Check for source access. Get the transactions correct.

OHDSI · Nov 15, 2024 · a1a29cd · a1a29cd
1 parent d3b3e25
commit a1a29cd
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 4 deletions.
diff --git a/src/main/java/org/ohdsi/webapi/achilles/service/AchillesCacheService.java b/src/main/java/org/ohdsi/webapi/achilles/service/AchillesCacheService.java
@@ -5,6 +5,7 @@
 import com.fasterxml.jackson.databind.node.ObjectNode;
 import org.ohdsi.webapi.achilles.domain.AchillesCacheEntity;
 import org.ohdsi.webapi.achilles.repository.AchillesCacheRepository;
+import org.ohdsi.webapi.shiro.management.datasource.SourceAccessor;
 import org.ohdsi.webapi.source.Source;
 import org.ohdsi.webapi.source.SourceRepository;
 import org.slf4j.Logger;
@@ -36,6 +37,9 @@ public class AchillesCacheService {
   @Autowired
   private SourceRepository sourceRepository;
 
+  @Autowired
+  private SourceAccessor sourceAccessor;
+
   public AchillesCacheService(AchillesCacheRepository cacheRepository,
       ObjectMapper objectMapper) {
     this.cacheRepository = cacheRepository;
@@ -95,11 +99,13 @@ public void saveDrilldownCacheMap(Source source, String domain, Map<Integer, Obj
   @Transactional()
   public void clearCache() {
     List<Source> sources = sourceRepository.findAll();
-    sources.parallelStream().forEach(this::clearCache);
+    sources.stream().forEach(this::clearCache);
   }
 
   private void clearCache(Source source) {
-    cacheRepository.deleteBySource(source);
+    if (sourceAccessor.hasAccess(source)) {
+      cacheRepository.deleteBySource(source);
+    }
   }
 
   private void createCacheEntities(Source source, Map<String, ObjectNode> nodes) {

diff --git a/src/main/java/org/ohdsi/webapi/cdmresults/service/CDMCacheService.java b/src/main/java/org/ohdsi/webapi/cdmresults/service/CDMCacheService.java
@@ -10,11 +10,13 @@
 import org.ohdsi.webapi.cdmresults.mapper.DescendantRecordCountMapper;
 import org.ohdsi.webapi.cdmresults.repository.CDMCacheRepository;
 import org.ohdsi.webapi.service.AbstractDaoService;
+import org.ohdsi.webapi.shiro.management.datasource.SourceAccessor;
 import org.ohdsi.webapi.source.Source;
 import org.ohdsi.webapi.source.SourceDaimon;
 import org.ohdsi.webapi.util.PreparedSqlRender;
 import org.ohdsi.webapi.util.PreparedStatementRenderer;
 import org.ohdsi.webapi.util.SessionUtils;
+import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.core.convert.ConversionService;
 import org.springframework.jdbc.core.JdbcTemplate;
@@ -52,6 +54,9 @@ public class CDMCacheService extends AbstractDaoService {
 
   private final ConversionService conversionService;
 
+  @Autowired
+  private SourceAccessor sourceAccessor;
+
   public CDMCacheService(CDMCacheBatchService cdmCacheBatchService,
           ConversionService conversionService,
           CDMCacheRepository cdmCacheRepository) {
@@ -99,11 +104,13 @@ public List<CDMCacheEntity> findAndCache(Source source, List<Integer> conceptIds
   @Transactional()
   public void clearCache() {
     List<Source> sources = getSourceRepository().findAll();
-    sources.parallelStream().forEach(this::clearCache);
+    sources.stream().forEach(this::clearCache);
   }
 
   private void clearCache(Source source) {
-    cdmCacheRepository.deleteBySource(source.getSourceId());
+    if (sourceAccessor.hasAccess(source)) {
+      cdmCacheRepository.deleteBySource(source.getSourceId());
+    }
   }
 
   private List<CDMCacheEntity> find(Source source, List<Integer> conceptIds) {

diff --git a/src/main/java/org/ohdsi/webapi/service/CDMResultsService.java b/src/main/java/org/ohdsi/webapi/service/CDMResultsService.java
@@ -44,6 +44,7 @@
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
 
 import javax.ws.rs.Consumes;
 import javax.ws.rs.ForbiddenException;
@@ -293,6 +294,7 @@ public JobExecutionResource refreshCache(@PathParam("sourceKey") final String so
      */
     @POST
     @Path("clearCache")
+    @Transactional()
     public void clearCache() {
         if (!isSecured() || !isAdmin()) {
             throw new ForbiddenException();