WebSVN – SmartDukaan – Diff – /trunk/profitmandi-fofo/src/main/java/com/spice/profitmandi/web/controller/CsController.java

         long size = 0;
         Map<Integer, AuthUser> authUserIdAndAuthUserMap = null;
         boolean isAdmin = roleManager.isAdmin(new HashSet<>(loginDetails.getRoleIds()));
         AuthUser currentAuthUser = isAdmin ? authRepository.selectByEmailOrMobile(loginDetails.getEmailId()) : null;
+        // Check if user is CRM category - CRM users see ALL tickets to handle partner communications
+        boolean isCrmUser = isAdmin && currentAuthUser != null && positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
         if (isAdmin) {
             int authUserId = currentAuthUser.getId();
-            if (ticketSearchType == null) {
+            if (isCrmUser) {
+                // CRM users see ALL tickets to respond to partner communications
                 if (ticketStatus.equals(TicketStatus.RESOLVED)) {
-                    tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.empty(), sortOrder, null, searchTerm);
+                    tickets = ticketRepository.selectAllTickets(Optional.empty(), sortOrder, ticketSearchType, searchTerm);
-                    size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.empty(), null, searchTerm);
+                    size = ticketRepository.selectAllTicketsCount(Optional.empty(), ticketSearchType, searchTerm);
                 } else {
-                    tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), sortOrder, null, searchTerm);
+                    tickets = ticketRepository.selectAllTickets(Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), sortOrder, ticketSearchType, searchTerm);
-                    size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), null, searchTerm);
+                    size = ticketRepository.selectAllTicketsCount(Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), ticketSearchType, searchTerm);
+                }
             } else {
+                // Non-CRM admins see only tickets assigned to them
+                if (ticketSearchType == null) {
-                if (ticketStatus.equals(TicketStatus.RESOLVED)) {
+                    if (ticketStatus.equals(TicketStatus.RESOLVED)) {
-                    tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.empty(), sortOrder, ticketSearchType, searchTerm);
+                        tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.empty(), sortOrder, null, searchTerm);
-                    size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.empty(), ticketSearchType, searchTerm);
+                        size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.empty(), null, searchTerm);
+                    } else {
+                        tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), sortOrder, null, searchTerm);
+                        size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), null, searchTerm);
+                    }
                 } else {
+                    if (ticketStatus.equals(TicketStatus.RESOLVED)) {
+                        tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.empty(), sortOrder, ticketSearchType, searchTerm);
+                        size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.empty(), ticketSearchType, searchTerm);
+                    } else {
-                    tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), sortOrder, ticketSearchType, searchTerm);
+                        tickets = ticketRepository.selectAllByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), sortOrder, ticketSearchType, searchTerm);
-                    size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), ticketSearchType, searchTerm);
+                        size = ticketRepository.selectAllCountByAssignee(authUserId, Optional.of(TicketStatus.CLOSED.equals(ticketStatus)), ticketSearchType, searchTerm);
+                    }
+                }
+            }
             // LOGGER.info(size + "size");
             if (tickets.size() > 0) {
                 ticketAssigneds = ticketAssignedRepository.selectByTicketIds(tickets.stream().map(x -> x.getId()).collect(Collectors.toList()));
             authUserIdAndAuthUserMap = new HashMap<>();
+        }
         model.addAttribute("size", size);
         model.addAttribute("roleType", isAdmin);
-        // Check if user is in CRM category (only CRM can send external communications)
+        // isCrmUser already calculated at start of method
-        boolean isCrmUser = isAdmin && currentAuthUser != null && positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
         model.addAttribute("isCrmUser", isCrmUser);
         List<Integer> subCategoryIds = tickets.stream().map(x -> x.getSubCategoryId()).collect(Collectors.toList());
         Map<Integer, TicketSubCategory> subCategoryIdAndSubCategoryMap = csService.getSubCategoryIdAndSubCategoryMap(subCategoryIds);
         if (subCategoryIdAndSubCategoryMap == null) {
+    }
     @GetMapping(value = "/cs/getActivities")
     public String getActivity(HttpServletRequest request, @RequestParam(name = "ticketId", defaultValue = "0") int ticketId, Model model) throws Exception {
+        LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
+        Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Authorization check: verify user has access to this ticket
+        boolean isAdmin = roleManager.isAdmin(loginDetails.getRoleIds());
+        if (!isAdmin) {
+            // Partners can only view their own tickets
+            if (ticket.getFofoId() != loginDetails.getFofoId()) {
+                throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to view this ticket");
+            }
+        } else {
+            // Admins must be assigned to the ticket OR be CRM user OR be in the escalation chain
+            AuthUser currentAuthUser = authRepository.selectByEmailOrMobile(loginDetails.getEmailId());
+            boolean isCrmUser = positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
+            if (!isCrmUser) {
+                // Check if user is assigned or in escalation chain
+                List<TicketAssigned> assignments = ticketAssignedRepository.selectByTicketIds(Arrays.asList(ticketId));
+                boolean isAssigned = assignments.stream().anyMatch(ta -> ta.getAssineeId() == currentAuthUser.getId() || ta.getManagerId() == currentAuthUser.getId());
+                boolean isInEscalationChain = ticket.getL1AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL2AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL3AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL4AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL5AuthUser() == currentAuthUser.getId();
+                if (!isAssigned && !isInEscalationChain) {
+                    throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to view this ticket");
+                }
+            }
+        }
         List<Activity> allactivities = activityRepository.selectAll(ticketId);
         // Batch fetch all documents for attachments (fix N+1 query)
         List<Integer> documentIds = allactivities.stream()
                 .flatMap(a -> a.getActivityAttachment().stream())
                     attachment.setDocumentName(document.getDisplayName());
+                }
+            }
+        }
         List<Activity> activities = null;
-        LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
-        if (roleManager.isAdmin(loginDetails.getRoleIds())) {
+        if (isAdmin) {
             Set<Integer> authUserIds = allactivities.stream().map(x -> x.getCreatedBy()).collect(Collectors.toSet());
             List<AuthUser> users = authRepository.selectByIds(new ArrayList<>(authUserIds));
             Map<Integer, String> authUserNameMap = users.stream().collect(Collectors.toMap(AuthUser::getId, x -> x.getFirstName() + " " + x.getLastName()));
             allactivities.stream().forEach(x -> x.setName(authUserNameMap.get(x.getCreatedBy())));
             activities = allactivities;
                                  Model model) throws Exception {
         LOGGER.info("documentIds" + documentIds);
         LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
         Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Authorization check: verify user has access to add activity to this ticket
+        boolean isAdmin = roleManager.isAdmin(loginDetails.getRoleIds());
+        if (!isAdmin) {
+            // Partners can only add activity to their own tickets
+            if (ticket.getFofoId() != loginDetails.getFofoId()) {
+                throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to add activity to this ticket");
+            }
+        } else {
+            // Admins must be assigned to the ticket OR be CRM user OR be in the escalation chain
+            AuthUser currentAuthUser = authRepository.selectByEmailOrMobile(loginDetails.getEmailId());
+            boolean isCrmUser = positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
+            if (!isCrmUser) {
+                List<TicketAssigned> assignments = ticketAssignedRepository.selectByTicketIds(Arrays.asList(ticketId));
+                boolean isAssigned = assignments.stream().anyMatch(ta -> ta.getAssineeId() == currentAuthUser.getId() || ta.getManagerId() == currentAuthUser.getId());
+                boolean isInEscalationChain = ticket.getL1AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL2AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL3AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL4AuthUser() == currentAuthUser.getId() ||
+                        ticket.getL5AuthUser() == currentAuthUser.getId();
+                if (!isAssigned && !isInEscalationChain) {
+                    throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to add activity to this ticket");
+                }
+            }
+        }
         List<TicketAssigned> ticketAssignedList = ticketAssignedRepository.selectByTicketIds(Arrays.asList(ticketId));
         List<Integer> authUserIds = ticketAssignedList.stream().map(x -> x.getAssineeId()).collect(Collectors.toList());
         authUserIds.add(ticketAssignedList.get(ticketAssignedList.size() - 1).getManagerId());
         Map<Integer, AuthUser> authUsersMap = authRepository.selectByIds(authUserIds).stream().collect(Collectors.toMap(x -> x.getId(), x -> x));
         if (ticket.getCloseTimestamp() == null) {
+        }
+    }
     @PostMapping(value = "/cs/closeTicket")
     public String closeTicket(HttpServletRequest request, @RequestParam(name = "ticketId", defaultValue = "0") int ticketId, @RequestParam(name = "happyCode") String happyCode, Model model) throws Exception {
+        LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
         Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Authorization check: only the ticket owner (partner) can close the ticket
+        boolean isAdmin = roleManager.isAdmin(loginDetails.getRoleIds());
+        if (isAdmin) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Only partners can close tickets using happy code");
+        }
+        // Verify the partner owns this ticket
+        if (ticket.getFofoId() != loginDetails.getFofoId()) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to close this ticket");
+        }
         if (ticket.getHappyCode().equals(happyCode)) {
             ticket.setCloseTimestamp(LocalDateTime.now());
             ticketRepository.persist(ticket);
             model.addAttribute("response1", mvcResponseSender.createResponseString(true));
         } else {
+    }
     @PostMapping(value = "/cs/edit-ticket")
     public String editTicket(HttpServletRequest request, @RequestParam(name = "ticketId", defaultValue = "0") int ticketId, @RequestParam(name = "subCategoryId", defaultValue = "0") int subCategoryId, @RequestParam(name = "categoryId", defaultValue = "0") int categoryId, @RequestParam(name = "authUserId", defaultValue = "0") int authUserId, @RequestParam(name = "escalationType", defaultValue = "L1") EscalationType escalationType, Model model) throws Exception {
         LOGGER.info("Ticket Id {}, CategoryId {}, SubCategory Id {} authUserId {}", ticketId, categoryId, subCategoryId, authUserId);
+        LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
+        // Only admins can edit tickets
+        if (!roleManager.isAdmin(loginDetails.getRoleIds())) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Only admins can edit tickets");
+        }
         Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Verify admin has access to this ticket (assigned, manager, escalation chain, or CRM)
+        AuthUser currentAuthUser = authRepository.selectByEmailOrMobile(loginDetails.getEmailId());
+        boolean isCrmUser = positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
+        if (!isCrmUser) {
+            List<TicketAssigned> assignments = ticketAssignedRepository.selectByTicketIds(Arrays.asList(ticketId));
+            boolean isAssigned = assignments.stream().anyMatch(ta -> ta.getAssineeId() == currentAuthUser.getId() || ta.getManagerId() == currentAuthUser.getId());
+            boolean isInEscalationChain = ticket.getL1AuthUser() == currentAuthUser.getId() ||
+                    ticket.getL2AuthUser() == currentAuthUser.getId() ||
+                    ticket.getL3AuthUser() == currentAuthUser.getId() ||
+                    ticket.getL4AuthUser() == currentAuthUser.getId() ||
+                    ticket.getL5AuthUser() == currentAuthUser.getId();
+            if (!isAssigned && !isInEscalationChain) {
+                throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to edit this ticket");
+            }
+        }
         csService.updateTicket(categoryId, subCategoryId, ticket, authUserId, escalationType);
         model.addAttribute("response1", mvcResponseSender.createResponseString(true));
         return "response";
+    }
     @PostMapping(value = "/cs/edit-partner-ticket")
     public String editPartnerTicket(HttpServletRequest request, @RequestParam(name = "ticketId", defaultValue = "0") int ticketId, @RequestParam(name = "subCategoryId", defaultValue = "0") int subCategoryId, @RequestParam(name = "categoryId", defaultValue = "0") int categoryId, @RequestParam(name = "authUserId", defaultValue = "0") int authUserId, @RequestParam(name = "escalationType", defaultValue = "L1") EscalationType escalationType, Model model) throws Exception {
         LOGGER.info("Ticket Id {}, CategoryId {}, SubCategory Id {} authUserId {}", ticketId, categoryId, subCategoryId, authUserId);
+        LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
+        // Only admins can edit partner tickets
+        if (!roleManager.isAdmin(loginDetails.getRoleIds())) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Only admins can edit partner tickets");
+        }
         Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Verify admin has access (must be in Sales, ABM, or RBM position for the partner)
+        AuthUser currentAuthUser = authRepository.selectByEmailOrMobile(loginDetails.getEmailId());
+        Map<String, Set<Integer>> authUserPartnerMap = csService.getAuthUserPartnerIdMapping();
+        Set<Integer> allowedPartnerIds = authUserPartnerMap.get(currentAuthUser.getEmailId());
+        if (allowedPartnerIds == null || !allowedPartnerIds.contains(ticket.getFofoId())) {
+            // Also allow CRM users
+            boolean isCrmUser = positionRepository.hasCategory(currentAuthUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
+            if (!isCrmUser) {
+                throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to edit this partner's ticket");
+            }
+        }
         csService.updateTicket(categoryId, subCategoryId, ticket, authUserId, escalationType);
         model.addAttribute("response1", mvcResponseSender.createResponseString(true));
         return "response";
+    }
     @PostMapping(value = "/cs/create-last-activity")
     public String createlastActivity(HttpServletRequest request, @RequestParam(name = "ticketId") int ticketId, @RequestParam(name = "lastactivity") ActivityType lastActivity, Model model) throws Exception {
         LoginDetails loginDetails = cookiesProcessor.getCookiesObject(request);
         Ticket ticket = ticketRepository.selectById(ticketId);
+        if (ticket == null) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "Ticket not found");
+        }
+        // Authorization check for partners: can only update their own tickets
+        boolean isAdmin = roleManager.isAdmin(loginDetails.getRoleIds());
+        if (!isAdmin && ticket.getFofoId() != loginDetails.getFofoId()) {
+            throw new ProfitMandiBusinessException("Ticket", ticketId, "You do not have permission to update this ticket");
+        }
         Activity activity = new Activity();
         String subject = String.format(ACTIVITY_SUBJECT, ticket.getId());
+        if (isAdmin) {
+            // Only CRM team members can mark tickets as resolved
-        if (roleManager.isAdmin(loginDetails.getRoleIds())) {
+            AuthUser authUser = authRepository.selectByEmailOrMobile(loginDetails.getEmailId());
+            boolean isCrmUser = positionRepository.hasCategory(authUser.getId(), ProfitMandiConstants.TICKET_CATEGORY_CRM);
+            if (!isCrmUser) {
+                throw new ProfitMandiBusinessException("Ticket", ticketId, "Only CRM team members can mark tickets as resolved");
+            }
             ticket.setLastActivity(lastActivity);
             String to = retailerService.getFofoRetailer(ticket.getFofoId()).getEmail();
             String message = String.format(PARTNER_RESOLVED_TICKET_MAIL, ticketId, "REOPEN");
             activity.setMessage(message);
-            activity.setCreatedBy(authRepository.selectByEmailOrMobile(loginDetails.getEmailId()).getId());
+            activity.setCreatedBy(authUser.getId());
             activity.setTicketId(ticketId);
             activity.setCreateTimestamp(LocalDateTime.now());
             activity.setType(ActivityType.COMMUNICATION_OUT);
             this.activityRelatedMail(to, null, subject, message);
         } else {

Subversion Repositories SmartDukaan

(root)/trunk/profitmandi-fofo/src/main/java/com/spice/profitmandi/web/controller/CsController.java – Rev 35590 → 35592