Package com.broadleafcommerce.paymenttransaction.service.validation

Class DefaultPaymentAccessValidationService

java.lang.Object

com.broadleafcommerce.paymenttransaction.service.validation.DefaultPaymentAccessValidationService

All Implemented Interfaces:

PaymentAccessValidationService

public class DefaultPaymentAccessValidationService
extends Object
implements PaymentAccessValidationService

Default implementation of PaymentAccessValidationService.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PAYMENT_CREATION_NOT_ALLOWED

Constructor Summary

Constructors

Constructor	Description
DefaultPaymentAccessValidationService(PaymentTTLValidationService paymentTTLValidationService, PaymentManagementService<Payment> paymentManagementService, com.broadleafcommerce.resource.security.utils.service.AuthenticationUtils authenticationUtils)

Method Summary

Modifier and Type	Method	Description
protected boolean	customerMatches(@NonNull Payment payment, @NonNull CustomerRef customer)	Validates if the owning user of the Payment matches the given CustomerRef.
protected com.broadleafcommerce.resource.security.utils.service.AuthenticationUtils	getAuthenticationUtils()
protected PaymentManagementService<Payment>	getPaymentManagementService()
protected PaymentTransactionServiceProperties	getPaymentTransactionServiceProperties()
protected PaymentTTLValidationService	getPaymentTTLValidationService()
protected PaymentValidationProperties	getPaymentValidationProperties()
protected boolean	isCustomerMutabilityBlocked(@NonNull Payment payment)
protected boolean	isCustomerMutabilityBlockedForPaymentFinalization(@NonNull Payment payment)
void	setPaymentTransactionServiceProperties(PaymentTransactionServiceProperties paymentTransactionServiceProperties)
void	setPaymentValidationProperties(PaymentValidationProperties paymentValidationProperties)
boolean	shouldAllowExistingPaymentArchival(@NonNull CreatePaymentRequest createPaymentRequest, CustomerRef customerRef, @NonNull Payment existingPayment, com.broadleafcommerce.data.tracking.core.context.ContextInfo contextInfo)	When CreatePaymentRequest.isShouldArchiveExistingPayments() is set to true, this method can be called to verify whether a found candidate existing payment can be archived.
protected boolean	shouldAllowSupplementaryUpdatesWhileMutabilityBlockedForPaymentFinalization(com.broadleafcommerce.data.tracking.core.context.ContextInfo context)
protected boolean	shouldSkipPaymentTTLValidation(@NonNull Payment payment, @NonNull CustomerRef customerRef, com.broadleafcommerce.data.tracking.core.context.ContextInfo context)
protected boolean	validateAccessForAnonymousOwnedPayment(@NonNull Payment payment, @NonNull CustomerRef customerRef)	Validates access for anonymous owned Payment for the given CustomerRef, which checks against the Payment.getOwningUserEmailAddress() and CustomerRef.getUsername() by default.
void	validateCreatePaymentAllowed(@NonNull CreatePaymentRequest createPaymentRequest, com.broadleafcommerce.data.tracking.core.context.ContextInfo context)	Validates if payment can be created.
void	validateCustomerPaymentRequest(@NonNull Payment payment, @NonNull CustomerRef customerRef, @NonNull UpdatePaymentRequest updatePaymentRequest, String lockToken, com.broadleafcommerce.data.tracking.core.context.ContextInfo context)	Validates access to the payment based on the passed in context.
void	validateCustomerPaymentRequest(@NonNull Payment payment, @NonNull CustomerRef customerRef, String lockToken, com.broadleafcommerce.data.tracking.core.context.ContextInfo context)	Validates access to the payment based on the passed in context
protected void	validatePaymentCustomerRef(@NonNull Payment payment, @NonNull CustomerRef customerRef, String lockToken, com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PAYMENT_CREATION_NOT_ALLOWED

public static final String PAYMENT_CREATION_NOT_ALLOWED

See Also:

• Constant Field Values

Constructor Details

DefaultPaymentAccessValidationService

public DefaultPaymentAccessValidationService(PaymentTTLValidationService paymentTTLValidationService,
 PaymentManagementService<Payment> paymentManagementService,
 com.broadleafcommerce.resource.security.utils.service.AuthenticationUtils authenticationUtils)

Method Details

validateCustomerPaymentRequest

public void validateCustomerPaymentRequest(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customerRef,
 @Nullable
 String lockToken,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

Description copied from interface: PaymentAccessValidationService

Validates access to the payment based on the passed in context

Specified by:

validateCustomerPaymentRequest in interface PaymentAccessValidationService

Parameters:

payment - the Payment requiring access

customerRef - the CustomerRef to validate against

lockToken - the current lock token

context - context information surrounding multitenant state

shouldAllowExistingPaymentArchival

public boolean shouldAllowExistingPaymentArchival(@NonNull
 @NonNull CreatePaymentRequest createPaymentRequest,
 @Nullable
 CustomerRef customerRef,
 @NonNull
 @NonNull Payment existingPayment,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo contextInfo)

Description copied from interface: PaymentAccessValidationService

When CreatePaymentRequest.isShouldArchiveExistingPayments() is set to true, this method can be called to verify whether a found candidate existing payment can be archived. Typically, this should reject based on the same conditions in PaymentAccessValidationService.validateCustomerPaymentRequest(Payment, CustomerRef, String, ContextInfo).

Specified by:

shouldAllowExistingPaymentArchival in interface PaymentAccessValidationService

Parameters:

createPaymentRequest - a CreatePaymentRequest which has requested archival of existing payments via CreatePaymentRequest.isShouldArchiveExistingPayments()

customerRef - the CustomerRef that is attempting to create the payment with archival of existing payments. Will be null if this is a system-initiated operation.

existingPayment - an existing payment that was found and is being considered for archival

contextInfo - context information surrounding multitenant state

Returns:

true if the existing payment can be archived, false otherwise

validateCustomerPaymentRequest

public void validateCustomerPaymentRequest(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customerRef,
 @NonNull
 @NonNull UpdatePaymentRequest updatePaymentRequest,
 @Nullable
 String lockToken,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

Description copied from interface: PaymentAccessValidationService

Validates access to the payment based on the passed in context. In the case of a Payment update request, the details of the UpdatePaymentRequest can be factored into determining if the customer's request should be allowed or blocked

Specified by:

validateCustomerPaymentRequest in interface PaymentAccessValidationService

Parameters:

payment - the Payment requiring access

customerRef - the CustomerRef to validate against

updatePaymentRequest - the request payload related to an update request (only present for update requests)

lockToken - the current lock token

context - context information surrounding multitenant state

validateCreatePaymentAllowed

public void validateCreatePaymentAllowed(@NonNull
 @NonNull CreatePaymentRequest createPaymentRequest,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

Description copied from interface: PaymentAccessValidationService

Validates if payment can be created. When PaymentValidationProperties.getCustomerMutabilityBlockedCreateCheck() contains an entry with Boolean.TRUE for CreatePaymentRequest.getOwnerType() and there is already a payment matching CreatePaymentRequest.getOwnerType() and CreatePaymentRequest.getOwnerId() with Payment.getAccessRestrictions() containing DefaultPaymentManagementAccessRestrictions.CUSTOMER_MUTABILITY_BLOCKED then validation fails.

Specified by:

validateCreatePaymentAllowed in interface PaymentAccessValidationService

Parameters:

createPaymentRequest - a request to create the Payment

context - context information surrounding multitenant state

shouldAllowSupplementaryUpdatesWhileMutabilityBlockedForPaymentFinalization

protected boolean shouldAllowSupplementaryUpdatesWhileMutabilityBlockedForPaymentFinalization(@Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

validatePaymentCustomerRef

protected void validatePaymentCustomerRef(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customerRef,
 @Nullable
 String lockToken,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

shouldSkipPaymentTTLValidation

protected boolean shouldSkipPaymentTTLValidation(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customerRef,
 @Nullable
 com.broadleafcommerce.data.tracking.core.context.ContextInfo context)

isCustomerMutabilityBlocked

protected boolean isCustomerMutabilityBlocked(@NonNull
 @NonNull Payment payment)

isCustomerMutabilityBlockedForPaymentFinalization

protected boolean isCustomerMutabilityBlockedForPaymentFinalization(@NonNull
 @NonNull Payment payment)

customerMatches

protected boolean customerMatches(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customer)

Validates if the owning user of the Payment matches the given CustomerRef.

This is to ensure that the currently authenticated user, the given CustomerRef, has access to the Payment.

Parameters:

payment - the Payment to check the owning user for

customer - the CustomerRef to check against

Returns:

true if the payment's owning user matches the given CustomerRef, otherwise false

validateAccessForAnonymousOwnedPayment

protected boolean validateAccessForAnonymousOwnedPayment(@NonNull
 @NonNull Payment payment,
 @NonNull
 @NonNull CustomerRef customerRef)

Validates access for anonymous owned Payment for the given CustomerRef, which checks against the Payment.getOwningUserEmailAddress() and CustomerRef.getUsername() by default.

Override this method for additional validations or if CustomerRef.getUsername() is not the same as the customer email.

Parameters:

payment - the Payment being accessed

customerRef - the CustomerRef to check against

Returns:

true if access is allowed, otherwise false.

getPaymentTTLValidationService

protected PaymentTTLValidationService getPaymentTTLValidationService()

getPaymentManagementService

protected PaymentManagementService<Payment> getPaymentManagementService()

getAuthenticationUtils

protected com.broadleafcommerce.resource.security.utils.service.AuthenticationUtils getAuthenticationUtils()

getPaymentTransactionServiceProperties

protected PaymentTransactionServiceProperties getPaymentTransactionServiceProperties()

setPaymentTransactionServiceProperties

@Autowired
public void setPaymentTransactionServiceProperties(PaymentTransactionServiceProperties paymentTransactionServiceProperties)

getPaymentValidationProperties

protected PaymentValidationProperties getPaymentValidationProperties()

setPaymentValidationProperties

@Autowired
public void setPaymentValidationProperties(PaymentValidationProperties paymentValidationProperties)