Source:
<code>public Response deleteFile(@PathParam("USERENTITYID") Long userEntityId, @PathParam("IDENTIFIER") String identifier, @Context Request request) { UserEntity userEntity = userEntityController.findUserEntityById(userEntityId); if (userEntity == null) { return Response.status(Status.NOT_FOUND).build(); } UserEntityFile userEntityFile = userEntityFileController.findByUserEntityAndIdentifier(userEntity, identifier); if (userEntityFile == null) { return Response.status(Status.NOT_FOUND).build(); } UserEntity loggedUserEntity = sessionController.getLoggedUserEntity(); if (loggedUserEntity == null) { return Response.status(Status.FORBIDDEN).build(); } EnvironmentUser environmentUser = environmentUserController.findEnvironmentUserByUserEntity(loggedUserEntity); <START> boolean isOwnerOfTheFileAndFileIsPublic = userEntity.getId().equals(loggedUserEntity.getId()) && userEntityFile.getVisibility() == UserEntityFileVisibility.PUBLIC; <END> boolean isAdministrator = environmentUser != null && environmentUser.getRole() != null && environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.ADMINISTRATOR; boolean isStaff = environmentUser != null && environmentUser.getRole() != null && ( environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.MANAGER || environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.TEACHER || environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.STUDY_GUIDER || environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.STUDY_PROGRAMME_LEADER ); boolean isStaffAndFileIsAccessibleByStaff = isStaff && userEntityFile.getVisibility() == UserEntityFileVisibility.STAFF; if (!isOwnerOfTheFileAndFileIsPublic && !isAdministrator && !isStaffAndFileIsAccessibleByStaff) { return Response.status(Status.FORBIDDEN).build(); } userEntityFileController.deleteUserEntityFile(userEntityFile); return Response.noContent().build(); }</code><technical_language>This prevent users deleting files PUBLIC. allowed if: - owner of file, visibility - a staff member visibility of file is PUBLIC STAFF Also, a more compact determine staff member simply if EnvironmentRoleArchetype is STUDENT</technical_language>

Target:
public Response deleteFile(@PathParam("USERENTITYID") Long userEntityId, @PathParam("IDENTIFIER") String identifier, @Context Request request) { UserEntity userEntity = userEntityController.findUserEntityById(userEntityId); if (userEntity == null) { return Response.status(Status.NOT_FOUND).build(); } UserEntityFile userEntityFile = userEntityFileController.findByUserEntityAndIdentifier(userEntity, identifier); if (userEntityFile == null) { return Response.status(Status.NOT_FOUND).build(); } UserEntity loggedUserEntity = sessionController.getLoggedUserEntity(); if (loggedUserEntity == null) { return Response.status(Status.FORBIDDEN).build(); } EnvironmentUser environmentUser = environmentUserController.findEnvironmentUserByUserEntity(loggedUserEntity); boolean isOwnerOfTheFile = userEntity.getId().equals(loggedUserEntity.getId()); boolean isAdministrator = environmentUser != null && environmentUser.getRole() != null && environmentUser.getRole().getArchetype() == EnvironmentRoleArchetype.ADMINISTRATOR; boolean isStaff = environmentUser != null && environmentUser.getRole() != null && environmentUser.getRole().getArchetype() != EnvironmentRoleArchetype.STUDENT; boolean isStaffAndFileIsAccessibleByStaff = isStaff && ( userEntityFile.getVisibility() == UserEntityFileVisibility.STAFF || userEntityFile.getVisibility() == UserEntityFileVisibility.PUBLIC); if (!isOwnerOfTheFile && !isAdministrator && !isStaffAndFileIsAccessibleByStaff) { return Response.status(Status.FORBIDDEN).build(); } userEntityFileController.deleteUserEntityFile(userEntityFile); return Response.noContent().build(); }