securize GET /api/stats/reports/curve/ by splitting into two

betagouv · Feb 13, 2025 · ec3d8f1 · ec3d8f1
1 parent f579802
commit ec3d8f1
Show file tree

Hide file tree

Showing 4 changed files with 43 additions and 35 deletions.
diff --git a/app/controllers/StatisticController.scala b/app/controllers/StatisticController.scala
@@ -16,12 +16,14 @@ import orchestrators.StatsOrchestrator
 import play.api.Logger
 import play.api.libs.json.Json
 import play.api.mvc.ControllerComponents
+import play.api.mvc.Result
 import play.api.mvc.Results
 import utils.QueryStringMapper
 
 import java.time.OffsetDateTime
 import java.util.Locale
 import java.util.UUID
+import scala.collection.immutable.Seq
 import scala.concurrent.ExecutionContext
 import scala.concurrent.Future
 import scala.util.Failure
@@ -53,30 +55,46 @@ class StatisticController(
       )
   }
 
-  /** Nom de fonction adoubé par Saïd. En cas d'incompréhension, merci de le contacter directement
-    */
-  def getReportsCountCurve() = Act.secured.all.allowImpersonation.async { request =>
-    ReportFilter
-      .fromQueryString(request.queryString)
-      .fold(
-        error => {
-          logger.error("Cannot parse querystring", error)
-          Future.successful(BadRequest)
-        },
-        filters => {
-          val mapper = new QueryStringMapper(request.queryString)
-          val ticks  = mapper.int("ticks").getOrElse(12)
-          val tickDuration = mapper
-            .string("tickDuration")
-            .flatMap(CurveTickDuration.namesToValuesMap.get)
-            .getOrElse(CurveTickDuration.Month)
-          statsOrchestrator
-            .getReportsCountCurve(Some(request.identity), filters, ticks, tickDuration)
-            .map(curve => Ok(Json.toJson(curve)))
-        }
-      )
+  def getReportsCountCurve() = Act.secured.adminsAndReadonlyAndAgents.allowImpersonation.async { request =>
+    getReportsCountCurveFromQueryString(
+      request.queryString,
+      request.identity
+    )
   }
 
+  def getReportsCountCurveForCompany(companyId: UUID) =
+    Act.securedWithCompanyAccessById(companyId).allowImpersonation.async { request =>
+      getReportsCountCurveFromQueryString(
+        request.queryString,
+        request.identity,
+        reportFilterModification = _.copy(companyIds = Seq(companyId))
+      )
+    }
+
+  private def getReportsCountCurveFromQueryString(
+      queryString: Map[String, Seq[String]],
+      user: User,
+      reportFilterModification: ReportFilter => ReportFilter = identity
+  ): Future[Result] =
+    ReportFilter.fromQueryString(queryString) match {
+      case Success(reportFilter) =>
+        val modifiedReportFilter = reportFilterModification(reportFilter)
+        val mapper               = new QueryStringMapper(queryString)
+        val ticks                = mapper.int("ticks").getOrElse(12)
+        val tickDuration = mapper
+          .string("tickDuration")
+          .flatMap(CurveTickDuration.namesToValuesMap.get)
+          .getOrElse(CurveTickDuration.Month)
+        for {
+          curve <- statsOrchestrator
+            .getReportsCountCurve(Some(user), modifiedReportFilter, ticks, tickDuration)
+        } yield Ok(Json.toJson(curve))
+      case Failure(error) =>
+        logger.error("Cannot parse querystring", error)
+        Future.successful(BadRequest)
+
+    }
+
   def getDelayReportResponseInHours(companyId: UUID) =
     Act.securedWithCompanyAccessById(companyId).allowImpersonation.async { request =>
       statsOrchestrator

diff --git a/app/loader/SignalConsoApplicationLoader.scala b/app/loader/SignalConsoApplicationLoader.scala
@@ -986,8 +986,8 @@ class SignalConsoComponents(
       asyncFileController,
       eventsController,
       adminController,
-      companyAccessController,
       statisticController,
+      companyAccessController,
       authController,
       accountController,
       blacklistedEmailsController,

diff --git a/app/orchestrators/StatsOrchestrator.scala b/app/orchestrators/StatsOrchestrator.scala
@@ -13,7 +13,6 @@ import models.report.delete.ReportAdminActionType
 import models.report.review.ResponseEvaluation
 import orchestrators.StatsOrchestrator.computeStartingDate
 import orchestrators.StatsOrchestrator.formatStatData
-import orchestrators.StatsOrchestrator.toPercentage
 import repositories.accesstoken.AccessTokenRepositoryInterface
 import repositories.event.EventRepositoryInterface
 import repositories.report.ReportRepositoryInterface
@@ -115,16 +114,6 @@ class StatsOrchestrator(
 
   }
 
-  def getReportCountPercentage(
-      user: Option[User],
-      filter: ReportFilter,
-      basePercentageFilter: ReportFilter
-  ): Future[Int] =
-    for {
-      count     <- reportRepository.count(user, filter)
-      baseCount <- reportRepository.count(user, basePercentageFilter)
-    } yield toPercentage(count, baseCount)
-
   def getReportsCountCurve(
       user: Option[User],
       reportFilter: ReportFilter,

diff --git a/conf/routes b/conf/routes
@@ -107,7 +107,8 @@ GET           /api/albert/classification/:reportId                    controller
 ########## COMPANY PAGE #######
 ###############################
 
-GET           /api/companies/$companyId<[-0-9a-f]{36}>                   controllers.CompanyController.getCompany(companyId: java.util.UUID)
+GET           /api/companies/$companyId<[-0-9a-f]{36}>                controllers.CompanyController.getCompany(companyId: java.util.UUID)
+GET           /api/stats/reports/curve/:companyId                     controllers.StatisticController.getReportsCountCurveForCompany(companyId: java.util.UUID)
 GET           /api/companies/:siret/events                            controllers.EventsController.getCompanyEvents(siret: SIRET, eventType: Option[String])
 GET           /api/accesses/:siret/most-active                        controllers.CompanyAccessController.listAccessesMostActive(siret: String)
 GET           /api/accesses/:siret/count                              controllers.CompanyAccessController.countAccesses(siret: String)