From 5f68a227da3ea5bae85eff35b65858dede3175a6 Mon Sep 17 00:00:00 2001
From: Bruno Roemers <bruno.roemers@atmire.com>
Date: Mon, 25 Jan 2021 20:59:05 +0100
Subject: [PATCH] 74236: Implement boundary checks

---
 .../submit/model/AccessConditionOption.java   | 41 ++++++++++++++++++-
 .../impl/BitstreamResourcePolicyUtils.java    |  5 ++-
 2 files changed, 42 insertions(+), 4 deletions(-)

diff --git a/dspace-api/src/main/java/org/dspace/submit/model/AccessConditionOption.java b/dspace-api/src/main/java/org/dspace/submit/model/AccessConditionOption.java
index 1c13f99398..22898a8a38 100644
--- a/dspace-api/src/main/java/org/dspace/submit/model/AccessConditionOption.java
+++ b/dspace-api/src/main/java/org/dspace/submit/model/AccessConditionOption.java
@@ -8,6 +8,7 @@
 package org.dspace.submit.model;
 
 import java.sql.SQLException;
+import java.text.ParseException;
 import java.util.Date;
 
 import org.dspace.authorize.AuthorizeException;
@@ -18,6 +19,7 @@ import org.dspace.core.Constants;
 import org.dspace.core.Context;
 import org.dspace.eperson.Group;
 import org.dspace.eperson.service.GroupService;
+import org.dspace.util.DateMathParser;
 import org.springframework.beans.factory.annotation.Autowired;
 
 /**
@@ -38,6 +40,8 @@ public class AccessConditionOption {
     @Autowired
     GroupService groupService;
 
+    DateMathParser dateMathParser = new DateMathParser();
+
     /** An unique name identifying the access contion option **/
     private String name;
 
@@ -140,7 +144,8 @@ public class AccessConditionOption {
     }
 
     public void createResourcePolicy(Context context, Bitstream b, String name, String description,
-                                     Date startDate, Date endDate) throws SQLException, AuthorizeException {
+                                     Date startDate, Date endDate)
+            throws SQLException, AuthorizeException, ParseException {
         if (getHasStartDate() && startDate == null) {
             throw new IllegalStateException("The access condition " + getName() + " requires a start date.");
         }
@@ -153,7 +158,39 @@ public class AccessConditionOption {
         if (!getHasEndDate() && endDate != null) {
             throw new IllegalStateException("The access condition " + getName() + " cannot contain an end date.");
         }
-        //TODO: check date limits as well
+
+        Date earliestStartDate = null;
+        if (getStartDateLimit() != null) {
+            earliestStartDate = dateMathParser.parseMath(getStartDateLimit());
+        }
+
+        Date latestEndDate = null;
+        if (getEndDateLimit() != null) {
+            latestEndDate = dateMathParser.parseMath(getEndDateLimit());
+        }
+
+        // throw if latestEndDate before earliestStartDate
+        if (earliestStartDate != null && latestEndDate != null && earliestStartDate.compareTo(latestEndDate) > 0) {
+            throw new IllegalStateException(String.format(
+                "The boundaries of %s overlap: [%s, %s]", getName(), getStartDateLimit(), getEndDateLimit()
+            ));
+        }
+
+        // throw if startDate before earliestStartDate
+        if (earliestStartDate != null && earliestStartDate.compareTo(startDate) > 0) {
+            throw new IllegalStateException(String.format(
+                "The start date of access condition %s should be later than %s from now.",
+                getName(), getStartDateLimit()
+            ));
+        }
+
+        // throw if endDate after latestEndDate
+        if (latestEndDate != null && latestEndDate.compareTo(endDate) < 0) {
+            throw new IllegalStateException(String.format(
+                "The end date of access condition %s should be earlier than %s from now.", getName(), getEndDateLimit()
+            ));
+        }
+
         Group group = groupService.findByName(context, getGroupName());
         authorizeService.createResourcePolicy(context, b, group, null, Constants.READ,
                 ResourcePolicy.TYPE_CUSTOM, name, description, startDate,
diff --git a/dspace-server-webapp/src/main/java/org/dspace/app/rest/submit/factory/impl/BitstreamResourcePolicyUtils.java b/dspace-server-webapp/src/main/java/org/dspace/app/rest/submit/factory/impl/BitstreamResourcePolicyUtils.java
index 4b9a0ae133..7261aa86b3 100644
--- a/dspace-server-webapp/src/main/java/org/dspace/app/rest/submit/factory/impl/BitstreamResourcePolicyUtils.java
+++ b/dspace-server-webapp/src/main/java/org/dspace/app/rest/submit/factory/impl/BitstreamResourcePolicyUtils.java
@@ -8,6 +8,7 @@
 package org.dspace.app.rest.submit.factory.impl;
 
 import java.sql.SQLException;
+import java.text.ParseException;
 import java.util.Date;
 import java.util.Iterator;
 
@@ -47,7 +48,7 @@ public class BitstreamResourcePolicyUtils {
      */
     public static void findApplyResourcePolicy(Context context, Iterator<UploadConfiguration> uploadConfigs,
                                          Bitstream b, UploadBitstreamAccessConditionDTO newAccessCondition)
-            throws SQLException, AuthorizeException {
+            throws SQLException, AuthorizeException, ParseException {
         String name = newAccessCondition.getName();
         String description = newAccessCondition.getDescription();
 
@@ -75,7 +76,7 @@ public class BitstreamResourcePolicyUtils {
     public static void findApplyResourcePolicy(Context context, Iterator<UploadConfiguration> uploadConfigs,
                                                Bitstream b, String name, String description,
                                                Date startDate, Date endDate)
-            throws SQLException, AuthorizeException {
+            throws SQLException, AuthorizeException, ParseException {
         while (uploadConfigs
                 .hasNext()) {
             UploadConfiguration uploadConfiguration = uploadConfigs.next();