Require view permission for the project events history query

pom.xml

@@ -94,6 +94,11 @@
 			<artifactId>webprotege-ipc</artifactId>
 			<version>2.0.1</version>
 		</dependency>
+		<dependency>
+			<groupId>edu.stanford.protege</groupId>
+			<artifactId>webprotege-authorization</artifactId>
+			<version>2.0.1</version>
+		</dependency>
 		<dependency>
 			<groupId>org.keycloak</groupId>
 			<artifactId>keycloak-admin-client</artifactId>

src/main/java/edu/stanford/protege/webprotegeeventshistory/GetLatestProjectEventsCommandHandler.java

@@ -1,17 +1,27 @@
 package edu.stanford.protege.webprotegeeventshistory;
 
-import edu.stanford.protege.webprotege.ipc.CommandHandler;
+import edu.stanford.protege.webprotege.authorization.BasicCapability;
+import edu.stanford.protege.webprotege.authorization.Capability;
+import edu.stanford.protege.webprotege.authorization.ProjectResource;
+import edu.stanford.protege.webprotege.authorization.Resource;
+import edu.stanford.protege.webprotege.ipc.AuthorizedCommandHandler;
+import edu.stanford.protege.webprotege.ipc.CommandExecutionException;
 import edu.stanford.protege.webprotege.ipc.ExecutionContext;
 import edu.stanford.protege.webprotegeeventshistory.dto.ProjectEventsQueryRequest;
 import edu.stanford.protege.webprotegeeventshistory.dto.ProjectEventsQueryResponse;
+import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Component;
 import reactor.core.publisher.Mono;
 
 import javax.annotation.Nonnull;
+import java.util.Collection;
+import java.util.List;
 
 
 @Component
-public class GetLatestProjectEventsCommandHandler implements CommandHandler<ProjectEventsQueryRequest, ProjectEventsQueryResponse> {
+public class GetLatestProjectEventsCommandHandler implements AuthorizedCommandHandler<ProjectEventsQueryRequest, ProjectEventsQueryResponse> {
+
+    private static final Capability VIEW_PROJECT = new BasicCapability("ViewProject");
 
     private final HighLevelBusinessEventsService service;
 
@@ -31,6 +41,21 @@ public Class<ProjectEventsQueryRequest> getRequestClass() {
         return ProjectEventsQueryRequest.class;
     }
 
+    @Nonnull
+    @Override
+    public Resource getTargetResource(ProjectEventsQueryRequest request) {
+        if (request.projectId == null) {
+            throw CommandExecutionException.of(HttpStatus.BAD_REQUEST, "projectId must not be null");
+        }
+        return ProjectResource.forProject(request.projectId);
+    }
+
+    @Nonnull
+    @Override
+    public Collection<Capability> getRequiredCapabilities() {
+        return List.of(VIEW_PROJECT);
+    }
+
     @Override
     public Mono<ProjectEventsQueryResponse> handleRequest(ProjectEventsQueryRequest request, ExecutionContext executionContext) {
         var response = service.fetchEvents(request);

src/test/java/edu/stanford/protege/webprotegeeventshistory/GetLatestProjectEventsCommandHandlerTest.java

@@ -0,0 +1,60 @@
+package edu.stanford.protege.webprotegeeventshistory;
+
+import edu.stanford.protege.webprotege.authorization.BasicCapability;
+import edu.stanford.protege.webprotege.authorization.Capability;
+import edu.stanford.protege.webprotege.authorization.ProjectResource;
+import edu.stanford.protege.webprotege.common.ProjectId;
+import edu.stanford.protege.webprotege.ipc.AuthorizedCommandHandler;
+import edu.stanford.protege.webprotege.ipc.CommandExecutionException;
+import edu.stanford.protege.webprotegeeventshistory.dto.ProjectEventsQueryRequest;
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.http.HttpStatus;
+
+import java.util.List;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+
+public class GetLatestProjectEventsCommandHandlerTest {
+
+    private GetLatestProjectEventsCommandHandler handler;
+
+    private ProjectId projectId;
+
+    @Before
+    public void setUp() {
+        // The contract methods under test never touch the service, so no stub is needed.
+        handler = new GetLatestProjectEventsCommandHandler(null);
+        projectId = ProjectId.generate();
+    }
+
+    @Test
+    public void GIVEN_handler_THEN_isAuthorizedCommandHandler() {
+        assertTrue(handler instanceof AuthorizedCommandHandler);
+    }
+
+    @Test
+    public void GIVEN_request_WHEN_getTargetResource_THEN_returnsProjectResourceForRequestProject() {
+        ProjectEventsQueryRequest request = new ProjectEventsQueryRequest();
+        request.projectId = projectId;
+
+        assertEquals(ProjectResource.forProject(projectId), handler.getTargetResource(request));
+    }
+
+    @Test
+    public void GIVEN_nullProjectId_WHEN_getTargetResource_THEN_throwsBadRequest() {
+        ProjectEventsQueryRequest request = new ProjectEventsQueryRequest();
+        request.projectId = null;
+
+        CommandExecutionException exception =
+                assertThrows(CommandExecutionException.class, () -> handler.getTargetResource(request));
+        assertEquals(HttpStatus.BAD_REQUEST, exception.getStatus());
+    }
+
+    @Test
+    public void GIVEN_handler_WHEN_getRequiredCapabilities_THEN_equalsViewProject() {
+        assertEquals(List.of((Capability) new BasicCapability("ViewProject")), handler.getRequiredCapabilities());
+    }
+}