Added grouping for the Accessible in order to improve security.

Author: j.bebendorf

src/main/java/org/javawebstack/orm/Accessible.java

@@ -1,7 +1,8 @@
 package org.javawebstack.orm;
 
 import org.javawebstack.orm.query.Query;
+import org.javawebstack.orm.query.QueryGroup;
 
 public interface Accessible {
-    <T extends Model> Query<T> access(Query<T> query, Object accessor);
+    <T extends Model> QueryGroup<T> access(Query<T> query, QueryGroup<T> accessChecks, Object accessor);
 }

src/main/java/org/javawebstack/orm/Repo.java

@@ -73,11 +73,11 @@ public Query<T> whereId(Object right) {
     }
 
     public Query<T> accessible(Object accessor) {
-        return accessible(query(), accessor);
+        return query().accessible(accessor);
     }
 
-    public Query<T> accessible(Query<T> query, Object accessor) {
-        return accessible == null ? query : accessible.access(query, accessor);
+    public Accessible getAccessible() {
+        return accessible;
     }
 
     public void save(T entry) {

src/main/java/org/javawebstack/orm/query/Query.java

@@ -30,6 +30,8 @@ public class Query<T extends Model> {
     private boolean withDeleted = false;
     private final List<QueryColumn> groupBy = new ArrayList<>();
     private QueryGroup<T> having;
+    private boolean applyAccessible = false;
+    private Object accessor;
 
     public Query(Class<T> model) {
         this(Repo.get(model), model);
@@ -53,6 +55,14 @@ public boolean isWithDeleted() {
         return withDeleted;
     }
 
+    public boolean shouldApplyAccessible() {
+        return applyAccessible;
+    }
+
+    public Object getAccessor() {
+        return accessor;
+    }
+
     public QueryGroup<T> getWhereGroup() {
         return where;
     }
@@ -318,7 +328,9 @@ public Query<T> has(Query<?> relation) {
     }
 
     public Query<T> accessible(Object accessor) {
-        return repo.accessible(this, accessor);
+        this.applyAccessible = true;
+        this.accessor = accessor;
+        return this;
     }
 
     public Query<T> filter(Map<String, String> filter) {

src/main/java/org/javawebstack/orm/wrapper/builder/MySQLQueryStringBuilder.java

@@ -1,10 +1,12 @@
 package org.javawebstack.orm.wrapper.builder;
 
-import org.javawebstack.orm.Repo;
-import org.javawebstack.orm.SQLMapper;
-import org.javawebstack.orm.TableInfo;
+import org.javawebstack.orm.*;
+import org.javawebstack.orm.exception.ORMQueryException;
 import org.javawebstack.orm.query.*;
 
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
 import java.sql.Timestamp;
 import java.time.Instant;
 import java.util.*;
@@ -15,6 +17,16 @@ public class MySQLQueryStringBuilder implements QueryStringBuilder {
 
     public static final MySQLQueryStringBuilder INSTANCE = new MySQLQueryStringBuilder();
 
+    private static Method accessibleAccessMethod;
+
+    static {
+        try {
+            accessibleAccessMethod = Accessible.class.getDeclaredMethod("access", Query.class, QueryGroup.class, Object.class);
+        } catch (NoSuchMethodException e) {
+            e.printStackTrace();
+        }
+    }
+
     public SQLQueryString buildInsert(TableInfo info, Map<String, Object> values) {
         List<Object> params = new ArrayList<>();
         StringBuilder sb = new StringBuilder("INSERT INTO `");
@@ -48,6 +60,18 @@ public SQLQueryString buildQuery(Query<?> query) {
                 .append('`');
         QueryGroup<?> where = query.getWhereGroup();
         checkWithDeleted(repo, query.isWithDeleted(), where);
+        if(query.shouldApplyAccessible()) {
+            QueryGroup<?> actualWhere = where;
+            where = new QueryGroup<>()
+                    .and(q -> (QueryGroup<Model>) actualWhere)
+                    .and(q -> {
+                        try {
+                            return (QueryGroup<Model>) accessibleAccessMethod.invoke(repo.getAccessible(), query, q, query.getAccessor());
+                        } catch (IllegalAccessException | InvocationTargetException e) {
+                            throw new ORMQueryException(e);
+                        }
+                    });
+        }
         if (!where.getQueryElements().isEmpty()) {
             SQLQueryString qs = convertGroup(repo.getInfo(), where);
             sb.append(" WHERE ").append(qs.getQuery());