added permission check to StockModule.getChildLocations

Signed-off-by: Stephan Richter <s.richter@srsoftware.de>

bus/src/main/java/de/srsoftware/umbrella/messagebus/MessageApi.java

@@ -49,11 +49,11 @@ public class MessageApi extends BaseHandler{
 					if (++counter > 300) counter = sendBeacon(addr,stream);
 				} else {
 					var event = eventQueue.removeFirst();
-					//if (event.isIntendedFor(user.get())) {
+					if (event.isIntendedFor(user.get())) {
 						LOG.log(DEBUG, "sending event to {0}", addr);
 						sendEvent(stream, event);
 						counter = 0;
-					//}
+					}
 				}
 			}
 			LOG.log(INFO,"{0} disconnected from event stream.",addr);

bus/src/main/java/de/srsoftware/umbrella/messagebus/MessageBus.java

@@ -12,7 +12,7 @@ public class MessageBus {
 
 	private MessageBus(){}
 
-	public void dispatch(Event event){
+	public void dispatch(Event<?> event){
 		new Thread(() -> { // TODO: use thread pool
 			try {
 				Thread.sleep(100);

bus/src/main/java/de/srsoftware/umbrella/messagebus/events/ItemEvent.java

@@ -0,0 +1,48 @@
+/* © SRSoftware 2025 */
+package de.srsoftware.umbrella.messagebus.events;
+
+import static de.srsoftware.umbrella.core.constants.Field.*;
+import static de.srsoftware.umbrella.core.model.Translatable.t;
+
+import de.srsoftware.umbrella.core.ModuleRegistry;
+import de.srsoftware.umbrella.core.api.Owner;
+import de.srsoftware.umbrella.core.model.*;
+import java.util.Collection;
+import java.util.List;
+
+public class ItemEvent extends Event<Item>{
+	public ItemEvent(UmbrellaUser initiator, String module, Item item, EventType type) {
+		super(initiator, module, item, type);
+	}
+
+	@Override
+	public Collection<UmbrellaUser> audience() {
+		Owner owner = payload().location().resolve().owner().resolve();
+		if (owner instanceof UmbrellaUser user) return List.of(user);
+		if (owner instanceof Company company) return ModuleRegistry.companyService().getMembers(company.id());
+		return List.of();
+	}
+
+	@Override
+	public Translatable describe() {
+		return switch (eventType()){
+			case CREATE -> describeCreate();
+			case null, default -> null;
+		};
+	}
+
+	private Translatable describeCreate() {
+		var loc  = payload().location().resolve().name();
+		return t("{user} added \"{item}\" to \"{location}\"", USER,initiator().name(), ITEM, payload().name(), LOCATION, loc);
+	}
+
+
+	@Override
+	public Translatable subject() {
+		var loc  = payload().location().resolve().name();
+		return switch (eventType()){
+			case CREATE -> t("A new item has been added to \"{location}\":",LOCATION,loc);
+			case null, default -> null;
+		};
+	}
+}

core/src/main/java/de/srsoftware/umbrella/core/constants/Path.java

@@ -5,8 +5,10 @@ public class Path {
 	private Path(){};
 
 	public static final String ADD              = "add";
-    public static final String AVAILABLE        = "available";
+	public static final String AVAILABLE        = "available";
+
 	public static final String CSS                     = "css";
+	public static final String CLONE                   = "clone";
 	public static final String COMMON_TEMPLATES        = "common_templates";
 	public static final String COMPANY                 = "company";
 	public static final String CONNECTED               = "connected";

documents/src/main/java/de/srsoftware/umbrella/documents/DocumentApi.java

@@ -552,7 +552,7 @@ public class DocumentApi extends BaseHandler implements DocumentService {
 	private boolean postToDocument(HttpExchange ex, de.srsoftware.tools.Path path, UmbrellaUser user, long docId) throws IOException, UmbrellaException {
 		var head = path.pop();
 		return switch (head){
-			case CLONE -> postCloneDoc(docId,ex,user);
+			case Path.CLONE -> postCloneDoc(docId,ex,user);
 			case POSITION -> postDocumentPosition(docId,ex,user);
 			case PATH_SEND -> sendDocument(ex,path,user,docId);
 			case null, default -> super.doPost(path,ex);

frontend/src/App.svelte

@@ -103,7 +103,8 @@
         <Route path="/search"                      component={Search} />
         <Route path="/stock"                       component={Stock} />
         <Route path="/stock/location/:location_id" component={Stock} />
-        <Route path="/stock/:owner/:owner_id/item/:item_id" component={Stock} />
+        <Route path="/stock/:item_id/view"         component={Stock} />
+        <Route path="/stock/:owner/:owner_id/item/:owner_number" component={Stock} />
         <Route path="/tags"                        component={TagList} />
         <Route path="/tags/use/:tag"               component={TagUses} />
         <Route path="/task"                        component={TaskList} />

frontend/src/Components/Menu.svelte

@@ -59,7 +59,7 @@ onMount(fetchModules);
     </form>
     <button class="symbol" onclick={e => expand = !expand}> </button>
     {#each modules as module,i}
-    <a href={module.module} {onclick} class={module.class}>{@html t(module.title)}</a>
+    <a href={module.module.includes('://') ? module.module : '/'+module.module} {onclick} class={module.class}>{@html t(module.title)}</a>
     {/each}
     {#if user.id == 2}
     <a href="https://svelte.dev/tutorial/svelte/state" target="_blank">{t('tutorial')}</a>

frontend/src/routes/stock/Index.svelte

@@ -1,5 +1,6 @@
 <script>
     import { onMount }      from 'svelte';
+    import { useTinyRouter } from 'svelte-tiny-router';
     import { api, drop, get, patch } from '../../urls.svelte';
     import { error, yikes } from '../../warn.svelte';
     import { t }            from '../../translations.svelte';
@@ -17,8 +18,9 @@
     let location        = $state(null);
     let draggedItem     = $state(null)
     let draggedLocation = $state(null)
-    let { item_id, location_id, owner, owner_id } = $props();
+    let { item_id, location_id, owner, owner_id, owner_number } = $props();
     let skip_location = false; // disable effect on setting location within loadItem()
+    let router = useTinyRouter();
 
     $effect(() => {
         // This effect runs whenever `location` changes
@@ -98,8 +100,8 @@
     }
 
     async function loadItem(){
-        if (!item_id) return;
-        const url = api(`stock/${owner}/${owner_id}/item/${item_id}`);
+        if (!owner_number) return;
+        const url = api(`stock/${owner}/${owner_id}/item/${owner_number}`);
         const res = await get(url);
         if (res.ok){
             yikes();
@@ -116,7 +118,7 @@
                 }
             }
             for (let i of json.items){
-                if (i.owner_number == +item_id) item = i;
+                if (i.owner_number == +owner_number) item = i;
             }
         } else {
             error(res);
@@ -170,12 +172,27 @@
     }
 
     async function load(){
+        await preload();
         await loadUserLocations();
         await loadPath();
         await loadProperties();
         await loadItem();
     }
 
+    async function preload(){
+        if (item_id) {
+            let url = api(`stock/item/${item_id}`);
+            const res = await get(url);
+            if (res.ok){
+                const json   = await res.json();
+                owner        = json.owner.type;
+                owner_id     = json.owner.id;
+                owner_number = json.owner_number;
+                location_id  = json.location.id;
+            }
+        }
+    }
+
     function moveToTop(loc){
         if (patchLocation(location,'parent_location_id',0)){
             loc.parent_location_id = 0;

frontend/src/routes/stock/ItemList.svelte

@@ -1,11 +1,39 @@
 <script>
-    import { api, post }    from '../../urls.svelte';
+    import { onDestroy, onMount } from 'svelte';
+    import { api, eventStream, post }    from '../../urls.svelte';
     import { error, yikes } from '../../warn.svelte';
     import { t }            from '../../translations.svelte';
 
     let { items, selected = $bindable(null), location = null, drag_start = item => console.log({dragging:item}) } = $props();
+    let eventSource      = null;
     let newItem = $state({name:null, code: null});
 
+    function handleCreateEvent(evt){
+        let json = JSON.parse(evt.data);
+        if (json.item.location.id == location.id){
+            items = [...items,json.item];
+            selected = json.item;
+        }
+    }
+
+    function handleEvent(evt,method){
+        console.log(evt,method);
+    }
+
+	function handleDeleteEvent(evt){
+        handleEvent(evt,'delete');
+    }
+
+    function handleUpdateEvent(evt){
+        handleEvent(evt,'update');
+    }
+
+    function load(){
+        try {
+			eventSource = eventStream(handleCreateEvent,handleUpdateEvent,handleDeleteEvent);
+        } catch (ignored) {}
+    }
+
     async function saveNewItem(){
         newItem.location = location;
         const url = api('stock/item');
@@ -17,6 +45,12 @@
             items = [...items, it];
         } else error(res);
     }
+
+    onDestroy(() => {
+		if (eventSource) eventSource.close();
+	});
+    onMount(load);
+
 </script>
 <table>
     <thead>

frontend/src/routes/stock/ItemProps.svelte

@@ -1,7 +1,7 @@
 <script>
     import LineEditor       from '../../Components/LineEditor.svelte';
     import { onMount }      from 'svelte';
-    import { api }          from '../../urls.svelte';
+    import { api, patch, post } from '../../urls.svelte';
     import { error, yikes } from '../../warn.svelte';
     import { t }            from '../../translations.svelte';
 
@@ -15,6 +15,15 @@
         }
     });
 
+    async function doClone(ev){
+        let url = api('stock/clone');
+        let res = await post(url,{id:item.id});
+        if (res.ok){
+            let json = await res.json();
+            yikes(res);
+        } else error(res);
+    }
+
     function byName(a,b){
         return a.name.localeCompare(b.name);
     }
@@ -30,11 +39,7 @@
             },
             add_prop : add_prop
         }
-        const res = await fetch(url,{
-            credentials:'include',
-            method:'POST',
-            body:JSON.stringify(data)
-        });
+        const res = await post(url,data);
         if (res.ok){
             const prop = await res.json();
             const id = prop.id;
@@ -45,18 +50,14 @@
         return false;
     }
 
-    async function patch(key,newVal){
+    async function update(key,newVal){
         const url = api('stock');
         const data = {
             id    : item.id,
             owner : item.owner,
         };
         data[key] = newVal;
-        const res = await fetch(url,{
-            credentials:'include',
-            method:'PATCH',
-            body:JSON.stringify(data)
-        });
+        const res = await patch(url,data);
         if (res.ok){
             yikes();
             return true;
@@ -67,13 +68,23 @@
 </script>
 
 {#if item}
-<LineEditor type="h3" editable={true} value={item.name} onSet={v => patch('name',v)} />
-Code: <LineEditor type="span" editable={true} value={item.code} onSet={v => patch('code',v)} />
+<LineEditor type="h3" editable={true} value={item.name} onSet={v => update('name',v)} />
+<button class="clone symbol" title={t('clone')} onclick={doClone}></button>
 <div>
     {@html item.description.rendered}
 </div>
 <table>
     <tbody>
+        <tr>
+            <td>{t('ID')}</td>
+            <td>{item.id}</td>
+        </tr>
+        <tr>
+            <td>{t('Code')}:</td>
+            <td>
+                <LineEditor type="span" editable={true} value={item.code} onSet={v => update('code',v)} />
+            </td>
+        </tr>
         {#each item.properties.toSorted(byName) as prop}
         <tr>
             <td>

stock/build.gradle.kts

@@ -1,6 +1,7 @@
 description = "Umbrella : Stock"
 
 dependencies{
+    implementation(project(":bus"))
     implementation(project(":core"))
     implementation("de.srsoftware:configuration.json:1.0.3")
 }

stock/src/main/java/de/srsoftware/umbrella/stock/StockModule.java

@@ -14,6 +14,7 @@ import static de.srsoftware.umbrella.core.constants.Module.USER;
 import static de.srsoftware.umbrella.core.constants.Path.*;
 import static de.srsoftware.umbrella.core.constants.Path.PROPERTY;
 import static de.srsoftware.umbrella.core.exceptions.UmbrellaException.*;
+import static de.srsoftware.umbrella.messagebus.MessageBus.messageBus;
 import static de.srsoftware.umbrella.stock.Constants.*;
 import static java.lang.System.Logger.Level.WARNING;
 import static java.util.Comparator.comparing;
@@ -26,10 +27,14 @@ import de.srsoftware.umbrella.core.*;
 import de.srsoftware.umbrella.core.api.Owner;
 import de.srsoftware.umbrella.core.api.StockService;
 import de.srsoftware.umbrella.core.constants.Field;
+import de.srsoftware.umbrella.core.constants.Module;
 import de.srsoftware.umbrella.core.constants.Path;
+import de.srsoftware.umbrella.core.constants.Text;
 import de.srsoftware.umbrella.core.exceptions.UmbrellaException;
 import de.srsoftware.umbrella.core.model.*;
 import de.srsoftware.umbrella.core.model.Location;
+import de.srsoftware.umbrella.messagebus.events.Event;
+import de.srsoftware.umbrella.messagebus.events.ItemEvent;
 import java.io.IOException;
 import java.util.*;
 import org.json.JSONObject;
@@ -113,6 +118,7 @@ public class StockModule extends BaseHandler implements StockService {
 						yield super.doGet(path,ex);
 					}
 				}
+				case Path.ITEM -> getItemById(user.get(),path,ex);
 				case Path.LOCATION -> {
 					try {
 						var location = Location.of(Long.parseLong(path.pop()));
@@ -155,6 +161,22 @@ public class StockModule extends BaseHandler implements StockService {
 		}
 	}
 
+	private boolean getItemById(UmbrellaUser user, de.srsoftware.tools.Path path, HttpExchange ex) throws IOException {
+		var head = path.pop();
+		if (head == null) throw missingField(Field.ID);
+		try {
+			var itemId = Long.parseLong(head);
+			var item = stockDb.loadItem(itemId);
+			var owner = item.location().resolve().owner().resolve();
+			boolean allowed = owner instanceof UmbrellaUser u && user.equals(u);
+			allowed = allowed || owner instanceof Company c && companyService().membership(c.id(),user.id());
+			if (!allowed) throw forbidden("You are not allowed to access item {id}",ID,itemId);
+			return sendContent(ex,item);
+		} catch (NumberFormatException e) {
+			throw invalidField(Field.ID, Text.NUMBER);
+		}
+	}
+
 	@Override
 	public boolean doPatch(de.srsoftware.tools.Path path, HttpExchange ex) throws IOException {
 		addCors(ex);
@@ -190,6 +212,7 @@ public class StockModule extends BaseHandler implements StockService {
 			if (user.isEmpty()) return unauthorized(ex);
 			var head = path.pop();
 			return switch (head) {
+				case Path.CLONE -> postClone(user.get(),ex);
 				case Path.ITEM -> postItem(user.get(), ex);
 				case LIST     -> postItemList(user.get(), path, ex);
 				case Path.LOCATION -> postLocation(user.get(),ex);
@@ -203,7 +226,8 @@ public class StockModule extends BaseHandler implements StockService {
 	}
 
 	private boolean getChildLocations(UmbrellaUser user, long parentId, HttpExchange ex) throws IOException {
-		LOG.log(WARNING,"No security check implemented for {0}.getChildLocations(user, parentId, ex)!",getClass().getSimpleName()); // TODO check, that user is allowed to request that location
+		var owner = stockDb.loadLocation(parentId).owner();
+		if (!assigned(owner,user)) throw forbidden("You are not allowed to access items of {owner}", OWNER,owner);
 		return sendContent(ex, stockDb.listChildLocations(parentId).stream().sorted(comparing(l -> l.name().toLowerCase())).map(DbLocation::toMap));
 	}
 
@@ -285,7 +309,7 @@ public class StockModule extends BaseHandler implements StockService {
 		var json = json(ex);
 		if (!(json.get(ID) instanceof Number id)) throw missingField(ID);
 		json.remove(ID);
-
+		LOG.log(WARNING,"Missing permission check in StockModule.patchItem()!");
 		var item = stockDb.loadItem(id.longValue());
 		item.patch(json);
 		return sendContent(ex,stockDb.save(item));
@@ -336,6 +360,23 @@ public class StockModule extends BaseHandler implements StockService {
 		return sendContent(ex,location);
 	}
 
+	private boolean postClone(UmbrellaUser user, HttpExchange ex) throws IOException {
+		var json = json(ex);
+		if (!json.has(ID))throw missingField(ID);
+		if (!(json.get(ID) instanceof Number num)) throw invalidField(ID,Text.NUMBER);
+		long itemId = num.longValue();
+		var item     = stockDb.loadItem(itemId);
+		stockDb.loadProperties(item);
+		var location = item.location().resolve();
+		var owner    = location.owner().resolve();
+		if (!assigned(owner,user)) throw forbidden("You are not allowed to add items to \"{location}\"!", Text.LOCATION,location.name());
+		var newItem = new Item(0,owner,0,location,item.code(),item.name(),item.description());
+		for (var property : item.properties()) newItem.properties().add(property);
+		newItem = stockDb.save(newItem);
+		messageBus().dispatch(new ItemEvent(user, Module.STOCK, newItem, Event.EventType.CREATE));
+		return sendContent(ex,newItem);
+	}
+
 	private boolean postItem(UmbrellaUser user, HttpExchange ex) throws IOException {
 		var json = json(ex);
 		if (!json.has(NAME) || !(json.get(NAME) instanceof String name)) throw missingField(NAME);
@@ -345,8 +386,10 @@ public class StockModule extends BaseHandler implements StockService {
 		var location = stockDb.loadLocation(locationData.getLong(ID));
 		var owner = location.owner().resolve();
 		if (!assigned(owner,user)) throw forbidden("You are not allowed to add items to {location}!", Field.LOCATION,location);
-		var newItem = new Item(0,owner,0,location,code,name,description);
-		return sendContent(ex,stockDb.save(newItem));
+		var newItem = stockDb.save(new Item(0,owner,0,location,code,name,description));
+		messageBus().dispatch(new ItemEvent(user, Module.STOCK, newItem, Event.EventType.CREATE));
+		return sendContent(ex,newItem);
+
 	}
 
 	private boolean postItemList(UmbrellaUser user, de.srsoftware.tools.Path path, HttpExchange ex) throws IOException {
@@ -395,6 +438,7 @@ public class StockModule extends BaseHandler implements StockService {
 		if (!(itemData.get(ID) instanceof Number itemId)) throw missingField(ID);
 		if (!(json.get("add_prop") instanceof JSONObject propData)) throw missingField("add_prop");
 		if (!propData.has(VALUE)) throw missingField(VALUE);
+		LOG.log(WARNING,"Missing permission check in StockModule.postProperty()!");
 		var value = propData.get(VALUE);
 		if (value == null) throw missingField(VALUE);
 

web/src/main/resources/web/css/default.css

@@ -476,6 +476,16 @@ table{
     bottom: 0;
 }
 
+.properties{
+	position: relative;
+}
+
+.properties .clone{
+	position: absolute;
+	right: 10px;
+	top: 40px;
+}
+
 .version > a{
     padding: 5px;
 }