merge repositories rest service: users must have karma for this operation

git-svn-id: https://svn.apache.org/repos/asf/archiva/trunk@1389245 13f79535-47bb-0310-9956-ffa450edef68

2 files changed, 14 insertions, 11 deletions

diff --git a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
index 334bb8d27..814fc3bbd 100644
--- a/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
+++ b/archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java
@@ -65,6 +65,8 @@ public class ArchivaRoleConstants
     public static final String OPERATION_REPOSITORY_UPLOAD = "archiva-upload-repository";
 
     public static final String OPERATION_REPOSITORY_DELETE = "archiva-delete-artifact";
+
+    public static final String OPERATION_MERGE_REPOSITORY = "archiva-merge-repository";
     
     public static final String OPERATION_VIEW_AUDIT_LOG = "archiva-view-audit-logs";
 
diff --git a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
index f206f0e9c..ec9996802 100644
--- a/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
+++ b/archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java
@@ -20,6 +20,7 @@ package org.apache.archiva.rest.api.services;
 
 import org.apache.archiva.maven2.model.Artifact;
 import org.apache.archiva.redback.authorization.RedbackAuthorization;
+import org.apache.archiva.security.common.ArchivaRoleConstants;
 
 import javax.ws.rs.GET;
 import javax.ws.rs.Path;
@@ -34,30 +35,30 @@ import java.util.List;
  * @author Olivier Lamy
  * @since 1.4-M3
  */
-@Path ( "/mergeRepositoriesService/" )
+@Path ("/mergeRepositoriesService/")
 public interface MergeRepositoriesService
 {
-    @Path ( "mergeConflictedArtifacts/{sourceRepositoryId}/{targetRepositoryId}" )
+    @Path ("mergeConflictedArtifacts/{sourceRepositoryId}/{targetRepositoryId}")
     @GET
-    @Produces ( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization ( noPermission = true )
+    @Produces ({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
     /**
      * <b>permissions are checked in impl</b>
      * @since 1.4-M3
      */
-    List<Artifact> getMergeConflictedArtifacts( @PathParam ( "sourceRepositoryId" ) String sourceRepositoryId,
-                                                @PathParam ( "targetRepositoryId" ) String targetRepositoryId )
+    List<Artifact> getMergeConflictedArtifacts( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
+                                                @PathParam ("targetRepositoryId") String targetRepositoryId )
         throws ArchivaRestServiceException;
 
-    @Path ( "mergeRepositories/{sourceRepositoryId}/{targetRepositoryId}/{skipConflicts}" )
+    @Path ("mergeRepositories/{sourceRepositoryId}/{targetRepositoryId}/{skipConflicts}")
     @GET
-    @RedbackAuthorization ( noPermission = true )
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
     /**
      * <b>permissions are checked in impl</b>
      * @since 1.4-M3
      */
-    void mergeRepositories( @PathParam ( "sourceRepositoryId" ) String sourceRepositoryId,
-                            @PathParam ( "targetRepositoryId" ) String targetRepositoryId,
-                            @PathParam ( "skipConflicts" ) boolean skipConflicts )
+    void mergeRepositories( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
+                            @PathParam ("targetRepositoryId") String targetRepositoryId,
+                            @PathParam ("skipConflicts") boolean skipConflicts )
         throws ArchivaRestServiceException;
 }