EDIT

from #8849#note-7

Generally for permission checks the class CdmUserHelper should be used which provides a couple of methods like userHasPermission(CdmBase entity, Object... args). String comparison is not always save as you may miss the rules implemented into by specific voters in CdmPermissionVoter.furtherVotingDescisions(CdmAuthority CdmAuthority, TargetEntityStates targetEntityStates, Collection attributes, ValidationResult validationResult).

Instead of using the string TAXONNODE it would be better to use PermissionClass.TAXONNODE instead.

Now to the logic. I think it is correct to only do the second step check for TaxonNode permissions if there is an accepted taxon with TaxonNodes at all. Otherwise the operation should be granted.

Apart from the above critics, code looks good but should be put into the TaxonBaseVoter as furtherVotingDescisions() implementation. As this can be breaking things we should do this only after the release. It should not be forgotten though as it is crucial to have all permission deccission logic at a central place.

One last comment on the CdmStore.currentAuthentiationHasPermission(...) methods: These should also use the CdmUserHelper internally or should be replaced by calls to the according CdmUserHelper methods.