Class AgendaAvailabilityRest

java.lang.Object
org.exoplatform.agenda.rest.AgendaAvailabilityRest

@RestController @RequestMapping("availability") public class AgendaAvailabilityRest extends Object
Reads other people's busy time, so that a screen where a meeting is being scheduled can draw it.

This controller adds no gate. There is exactly one place in the product that decides who may read whose free/busy — AgendaAvailabilityServiceImpl, over the calendar ACL floor (EXO-89841) and the target's own sharing setting (EXO-89844) — and this resource does nothing but call it and render what it answered. A second check here would be a second thing to keep in step with the first, and the two would drift.

The asking user comes from the session, never from a parameter. request.getRemoteUser() is what the container authenticated; an identifier the caller supplies is a claim, and a claim reaching an ACL decision is how an authorisation check stops being one.

The answer degrades rather than refusing: a participant whose busy time is not readable is reported as unread, not omitted and not emptied, so the screen can name them. See UserBusyTimeEntity.

  • Constructor Details

    • AgendaAvailabilityRest

      @Autowired public AgendaAvailabilityRest(org.exoplatform.agenda.service.AgendaAvailabilityService agendaAvailabilityService, org.exoplatform.social.core.manager.IdentityManager identityManager)
      Builds the resource.
      Parameters:
      agendaAvailabilityService - the one holder of the free/busy gate
      identityManager - used to resolve the authenticated user's identity
  • Method Details

    • getBusyTime

      @GetMapping @Secured("users") public List<UserBusyTimeEntity> getBusyTime(jakarta.servlet.http.HttpServletRequest request, @RequestParam("identityIds") List<Long> identityIds, @RequestParam("start") String start, @RequestParam("end") String end, @RequestParam(name="timeZoneId",required=false) String timeZoneId)
      Answers the busy time of each named participant over a window, with the status of each read.
      Parameters:
      request - the authenticated request, the only source of the asking user's identity
      identityIds - technical identifiers of the participants asked about
      start - window start, ISO-8601
      end - window end, ISO-8601
      timeZoneId - the asking user's own zone, the one the ranges come back in — the same parameter the events resource takes, so the grid reads a busy block's wall-clock time the way it reads every other event on it. Blank means UTC.
      Returns:
      one entry per distinct participant, in the order asked