validateApiUsageState improvements

YevhenBondarenko
1 parent 42dd3861
Showing 1 changed file with 3 additions and 0 deletions
application/src/main/java/org/thingsboard/server/service/security/AccessValidator.java
--- a/application/src/main/java/org/thingsboard/server/service/security/AccessValidator.java
View file @9ab92ba
+++ b/application/src/main/java/org/thingsboard/server/service/security/AccessValidator.java
View file @9ab92ba
@@ -250,6 +250,9 @@ public class AccessValidator {
         if (currentUser.isSystemAdmin()) {
             callback.onSuccess(ValidationResult.accessDenied(SYSTEM_ADMINISTRATOR_IS_NOT_ALLOWED_TO_PERFORM_THIS_OPERATION));
         } else {
+            if (!operation.equals(Operation.READ_TELEMETRY)) {
+                callback.onSuccess(ValidationResult.accessDenied("Allowed only READ_TELEMETRY operation!"));
+            }
             ApiUsageState apiUsageState = apiUsageStateService.findApiUsageStateById(currentUser.getTenantId(), new ApiUsageStateId(entityId.getId()));
             if (apiUsageState == null) {
                 callback.onSuccess(ValidationResult.entityNotFound("Api Usage State with requested id wasn't found!"));