7 files changed, 131 insertions, 31 deletions

diff --git a/src/Wallabag/CoreBundle/Controller/WallabagRestController.php b/src/Wallabag/CoreBundle/Controller/WallabagRestController.php
index e59ad4b7..81bfbe12 100644
--- a/src/Wallabag/CoreBundle/Controller/WallabagRestController.php
+++ b/src/Wallabag/CoreBundle/Controller/WallabagRestController.php
@@ -9,10 +9,36 @@ use Symfony\Component\HttpFoundation\Response;
 use Wallabag\CoreBundle\Entity\Entry;
 use Wallabag\CoreBundle\Entity\Tag;
 use Wallabag\CoreBundle\Service\Extractor;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 
 class WallabagRestController extends Controller
 {
     /**
+     * @param Entry  $entry
+     * @param string $tags
+     */
+    private function assignTagsToEntry(Entry $entry, $tags)
+    {
+        foreach (explode(',', $tags) as $label) {
+            $label = trim($label);
+            $tagEntity = $this
+                ->getDoctrine()
+                ->getRepository('WallabagCoreBundle:Tag')
+                ->findOneByLabel($label);
+
+            if (is_null($tagEntity)) {
+                $tagEntity = new Tag($this->getUser());
+                $tagEntity->setLabel($label);
+            }
+
+            // only add the tag on the entry if the relation doesn't exist
+            if (!$entry->getTags()->contains($tagEntity)) {
+                $entry->addTag($tagEntity);
+            }
+        }
+    }
+
+    /**
      * Retrieve salt for a giver user.
      *
      * @ApiDoc(
@@ -87,6 +113,10 @@ class WallabagRestController extends Controller
      */
     public function getEntryAction(Entry $entry)
     {
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
         $json = $this->get('serializer')->serialize($entry, 'json');
 
         return new Response($json, 200, array('application/json'));
@@ -106,7 +136,6 @@ class WallabagRestController extends Controller
      */
     public function postEntriesAction(Request $request)
     {
-        //TODO gérer si on passe les tags
         $url = $request->request->get('url');
 
         $content = Extractor::extract($url);
@@ -114,6 +143,9 @@ class WallabagRestController extends Controller
         $entry->setUrl($url);
         $entry->setTitle($request->request->get('title') ?: $content->getTitle());
         $entry->setContent($content->getBody());
+
+        $this->assignTagsToEntry($entry, $request->request->get('tags', array()));
+
         $em = $this->getDoctrine()->getManager();
         $em->persist($entry);
         $em->flush();
@@ -141,8 +173,11 @@ class WallabagRestController extends Controller
      */
     public function patchEntriesAction(Entry $entry, Request $request)
     {
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
         $title      = $request->request->get("title");
-        $tags       = $request->request->get("tags", array());
         $isArchived = $request->request->get("archive");
         $isStarred  = $request->request->get("star");
 
@@ -158,6 +193,8 @@ class WallabagRestController extends Controller
             $entry->setStarred($isStarred);
         }
 
+        $this->assignTagsToEntry($entry, $request->request->get('tags', array()));
+
         $em = $this->getDoctrine()->getManager();
         $em->flush();
 
@@ -176,6 +213,10 @@ class WallabagRestController extends Controller
      */
     public function deleteEntriesAction(Entry $entry)
     {
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
         $em = $this->getDoctrine()->getManager();
         $em->remove($entry);
         $em->flush();
@@ -196,6 +237,12 @@ class WallabagRestController extends Controller
      */
     public function getEntriesTagsAction(Entry $entry)
     {
+        var_dump($entry->getUser()->getId());
+        var_dump($this->getUser()->getId());
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
         $json = $this->get('serializer')->serialize($entry->getTags(), 'json');
 
         return new Response($json, 200, array('application/json'));
@@ -215,25 +262,12 @@ class WallabagRestController extends Controller
      */
     public function postEntriesTagsAction(Request $request, Entry $entry)
     {
-        $tags = explode(',', $request->request->get('tags'));
-
-        foreach ($tags as $label) {
-            $tagEntity = $this
-                ->getDoctrine()
-                ->getRepository('WallabagCoreBundle:Tag')
-                ->findOneByLabel($label);
-
-            if (is_null($tagEntity)) {
-                $tagEntity = new Tag();
-                $tagEntity->setLabel($label);
-            }
-
-            // only add the tag on the entry if the relation doesn't exist
-            if (!$entry->getTags()->contains($tagEntity)) {
-                $entry->addTag($tagEntity);
-            }
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
         }
 
+        $this->assignTagsToEntry($entry, $request->request->get('tags', array()));
+
         $em = $this->getDoctrine()->getManager();
         $em->persist($entry);
         $em->flush();
@@ -255,17 +289,30 @@ class WallabagRestController extends Controller
      */
     public function deleteEntriesTagsAction(Entry $entry, Tag $tag)
     {
+        if ($entry->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
+        $entry->removeTag($tag);
+        $em = $this->getDoctrine()->getManager();
+        $em->persist($entry);
+        $em->flush();
+
+        $json = $this->get('serializer')->serialize($entry, 'json');
+
+        return new Response($json, 200, array('application/json'));
     }
 
     /**
      * Retrieve all tags
      *
-     * @ApiDoc(
-     *          {"name"="user", "dataType"="integer", "requirement"="\w+", "description"="The user ID"}
-     * )
+     * @ApiDoc()
      */
-    public function getTagsUserAction()
+    public function getTagsAction()
     {
+        $json = $this->get('serializer')->serialize($this->getUser()->getTags(), 'json');
+
+        return new Response($json, 200, array('application/json'));
     }
 
     /**
@@ -279,5 +326,16 @@ class WallabagRestController extends Controller
      */
     public function deleteTagAction(Tag $tag)
     {
+        if ($tag->getUser()->getId() != $this->getUser()->getId()) {
+            throw $this->createAccessDeniedException();
+        }
+
+        $em = $this->getDoctrine()->getManager();
+        $em->remove($tag);
+        $em->flush();
+
+        $json = $this->get('serializer')->serialize($tag, 'json');
+
+        return new Response($json, 200, array('application/json'));
     }
 }
diff --git a/src/Wallabag/CoreBundle/DataFixtures/ORM/LoadEntryData.php b/src/Wallabag/CoreBundle/DataFixtures/ORM/LoadEntryData.php
index edab9adc..b0f07755 100644
--- a/src/Wallabag/CoreBundle/DataFixtures/ORM/LoadEntryData.php
+++ b/src/Wallabag/CoreBundle/DataFixtures/ORM/LoadEntryData.php
@@ -38,9 +38,9 @@ class LoadEntryData extends AbstractFixture implements OrderedFixtureInterface
         $entry3->setTitle('test title entry3');
         $entry3->setContent('This is my content /o/');
 
-        $tag1 = new Tag();
+        $tag1 = new Tag($this->getReference('admin-user'));
         $tag1->setLabel("foo");
-        $tag2 = new Tag();
+        $tag2 = new Tag($this->getReference('admin-user'));
         $tag2->setLabel("bar");
 
         $entry3->addTag($tag1);
diff --git a/src/Wallabag/CoreBundle/Entity/Entry.php b/src/Wallabag/CoreBundle/Entity/Entry.php
index 229a6704..75aeae84 100644
--- a/src/Wallabag/CoreBundle/Entity/Entry.php
+++ b/src/Wallabag/CoreBundle/Entity/Entry.php
@@ -406,4 +406,9 @@ class Entry
         $this->tags[] = $tag;
         $tag->addEntry($this);
     }
+
+    public function removeTag(Tag $tag)
+    {
+        $this->tags->removeElement($tag);
+    }
 }
diff --git a/src/Wallabag/CoreBundle/Entity/Tag.php b/src/Wallabag/CoreBundle/Entity/Tag.php
index 5aed1fa0..29a5e4b5 100644
--- a/src/Wallabag/CoreBundle/Entity/Tag.php
+++ b/src/Wallabag/CoreBundle/Entity/Tag.php
@@ -41,8 +41,14 @@ class Tag
      */
     private $entries;
 
-    public function __construct()
+    /**
+     * @ORM\ManyToOne(targetEntity="User", inversedBy="tags")
+     */
+    private $user;
+
+    public function __construct(User $user)
     {
+        $this->user    = $user;
         $this->entries = new ArrayCollection();
     }
     /**
diff --git a/src/Wallabag/CoreBundle/Entity/User.php b/src/Wallabag/CoreBundle/Entity/User.php
index 5589c039..f05c8760 100644
--- a/src/Wallabag/CoreBundle/Entity/User.php
+++ b/src/Wallabag/CoreBundle/Entity/User.php
@@ -101,10 +101,17 @@ class User implements AdvancedUserInterface, \Serializable
      */
     private $config;
 
+    /**
+     * @ORM\OneToMany(targetEntity="Tag", mappedBy="user", cascade={"remove"})
+     */
+    private $tags;
+
     public function __construct()
     {
-        $this->salt    = md5(uniqid(null, true));
-        $this->entries = new ArrayCollection();
+        $this->isActive = true;
+        $this->salt     = md5(uniqid(null, true));
+        $this->entries  = new ArrayCollection();
+        $this->tags     = new ArrayCollection();
     }
 
     /**
@@ -279,6 +286,25 @@ class User implements AdvancedUserInterface, \Serializable
     }
 
     /**
+     * @param Entry $entry
+     *
+     * @return User
+     */
+    public function addTag(Tag $tag)
+    {
+        $this->tags[] = $tag;
+
+        return $this;
+    }
+
+    /**
+     * @return ArrayCollection<Tag>
+     */
+    public function getTags()
+    {
+        return $this->tags;
+    }
+    /**
      * @inheritDoc
      */
     public function eraseCredentials()
diff --git a/src/Wallabag/CoreBundle/Repository/EntryRepository.php b/src/Wallabag/CoreBundle/Repository/EntryRepository.php
index 10fb9bf7..a8085ac9 100644
--- a/src/Wallabag/CoreBundle/Repository/EntryRepository.php
+++ b/src/Wallabag/CoreBundle/Repository/EntryRepository.php
@@ -124,11 +124,14 @@ class EntryRepository extends EntityRepository
      *
      * @return Entry
      */
-    public function findOneWithTags()
+    public function findOneWithTags($userId)
     {
         $qb = $this->createQueryBuilder('e')
             ->innerJoin('e.tags', 't')
-            ->addSelect('t');
+            ->addSelect('t')
+            ->where('t.user=:userId')->setParameter('userId', 1);
+
+        return $qb->getQuery()->getOneOrNullResult();
 
         return $qb
             ->getQuery()
diff --git a/src/Wallabag/CoreBundle/Tests/Controller/WallabagRestControllerTest.php b/src/Wallabag/CoreBundle/Tests/Controller/WallabagRestControllerTest.php
index cadbb70b..04448537 100644
--- a/src/Wallabag/CoreBundle/Tests/Controller/WallabagRestControllerTest.php
+++ b/src/Wallabag/CoreBundle/Tests/Controller/WallabagRestControllerTest.php
@@ -161,7 +161,9 @@ class WallabagRestControllerTest extends WallabagTestCase
         $entry = $client->getContainer()
             ->get('doctrine.orm.entity_manager')
             ->getRepository('WallabagCoreBundle:Entry')
-            ->findOneWithTags();
+            ->findOneWithTags(1);
+
+        var_dump($entry->getTitle());
 
         if (!$entry) {
             $this->markTestSkipped('No content found in db.');