittedFieldsForRole = getPermittedFieldsForRole(project, projectRole);
+		List<MetadataTemplateField> permittedFieldsForRole = getPermittedFieldsForRole(project, projectRole,
+				includeTemplateFields);
 
 		return permittedFieldsForRole;
 	}

src/main/java/ca/corefacility/bioinformatics/irida/service/sample/MetadataTemplateService.java

@@ -146,17 +146,20 @@ public interface MetadataTemplateService extends CRUDService<Long, MetadataTempl
 	/**
 	 * Get all {@link MetadataTemplateField} that are permitted to be read by a given {@link ProjectRole}
 	 *
-	 * @param project the {@link Project} to get fields for
-	 * @param role    the {@link ProjectRole} to request
+	 * @param project               the {@link Project} to get fields for
+	 * @param role                  the {@link ProjectRole} to request
+	 * @param includeTemplateFields whether to include metadata template fields in the allowed fields
 	 * @return the {@link MetadataTemplateField} the given role can read
 	 */
-	public List<MetadataTemplateField> getPermittedFieldsForRole(Project project, ProjectRole role);
+	public List<MetadataTemplateField> getPermittedFieldsForRole(Project project, ProjectRole role,
+			boolean includeTemplateFields);
 
 	/**
 	 * Get all {@link MetadataTemplateField} that the currently logged in user is allowed to read
 	 *
-	 * @param project the {@link Project} to request fields from
+	 * @param project               the {@link Project} to request fields from
+	 * @param includeTemplateFields whether to include metadata template fields in the allowed fields
 	 * @return a list of {@link MetadataTemplateField} collecting the allowed {@link MetadataTemplateField}
 	 */
-	public List<MetadataTemplateField> getPermittedFieldsForCurrentUser(Project project);
+	public List<MetadataTemplateField> getPermittedFieldsForCurrentUser(Project project, boolean includeTemplateFields);
 }

src/main/java/ca/corefacility/bioinformatics/irida/web/controller/api/samples/RESTSampleMetadataController.java

@@ -94,7 +94,7 @@ public ModelMap getProjectSampleMetadata(final @PathVariable Long projectId) {
 		Project project = projectService.read(projectId);
 
 		List<MetadataTemplateField> metadataTemplateFields = metadataTemplateService.getPermittedFieldsForCurrentUser(
-				project);
+				project, true);
 
 		List<Sample> samples = sampleService.getSamplesForProjectShallow(project);
 		ProjectMetadataResponse metadataResponse = sampleService.getMetadataForProject(project,

src/test/java/ca/corefacility/bioinformatics/irida/ria/unit/web/LineListControllerTest.java

@@ -54,7 +54,7 @@ public void testGetProjectMetadataTemplateFields() {
 		long projectId = 1L;
 		lineListController.getProjectMetadataTemplateFields(projectId, Locale.ENGLISH);
 		verify(projectService, times(1)).read(projectId);
-		verify(metadataTemplateService, times(1)).getPermittedFieldsForCurrentUser(any(Project.class));
+		verify(metadataTemplateService, times(1)).getPermittedFieldsForCurrentUser(any(Project.class), true);
 	}
 
 	@Test
@@ -77,7 +77,7 @@ public void testGetAllProjectMetadataEntries() {
 		when(projectService.read(projectId)).thenReturn(project);
 		when(sampleService.getMetadataForProject(project, fieldList)).thenReturn(new ProjectMetadataResponse(project,metadata));
 		when(sampleService.getSamplesForProjectShallow(project)).thenReturn(Lists.newArrayList(s1, s2));
-		when(metadataTemplateService.getPermittedFieldsForCurrentUser(project)).thenReturn(fieldList);
+		when(metadataTemplateService.getPermittedFieldsForCurrentUser(project, true)).thenReturn(fieldList);
 		List<UISampleMetadata> projectSamplesMetadataEntries = lineListController.getProjectSamplesMetadataEntries(
 				projectId);
 

src/test/java/ca/corefacility/bioinformatics/irida/service/impl/integration/sample/SampleServiceImplIT.java

@@ -484,7 +484,7 @@ public void testGetPartialMetadataAsUser() {
 		Project project = projectService.read(1L);
 
 		List<MetadataTemplateField> permittedFieldsForCurrentUser = metadataTemplateService.getPermittedFieldsForCurrentUser(
-				project);
+				project, true);
 
 		ProjectMetadataResponse metadataForProject = sampleService.getMetadataForProject(project,
 				permittedFieldsForCurrentUser);

src/test/java/ca/corefacility/bioinformatics/irida/web/controller/test/unit/samples/RESTSampleMetadataControllerTest.java

@@ -61,7 +61,7 @@ public void testReadProjectSampleMetadata() {
 
 		when(projectService.read(p1.getId())).thenReturn(p1);
 		when(sampleService.getSamplesForProjectShallow(p1)).thenReturn(Lists.newArrayList(s1, s2));
-		when(metadataTemplateService.getPermittedFieldsForCurrentUser(p1)).thenReturn(fieldList);
+		when(metadataTemplateService.getPermittedFieldsForCurrentUser(p1, true)).thenReturn(fieldList);
 		when(sampleService.getMetadataForProject(p1, fieldList)).thenReturn(new ProjectMetadataResponse(p1,metadata));
 
 		ModelMap modelMap = metadataController.getProjectSampleMetadata(p1.getId());