private void authorize ( HttpSession session , Action action , Entity entity , String location ) throws AuthorizationException , DataAccessException { AuthenticatedUser user = ( AuthenticatedUser ) session . getAttribute ( "authenticatedUser" ) ; if ( user == null && ApplicationContext . getServiceUser ( ) != null ) { String cuid = ApplicationContext . getServiceUser ( ) ; user = new AuthenticatedUser ( UserGroupCache . getUser ( cuid ) ) ; } if ( user == null ) throw new AuthorizationException ( AuthorizationException . NOT_AUTHORIZED , "Authentication failure" ) ; if ( action == Action . Create || action == Action . Delete ) { if ( ! user . hasRole ( Role . PROCESS_EXECUTION ) ) { throw new AuthorizationException ( AuthorizationException . FORBIDDEN , "User " + user . getCuid ( ) + " not authorized for " + action + " on " + location ) ; } logger . info ( "Asset mod request received from user: " + user . getCuid ( ) + " for: " + location ) ; UserAction userAction = new UserAction ( user . getCuid ( ) , action , entity , 0L , location ) ; userAction . setSource ( getClass ( ) . getSimpleName ( ) ) ; ServiceLocator . getUserServices ( ) . auditLog ( userAction ) ; } }
Also audit logs create and delete .