Files
raven/server/AyaNova/biz/BizObjectFactory.cs
John Cardinal d254affc8b case 4720 - restricted roles get filtered work order items in report data, rendering and export
Opening a work order filters it for restricted users (TechRestricted,
SubContractor, SubContractorRestricted): only items they are scheduled on, and
on those only their own labour, travel and scheduling, and for some roles no
parts, units, expenses etc. Report data, rendering and export went through
WorkOrderGetPartialAsync, which filtered nothing for child types (security
review F27). Two causes:
- the partial fetch now applies the same filtering: the item only if the user
  is scheduled on it (checked in the database), then its details filtered; the
  existing per-item filtering moved unchanged into RemoveRestrictedUserItemDetails
  so both fetches share it;
- BizObjectFactory created WorkOrderBiz with UserType.Service for everyone, so
  in these paths a subcontractor was never treated as one; it now passes the
  user's real type (only the subcontractor flags depend on it).

Checked: report data for a restricted subcontractor on work order 1 went from
the whole item with parts to none; scheduled on an item, it gets the item
without parts or other users' labour. Full suite: 111 passed, 5 skipped, the
same 2 known failures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-24 16:27:59 -07:00

173 lines
7.8 KiB
C#

using System.Linq;
using Microsoft.EntityFrameworkCore;
using AyaNova.Util;
using AyaNova.Models;
namespace AyaNova.Biz
{
internal static class BizObjectFactory
{
//Returns the biz object class that corresponds to the type presented
//Used by SEARCH, REPORTING and objects with JOBS
internal static BizObject GetBizObject(AyaType ayaType,
AyContext ct,
long userId,
AuthorizationRoles roles,
long translationId = 0)
{
if (translationId == 0)
translationId = ServerBootConfig.AYANOVA_DEFAULT_TRANSLATION_ID;
switch (ayaType)
{
//CoreBizObject add here
case AyaType.ServerJob:
return new JobOperationsBiz(ct, userId, roles);
case AyaType.TrialSeeder:
return new TrialBiz(ct, userId, roles);
case AyaType.Translation:
return new TranslationBiz(ct, userId, translationId, roles);
case AyaType.DataListSavedFilter:
return new DataListSavedFilterBiz(ct, userId, translationId, roles);
case AyaType.FormCustom:
return new FormCustomBiz(ct, userId, translationId, roles);
case AyaType.FileAttachment:
return new AttachmentBiz(ct, userId, roles);
case AyaType.Customer:
return new CustomerBiz(ct, userId, translationId, roles);
case AyaType.CustomerNote:
return new CustomerNoteBiz(ct, userId, translationId, roles);
case AyaType.User:
return new UserBiz(ct, userId, translationId, roles);
case AyaType.Memo:
return new MemoBiz(ct, userId, translationId, roles);
case AyaType.Contract:
return new ContractBiz(ct, userId, translationId, roles);
case AyaType.HeadOffice:
return new HeadOfficeBiz(ct, userId, translationId, roles);
case AyaType.LoanUnit:
return new LoanUnitBiz(ct, userId, translationId, roles);
case AyaType.Part:
return new PartBiz(ct, userId, translationId, roles);
case AyaType.PartWarehouse:
return new PartWarehouseBiz(ct, userId, translationId, roles);
case AyaType.PartAssembly:
return new PartAssemblyBiz(ct, userId, translationId, roles);
case AyaType.PartInventory:
return new PartInventoryBiz(ct, userId, translationId, roles);
case AyaType.PartInventoryDataList:
return new PartInventoryDataListBiz(ct, userId, translationId, roles);
case AyaType.PartInventoryRequestDataList:
return new PartInventoryRequestDataListBiz(ct, userId, translationId, roles);
case AyaType.Project:
return new ProjectBiz(ct, userId, translationId, roles);
case AyaType.PurchaseOrder:
return new PurchaseOrderBiz(ct, userId, translationId, roles);
case AyaType.Unit:
return new UnitBiz(ct, userId, translationId, roles);
case AyaType.UnitModel:
return new UnitModelBiz(ct, userId, translationId, roles);
case AyaType.Vendor:
return new VendorBiz(ct, userId, translationId, roles);
//--- WorkOrder
case AyaType.WorkOrder:
case AyaType.WorkOrderItem:
case AyaType.WorkOrderItemExpense:
case AyaType.WorkOrderItemLabor:
case AyaType.WorkOrderItemLoan:
case AyaType.WorkOrderItemPart:
case AyaType.WorkOrderItemPartRequest:
case AyaType.WorkOrderItemScheduledUser:
case AyaType.WorkOrderItemTask:
case AyaType.WorkOrderItemTravel:
case AyaType.WorkOrderItemUnit:
case AyaType.WorkOrderItemOutsideService:
//case 4720: the real user type, the subcontractor restrictions depend on it (report data and export come through here)
var workOrderUserType = ct.User.AsNoTracking().Where(z => z.Id == userId).Select(z => z.UserType).FirstOrDefault();
return new WorkOrderBiz(ct, userId, translationId, roles, workOrderUserType);
//--- Quote
case AyaType.Quote:
case AyaType.QuoteItem:
case AyaType.QuoteItemExpense:
case AyaType.QuoteItemLabor:
case AyaType.QuoteItemLoan:
case AyaType.QuoteItemPart:
case AyaType.QuoteItemScheduledUser:
case AyaType.QuoteItemTask:
case AyaType.QuoteItemTravel:
case AyaType.QuoteItemUnit:
case AyaType.QuoteItemOutsideService:
return new QuoteBiz(ct, userId, translationId, roles, UserType.Service);
//---
//--- PM
case AyaType.PM:
case AyaType.PMItem:
case AyaType.PMItemExpense:
case AyaType.PMItemLabor:
case AyaType.PMItemLoan:
case AyaType.PMItemPart:
case AyaType.PMItemScheduledUser:
case AyaType.PMItemTask:
case AyaType.PMItemTravel:
case AyaType.PMItemUnit:
case AyaType.PMItemOutsideService:
return new PMBiz(ct, userId, translationId, roles, UserType.Service);
//---
case AyaType.WorkOrderStatus:
return new WorkOrderStatusBiz(ct, userId, translationId, roles);
case AyaType.Reminder:
return new ReminderBiz(ct, userId, translationId, roles);
case AyaType.Review:
return new ReviewBiz(ct, userId, translationId, roles);
case AyaType.ServiceRate:
return new ServiceRateBiz(ct, userId, translationId, roles);
case AyaType.TravelRate:
return new TravelRateBiz(ct, userId, translationId, roles);
case AyaType.TaxCode:
return new TaxCodeBiz(ct, userId, translationId, roles);
// case AyaType.ServiceBank:
// return new ServiceBankBiz(ct, userId, translationId, roles);
case AyaType.CustomerServiceRequest:
return new CustomerServiceRequestBiz(ct, userId, translationId, roles);
case AyaType.CustomerNotifySubscription:
return new CustomerNotifySubscriptionBiz(ct, userId, translationId, roles);
case AyaType.TaskGroup:
return new TaskGroupBiz(ct, userId, translationId, roles);
case AyaType.UnitMeterReading:
return new UnitMeterReadingBiz(ct, userId, translationId, roles);
case AyaType.Report:
return new ReportBiz(ct, userId, translationId, roles);
default:
throw new System.NotSupportedException($"AyaNova.BLL.BizObjectFactory::GetBizObject type {ayaType.ToString()} is not supported");
}
}
/////////////////////////////////////////////////////////////////////
}//eoc
}//eons