diff --git a/waltz-web/src/main/java/org/finos/waltz/web/endpoints/api/MeasurableRatingEndpoint.java b/waltz-web/src/main/java/org/finos/waltz/web/endpoints/api/MeasurableRatingEndpoint.java index 7da617feb6..3cc8a92d94 100644 --- a/waltz-web/src/main/java/org/finos/waltz/web/endpoints/api/MeasurableRatingEndpoint.java +++ b/waltz-web/src/main/java/org/finos/waltz/web/endpoints/api/MeasurableRatingEndpoint.java @@ -147,7 +147,7 @@ private Collection saveRoute(Request request, Response z) thro : Operation.ADD; checkHasPermissionForThisOperation(command.measurableId(), command.entityReference(), operation, getUsername(request)); - requireRole(userRoleService, request, measurableRatingService.getRequiredRatingEditRole(mkRef(EntityKind.MEASURABLE, command.measurableId()))); + return measurableRatingService.save(command, false); } @@ -188,8 +188,10 @@ private void checkHasPermissionForThisOperation(Long measurableId, .user(username) .build(); + boolean involvementBasedPermissions = permissionGroupService.hasPermission(checkPermissionCommand); + checkTrue( - roleBasedPermissions || permissionGroupService.hasPermission(checkPermissionCommand), + roleBasedPermissions || involvementBasedPermissions, format("User does not have permission to %s measurable ratings for this %s", operation.name().toLowerCase(), parentReference.kind().prettyName())); }