annotate src/main/java/de/intevation/lada/util/auth/MessungAuthorizer.java @ 960:7fc536615624

Fixed authorization issues.
author Raimund Renkert <raimund.renkert@intevation.de>
date Fri, 27 May 2016 16:03:40 +0200
parents edb014e8045d
children 829092ba09f7
rev   line source
849
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
1 /* Copyright (C) 2013 by Bundesamt fuer Strahlenschutz
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
2 * Software engineering by Intevation GmbH
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
3 *
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
4 * This file is Free Software under the GNU GPL (v>=3)
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
5 * and comes with ABSOLUTELY NO WARRANTY! Check out
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
6 * the documentation coming with IMIS-Labordaten-Application for details.
d0a591b3eade Added missing file header.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 833
diff changeset
7 */
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
8 package de.intevation.lada.util.auth;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
9
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
10 import java.util.ArrayList;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
11 import java.util.List;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
12
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
13 import de.intevation.lada.model.land.LMessung;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
14 import de.intevation.lada.model.land.LProbe;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
15 import de.intevation.lada.model.land.LStatusProtokoll;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
16 import de.intevation.lada.model.stamm.AuthLstUmw;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
17 import de.intevation.lada.util.data.QueryBuilder;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
18 import de.intevation.lada.util.rest.RequestMethod;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
19 import de.intevation.lada.util.rest.Response;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
20
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
21 public class MessungAuthorizer extends BaseAuthorizer {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
22
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
23 @Override
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
24 public <T> boolean isAuthorized(
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
25 Object data,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
26 RequestMethod method,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
27 UserInfo userInfo,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
28 Class<T> clazz
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
29 ) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
30 LMessung messung = (LMessung)data;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
31 Response response =
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
32 repository.getById(LProbe.class, messung.getProbeId(), "land");
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
33 LProbe probe = (LProbe)response.getData();
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
34 if (method == RequestMethod.PUT ||
889
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
35 method == RequestMethod.DELETE) {
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
36 return !this.isMessungReadOnly(messung.getId()) &&
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
37 getAuthorization(userInfo, probe);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
38 }
895
0a69252ed7a0 Fixed IAE on messung create.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 894
diff changeset
39 if (method == RequestMethod.POST) {
0a69252ed7a0 Fixed IAE on messung create.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 894
diff changeset
40 return getAuthorization(userInfo, probe);
0a69252ed7a0 Fixed IAE on messung create.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 894
diff changeset
41 }
889
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
42 LStatusProtokoll status = repository.getByIdPlain(
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
43 LStatusProtokoll.class,
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
44 messung.getStatus(),
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
45 "land");
c160d6c895d2 Check messung status to authorize GET requests on Messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 886
diff changeset
46 return status.getStatusWert() > 0 || getAuthorization(userInfo, probe);
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
47 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
48
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
49 @SuppressWarnings("unchecked")
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
50 @Override
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
51 public <T> Response filter(
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
52 Response data,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
53 UserInfo userInfo,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
54 Class<T> clazz
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
55 ) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
56 if (data.getData() instanceof List<?>) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
57 List<LMessung> messungen = new ArrayList<LMessung>();
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
58 for (LMessung messung :(List<LMessung>)data.getData()) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
59 messungen.add(setAuthData(userInfo, messung));
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
60 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
61 data.setData(messungen);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
62 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
63 else if (data.getData() instanceof LMessung) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
64 LMessung messung = (LMessung)data.getData();
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
65 data.setData(setAuthData(userInfo, messung));
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
66 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
67 return data;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
68 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
69
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
70 /**
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
71 * Authorize a sinle messung object.
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
72 *
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
73 * @param userInfo The user information.
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
74 * @param messung The messung object.
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
75 * @return The messung.
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
76 */
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
77 private LMessung setAuthData(
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
78 UserInfo userInfo,
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
79 LMessung messung
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
80 ) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
81 LProbe probe =
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
82 (LProbe)repository.getById(
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
83 LProbe.class, messung.getProbeId(), "land").getData();
861
68348c675b13 Since LST has no netzbetreiberId, check if the user belongs to a LST in
Raimund Renkert <raimund.renkert@intevation.de>
parents: 849
diff changeset
84 if (!userInfo.getNetzbetreiber().contains(probe.getNetzbetreiberId()) &&
68348c675b13 Since LST has no netzbetreiberId, check if the user belongs to a LST in
Raimund Renkert <raimund.renkert@intevation.de>
parents: 849
diff changeset
85 !userInfo.getFunktionen().contains(3)) {
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
86 messung.setOwner(false);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
87 messung.setReadonly(true);
920
edb014e8045d Always set statusEdit attribute for messung objects.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 917
diff changeset
88 messung.setStatusEdit(false);
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
89 return messung;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
90 }
894
f5b4784d9173 Load probe attribute 'laborMstId' from db and use this field to authorize
Raimund Renkert <raimund.renkert@intevation.de>
parents: 889
diff changeset
91 if (userInfo.belongsTo(probe.getMstId(), probe.getLaborMstId())) {
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
92 messung.setOwner(true);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
93 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
94 else {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
95 messung.setOwner(false);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
96 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
97 if (messung.getStatus() == null) {
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
98 messung.setReadonly(false);
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
99 messung.setStatusEdit(false);
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
100 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
101 else {
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
102 LStatusProtokoll status = repository.getByIdPlain(
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
103 LStatusProtokoll.class,
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
104 messung.getStatus(),
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
105 "land");
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
106 messung.setReadonly(
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
107 status.getStatusWert() != 0 && status.getStatusWert() != 4);
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
108
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
109 boolean statusEdit = false;
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
110 if (userInfo.getFunktionen().contains(3)) {
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
111 QueryBuilder<AuthLstUmw> lstFilter = new QueryBuilder<AuthLstUmw>(
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
112 repository.entityManager("stamm"),
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
113 AuthLstUmw.class);
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
114 lstFilter.or("lstId", userInfo.getMessstellen());
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
115 List<AuthLstUmw> lsts =
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
116 repository.filterPlain(lstFilter.getQuery(), "stamm");
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
117 for (int i = 0; i < lsts.size(); i++) {
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
118 if (lsts.get(i).getUmwId().equals(probe.getUmwId())
960
7fc536615624 Fixed authorization issues.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 920
diff changeset
119 && (status.getStatusStufe() == 2
7fc536615624 Fixed authorization issues.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 920
diff changeset
120 || status.getStatusStufe() == 3)
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
121 ) {
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
122 statusEdit = true;
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
123 }
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
124 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
125 }
960
7fc536615624 Fixed authorization issues.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 920
diff changeset
126 if (userInfo.getFunktionenForNetzbetreiber(probe.getNetzbetreiberId()).contains(2) &&
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
127 userInfo.getNetzbetreiber().contains(probe.getNetzbetreiberId()) &&
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
128 (status.getStatusStufe() == 1 || status.getStatusStufe() == 2) &&
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
129 status.getStatusWert() >= 1
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
130 ) {
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
131 statusEdit = true;
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
132 }
960
7fc536615624 Fixed authorization issues.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 920
diff changeset
133 if (userInfo.getFunktionenForMst(probe.getMstId()).contains(1) &&
917
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
134 userInfo.belongsTo(probe.getMstId(), probe.getLaborMstId()) &&
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
135 (status.getStatusStufe() <= 1 || status.getStatusWert() == 4)
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
136 ) {
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
137 statusEdit = true;
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
138 }
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
139 messung.setStatusEdit(statusEdit);
d53261aa38eb Fixed NPE for messungen without status.
Raimund Renkert <raimund.renkert@intevation.de>
parents: 895
diff changeset
140
833
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
141 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
142 return messung;
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
143 }
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
144
fa922101a462 Refactored Authorization.
Raimund Renkert <raimund.renkert@intevation.de>
parents:
diff changeset
145 }
This site is hosted by Intevation GmbH (Datenschutzerklärung und Impressum | Privacy Policy and Imprint)