Class AgendaAvailabilityRest
This controller adds no gate. There is exactly one place in
the product that decides who may read whose free/busy —
AgendaAvailabilityServiceImpl, over the calendar ACL floor
(EXO-89841) and the target's own sharing setting (EXO-89844) — and this
resource does nothing but call it and render what it answered. A second
check here would be a second thing to keep in step with the first, and the
two would drift.
The asking user comes from the session, never from a parameter.
request.getRemoteUser() is what the container authenticated; an
identifier the caller supplies is a claim, and a claim reaching an ACL
decision is how an authorisation check stops being one.
The answer degrades rather than refusing: a participant whose busy time is
not readable is reported as unread, not omitted and not emptied, so the
screen can name them. See UserBusyTimeEntity.
-
Constructor Summary
ConstructorsConstructorDescriptionAgendaAvailabilityRest(org.exoplatform.agenda.service.AgendaAvailabilityService agendaAvailabilityService, org.exoplatform.social.core.manager.IdentityManager identityManager) Builds the resource. -
Method Summary
-
Constructor Details
-
AgendaAvailabilityRest
@Autowired public AgendaAvailabilityRest(org.exoplatform.agenda.service.AgendaAvailabilityService agendaAvailabilityService, org.exoplatform.social.core.manager.IdentityManager identityManager) Builds the resource.- Parameters:
agendaAvailabilityService- the one holder of the free/busy gateidentityManager- used to resolve the authenticated user's identity
-
-
Method Details
-
getBusyTime
@GetMapping @Secured("users") public List<UserBusyTimeEntity> getBusyTime(jakarta.servlet.http.HttpServletRequest request, @RequestParam("identityIds") List<Long> identityIds, @RequestParam("start") String start, @RequestParam("end") String end, @RequestParam(name="timeZoneId",required=false) String timeZoneId) Answers the busy time of each named participant over a window, with the status of each read.- Parameters:
request- the authenticated request, the only source of the asking user's identityidentityIds- technical identifiers of the participants asked aboutstart- window start, ISO-8601end- window end, ISO-8601timeZoneId- the asking user's own zone, the one the ranges come back in — the same parameter the events resource takes, so the grid reads a busy block's wall-clock time the way it reads every other event on it. Blank means UTC.- Returns:
- one entry per distinct participant, in the order asked
-