<!--
  Licensed to the Apache Software Foundation (ASF) under one
  or more contributor license agreements.  See the NOTICE file
  distributed with this work for additional information
  regarding copyright ownership.  The ASF licenses this file
  to you under the Apache License, Version 2.0 (the
  "License"); you may not use this file except in compliance
  with the License.  You may obtain a copy of the License at

  http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing,
  software distributed under the License is distributed on an
  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  KIND, either express or implied.  See the License for the
  specific language governing permissions and limitations
  under the License.
  -->

<simple-methods xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns="http://ofbiz.apache.org/Simple-Method" xsi:schemaLocation="http://ofbiz.apache.org/Simple-Method http://ofbiz.apache.org/dtds/simple-methods.xsd">

    <simple-method method-name="contentManagerPermission" short-description="Check user has Content Manager permission">
        <set field="primaryPermission" value="CONTENTMGR"/>
        <call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
    </simple-method>
    <simple-method method-name="contentManagerRolePermission" short-description="Check user has Content Manager permission">
        <set field="primaryPermission" value="CONTENTMGR"/>
        <set field="altPermission" value="CONTENTMGR_ROLE"/>
        <call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
    </simple-method>

    <simple-method method-name="genericContentPermission" short-description="Generic Service for Content Permissions">
        <set field="primaryPermission" value="CONTENTMGR"/>
        <call-simple-method method-name="genericBasePermissionCheck" xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>

        <!-- setting the roleEntity or this service -->
        <set field="roleEntityField" value="contentId"/>
        <set field="roleEntity" value="ContentRole"/>
        <!-- here we can use contentIdTo to check parent(s) ownership -->
        <if>
            <condition>
                <and>
                    <if-empty field="parameters.ownerContentId"/>
                    <not>
                        <if-empty field="parameters.contentIdFrom"/>
                    </not>
                </and>
            </condition>
            <then>
                <set field="ownerContentId" from-field="parameters.contentIdFrom"/>
            </then>
        </if>

        <!-- mainAction based call outs -->
        <if>
            <condition>
                <not>
                    <if-compare field="hasPermission" value="true" type="Boolean" operator="equals"/>
                </not>
            </condition>
            <then>
                <if>
                    <!-- view content -->
                    <condition>
                        <if-compare field="parameters.mainAction" value="VIEW" operator="equals"/>
                    </condition>
                    <then>
                        <call-simple-method method-name="viewContentPermission"/>
                    </then>
                    <else-if>
                        <!-- create content -->
                        <condition>
                            <if-compare field="parameters.mainAction" value="CREATE" operator="equals"/>
                        </condition>
                        <then>
                            <!-- setup default operation -->
                            <if-empty field="parameters.contentOperationId">
                                <set field="contentOperationId" value="CONTENT_CREATE"/>
                            </if-empty>
                            <call-simple-method method-name="createContentPermission"/>
                        </then>
                    </else-if>
                    <else-if>
                        <!-- update content -->
                        <condition>
                            <if-compare field="parameters.mainAction" value="UPDATE" operator="equals"/>
                        </condition>
                        <then>
                            <!-- setup default operation -->
                            <if-empty field="parameters.contentOperationId">
                                <set field="contentOperationId" value="CONTENT_UPDATE"/>
                            </if-empty>
                            <call-simple-method method-name="updateContentPermission"/>
                        </then>
                    </else-if>
                    <!-- all other actions use main base check -->
                </if>
            </then>
            <else>
                <log level="info" message="Admin permission found: ${primaryPermission}_${mainAction}"/>
            </else>
        </if>

        <log level="info" message="Permission service [${mainAction} / ${parameters.contentId}] completed; returning hasPermission = ${hasPermission}"/>
        <field-to-result field="hasPermission"/>
    </simple-method>

    <simple-method method-name="viewContentPermission" short-description="Check user can view content">
        <!-- if called directly check the main permission -->
        <if-empty field="hasPermission">
            <set field="primaryPermission" value="CONTENTMGR"/>
            <set field="mainAction" value="VIEW"/>
            <call-simple-method method-name="genericBasePermissionCheck"
                                xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
        </if-empty>

        <!-- check content role permission -->
        <set field="primaryPermission" value="CONTENTMGR_ROLE"/>
        <call-simple-method method-name="genericBasePermissionCheck"
                            xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>

        <!-- must have the security permission to continue -->
        <if>
            <condition>
                <if-compare field="hasPermission" value="true" type="Boolean" operator="equals"/>
            </condition>
            <then>
                <!-- if no operation is passed; we use the CONTENT_VIEW operation -->
                <if-empty field="parameters.contentOperationId">
                    <set field="parameters.contentOperationId" value="CONTENT_VIEW"/>
                </if-empty>

                <!-- contentId is required for update checking -->
                <if-empty field="contentId">
                    <set field="contentId" from-field="parameters.contentId"/>
                </if-empty>
                <if-empty field="contentId">
                    <add-error>
                        <fail-property resource="ContentUiLabels" property="ContentViewPermissionError"/>
                    </add-error>
                </if-empty>
                <check-errors/>

                <!-- grab the current requested content record -->
                <entity-one entity-name="Content" value-field="content">
                    <field-map field-name="contentId" from-field="contentId"/>
                </entity-one>

                <!-- check the operation security -->
                <set field="contentOperationId" from-field="parameters.contentOperationId"/>
                <set field="content" from-field="content"/>
                <set field="checkId" from-field="contentId"/>
                <call-simple-method method-name="checkContentOperationSecurity"/>
            </then>
        </if>
    </simple-method>

    <simple-method method-name="createContentPermission" short-description="Check user can create new content">
        <!-- if called directly check the main permission -->
        <if-empty field="hasPermission">
            <set field="primaryPermission" value="CONTENTMGR"/>
            <set field="mainAction" value="CREATE"/>
            <call-simple-method method-name="genericBasePermissionCheck"
                                xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
        </if-empty>

        <!-- ownerContentId can be set from a calling method -->
        <if-empty field="ownerContentId">
            <set field="ownerContentId" from-field="parameters.ownerContentId"/>
        </if-empty>

        <!-- operation ID can be set from the calling method -->
        <if-empty field="contentOperationId">
            <set field="contentOperationId" from-field="parameters.contentOperationId"/>
        </if-empty>

        <!-- statusId can be set from the calling method -->
        <if-empty field="statusId">
            <set field="statusId" from-field="parameters.statusId"/>
        </if-empty>

        <!-- check role permission? -->
        <set field="primaryPermission" value="CONTENTMGR_ROLE"/>
        <call-simple-method method-name="genericBasePermissionCheck"
                            xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>

        <!-- must have the security permission to continue -->
        <if>
            <condition>
                <if-compare field="hasPermission" value="true" type="Boolean" operator="equals"/>
            </condition>
            <then>
                <log level="verbose" message="Found necessary ROLE permission: ${primaryPermission}_${mainAction} :: ${contentOperationId}"/>

                <!-- if an operation is passed, check the operation security -->
                <if>
                    <condition>
                        <not>
                            <if-empty field="contentOperationId"/>
                        </not>
                    </condition>
                    <then>
                        <set field="checkId" from-field="ownerContentId"/>
                        <call-simple-method method-name="checkContentOperationSecurity"/>
                    </then>
                </if>

                <!-- check if there was no operation; or if the operation check failed, we are okay to create unless we are creating against a parent; check parent ownership -->
                <if>
                    <condition>
                        <or>
                            <if-empty field="contentOperationId"/>
                            <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                        </or>
                    </condition>
                    <then>
                        <if>
                            <condition>
                                <not>
                                    <if-empty field="ownerContentId"/>
                                </not>
                            </condition>
                            <then>
                                <log level="verbose" message="No operation found; but ownerContentId [${ownerContentId}] was; checking ownership"/>
                                <set field="checkId" from-field="ownerContentId"/>
                                <log level="verbose" message="Checking Parent Ownership [${checkId}]"/>
                                <call-simple-method method-name="checkOwnership"/>
                                <if>
                                    <condition>
                                        <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                    </condition>
                                    <then>
                                        <!-- no permission on this parent; check the parent's parent(s) -->
                                        <while>
                                            <condition>
                                                <!-- iterate until either we have permission or there are no more parents -->
                                                <and>
                                                    <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                                    <not>
                                                        <if-empty field="checkId"/>
                                                    </not>
                                                </and>
                                            </condition>
                                            <then>
                                                <entity-one entity-name="Content" value-field="currentContent">
                                                    <field-map field-name="contentId" from-field="checkId"/>
                                                </entity-one>
                                                <if>
                                                    <condition>
                                                        <not>
                                                            <if-empty field="currentContent.ownerContentId"/>
                                                        </not>
                                                    </condition>
                                                    <then>
                                                        <set field="checkId" from-field="currentContent.ownerContentId"/>
                                                        <log level="verbose" message="Checking Parent(s) Ownership [${checkId}]"/>
                                                        <call-simple-method method-name="checkOwnership"/>
                                                    </then>

                                                    <!-- no parent record found; time to stop recursion -->
                                                    <else>
                                                        <clear-field field="checkId"/>
                                                    </else>
                                                </if>
                                            </then>
                                        </while>
                                    </then>
                                    <else>
                                        <log level="verbose" message="Permission set to TRUE; granting access"/>
                                    </else>
                                </if>
                            </then>
                        </if>
                    </then>
                </if>
            </then>
        </if>
    </simple-method>

    <simple-method method-name="updateContentPermission" short-description="Check user can update existing content">
        <!-- if called directly check the main permission -->
        <if-empty field="hasPermission">
            <set field="primaryPermission" value="CONTENTMGR"/>
            <set field="mainAction" value="UPDATE"/>
            <call-simple-method method-name="genericBasePermissionCheck"
                                xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>
        </if-empty>

        <!-- contentId is required for update checking -->
        <if-empty field="contentId">
            <set field="contentId" from-field="parameters.contentId"/>
        </if-empty>
        <if-empty field="contentId">
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentSecurityUpdatePermission"/>
            </add-error>
        </if-empty>
        <check-errors/>

        <!-- ownerContentId can be set from a calling method -->
        <if-empty field="ownerContentId">
            <set field="ownerContentId" from-field="parameters.ownerContentId"/>
        </if-empty>

        <!-- operation ID can be set from the calling method -->
        <if-empty field="contentOperationId">
            <set field="contentOperationId" from-field="parameters.contentOperationId"/>
        </if-empty>

        <!-- check role permission -->
        <set field="primaryPermission" value="CONTENTMGR_ROLE"/>
        <call-simple-method method-name="genericBasePermissionCheck"
                            xml-resource="component://common/minilang/permission/CommonPermissionServices.xml"/>

        <!-- must have permission to continue -->
        <if>
            <condition>
                <if-compare field="hasPermission" value="true" type="Boolean" operator="equals"/>
            </condition>
            <then>
                <log level="verbose" message="Found necessary ROLE permission: ${primaryPermission}_${mainAction}"/>

                <!-- obtain the current content record -->
                <entity-one entity-name="Content" value-field="thisContent">
                    <field-map field-name="contentId"/>
                </entity-one>
                <if-empty field="thisContent">
                    <add-error>
                        <fail-property resource="ContentUiLabels" property="ContentNoContentFound"/>
                    </add-error>
                    <check-errors/>
                </if-empty>

                <!-- check the operation -->
                <if>
                    <condition>
                        <not>
                            <if-empty field="contentOperationId"/>
                        </not>
                    </condition>
                    <then>
                        <log level="verbose" message="Checking content operation for UPDATE: ${contentOperationId}"/>
                        <set field="checkId" from-field="contentId"/>
                        <call-simple-method method-name="checkContentOperationSecurity"/>
                    </then>
                </if>

                <!-- check if there was no operation; or if the operation check failed -->
                <if>
                    <condition>
                        <or>
                            <if-empty field="contentOperationId"/>
                            <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                        </or>
                    </condition>

                    <!-- if no valid operation is passed; check ownership for permission -->
                    <then>
                        <log level="verbose" message="No valid operation for UPDATE; checking ownership instead!"/>
                        <set field="checkId" from-field="contentId"/>
                        <call-simple-method method-name="checkOwnership"/>

                        <!-- we are okay to update; unless we are updating the owner content; verify ownership there -->
                        <if>
                            <condition>
                                <and>
                                    <not>
                                        <if-empty field="ownerContentId"/>
                                    </not>
                                    <if-compare-field field="thisContent.ownerContentId" to-field="ownerContentId" operator="not-equals"/>
                                </and>
                            </condition>
                            <then>
                                <log level="verbose" message="Updating content ownership; need to verify permision on parent(s)"/>
                                <set field="checkId" from-field="ownerContentId"/>
                                <call-simple-method method-name="checkOwnership"/>
                                <if>
                                    <condition>
                                        <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                    </condition>
                                    <then>
                                        <!-- no permission on this parent; check the parent's parent(s) -->
                                        <while>
                                            <condition>
                                                <!-- iterate until either we have permission or there are no more parents -->
                                                <and>
                                                    <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                                    <not>
                                                        <if-empty field="checkId"/>
                                                    </not>
                                                </and>
                                            </condition>
                                            <then>
                                                <entity-one entity-name="Content" value-field="currentContent">
                                                    <field-map field-name="contentId" from-field="checkId"/>
                                                </entity-one>
                                                <if>
                                                    <condition>
                                                        <not>
                                                            <if-empty field="currentContent.ownerContentId"/>
                                                        </not>
                                                    </condition>
                                                    <then>
                                                        <set field="checkId" from-field="currentContent.ownerContentId"/>
                                                        <call-simple-method method-name="checkOwnership"/>
                                                    </then>

                                                    <!-- no parent record found; time to stop recursion -->
                                                    <else>
                                                        <clear-field field="checkId"/>
                                                    </else>
                                                </if>
                                            </then>
                                        </while>
                                    </then>
                                </if>
                            </then>
                        </if>
                    </then>
                </if>
            </then>
        </if>
    </simple-method>


    <!-- method to check operation security -->
    <simple-method method-name="checkContentOperationSecurity" short-description="Checks for Operation defined security">
        <!-- resetting the permission flag -->
        <set field="hasPermission" type="Boolean" value="false"/>

        <if-empty field="contentOperationId">
            <set field="requiredField" value="contentOperationId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>

        <if-empty field="contentPurposeTypeId">
            <set field="contentPurposeTypeId" from-field="parameters.contentPurposeTypeId"/>
        </if-empty>
        <if-empty field="contentPurposeTypeId">
            <set field="contentPurposeTypeId" value="_NA_"/>
        </if-empty>

        <entity-one entity-name="Content" value-field="checkContent">
            <field-map field-name="contentId" from-field="checkId"/>
        </entity-one>
        <set field="statusId" from-field="checkContent.statusId"/>

        <!-- If operation is CONTENT_CREATE and contentPurposeTypeId exists in parameters than obtain operations
             for that contentPurposeTypeId, else get the operations for checkContent -->
        <if>
            <condition>
                <and>
                    <if-compare field="contentOperationId" operator="equals" value="CONTENT_CREATE"/>
                    <not>
                        <if-empty field="contentPurposeTypeId"/>
                    </not>
                </and>
            </condition>
            <then>
                <!-- find defined purpose/operation mappings -->
                <entity-condition entity-name="ContentPurposeOperation" list="operations">
                    <condition-list combine="and">
                        <condition-expr field-name="contentPurposeTypeId" operator="equals" from-field="contentPurposeTypeId"/>
                        <condition-expr field-name="contentOperationId" operator="equals" from-field="contentOperationId"/>
                    </condition-list>
                </entity-condition>
            </then>
            <else>
                <!-- get all purposes for checkContent -->
                <call-simple-method method-name="findAllContentPurposes"/>

                <!-- find defined purpose/operation mappings -->
                <iterate list="contentPurposes" entry="currentPurpose">
                    <entity-condition entity-name="ContentPurposeOperation" list="currentOperations">
                        <condition-list combine="and">
                            <condition-expr field-name="contentPurposeTypeId" operator="equals" from-field="currentPurpose.contentPurposeTypeId"/>
                            <condition-expr field-name="contentOperationId" operator="equals" from-field="contentOperationId"/>
                        </condition-list>
                        <order-by field-name="contentPurposeTypeId"/>
                    </entity-condition>
                    <list-to-list list="currentOperations" to-list="operations"/>
                </iterate>

                <!-- check the _NA_ purpose but only if no other purposes were found -->
                <if-empty field="contentPurposes">
                    <entity-condition entity-name="ContentPurposeOperation" list="operations">
                        <condition-list combine="and">
                            <condition-expr field-name="contentPurposeTypeId" operator="equals" value="_NA_"/>
                            <condition-expr field-name="contentOperationId" operator="equals" from-field="contentOperationId"/>
                        </condition-list>
                        <order-by field-name="contentPurposeTypeId"/>
                    </entity-condition>
                </if-empty>
            </else>
        </if>

        <!-- place holder for the content ID -->
        <set field="toCheckContentId" from-field="checkId"/>
        <log level="verbose" message="[${checkId}] Found Operations [${contentPurposeTypeId}/${contentOperationId}] :: ${operations}"/>

        <if>
            <condition>
                <if-empty field="operations"/>
            </condition>
            <!-- there are no ContentPurposeOperation entries for this operation/purpose; default is approve permission -->
            <then>
                <log level="verbose" message="No operations found; permission granted!"/>
                <set field="hasPermission" type="Boolean" value="true"/>
            </then>
            <!-- there are requirements to test -->
            <else>
                <!-- get all possible partyIds for this user (including group memberships) -->
                <call-simple-method method-name="findAllAssociatedPartyIds"/>

                <!-- check each operation security -->
                <iterate list="operations" entry="operation">
                    <if-compare field="hasPermission" value="false" type="Boolean" operator="equals">
                        <!-- reset the checkId if needed -->
                        <if>
                            <condition>
                                <and>
                                    <if-empty field="checkId"/>
                                    <not>
                                        <if-empty field="toCheckContentId"/>
                                    </not>
                                </and>
                            </condition>
                            <then>
                                <set field="checkId" from-field="toCheckContentId"/>
                            </then>
                        </if>

                        <log level="verbose" message="Testing [${checkId}] [${statusId}] OPERATION: ${operation}"/>

                        <!-- check statusId -->
                        <if>
                            <condition>
                                <or>
                                    <if-compare field="operation.statusId" value="_NA_" operator="equals"/>
                                    <and>
                                        <not>
                                            <if-empty field="statusId"/>
                                        </not>
                                        <if-compare-field field="operation.statusId" to-field="statusId" operator="equals"/>
                                    </and>
                                </or>
                            </condition>
                            <then>
                                <log level="verbose" message="Passed status check; now checking role(s)"/>

                                <!-- first check passed; now we test for the role membership(s) -->
                                <iterate list="partyIdList" entry="thisPartyId">
                                    <if-compare field="hasPermission" value="false" type="Boolean" operator="equals">
                                        <set field="checkRoleTypeId" from-field="operation.roleTypeId"/>
                                        <set field="checkPartyId" from-field="thisPartyId"/>
                                        <!-- reset the checkId if needed -->
                                        <if>
                                            <condition>
                                                <and>
                                                    <if-empty field="checkId"/>
                                                    <not>
                                                        <if-empty field="toCheckContentId"/>
                                                    </not>
                                                </and>
                                            </condition>
                                            <then>
                                                <set field="checkId" from-field="toCheckContentId"/>
                                            </then>
                                        </if>
                                        <call-simple-method method-name="checkRoleSecurity"/>

                                        <!-- check the parent(s) for permission -->
                                        <if>
                                            <condition>
                                                <and>
                                                    <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                                    <not>
                                                        <if-empty field="checkId"/>
                                                    </not>
                                                </and>
                                            </condition>
                                            <then>
                                                <log level="verbose" message="Starting loop; checking operation: ${operation.contentOperationId}"/>
                                                <while>
                                                    <condition>
                                                        <!-- iterate until either we have permission or there are no more parents -->
                                                        <and>
                                                            <if-compare field="hasPermission" value="false" type="Boolean" operator="equals"/>
                                                            <not>
                                                                <if-empty field="checkId"/>
                                                            </not>
                                                        </and>
                                                    </condition>
                                                    <then>
                                                        <entity-one entity-name="Content" value-field="currentContent">
                                                            <field-map field-name="contentId" from-field="checkId"/>
                                                        </entity-one>
                                                        <if>
                                                            <condition>
                                                                <not>
                                                                    <if-empty field="currentContent.ownerContentId"/>
                                                                </not>
                                                            </condition>
                                                            <then>
                                                                <set field="checkId" from-field="currentContent.ownerContentId"/>
                                                                <call-simple-method method-name="checkRoleSecurity"/>
                                                            </then>

                                                            <!-- no parent record found; time to stop recursion -->
                                                            <else>
                                                                <clear-field field="checkId"/>
                                                            </else>
                                                        </if>
                                                    </then>
                                                </while>
                                            </then>
                                        </if>
                                    </if-compare>
                                </iterate>
                            </then>
                        </if>
                    </if-compare>
                </iterate>
            </else>
        </if>
    </simple-method>

    <!-- method to check content ownership -->
    <simple-method method-name="checkOwnership" short-description="Checks the (role) ownership of a record">
        <!-- resetting the permission flag -->
        <set field="hasPermission" type="Boolean" value="false"/>

        <if-empty field="checkId">
            <set field="requiredField" value="checkId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <if-empty field="partyId">
            <set field="partyId" from-field="userLogin.partyId"/>
        </if-empty>
        <check-errors/>

        <!-- get all the associated parties (this user + all group memberships) -->
        <call-simple-method method-name="findAllAssociatedPartyIds"/>

        <!-- ownership role -->
        <set field="checkRoleTypeId" value="OWNER"/>

        <!-- check to see if any of the parties are owner of the content -->
        <iterate list="partyIdList" entry="thisPartyId">
            <if>
                <condition>
                    <not>
                        <if-compare field="hasPermission" value="true" operator="equals"/>
                    </not>
                </condition>
                <then>
                    <log level="verbose" message="Checking to see if party [${thisPartyId}] has ownership of ${checkId} :: ${hasPermission}"/>
                    <set field="checkPartyId" from-field="thisPartyId"/>
                    <call-simple-method method-name="checkRoleSecurity"/>
                </then>
                <else>
                    <log level="verbose" message="Field hasPermission is TRUE [${hasPermission}] did not test!"/>
                </else>
            </if>
        </iterate>
    </simple-method>

    <!-- method the check Content Role associations -->
    <simple-method method-name="checkRoleSecurity" short-description="Check users role associations with Content">
        <!-- resetting the permission flag -->
        <set field="hasPermission" type="Boolean" value="false"/>
        <log level="verbose" message="checkRoleSecurity: just reset hasPermission value to false!"/>

        <!-- roleEntity is required to determine which content role table to look: ContentRole, DataResourceRole, etc -->
        <if-empty field="roleEntity">
            <set field="requiredField" value="roleEntity"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <!-- roleEntityField is required to determine the pk field to check; contentId, dataResourceId, etc -->
        <if-empty field="roleEntityField">
            <set field="requiredField" value="roleEntityField"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <!-- setting the env field contentId is required for this simple method -->
        <if-empty field="checkId">
            <set field="requiredField" value="checkId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <!-- the party ID to check is required for this check -->
        <if-empty field="checkPartyId">
            <set field="requiredField" value="checkPartyId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <check-errors/>

        <log level="verbose" message="About to test of checkRoleTypeId is empty... ${checkRoleTypeId}"/>

        <if>
            <condition>
                <and>
                    <not>
                        <if-empty field="checkRoleTypeId"/>
                    </not>
                    <if-compare field="checkRoleTypeId" value="_NA_" operator="equals"/>
                </and>
            </condition>
            <then>
                <!-- _NA_ role means anyone (logged in) has permission -->
                <set field="hasPermission" type="Boolean" value="true"/>
            </then>

            <!-- not _NA_ so do the actual role check -->
            <else>
                <if>
                    <condition>
                        <not>
                            <if-empty field="checkRoleTypeId"/>
                        </not>
                    </condition>
                    <then>
                        <log level="verbose" message="Doing lookup [${roleEntity}] with roleTypeId : ${checkRoleTypeId}"/>
                        <!-- looking up a specific role -->
                        <set field="lookup.${roleEntityField}" from-field="checkId"/>
                        <set field="lookup.roleTypeId" from-field="checkRoleTypeId"/>
                        <set field="lookup.partyId" from-field="checkPartyId"/>
                        <find-by-and entity-name="${roleEntity}" map="lookup" list="foundRoles"/>
                        <!--
                        <entity-and entity-name="${roleEntity}" list="foundRoles">
                            <field-map from-field="${roleEntityField}"/>
                            <field-map field-name="roleTypeId" from-field="checkRoleTypeId"/>
                            <field-map field-name="partyId" from-field="checkPartyId"/>
                        </entity-and>
                        -->
                    </then>
                    <else>
                        <log level="verbose" message="Doing lookup without roleTypeId"/>
                        <!-- looking up any role -->
                        <set field="lookup.${roleEntityField}" from-field="checkId"/>
                        <set field="lookup.partyId" from-field="checkPartyId"/>
                        <find-by-and entity-name="${roleEntity}" map="lookup" list="foundRoles"/>
                        <!--
                        <entity-and entity-name="${roleEntity}" list="foundRoles">
                            <field-map from-field="${roleEntityField}"/>
                            <field-map field-name="partyId" from-field="checkPartyId"/>
                        </entity-and>
                        -->
                    </else>
                </if>

                <log level="verbose" message="Checking for ContentRole: [party] - ${checkPartyId} [role] - ${checkRoleTypeId} [content] - ${checkId} :: ${foundRoles}"/>

                <!-- the return should contain some entry if the user is a member -->
                <if>
                    <condition>
                        <not>
                            <if-empty field="foundRoles"/>
                        </not>
                    </condition>
                    <then>
                        <set field="hasPermission" type="Boolean" value="true"/>
                    </then>
                </if>
            </else>
        </if>

    </simple-method>

    <!-- method to get the content purposes -->
    <simple-method method-name="findAllContentPurposes" short-description="Find all content purposes for the specified content">
        <if-empty field="checkId">
            <set field="requiredField" value="checkId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <check-errors/>

        <set field="purposeLookup.contentId" from-field="checkId"/>
        <find-by-and entity-name="ContentPurpose" map="purposeLookup" list="contentPurposes"/>
    </simple-method>

    <!-- method to get user's party associations -->
    <simple-method method-name="findAllAssociatedPartyIds" short-description="Finds all associated party Ids for a user">
        <set field="lookupMap.partyIdFrom" from-field="userLogin.partyId"/>
        <set field="lookupMap.partyRelationshipTypeId" value="GROUP_ROLLUP"/>
        <set field="lookupMap.includeFromToSwitched" value="Y"/>
        <call-service service-name="getRelatedParties" include-user-login="true" in-map-name="lookupMap">
            <result-to-field result-name="relatedPartyIdList" field="partyIdList"/>
        </call-service>
        <log level="verbose" message="Got list of associated parties: ${partyIdList}"/>
    </simple-method>

    <!-- method to get content associations -->
    <simple-method method-name="findAllParentContent" short-description="Finds all associated parent content">
        <if-empty field="contentId">
            <set field="requiredField" value="contentId"/>
            <add-error>
                <fail-property resource="ContentUiLabels" property="ContentRequiredField"/>
            </add-error>
        </if-empty>
        <check-errors/>

        <entity-and entity-name="ContentAssoc" list="assocs" filter-by-date="true">
            <field-map field-name="contentIdTo" from-field="contentId"/>
        </entity-and>
        <field-to-result field="assocs" result-name="contentAssocList"/>
    </simple-method>
</simple-methods>