minor improvements

application/src/main/java/org/thingsboard/server/controller/AssetProfileController.java

@@ -48,8 +48,8 @@ import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
-import java.util.Objects;
 import java.util.concurrent.ExecutionException;
 
 import static org.thingsboard.server.controller.ControllerConstants.ASSET_PROFILE_ID;
@@ -236,7 +236,9 @@ public class AssetProfileController extends BaseController {
             @Parameter(description = "A list of asset profile ids, separated by comma ','", array = @ArraySchema(schema = @Schema(type = "string")), required = true)
             @RequestParam("assetProfileIds") String[] strAssetProfileIds) throws ThingsboardException, ExecutionException, InterruptedException {
         checkArrayParameter("assetProfileIds", strAssetProfileIds);
-
+        if (!accessControlService.hasPermission(getCurrentUser(), Resource.ASSET_PROFILE, Operation.READ)) {
+            return Collections.emptyList();
+        }
         SecurityUser user = getCurrentUser();
         TenantId tenantId = user.getTenantId();
         List<AssetProfileId> assetProfileIds = new ArrayList<>();
@@ -244,16 +246,7 @@ public class AssetProfileController extends BaseController {
             assetProfileIds.add(new AssetProfileId(toUUID(strAssetProfileId)));
         }
 
-        return Objects.requireNonNull(checkNotNull(assetProfileService.findAssetProfilesByIdsAsync(tenantId, assetProfileIds).get()))
-                .stream()
-                .filter(e -> {
-                    try {
-                        return accessControlService.hasPermission(user, Resource.ASSET_PROFILE, Operation.READ, e.getId(), e);
-                    } catch (ThingsboardException ex) {
-                        return false;
-                    }
-                })
-                .toList();
+        return checkNotNull(assetProfileService.findAssetProfilesByIdsAsync(tenantId, assetProfileIds).get());
     }
 
 }

application/src/main/java/org/thingsboard/server/controller/DeviceProfileController.java

@@ -51,8 +51,8 @@ import org.thingsboard.server.service.security.permission.Operation;
 import org.thingsboard.server.service.security.permission.Resource;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
-import java.util.Objects;
 import java.util.UUID;
 import java.util.concurrent.ExecutionException;
 
@@ -292,6 +292,9 @@ public class DeviceProfileController extends BaseController {
             @Parameter(description = "A list of device profile ids, separated by comma ','",  array = @ArraySchema(schema = @Schema(type = "string")), required = true)
             @RequestParam("deviceProfileIds") String[] strDeviceProfileIds) throws ThingsboardException, ExecutionException, InterruptedException {
         checkArrayParameter("deviceProfileIds", strDeviceProfileIds);
+        if (!accessControlService.hasPermission(getCurrentUser(), Resource.DEVICE_PROFILE, Operation.READ)) {
+            return Collections.emptyList();
+        }
         SecurityUser user = getCurrentUser();
         TenantId tenantId = user.getTenantId();
         List<DeviceProfileId> deviceProfileIds = new ArrayList<>();
@@ -299,16 +302,7 @@ public class DeviceProfileController extends BaseController {
             deviceProfileIds.add(new DeviceProfileId(toUUID(strDeviceProfileId)));
         }
 
-        return Objects.requireNonNull(checkNotNull(deviceProfileService.findDeviceProfilesByIdsAsync(tenantId, deviceProfileIds).get()))
-                .stream()
-                .filter(e -> {
-                    try {
-                        return accessControlService.hasPermission(user, Resource.DEVICE_PROFILE, Operation.READ, e.getId(), e);
-                    } catch (ThingsboardException ex) {
-                        return false;
-                    }
-                })
-                .toList();
+        return checkNotNull(deviceProfileService.findDeviceProfilesByIdsAsync(tenantId, deviceProfileIds).get());
     }
 
 }

application/src/main/java/org/thingsboard/server/service/security/permission/AccessControlService.java

@@ -24,6 +24,8 @@ public interface AccessControlService {
 
     void checkPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException;
 
+    boolean hasPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException;
+
     <I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource, Operation operation, I entityId, T entity) throws ThingsboardException;
 
     <I extends EntityId, T extends HasTenantId> boolean hasPermission(SecurityUser user, Resource resource, Operation operation, I entityId, T entity) throws ThingsboardException;

application/src/main/java/org/thingsboard/server/service/security/permission/DefaultAccessControlService.java

@@ -55,6 +55,16 @@ public class DefaultAccessControlService implements AccessControlService {
         }
     }
 
+    @Override
+    @SuppressWarnings("unchecked")
+    public boolean hasPermission(SecurityUser user, Resource resource, Operation operation) throws ThingsboardException {
+        PermissionChecker permissionChecker = getPermissionChecker(user.getAuthority(), resource);
+        if (permissionChecker != null) {
+            return permissionChecker.hasPermission(user, operation);
+        }
+        return false;
+    }
+
     @Override
     @SuppressWarnings("unchecked")
     public <I extends EntityId, T extends HasTenantId> void checkPermission(SecurityUser user, Resource resource,

application/src/main/java/org/thingsboard/server/service/security/permission/PermissionChecker.java

@@ -16,7 +16,6 @@
 package org.thingsboard.server.service.security.permission;
 
 import org.thingsboard.server.common.data.HasTenantId;
-import org.thingsboard.server.common.data.exception.ThingsboardException;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.service.security.model.SecurityUser;
 

common/data/src/main/java/org/thingsboard/server/common/data/DeviceProfileInfo.java

@@ -31,7 +31,7 @@ import java.util.UUID;
 @Value
 @EqualsAndHashCode(callSuper = true)
 @ToString(callSuper = true, exclude = "image")
-public class DeviceProfileInfo extends EntityInfo implements HasTenantId {
+public class DeviceProfileInfo extends EntityInfo {
 
     @Schema(description = "Either URL or Base64 data of the icon. Used in the mobile application to visualize set of device profiles in the grid view. ")
     private final String image;

common/data/src/main/java/org/thingsboard/server/common/data/asset/AssetProfileInfo.java

@@ -23,7 +23,6 @@ import lombok.ToString;
 import lombok.Value;
 import org.thingsboard.server.common.data.EntityInfo;
 import org.thingsboard.server.common.data.EntityType;
-import org.thingsboard.server.common.data.HasTenantId;
 import org.thingsboard.server.common.data.id.DashboardId;
 import org.thingsboard.server.common.data.id.EntityId;
 import org.thingsboard.server.common.data.id.EntityIdFactory;
@@ -34,7 +33,7 @@ import java.util.UUID;
 @Value
 @EqualsAndHashCode(callSuper = true)
 @ToString(callSuper = true, exclude = "image")
-public class AssetProfileInfo extends EntityInfo implements HasTenantId {
+public class AssetProfileInfo extends EntityInfo {
 
     @Schema(description = "Either URL or Base64 data of the icon. Used in the mobile application to visualize set of asset profiles in the grid view. ")
     private final String image;