src/org/ohmage/service/UserMediaServices.java
public void verifyUserCanReadMedia(
			final String username, 
			final UUID id)
			throws ServiceException {
		
		try {
			// If it is their own image, they can read it.
			if(username.equals(userMediaQueries.getMediaOwner(id))) {
				return;
			}
			
			// If they are an admin, they can read it.
			if(userQueries.userIsAdmin(username)) {
				return;
			}
			
			// Retrieve all of the campaigns associated with an image.
			List<String> campaignIds = 
				campaignVideoQueries.getCampaignIdsForMediaId(id);
			
			// For each of the campaigns, see if the requesting user has 
			// sufficient permissions.
			for(String campaignId : campaignIds) {
				List<Campaign.Role> roles = 
					userCampaignQueries.getUserCampaignRoles(
						username, 
						campaignId);

				// If they are a supervisor.
				if(roles.contains(Campaign.Role.SUPERVISOR)) {
					return;
				}
				
				// Retrieves the privacy state of the image in this campaign. 
				// If null is returned, something has changed since the list of
				// campaign IDs was retrieved, so we need to just error out.
				SurveyResponse.PrivacyState imagePrivacyState = 
					campaignVideoQueries.getMediaPrivacyStateInCampaign(
						campaignId, id);
				
				// They are an author and the image is shared
				if(roles.contains(Campaign.Role.AUTHOR) && 
						SurveyResponse.PrivacyState.SHARED.equals(imagePrivacyState)) {
					return;
				}
				
				// Retrieve the campaign's privacy state.
				Campaign.PrivacyState campaignPrivacyState = 
					campaignQueries.getCampaignPrivacyState(campaignId);
				
				// They are an analyst, the image is shared, and the campaign is shared.
				if(roles.contains(Campaign.Role.ANALYST) && 
						SurveyResponse.PrivacyState.SHARED.equals(imagePrivacyState) &&
						Campaign.PrivacyState.SHARED.equals(campaignPrivacyState)) {
					
					return;
				}
			}
			
			// If we made it to this point, the requesting user doesn't have
			// sufficient permissions to read the image.
			throw new ServiceException(
					ErrorCode.IMAGE_INSUFFICIENT_PERMISSIONS, 
					"The user doesn't have sufficient permissions to read the image.");
		}
		catch(DataAccessException e) {
			throw new ServiceException(e);
		}
	}
/**
	 * Retrieves the URL of a video based on the user's 
	 * 
	 * @param username The user's username.
	 * 
	 * @param videoId The video's unique identifier.
	 * 
	 * @return The URL of the video.
	 * 
	 * @throws ServiceException The user is not allowed to read the video or
	 * 							there was an error.
	 */
Retrieves the URL of a video based on the user's

@param username The user's username.

@param videoId The video's unique identifier.

@return The URL of the video.

@throws ServiceException The user is not allowed to read the video or
there was an error.
Retrieves the URL of a video based on the user ' s @param username The user ' s username . @param videoId The video ' s unique identifier . @return The URL of the video . @throws ServiceException The user is not allowed to read the video or there was an error .
public void verifyUserCanReadMedia(
			final String username, 
			final UUID id)
			throws ServiceException {
		try {
			if(username.equals(userMediaQueries.getMediaOwner(id))) {
				return;
			}
			if(userQueries.userIsAdmin(username)) {
				return;
			}
			List<String> campaignIds = 
				campaignVideoQueries.getCampaignIdsForMediaId(id);
			for(String campaignId : campaignIds) {
				List<Campaign.Role> roles = 
					userCampaignQueries.getUserCampaignRoles(
						username, 
						campaignId);
				if(roles.contains(Campaign.Role.SUPERVISOR)) {
					return;
				}
				SurveyResponse.PrivacyState imagePrivacyState = 
					campaignVideoQueries.getMediaPrivacyStateInCampaign(
						campaignId, id);
				if(roles.contains(Campaign.Role.AUTHOR) && 
						SurveyResponse.PrivacyState.SHARED.equals(imagePrivacyState)) {
					return;
				}
				Campaign.PrivacyState campaignPrivacyState = 
					campaignQueries.getCampaignPrivacyState(campaignId);
				if(roles.contains(Campaign.Role.ANALYST) && 
						SurveyResponse.PrivacyState.SHARED.equals(imagePrivacyState) &&
						Campaign.PrivacyState.SHARED.equals(campaignPrivacyState)) {
					return;
				}
			}
			throw new ServiceException(
					ErrorCode.IMAGE_INSUFFICIENT_PERMISSIONS, 
					"The user doesn't have sufficient permissions to read the image.");
		}
		catch(DataAccessException e) {
			throw new ServiceException(e);
		}
	}
public void verifyUserCanReadMedia ( final String username , final UUID id ) throws ServiceException { try { if ( username . equals ( userMediaQueries . getMediaOwner ( id ) ) ) { return ; } if ( userQueries . userIsAdmin ( username ) ) { return ; } List < String > campaignIds = campaignVideoQueries . getCampaignIdsForMediaId ( id ) ; for ( String campaignId : campaignIds ) { List < Campaign . Role > roles = userCampaignQueries . getUserCampaignRoles ( username , campaignId ) ; if ( roles . contains ( Campaign . Role . SUPERVISOR ) ) { return ; } SurveyResponse . PrivacyState imagePrivacyState = campaignVideoQueries . getMediaPrivacyStateInCampaign ( campaignId , id ) ; if ( roles . contains ( Campaign . Role . AUTHOR ) && SurveyResponse . PrivacyState . SHARED . equals ( imagePrivacyState ) ) { return ; } Campaign . PrivacyState campaignPrivacyState = campaignQueries . getCampaignPrivacyState ( campaignId ) ; if ( roles . contains ( Campaign . Role . ANALYST ) && SurveyResponse . PrivacyState . SHARED . equals ( imagePrivacyState ) && Campaign . PrivacyState . SHARED . equals ( campaignPrivacyState ) ) { return ; } } throw new ServiceException ( ErrorCode . IMAGE_INSUFFICIENT_PERMISSIONS , "The user doesn't have sufficient permissions to read the image." ) ; } catch ( DataAccessException e ) { throw new ServiceException ( e ) ; } }
Retrieves the URL of a video based on the user's
Retrieves the URL of a video based on the user ' s
// If it is their own image, they can read it. // If they are an admin, they can read it. // Retrieve all of the campaigns associated with an image. // For each of the campaigns, see if the requesting user has  // sufficient permissions. // If they are a supervisor. // Retrieves the privacy state of the image in this campaign.  // If null is returned, something has changed since the list of // campaign IDs was retrieved, so we need to just error out. // They are an author and the image is shared // Retrieve the campaign's privacy state. // They are an analyst, the image is shared, and the campaign is shared. // If we made it to this point, the requesting user doesn't have // sufficient permissions to read the image.