The check for whether a task can be updated has been loosened, means pooled tasks can now be claimed.

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/alfresco/HEAD/root@21582 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

source/java/org/alfresco/repo/web/scripts/workflow/TaskInstancePut.java

@@ -21,6 +21,7 @@ package org.alfresco.repo.web.scripts.workflow;
 import java.io.IOException;
 import java.io.Serializable;
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -28,6 +29,7 @@ import java.util.Map;
 import javax.servlet.http.HttpServletResponse;
 
 import org.alfresco.model.ContentModel;
+import org.alfresco.repo.workflow.WorkflowModel;
 import org.alfresco.service.cmr.dictionary.PropertyDefinition;
 import org.alfresco.service.cmr.repository.NodeRef;
 import org.alfresco.service.cmr.repository.datatype.DefaultTypeConverter;
@@ -64,34 +66,38 @@ public class TaskInstancePut extends AbstractWorkflowWebscript
             WorkflowTask workflowTask = workflowService.getTaskById(taskId);
 
             String currentUser = authenticationService.getCurrentUserName();
-
             Serializable owner = workflowTask.getProperties().get(ContentModel.PROP_OWNER);
-
             Serializable initiator = getWorkflowInitiator(workflowTask);
 
-            if (!(owner != null && currentUser.equals(owner) || initiator != null && currentUser.equals(initiator)))
+            // if the the current user is the owner of the task, the initiator of the workflow
+            // or a member of the assigned pooled actors group, updating the task is allowed
+            if ((owner != null && currentUser.equals(owner)) ||
+                (initiator != null && currentUser.equals(initiator)) ||
+                isUserInPooledActors(workflowTask, currentUser))
             {
-                throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Failed to update workflow task with id: " + taskId);
-            }
-
                 // read request json            
                 json = new JSONObject(new JSONTokener(req.getContent().getContent()));
                 
                 // update task properties
                 workflowTask = workflowService.updateTask(taskId, parseTaskProperties(json), null, null);
                 
-            // task was not founded -> return 404
+                // task was not found -> return 404
                 if (workflowTask == null)
                 {
                     throw new WebScriptException(HttpServletResponse.SC_NOT_FOUND, "Failed to find workflow task with id: " + taskId);
                 }
                 
-            Map<String, Object> model = new HashMap<String, Object>();
                 // build the model for ftl
+                Map<String, Object> model = new HashMap<String, Object>();
                 model.put("workflowTask", modelBuilder.buildDetailed(workflowTask));
                 
                 return model;
             }
+            else
+            {
+                throw new WebScriptException(HttpServletResponse.SC_UNAUTHORIZED, "Failed to update workflow task with id: " + taskId);
+            }
+        }
         catch (IOException iox)
         {
             throw new WebScriptException(Status.STATUS_BAD_REQUEST, "Could not read content from request.", iox);
@@ -171,7 +177,7 @@ public class TaskInstancePut extends AbstractWorkflowWebscript
     {
         Serializable initiatorUserName = null;
         
-        NodeRef initiator = workflowTask.path.instance.initiator;
+        NodeRef initiator = workflowTask.getPath().getInstance().getInitiator();
         
         if (initiator != null)
         {
@@ -180,4 +186,20 @@ public class TaskInstancePut extends AbstractWorkflowWebscript
         
         return initiatorUserName;
     }
+    
+    private boolean isUserInPooledActors(WorkflowTask task, String currentUser)
+    {
+        boolean result = false;
+        
+        Collection<?> actors = (Collection<?>)task.getProperties().get(WorkflowModel.ASSOC_POOLED_ACTORS);
+        if (actors != null && !actors.isEmpty())
+        {
+            // TODO: determine whether the user is in any of the groups, for now allow
+            //       pooled tasks to be updated.
+            
+            result = true;
+        }
+        
+        return result;
+    }
 }

source/java/org/alfresco/repo/web/scripts/workflow/WorkflowRestApiTest.java

@@ -269,10 +269,12 @@ public class WorkflowRestApiTest extends BaseWebScriptTest
         jsonProperties.put(qnameToString(WorkflowModel.PROP_DESCRIPTION), "Edited description");
         jsonProperties.put(qnameToString(WorkflowModel.PROP_PRIORITY), 1);
         
+        // test USER3 can not update the task
         personManager.setUser(USER3);
         Response unauthResponse = sendRequest(new PutRequest(URL_TASKS + "/" + startTask.id, jsonProperties.toString(), "application/json"), 401);
         assertEquals(Status.STATUS_UNAUTHORIZED, unauthResponse.getStatus());
 
+        // test USER1 (the task owner) can update the task
         personManager.setUser(USER1);
         Response putResponse = sendRequest(new PutRequest(URL_TASKS + "/" + startTask.id, jsonProperties.toString(), "application/json"), 200);
         
@@ -285,6 +287,14 @@ public class WorkflowRestApiTest extends BaseWebScriptTest
         JSONObject editedJsonProperties = result.getJSONObject("properties");
         
         compareProperties(jsonProperties, editedJsonProperties);
+        
+        // get the next task where USER2 is the owner
+        workflowService.endTask(startTask.id, null);
+        List<WorkflowPath> paths = workflowService.getWorkflowPaths(adhocPath.getInstance().getId());
+        WorkflowTask nextTask = workflowService.getTasksForWorkflowPath(paths.get(0).getId()).get(0);
+        
+        // make sure USER1 (the workflow initiator) can update
+        putResponse = sendRequest(new PutRequest(URL_TASKS + "/" + nextTask.id, jsonProperties.toString(), "application/json"), 200);
     }
     
     public void testWorkflowDefinitionsGet() throws Exception