|
diff --git a/stock/src/main/java/de/srsoftware/umbrella/stock/StockModule.java b/stock/src/main/java/de/srsoftware/umbrella/stock/StockModule.java
index bd8d574d..c8b3130e 100644
--- a/stock/src/main/java/de/srsoftware/umbrella/stock/StockModule.java
+++ b/stock/src/main/java/de/srsoftware/umbrella/stock/StockModule.java
@@ -27,6 +27,7 @@ import de.srsoftware.umbrella.core.api.Owner;
import de.srsoftware.umbrella.core.api.StockService;
import de.srsoftware.umbrella.core.constants.Field;
import de.srsoftware.umbrella.core.constants.Path;
+import de.srsoftware.umbrella.core.constants.Text;
import de.srsoftware.umbrella.core.exceptions.UmbrellaException;
import de.srsoftware.umbrella.core.model.*;
import de.srsoftware.umbrella.core.model.Location;
@@ -113,6 +114,7 @@ public class StockModule extends BaseHandler implements StockService {
yield super.doGet(path,ex);
}
}
+ case Path.ITEM -> getItemById(user.get(),path,ex);
case Path.LOCATION -> {
try {
var location = Location.of(Long.parseLong(path.pop()));
@@ -155,6 +157,22 @@ public class StockModule extends BaseHandler implements StockService {
}
}
+ private boolean getItemById(UmbrellaUser user, de.srsoftware.tools.Path path, HttpExchange ex) throws IOException {
+ var head = path.pop();
+ if (head == null) throw missingField(Field.ID);
+ try {
+ var itemId = Long.parseLong(head);
+ var item = stockDb.loadItem(itemId);
+ var owner = item.location().resolve().owner().resolve();
+ boolean allowed = owner instanceof UmbrellaUser u && user.equals(u);
+ allowed = allowed || owner instanceof Company c && companyService().membership(c.id(),user.id());
+ if (!allowed) throw forbidden("You are not allowed to access item {id}",ID,itemId);
+ return sendContent(ex,item);
+ } catch (NumberFormatException e) {
+ throw invalidField(Field.ID, Text.NUMBER);
+ }
+ }
+
@Override
public boolean doPatch(de.srsoftware.tools.Path path, HttpExchange ex) throws IOException {
addCors(ex);
|