feat: Leave non-editable removed criteria out of CSV if user is ACB

When reviewing the checklist of things that should happen when a9 gets
removed, I realized that certain criteria are considered "editable" -
that is if they have been removed less than 1 year ago. I was including
ALL criteria in the listing CSV File but I think that might be confusing
for users actually because they would see some "original" criteria that
actually could not be added anyway. This commit changes the criteria
included in the download file - only those that are 1) attested or 2)
editable to the user are included. If ADMIN/ONC gets the CSV file then
they do get all the original criteria because they can do pretty much
whatever they want.

[#OCD-4705]

chpl/chpl-service/src/main/java/gov/healthit/chpl/certificationCriteria/CertificationCriteriaManager.java

@@ -16,6 +16,7 @@
 import gov.healthit.chpl.certificationCriteria.CertificationCriterionWithAttributes.AllowedAttributes;
 import gov.healthit.chpl.dao.CertificationCriterionDAO;
 import gov.healthit.chpl.domain.CertifiedProductSearchDetails;
+import gov.healthit.chpl.permissions.ResourcePermissionsFactory;
 import gov.healthit.chpl.util.CertificationResultRules;
 import gov.healthit.chpl.util.DateUtil;
 import lombok.extern.log4j.Log4j2;
@@ -26,14 +27,17 @@ public class CertificationCriteriaManager {
     private CertificationCriterionDAO certificationCriterionDao;
     private CertificationResultRules rules;
     private CertificationCriterionComparator criterionComparator;
+    private ResourcePermissionsFactory resourcePermissionsFactory;
 
     @Autowired
     public CertificationCriteriaManager(CertificationCriterionDAO certificationCriterionDao,
             CertificationResultRules rules,
-            CertificationCriterionComparator criterionComparator) {
+            CertificationCriterionComparator criterionComparator,
+            ResourcePermissionsFactory resourcePermissionsFactory) {
         this.certificationCriterionDao = certificationCriterionDao;
         this.rules = rules;
         this.criterionComparator = criterionComparator;
+        this.resourcePermissionsFactory = resourcePermissionsFactory;
     }
 
     @Transactional
@@ -65,10 +69,10 @@ public List<CertificationCriterion> getActive(String certificationEdition, Local
                 .collect(Collectors.toList());
     }
 
-    public List<CertificationCriterion> getCriteriaAvailableToListing(CertifiedProductSearchDetails listing) {
+    public List<CertificationCriterion> getCriteriaAvailableToListingAndUser(CertifiedProductSearchDetails listing) {
         List<CertificationCriterion> allCriteriaAvailableToListing = Stream.concat(
                 getAttestedCriteria(listing).stream(),
-                getActiveCriteriaBasedOnEditionAndDate(listing).stream())
+                getEditableCriteria(listing).stream())
             .distinct()
             .sorted(criterionComparator)
             .collect(Collectors.toList());
@@ -82,11 +86,18 @@ private List<CertificationCriterion> getAttestedCriteria(CertifiedProductSearchD
                 .collect(Collectors.toList());
     }
 
-    private List<CertificationCriterion> getActiveCriteriaBasedOnEditionAndDate(CertifiedProductSearchDetails listing) {
+    private List<CertificationCriterion> getEditableCriteria(CertifiedProductSearchDetails listing) {
         String edition = listing.getEdition() != null && !StringUtils.isEmpty(listing.getEdition().getName())
                         ? listing.getEdition().getName() : null;
 
-        return this.getActive(edition, listing.getCertificationDay(), LocalDate.now());
+        List<CertificationCriterion> allActiveCriteria = this.getActive(edition, listing.getCertificationDay(), LocalDate.now());
+        if (!resourcePermissionsFactory.get().isUserRoleAdmin()
+                && !resourcePermissionsFactory.get().isUserRoleOnc()) {
+            return allActiveCriteria.stream()
+                    .filter(criterion -> criterion.isEditable())
+                    .collect(Collectors.toList());
+        }
+        return allActiveCriteria;
     }
 
     @Transactional

chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvDataWriter.java

@@ -141,7 +141,7 @@ public List<List<String>> getCsvData(CertifiedProductSearchDetails listing, int
     }
 
     private List<CertificationResult> getAllAvailableCriteriaAsCertResults(CertifiedProductSearchDetails listing) {
-        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListing(listing);
+        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListingAndUser(listing);
         List<CertificationResult> allAvailableCriteriaAsCertResults = new ArrayList<CertificationResult>();
         allCriteriaAvailableToListing.stream()
             .forEach(criterion -> {

chpl/chpl-service/src/main/java/gov/healthit/chpl/certifiedproduct/csv/ListingCsvHeadingWriter.java

@@ -111,7 +111,7 @@ public List<String> getCsvHeadings(CertifiedProductSearchDetails listing) {
 
     private List<String> getCriteriaHeadings(CertifiedProductSearchDetails listing) {
         List<String> criteriaHeadings = new ArrayList<String>();
-        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListing(listing);
+        List<CertificationCriterion> allCriteriaAvailableToListing = criteriaManager.getCriteriaAvailableToListingAndUser(listing);
         allCriteriaAvailableToListing.stream()
             .forEach(certResult -> criteriaHeadings.addAll(getCriterionHeadings(certResult)));
         return criteriaHeadings;