You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by an...@apache.org on 2014/12/11 11:29:49 UTC
svn commit: r1644589 - in /jackrabbit/oak/branches/1.0: ./
oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/
oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/
oak-core/src/main/java/o...
Author: angela
Date: Thu Dec 11 10:29:48 2014
New Revision: 1644589
URL: http://svn.apache.org/r1644589
Log:
merge revisions 1585963 and 1617463 (OAK-2015)
Added:
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java
- copied, changed from r1585963, jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java
Modified:
jackrabbit/oak/branches/1.0/ (props changed)
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntry.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrincipalRestrictionProvider.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImpl.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositePattern.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositeRestrictionProvider.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.java
jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/whiteboard/WhiteboardRestrictionProvider.java
jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/ACLTest.java
jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHookTest.java
jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImplTest.java
jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/TestProvider.java
jackrabbit/oak/branches/1.0/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/privilege/PrivilegeRegistrationTest.java
Propchange: jackrabbit/oak/branches/1.0/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Thu Dec 11 10:29:48 2014
@@ -1,2 +1,2 @@
-/jackrabbit/oak/trunk:1584578,1584602,1584614,1584616,1584709,1584781,1584937,1585297,1585304-1585305,1585420,1585424,1585427,1585448,1585465,1585468,1585486,1585497,1585509,1585647,1585655-1585656,1585661,1585665-1585666,1585669-1585670,1585673,1585680,1585719,1585763,1585770,1585896,1585904,1585907,1585940,1585949,1585951,1585956,1585962,1586287,1586320,1586364,1586372,1586655,1586836,1587130,1587224,1587399,1587408,1587472,1587485,1587488,1587538,1587580,1587807,1588033,1588042,1588046,1588066,1588201,1589025,1589101,1589137,1589141,1589263,1589440,1589442,1589484,1589488,1589661,1589664,1589682,1589708,1589741,1589748,1589789,1589794,1589850,1589864,1590628,1590660,1590684,1590697,1590701,1590980,1590988,1591101,1591226,1591229,1591293,1591314,1591317,1591362,1591374,1591381,1591438,1591467,1591552,1591704,1591713,1591715,1591723,1591874,1592487,1592512,1592658,1592665,1592677,1592742,1592744,1592787,1592809,1592955,1593036,1593048,1593061,1593133,1593210-1593211,1593231,1593245
,1593250,1593294,1593304,1593317,1593342,1593554,1594158-1594164,1594166-1594167,1594169,1594237,1594800,1594808,1594835,1594888,1595147,1595457,1595856,1596241,1596474,1596534,1596844,1597569,1597795,1597854,1597860,1598292,1598302,1598352,1598369,1598595,1598631,1598696,1598732,1598797-1598798,1599299,1599332,1599416,1599434,1599671,1600088,1600935,1601309,1601388,1601578,1601676,1601757,1601768,1601814,1601833,1601838,1601853,1601878,1601888,1601922,1602156,1602174,1602179,1602183,1602207,1602227,1602256,1602261,1602796-1602797,1602800,1602809,1602853,1602872,1602914,1603155,1603307,1603401,1603441,1603748,1604166,1605030,1605036,1605038,1605292,1605447,1605526,1605670,1605725,1605831,1605852,1606077,1606079,1606087,1606638,1606641,1606644,1606708,1606711,1607031-1607032,1607077,1607127,1607141,1607152,1607185,1607196,1607331,1607362,1607366,1607392,1607526,1607664,1607737,1608560,1608783,1609064,1609081,1609165,1609488,1610489,1610592,1610603,1610634,1610658,1610664,1611021,1611
041,1611275,1611277,1611313,1611332,1611584,1612560,1612825,1612993,1613018,1613041,1614265,1614272,1614344-1614345,1614384-1614385,1614397,1614405-1614406,1614574,1614591,1614593,1614596,1614604,1614689,1614807,1614835,1614891,1615417-1615418,1616182,1616236,1616463,1616719,1617417,1617451,1617711,1618158,1618613,1618624,1618709,1619222,1619411,1619695,1619800,1619808,1619815,1619823-1619824,1620512,1620581,1620585,1620634,1620898,1621115,1621123-1621124,1621168,1621192,1621201,1621706,1621962,1622197,1622201,1622207,1622250,1622479,1623364,1623766,1623827,1623949,1623969,1623973,1624216,1624317,1624551,1624973,1624993-1624994,1625025,1625036,1625158,1625224,1625237,1625299,1625348,1625620,1625916,1625962-1625963,1626021,1626053,1626163,1626168,1626175,1626191,1626265,1626770,1627047,1627052,1627228,1627346,1627470,1627473,1627479,1627503,1627586,1627590,1627715,1627731,1628180,1628198,1628262,1628447,1628608,1629688,1629840,1629917,1630055-1630057,1630156,1630299,1630338,1630773,1
631283-1631284,1631333-1631334,1631617-1631619,1631630,1631699,1631704,1631711,1631967-1631969,1631986,1631990,1631999,1632002-1632003,1632017,1632258,1632264,1632270,1632293,1632303,1632592,1632605,1633315,1633559-1633560,1633562,1633567,1633571,1633598,1633608,1633641,1633687,1633697,1633768,1633783,1634505,1634513,1634774,1634779,1634781,1634792,1634803,1634814,1634816,1634838,1634841,1634852,1634864,1634896,1634898,1635044-1635045,1635060,1635077,1635089,1635102,1635108,1635218,1635387,1635435,1635518,1635563,1635586,1636336,1636348,1636505,1636585,1636799,1637368,1637382,1637413,1637651,1637815,1638779-1638783,1639260,1639577,1639622,1639963,1639966,1639973,1640134,1640143,1640555-1640556,1640694-1640695,1640715,1640722-1640723,1640728,1640863-1640872,1641340,1641352,1641541,1641596-1641599,1641601,1641662,1641671,1641695,1641771,1641802,1641811,1641950,1642031,1642056,1642119,1642285,1642648,1642667,1642954,1642959,1643111,1643178,1643186,1643204,1643287,1643767,1643774,164398
2,1644016,1644106,1644366,1644383,1644397-1644398,1644407,1644479,1644547,1644552,1644554
+/jackrabbit/oak/trunk:1584578,1584602,1584614,1584616,1584709,1584781,1584937,1585297,1585304-1585305,1585420,1585424,1585427,1585448,1585465,1585468,1585486,1585497,1585509,1585647,1585655-1585656,1585661,1585665-1585666,1585669-1585670,1585673,1585680,1585719,1585763,1585770,1585896,1585904,1585907,1585940,1585949,1585951,1585956,1585962-1585963,1586287,1586320,1586364,1586372,1586655,1586836,1587130,1587224,1587399,1587408,1587472,1587485,1587488,1587538,1587580,1587807,1588033,1588042,1588046,1588066,1588201,1589025,1589101,1589137,1589141,1589263,1589440,1589442,1589484,1589488,1589661,1589664,1589682,1589708,1589741,1589748,1589789,1589794,1589850,1589864,1590628,1590660,1590684,1590697,1590701,1590980,1590988,1591101,1591226,1591229,1591293,1591314,1591317,1591362,1591374,1591381,1591438,1591467,1591552,1591704,1591713,1591715,1591723,1591874,1592487,1592512,1592658,1592665,1592677,1592742,1592744,1592787,1592809,1592955,1593036,1593048,1593061,1593133,1593210-1593211,1593231
,1593245,1593250,1593294,1593304,1593317,1593342,1593554,1594158-1594164,1594166-1594167,1594169,1594237,1594800,1594808,1594835,1594888,1595147,1595457,1595856,1596241,1596474,1596534,1596844,1597569,1597795,1597854,1597860,1598292,1598302,1598352,1598369,1598595,1598631,1598696,1598732,1598797-1598798,1599299,1599332,1599416,1599434,1599671,1600088,1600935,1601309,1601388,1601578,1601676,1601757,1601768,1601814,1601833,1601838,1601853,1601878,1601888,1601922,1602156,1602174,1602179,1602183,1602207,1602227,1602256,1602261,1602796-1602797,1602800,1602809,1602853,1602872,1602914,1603155,1603307,1603401,1603441,1603748,1604166,1605030,1605036,1605038,1605292,1605447,1605526,1605670,1605725,1605831,1605852,1606077,1606079,1606087,1606638,1606641,1606644,1606708,1606711,1607031-1607032,1607077,1607127,1607141,1607152,1607185,1607196,1607331,1607362,1607366,1607392,1607526,1607664,1607737,1608560,1608783,1609064,1609081,1609165,1609488,1610489,1610592,1610603,1610634,1610658,1610664,1611
021,1611041,1611275,1611277,1611313,1611332,1611584,1612560,1612825,1612993,1613018,1613041,1614265,1614272,1614344-1614345,1614384-1614385,1614397,1614405-1614406,1614574,1614591,1614593,1614596,1614604,1614689,1614807,1614835,1614891,1615417-1615418,1616182,1616236,1616463,1616719,1617417,1617451,1617463,1617711,1618158,1618613,1618624,1618709,1619222,1619411,1619695,1619800,1619808,1619815,1619823-1619824,1620512,1620581,1620585,1620634,1620898,1621115,1621123-1621124,1621168,1621192,1621201,1621706,1621962,1622197,1622201,1622207,1622250,1622479,1623364,1623766,1623827,1623949,1623969,1623973,1624216,1624317,1624551,1624973,1624993-1624994,1625025,1625036,1625158,1625224,1625237,1625299,1625348,1625620,1625916,1625962-1625963,1626021,1626053,1626163,1626168,1626175,1626191,1626265,1626770,1627047,1627052,1627228,1627346,1627470,1627473,1627479,1627503,1627586,1627590,1627715,1627731,1628180,1628198,1628262,1628447,1628608,1629688,1629840,1629917,1630055-1630057,1630156,1630299,1
630338,1630773,1631283-1631284,1631333-1631334,1631617-1631619,1631630,1631699,1631704,1631711,1631967-1631969,1631986,1631990,1631999,1632002-1632003,1632017,1632258,1632264,1632270,1632293,1632303,1632592,1632605,1633315,1633559-1633560,1633562,1633567,1633571,1633598,1633608,1633641,1633687,1633697,1633768,1633783,1634505,1634513,1634774,1634779,1634781,1634792,1634803,1634814,1634816,1634838,1634841,1634852,1634864,1634896,1634898,1635044-1635045,1635060,1635077,1635089,1635102,1635108,1635218,1635387,1635435,1635518,1635563,1635586,1636336,1636348,1636505,1636585,1636799,1637368,1637382,1637413,1637651,1637815,1638779-1638783,1639260,1639577,1639622,1639963,1639966,1639973,1640134,1640143,1640555-1640556,1640694-1640695,1640715,1640722-1640723,1640728,1640863-1640872,1641340,1641352,1641541,1641596-1641599,1641601,1641662,1641671,1641695,1641771,1641802,1641811,1641950,1642031,1642056,1642119,1642285,1642648,1642667,1642954,1642959,1643111,1643178,1643186,1643204,1643287,164376
7,1643774,1643982,1644016,1644106,1644366,1644383,1644397-1644398,1644407,1644479,1644547,1644552,1644554
/jackrabbit/trunk:1345480
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntry.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntry.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntry.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntry.java Thu Dec 11 10:29:48 2014
@@ -16,25 +16,18 @@
*/
package org.apache.jackrabbit.oak.security.authorization.permission;
-import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import com.google.common.base.Objects;
import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Tree;
-import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.commons.PathUtils;
import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants;
-import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern;
-import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
-import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
import org.apache.jackrabbit.util.Text;
-import static org.apache.jackrabbit.JcrConstants.JCR_PRIMARYTYPE;
-
final class PermissionEntry implements Comparable<PermissionEntry>, PermissionConstants {
/**
@@ -62,22 +55,14 @@ final class PermissionEntry implements C
*/
final RestrictionPattern restriction;
- PermissionEntry(String path, Tree entryTree, RestrictionProvider restrictionsProvider) {
+ PermissionEntry(@Nonnull String path, boolean isAllow, int index,
+ @Nonnull PrivilegeBits privilegeBits,
+ @Nonnull RestrictionPattern restriction) {
this.path = path;
- isAllow = entryTree.getProperty(REP_IS_ALLOW).getValue(Type.BOOLEAN);
- index = Integer.parseInt(entryTree.getName());
- privilegeBits = PrivilegeBits.getInstance(entryTree.getProperty(REP_PRIVILEGE_BITS));
- restriction = restrictionsProvider.getPattern(path, entryTree);
- }
-
- static void write(NodeBuilder parent, boolean isAllow, int index, PrivilegeBits privilegeBits, Set<Restriction> restrictions) {
- NodeBuilder n = parent.child(String.valueOf(index))
- .setProperty(JCR_PRIMARYTYPE, NT_REP_PERMISSIONS, Type.NAME)
- .setProperty(REP_IS_ALLOW, isAllow)
- .setProperty(privilegeBits.asPropertyState(REP_PRIVILEGE_BITS));
- for (Restriction restriction : restrictions) {
- n.setProperty(restriction.getProperty());
- }
+ this.isAllow = isAllow;
+ this.index = index;
+ this.privilegeBits = privilegeBits;
+ this.restriction = restriction;
}
public boolean matches(@Nonnull Tree tree, @Nullable PropertyState property) {
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java Thu Dec 11 10:29:48 2014
@@ -16,44 +16,28 @@
*/
package org.apache.jackrabbit.oak.security.authorization.permission;
-import java.util.ArrayList;
import java.util.HashMap;
-import java.util.List;
import java.util.Map;
-import java.util.Set;
-
import javax.annotation.Nonnull;
import org.apache.jackrabbit.oak.api.CommitFailedException;
-import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.core.ImmutableRoot;
import org.apache.jackrabbit.oak.plugins.nodetype.TypePredicate;
-import org.apache.jackrabbit.oak.plugins.tree.ImmutableTree;
import org.apache.jackrabbit.oak.spi.commit.CommitInfo;
import org.apache.jackrabbit.oak.spi.commit.PostValidationHook;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants;
-import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
-import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider;
import org.apache.jackrabbit.oak.spi.state.DefaultNodeStateDiff;
import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
import org.apache.jackrabbit.oak.spi.state.NodeState;
import org.apache.jackrabbit.oak.spi.state.NodeStateUtils;
-import org.apache.jackrabbit.util.Text;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
-import com.google.common.base.Objects;
-import com.google.common.base.Strings;
-
-import static com.google.common.collect.Iterables.addAll;
-import static com.google.common.collect.Sets.newLinkedHashSet;
-import static org.apache.jackrabbit.JcrConstants.JCR_PRIMARYTYPE;
import static org.apache.jackrabbit.JcrConstants.JCR_SYSTEM;
import static org.apache.jackrabbit.oak.plugins.memory.EmptyNodeState.EMPTY_NODE;
-import static org.apache.jackrabbit.oak.plugins.tree.TreeConstants.OAK_CHILD_ORDER;
/**
* {@code CommitHook} implementation that processes any modification made to
@@ -92,8 +76,8 @@ public class PermissionHook implements P
private TypePredicate isACE;
private TypePredicate isGrantACE;
- private Map<String, Acl> modified = new HashMap<String, Acl>();
- private Map<String, Acl> deleted = new HashMap<String, Acl>();
+ private Map<String, PermissionStoreEditor> modified = new HashMap<String, PermissionStoreEditor>();
+ private Map<String, PermissionStoreEditor> deleted = new HashMap<String, PermissionStoreEditor>();
public PermissionHook(String workspaceName, RestrictionProvider restrictionProvider) {
this.workspaceName = workspaceName;
@@ -121,11 +105,11 @@ public class PermissionHook implements P
}
private void apply() {
- for (Map.Entry<String, Acl> entry : deleted.entrySet()) {
- entry.getValue().remove();
+ for (Map.Entry<String, PermissionStoreEditor> entry : deleted.entrySet()) {
+ entry.getValue().removePermissionEntries();
}
- for (Map.Entry<String, Acl> entry : modified.entrySet()) {
- entry.getValue().update();
+ for (Map.Entry<String, PermissionStoreEditor> entry : modified.entrySet()) {
+ entry.getValue().updatePermissionEntries();
}
}
@@ -151,8 +135,8 @@ public class PermissionHook implements P
}
String path = parentPath + '/' + name;
if (isACL.apply(after)) {
- Acl acl = new Acl(parentPath, name, after);
- modified.put(acl.accessControlledPath, acl);
+ PermissionStoreEditor psEditor = createPermissionStoreEditor(name, after);
+ modified.put(psEditor.accessControlledPath, psEditor);
} else {
after.compareAgainstBaseState(EMPTY_NODE, new Diff(path));
}
@@ -168,23 +152,23 @@ public class PermissionHook implements P
String path = parentPath + '/' + name;
if (isACL.apply(before)) {
if (isACL.apply(after)) {
- Acl acl = new Acl(parentPath, name, after);
- modified.put(acl.accessControlledPath, acl);
+ PermissionStoreEditor psEditor = createPermissionStoreEditor(name, after);
+ modified.put(psEditor.accessControlledPath, psEditor);
// also consider to remove the ACL from removed entries of other principals
- Acl beforeAcl = new Acl(parentPath, name, before);
- beforeAcl.entries.keySet().removeAll(acl.entries.keySet());
- if (!beforeAcl.entries.isEmpty()) {
- deleted.put(parentPath, beforeAcl);
+ PermissionStoreEditor beforeEditor = createPermissionStoreEditor(name, before);
+ beforeEditor.entries.keySet().removeAll(psEditor.entries.keySet());
+ if (!beforeEditor.entries.isEmpty()) {
+ deleted.put(parentPath, beforeEditor);
}
} else {
- Acl acl = new Acl(parentPath, name, before);
- deleted.put(acl.accessControlledPath, acl);
+ PermissionStoreEditor psEditor = createPermissionStoreEditor(name, before);
+ deleted.put(psEditor.accessControlledPath, psEditor);
}
} else if (isACL.apply(after)) {
- Acl acl = new Acl(parentPath, name, after);
- modified.put(acl.accessControlledPath, acl);
+ PermissionStoreEditor psEditor = createPermissionStoreEditor(name, after);
+ modified.put(psEditor.accessControlledPath, psEditor);
} else {
after.compareAgainstBaseState(before, new Diff(path));
}
@@ -199,218 +183,16 @@ public class PermissionHook implements P
}
String path = parentPath + '/' + name;
if (isACL.apply(before)) {
- Acl acl = new Acl(parentPath, name, before);
- deleted.put(acl.accessControlledPath, acl);
+ PermissionStoreEditor psEditor = createPermissionStoreEditor(name, before);
+ deleted.put(psEditor.accessControlledPath, psEditor);
} else {
EMPTY_NODE.compareAgainstBaseState(before, new Diff(path));
}
return true;
}
- }
-
- private final class Acl {
-
- private final String accessControlledPath;
-
- private final String nodeName;
-
- private final Map<String, List<AcEntry>> entries = new HashMap<String, List<AcEntry>>();
-
- private Acl(String aclPath, String name, @Nonnull NodeState node) {
- if (name.equals(REP_REPO_POLICY)) {
- this.accessControlledPath = "";
- } else {
- this.accessControlledPath = aclPath.length() == 0 ? "/" : aclPath;
- }
- nodeName = PermissionUtil.getEntryName(accessControlledPath);
-
- Set<String> orderedChildNames =
- newLinkedHashSet(node.getNames(OAK_CHILD_ORDER));
- long n = orderedChildNames.size();
- if (node.getChildNodeCount(n + 1) > n) {
- addAll(orderedChildNames, node.getChildNodeNames());
- }
-
- int index = 0;
- for (String childName : orderedChildNames) {
- NodeState ace = node.getChildNode(childName);
- if (isACE.apply(ace)) {
- AcEntry entry = new AcEntry(ace, accessControlledPath, index);
- List<AcEntry> list = entries.get(entry.principalName);
- if (list == null) {
- list = new ArrayList<AcEntry>();
- entries.put(entry.principalName, list);
- }
- list.add(entry);
- index++;
- }
- }
- }
-
- private void remove() {
- for (String principalName: entries.keySet()) {
- if (permissionRoot.hasChildNode(principalName)) {
- NodeBuilder principalRoot = permissionRoot.getChildNode(principalName);
-
- // find the ACL node that for this path and principal
- NodeBuilder parent = principalRoot.getChildNode(nodeName);
- if (!parent.exists()) {
- continue;
- }
-
- // check if the node is the correct one
- if (PermissionUtil.checkACLPath(parent, accessControlledPath)) {
- // remove and reconnect child nodes
- NodeBuilder newParent = null;
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) != 'c') {
- continue;
- }
- NodeBuilder child = parent.getChildNode(childName);
- if (newParent == null) {
- newParent = child;
- } else {
- newParent.setChildNode(childName, child.getNodeState());
- child.remove();
- }
- }
- parent.remove();
- if (newParent != null) {
- principalRoot.setChildNode(nodeName, newParent.getNodeState());
- }
- } else {
- // check if any of the child nodes match
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) != 'c') {
- continue;
- }
- NodeBuilder child = parent.getChildNode(childName);
- if (PermissionUtil.checkACLPath(child, accessControlledPath)) {
- child.remove();
- }
- }
- }
- } else {
- log.error("Unable to remove permission entry {}: Principal root missing.", this);
- }
- }
- }
-
- private void update() {
- for (String principalName: entries.keySet()) {
- NodeBuilder principalRoot = permissionRoot.child(principalName);
- if (!principalRoot.hasProperty(JCR_PRIMARYTYPE)) {
- principalRoot.setProperty(JCR_PRIMARYTYPE, NT_REP_PERMISSION_STORE, Type.NAME);
- }
- NodeBuilder parent = principalRoot.child(nodeName);
- if (!parent.hasProperty(JCR_PRIMARYTYPE)) {
- parent.setProperty(JCR_PRIMARYTYPE, NT_REP_PERMISSION_STORE, Type.NAME);
- }
-
- // check if current parent already has the correct path
- if (parent.hasProperty(REP_ACCESS_CONTROLLED_PATH)) {
- if (!PermissionUtil.checkACLPath(parent, accessControlledPath)) {
- // hash collision, find a new child
- NodeBuilder child = null;
- int idx = 0;
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) != 'c') {
- continue;
- }
- child = parent.getChildNode(childName);
- if (PermissionUtil.checkACLPath(child, accessControlledPath)) {
- break;
- }
- child = null;
- idx++;
- }
- while (child == null) {
- String name = 'c' + String.valueOf(idx++);
- child = parent.getChildNode(name);
- if (child.exists()) {
- child = null;
- } else {
- child = parent.child(name);
- child.setProperty(JCR_PRIMARYTYPE, NT_REP_PERMISSION_STORE, Type.NAME);
- }
- }
- parent = child;
- parent.setProperty(REP_ACCESS_CONTROLLED_PATH, accessControlledPath);
- }
- } else {
- // new parent
- parent.setProperty(REP_ACCESS_CONTROLLED_PATH, accessControlledPath);
- }
- updateEntries(parent, entries.get(principalName));
- }
- }
-
- private void updateEntries(NodeBuilder parent, List<AcEntry> list) {
- // remove old entries
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) != 'c') {
- parent.getChildNode(childName).remove();
- }
- }
- for (AcEntry ace: list) {
- PermissionEntry.write(parent, ace.isAllow, ace.index, ace.privilegeBits, ace.restrictions);
- }
- }
- }
-
- private final class AcEntry {
- private final String accessControlledPath;
- private final String principalName;
- private final PrivilegeBits privilegeBits;
- private final boolean isAllow;
- private final Set<Restriction> restrictions;
- private final int index;
- private int hashCode = -1;
-
- private AcEntry(@Nonnull NodeState node, @Nonnull String accessControlledPath, int index) {
- this.accessControlledPath = accessControlledPath;
- this.index = index;
-
- principalName = Text.escapeIllegalJcrChars(node.getString(REP_PRINCIPAL_NAME));
- privilegeBits = bitsProvider.getBits(node.getNames(REP_PRIVILEGES));
- isAllow = isGrantACE.apply(node);
- restrictions = restrictionProvider.readRestrictions(Strings.emptyToNull(accessControlledPath), new ImmutableTree(node));
- }
-
- @Override
- public int hashCode() {
- if (hashCode == -1) {
- hashCode = Objects.hashCode(accessControlledPath, principalName, privilegeBits, isAllow, restrictions);
- }
- return hashCode;
- }
-
- @Override
- public boolean equals(Object o) {
- if (o == this) {
- return true;
- }
- if (o instanceof AcEntry) {
- AcEntry other = (AcEntry) o;
- return isAllow == other.isAllow
- && privilegeBits.equals(other.privilegeBits)
- && principalName.equals(other.principalName)
- && accessControlledPath.equals(other.accessControlledPath)
- && restrictions.equals(other.restrictions);
- }
- return false;
- }
-
- @Override
- public String toString() {
- StringBuilder sb = new StringBuilder();
- sb.append(accessControlledPath);
- sb.append(';').append(principalName);
- sb.append(';').append(isAllow ? "allow" : "deny");
- sb.append(';').append(bitsProvider.getPrivilegeNames(privilegeBits));
- sb.append(';').append(restrictions);
- return sb.toString();
+ private PermissionStoreEditor createPermissionStoreEditor(@Nonnull String nodeName, @Nonnull NodeState nodeState) {
+ return new PermissionStoreEditor(parentPath, nodeName, nodeState, permissionRoot, isACE, isGrantACE, bitsProvider, restrictionProvider);
}
}
}
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java Thu Dec 11 10:29:48 2014
@@ -29,6 +29,8 @@ import javax.annotation.Nullable;
*/
public interface PermissionStore {
+ long DYNAMIC_ALL_BITS = -1;
+
/**
* Loads the permission entries for the given principal and path. if the given {@code entries} is {@code null}, it
* will be created automatically if needed. If a {@code entries} is given, it will reuse it and the same object is
Copied: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java (from r1585963, jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java)
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java?p2=jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java&p1=jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java&r1=1585963&r2=1644589&rev=1644589&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreEditor.java Thu Dec 11 10:29:48 2014
@@ -25,7 +25,10 @@ import javax.annotation.Nonnull;
import com.google.common.base.Objects;
import com.google.common.base.Strings;
import com.google.common.collect.Maps;
+import com.google.common.primitives.Longs;
+import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.plugins.memory.PropertyStates;
import org.apache.jackrabbit.oak.plugins.nodetype.TypePredicate;
import org.apache.jackrabbit.oak.plugins.tree.ImmutableTree;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
@@ -34,6 +37,7 @@ import org.apache.jackrabbit.oak.spi.sec
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
import org.apache.jackrabbit.oak.spi.state.NodeState;
import org.apache.jackrabbit.util.Text;
@@ -54,8 +58,6 @@ final class PermissionStoreEditor implem
final Map<String, List<AcEntry>> entries = Maps.<String, List<AcEntry>>newHashMap();
private final NodeBuilder permissionRoot;
- private final TypePredicate isACE;
- private final RestrictionProvider restrictionProvider;
PermissionStoreEditor(@Nonnull String aclPath, @Nonnull String name,
@Nonnull NodeState node, @Nonnull NodeBuilder permissionRoot,
@@ -63,9 +65,6 @@ final class PermissionStoreEditor implem
@Nonnull PrivilegeBitsProvider bitsProvider,
@Nonnull RestrictionProvider restrictionProvider) {
this.permissionRoot = permissionRoot;
- this.isACE = isACE;
- this.restrictionProvider = restrictionProvider;
-
if (name.equals(REP_REPO_POLICY)) {
accessControlledPath = "";
} else {
@@ -79,6 +78,7 @@ final class PermissionStoreEditor implem
addAll(orderedChildNames, node.getChildNodeNames());
}
+ PrivilegeBits jcrAll = bitsProvider.getBits(PrivilegeConstants.JCR_ALL);
int index = 0;
for (String childName : orderedChildNames) {
NodeState ace = node.getChildNode(childName);
@@ -87,8 +87,9 @@ final class PermissionStoreEditor implem
PrivilegeBits privilegeBits = bitsProvider.getBits(ace.getNames(REP_PRIVILEGES));
Set<Restriction> restrictions = restrictionProvider.readRestrictions(Strings.emptyToNull(accessControlledPath), new ImmutableTree(ace));
-
- AcEntry entry = new AcEntry(ace, accessControlledPath, index, isAllow, privilegeBits, restrictions);
+ AcEntry entry = (privilegeBits.equals(jcrAll)) ?
+ new JcrAllAcEntry(ace, accessControlledPath, index, isAllow, privilegeBits, restrictions) :
+ new AcEntry(ace, accessControlledPath, index, isAllow, privilegeBits, restrictions);
List<AcEntry> list = entries.get(entry.principalName);
if (list == null) {
list = new ArrayList<AcEntry>();
@@ -100,52 +101,6 @@ final class PermissionStoreEditor implem
}
}
- void removePermissionEntry(@Nonnull String principalName, @Nonnull PermissionEntry permissionEntry) {
- if (permissionRoot.hasChildNode(principalName)) {
- NodeBuilder principalRoot = permissionRoot.getChildNode(principalName);
-
- // find the ACL node that for this path and principal
- NodeBuilder parent = principalRoot.getChildNode(nodeName);
- if (!parent.exists()) {
- log.error("Unable to remove permission entry {}: Parent for node " + nodeName + " missing.", this);
- return;
- }
-
- // check if the node is the correct one
- if (!PermissionUtil.checkACLPath(parent, accessControlledPath)) {
- parent = null;
- // find the right collision node
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) != 'c') {
- continue;
- }
- NodeBuilder child = parent.getChildNode(childName);
- if (PermissionUtil.checkACLPath(child, accessControlledPath)) {
- parent = child;
- break;
- }
- }
- if (parent == null) {
- log.error("Unable to remove permission entry {}: Parent for node " + nodeName + " missing.", this);
- return;
- }
- }
-
- for (String childName : parent.getChildNodeNames()) {
- if (childName.charAt(0) == 'c') {
- continue;
- }
-
- NodeBuilder entryNode = parent.getChildNode(childName);
- if (permissionEntry.equals(new PermissionEntry(accessControlledPath, new ImmutableTree(entryNode.getNodeState()), restrictionProvider))) {
- entryNode.remove();
- }
- }
- } else {
- log.error("Unable to remove permission entry {}: Principal root missing.", this);
- }
- }
-
void removePermissionEntries() {
for (String principalName : entries.keySet()) {
if (permissionRoot.hasChildNode(principalName)) {
@@ -256,20 +211,35 @@ final class PermissionStoreEditor implem
}
}
- final class AcEntry {
+ private final class JcrAllAcEntry extends AcEntry {
- final String accessControlledPath;
- final String principalName;
- final PrivilegeBits privilegeBits;
- final boolean isAllow;
- final Set<Restriction> restrictions;
- final int index;
- int hashCode = -1;
+ private JcrAllAcEntry(@Nonnull NodeState node,
+ @Nonnull String accessControlledPath,
+ int index, boolean isAllow,
+ @Nonnull PrivilegeBits privilegeBits,
+ @Nonnull Set<Restriction> restrictions) {
+ super(node, accessControlledPath, index, isAllow, privilegeBits, restrictions);
+ }
- private TypePredicate isACE;
+ @Override
+ protected PropertyState getPrivilegeBitsProperty() {
+ return PropertyStates.createProperty(REP_PRIVILEGE_BITS, Longs.asList(PermissionStore.DYNAMIC_ALL_BITS), Type.LONGS);
+ }
+ }
+
+ private class AcEntry {
- AcEntry(@Nonnull NodeState node, @Nonnull String accessControlledPath, int index,
- boolean isAllow, PrivilegeBits privilegeBits, Set<Restriction> restrictions) {
+ private final String accessControlledPath;
+ private final String principalName;
+ private final PrivilegeBits privilegeBits;
+ private final boolean isAllow;
+ private final Set<Restriction> restrictions;
+ private final int index;
+ private int hashCode = -1;
+
+ private AcEntry(@Nonnull NodeState node, @Nonnull String accessControlledPath, int index,
+ boolean isAllow, @Nonnull PrivilegeBits privilegeBits,
+ @Nonnull Set<Restriction> restrictions) {
this.accessControlledPath = accessControlledPath;
this.index = index;
@@ -279,20 +249,20 @@ final class PermissionStoreEditor implem
this.restrictions = restrictions;
}
- PermissionEntry asPermissionEntry() {
- return new PermissionEntry(accessControlledPath, isAllow, index, privilegeBits, restrictionProvider.getPattern(accessControlledPath, restrictions));
- }
-
- void writeToPermissionStore(NodeBuilder parent) {
+ private void writeToPermissionStore(NodeBuilder parent) {
NodeBuilder n = parent.child(String.valueOf(index))
.setProperty(JCR_PRIMARYTYPE, NT_REP_PERMISSIONS, Type.NAME)
.setProperty(REP_IS_ALLOW, isAllow)
- .setProperty(privilegeBits.asPropertyState(REP_PRIVILEGE_BITS));
+ .setProperty(getPrivilegeBitsProperty());
for (Restriction restriction : restrictions) {
n.setProperty(restriction.getProperty());
}
}
+ protected PropertyState getPrivilegeBitsProperty() {
+ return privilegeBits.asPropertyState(REP_PRIVILEGE_BITS);
+ }
+
//-------------------------------------------------------------< Object >---
@Override
public int hashCode() {
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java Thu Dec 11 10:29:48 2014
@@ -25,10 +25,15 @@ import javax.annotation.CheckForNull;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
+import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
import org.apache.jackrabbit.oak.util.TreeUtil;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -36,7 +41,7 @@ import org.slf4j.LoggerFactory;
/**
* {@code PermissionStoreImpl}...
*/
-public class PermissionStoreImpl implements PermissionStore {
+public class PermissionStoreImpl implements PermissionStore, PermissionConstants {
/**
* default logger
@@ -49,17 +54,25 @@ public class PermissionStoreImpl impleme
private final RestrictionProvider restrictionProvider;
+ private final PrivilegeBitsProvider privilegeBitsProvider;
+
+ private PrivilegeBits allBits;
+
private final Map<String, Tree> principalTreeMap = new HashMap<String, Tree>();
public PermissionStoreImpl(Root root, String workspaceName, RestrictionProvider restrictionProvider) {
this.permissionsTree = PermissionUtil.getPermissionsRoot(root, workspaceName);
this.workspaceName = workspaceName;
this.restrictionProvider = restrictionProvider;
+ this.privilegeBitsProvider = new PrivilegeBitsProvider(root);
+
+ allBits = privilegeBitsProvider.getBits(PrivilegeConstants.JCR_ALL);
}
protected void flush(Root root) {
this.permissionsTree = PermissionUtil.getPermissionsRoot(root, workspaceName);
this.principalTreeMap.clear();
+ allBits = privilegeBitsProvider.getBits(PrivilegeConstants.JCR_ALL);
}
@CheckForNull
@@ -85,12 +98,12 @@ public class PermissionStoreImpl impleme
if (principalRoot.hasChild(name)) {
Tree child = principalRoot.getChild(name);
if (PermissionUtil.checkACLPath(child, path)) {
- entries = loadPermissionEntries(path, entries, child, restrictionProvider);
+ entries = loadPermissionEntries(path, entries, child);
} else {
// check for child node
for (Tree node : child.getChildren()) {
if (PermissionUtil.checkACLPath(node, path)) {
- entries = loadPermissionEntries(path, entries, node, restrictionProvider);
+ entries = loadPermissionEntries(path, entries, node);
}
}
}
@@ -104,7 +117,7 @@ public class PermissionStoreImpl impleme
Tree principalRoot = getPrincipalRoot(principalName);
if (principalRoot != null) {
for (Tree entryTree : principalRoot.getChildren()) {
- loadPermissionEntries(entryTree, entries, restrictionProvider);
+ loadPermissionEntries(entryTree, entries);
}
}
}
@@ -124,7 +137,7 @@ public class PermissionStoreImpl impleme
Tree principalRoot = getPrincipalRoot(principalName);
if (principalRoot != null) {
for (Tree entryTree : principalRoot.getChildren()) {
- loadPermissionEntries(entryTree, ret.getEntries(), restrictionProvider);
+ loadPermissionEntries(entryTree, ret.getEntries());
}
}
ret.setFullyLoaded(true);
@@ -135,9 +148,8 @@ public class PermissionStoreImpl impleme
return ret;
}
- private static void loadPermissionEntries(@Nonnull Tree tree,
- @Nonnull Map<String, Collection<PermissionEntry>> pathEntryMap,
- @Nonnull RestrictionProvider restrictionProvider) {
+ private void loadPermissionEntries(@Nonnull Tree tree,
+ @Nonnull Map<String, Collection<PermissionEntry>> pathEntryMap) {
String path = TreeUtil.getString(tree, PermissionConstants.REP_ACCESS_CONTROLLED_PATH);
Collection<PermissionEntry> entries = pathEntryMap.get(path);
if (entries == null) {
@@ -146,26 +158,40 @@ public class PermissionStoreImpl impleme
}
for (Tree child : tree.getChildren()) {
if (child.getName().charAt(0) == 'c') {
- loadPermissionEntries(child, pathEntryMap, restrictionProvider);
+ loadPermissionEntries(child, pathEntryMap);
} else {
- entries.add(new PermissionEntry(path, child, restrictionProvider));
+ entries.add(createPermissionEntry(path, child));
}
}
}
@CheckForNull
- private static Collection<PermissionEntry> loadPermissionEntries(@Nonnull String path,
- @Nullable Collection<PermissionEntry> ret,
- @Nonnull Tree tree,
- @Nonnull RestrictionProvider restrictionProvider) {
+ private Collection<PermissionEntry> loadPermissionEntries(@Nonnull String path,
+ @Nullable Collection<PermissionEntry> ret,
+ @Nonnull Tree tree) {
for (Tree ace : tree.getChildren()) {
if (ace.getName().charAt(0) != 'c') {
if (ret == null) {
ret = new TreeSet<PermissionEntry>();
}
- ret.add(new PermissionEntry(path, ace, restrictionProvider));
+ ret.add(createPermissionEntry(path, ace));
}
}
return ret;
}
+
+ private PermissionEntry createPermissionEntry(@Nonnull String path,
+ @Nonnull Tree entryTree) {
+ PropertyState ps = entryTree.getProperty(REP_PRIVILEGE_BITS);
+ PrivilegeBits bits = (isJcrAll(ps)) ? allBits : PrivilegeBits.getInstance(ps);
+ return new PermissionEntry(path,
+ entryTree.getProperty(REP_IS_ALLOW).getValue(Type.BOOLEAN),
+ Integer.parseInt(entryTree.getName()),
+ bits,
+ restrictionProvider.getPattern(path, entryTree));
+ }
+
+ private static boolean isJcrAll(PropertyState property) {
+ return property.count() == 1 && property.getValue(Type.LONG, 0) == DYNAMIC_ALL_BITS;
+ }
}
\ No newline at end of file
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrincipalRestrictionProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrincipalRestrictionProvider.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrincipalRestrictionProvider.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/PrincipalRestrictionProvider.java Thu Dec 11 10:29:48 2014
@@ -108,4 +108,10 @@ public class PrincipalRestrictionProvide
public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Tree tree) {
return base.getPattern(oakPath, tree);
}
+
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ return base.getPattern(oakPath, restrictions);
+ }
}
\ No newline at end of file
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImpl.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImpl.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImpl.java Thu Dec 11 10:29:48 2014
@@ -19,6 +19,9 @@ package org.apache.jackrabbit.oak.securi
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
+import java.util.Set;
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
import javax.jcr.security.AccessControlException;
import com.google.common.collect.ImmutableMap;
@@ -29,10 +32,13 @@ import org.apache.jackrabbit.oak.api.Tre
import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.AbstractRestrictionProvider;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.CompositePattern;
+import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinition;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionDefinitionImpl;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionPattern;
import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* Default restriction provider implementation that supports the following
@@ -51,6 +57,8 @@ import org.apache.jackrabbit.oak.spi.sec
@Service(RestrictionProvider.class)
public class RestrictionProviderImpl extends AbstractRestrictionProvider {
+ private static final Logger log = LoggerFactory.getLogger(RestrictionProviderImpl.class);
+
public RestrictionProviderImpl() {
super(supportedRestrictions());
}
@@ -69,9 +77,8 @@ public class RestrictionProviderImpl ext
if (oakPath == null) {
return RestrictionPattern.EMPTY;
} else {
+ List<RestrictionPattern> patterns = new ArrayList<RestrictionPattern>(3);
PropertyState glob = tree.getProperty(REP_GLOB);
-
- List<RestrictionPattern> patterns = new ArrayList<RestrictionPattern>(2);
if (glob != null) {
patterns.add(GlobPattern.create(oakPath, glob.getValue(Type.STRING)));
}
@@ -79,17 +86,34 @@ public class RestrictionProviderImpl ext
if (ntNames != null) {
patterns.add(new NodeTypePattern(ntNames.getValue(Type.NAMES)));
}
-
PropertyState prefixes = tree.getProperty(REP_PREFIXES);
if (prefixes != null) {
patterns.add(new PrefixPattern(prefixes.getValue(Type.STRINGS)));
}
+ return CompositePattern.create(patterns);
+ }
+ }
- switch (patterns.size()) {
- case 1 : return patterns.get(0);
- case 2 : return new CompositePattern(patterns);
- default : return RestrictionPattern.EMPTY;
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ if (oakPath == null || restrictions.isEmpty()) {
+ return RestrictionPattern.EMPTY;
+ } else {
+ List<RestrictionPattern> patterns = new ArrayList<RestrictionPattern>(3);
+ for (Restriction r : restrictions) {
+ String name = r.getDefinition().getName();
+ if (REP_GLOB.equals(name)) {
+ patterns.add(GlobPattern.create(oakPath, r.getProperty().getValue(Type.STRING)));
+ } else if (REP_NT_NAMES.equals(name)) {
+ patterns.add(new NodeTypePattern(r.getProperty().getValue(Type.NAMES)));
+ } else if (REP_PREFIXES.equals(name)) {
+ patterns.add(new PrefixPattern(r.getProperty().getValue(Type.STRINGS)));
+ } else {
+ log.debug("Ignoring unsupported restriction " + name);
+ }
}
+ return CompositePattern.create(patterns);
}
}
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositePattern.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositePattern.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositePattern.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositePattern.java Thu Dec 11 10:29:48 2014
@@ -37,6 +37,14 @@ public final class CompositePattern impl
this.patterns = patterns;
}
+ public static RestrictionPattern create(@Nonnull List<RestrictionPattern> patterns) {
+ switch (patterns.size()) {
+ case 0 : return RestrictionPattern.EMPTY;
+ case 1 : return patterns.get(0);
+ default : return new CompositePattern(patterns);
+ }
+ }
+
@Override
public boolean matches(@Nonnull Tree tree, @Nullable PropertyState property) {
for (RestrictionPattern pattern : patterns) {
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositeRestrictionProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositeRestrictionProvider.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositeRestrictionProvider.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/CompositeRestrictionProvider.java Thu Dec 11 10:29:48 2014
@@ -128,18 +128,20 @@ public class CompositeRestrictionProvide
@Nonnull
@Override
public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Tree tree) {
+ return getPattern(oakPath, readRestrictions(oakPath, tree));
+ }
+
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
List<RestrictionPattern> patterns = new ArrayList<RestrictionPattern>();
for (RestrictionProvider rp : providers) {
- RestrictionPattern pattern = rp.getPattern(oakPath, tree);
+ RestrictionPattern pattern = rp.getPattern(oakPath, restrictions);
if (pattern != RestrictionPattern.EMPTY) {
patterns.add(pattern);
}
}
- switch (patterns.size()) {
- case 0 : return RestrictionPattern.EMPTY;
- case 1 : return patterns.iterator().next();
- default : return new CompositePattern(patterns);
- }
+ return CompositePattern.create(patterns);
}
//------------------------------------------------------------< private >---
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/RestrictionProvider.java Thu Dec 11 10:29:48 2014
@@ -134,6 +134,20 @@ public interface RestrictionProvider {
RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Tree tree);
/**
+ * Creates the {@link RestrictionPattern} for the specified restrictions.
+ * The implementation should ignore all restrictions present in the specified
+ * set that it doesn't support.
+ *
+ * @param oakPath The path of the access controlled tree or {@code null} if
+ * the target policies applies to the repository level.
+ * @param restrictions the restrictions.
+ * @return A new {@link RestrictionPattern} representing those restrictions
+ * of the specified set that are supported by this implementation.
+ */
+ @Nonnull
+ RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions);
+
+ /**
* Empty restriction provider implementation that doesn't support any
* restrictions.
*/
@@ -178,5 +192,11 @@ public interface RestrictionProvider {
public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Tree tree) {
return RestrictionPattern.EMPTY;
}
+
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ return RestrictionPattern.EMPTY;
+ }
};
}
Modified: jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/whiteboard/WhiteboardRestrictionProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/whiteboard/WhiteboardRestrictionProvider.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/whiteboard/WhiteboardRestrictionProvider.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/whiteboard/WhiteboardRestrictionProvider.java Thu Dec 11 10:29:48 2014
@@ -83,6 +83,12 @@ public class WhiteboardRestrictionProvid
return getProvider().getPattern(oakPath, tree);
}
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ return getProvider().getPattern(oakPath, restrictions);
+ }
+
//------------------------------------------------------------< private >---
private RestrictionProvider getProvider() {
return CompositeRestrictionProvider.newInstance(getServices());
Modified: jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/ACLTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/ACLTest.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/ACLTest.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/accesscontrol/ACLTest.java Thu Dec 11 10:29:48 2014
@@ -800,5 +800,11 @@ public class ACLTest extends AbstractAcc
public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Tree tree) {
throw new UnsupportedOperationException();
}
+
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ throw new UnsupportedOperationException();
+ }
}
}
\ No newline at end of file
Modified: jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHookTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHookTest.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHookTest.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHookTest.java Thu Dec 11 10:29:48 2014
@@ -20,22 +20,28 @@ import java.security.Principal;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
+import java.util.Set;
import javax.jcr.RepositoryException;
import javax.jcr.security.AccessControlEntry;
import javax.jcr.security.AccessControlManager;
+import com.google.common.collect.ImmutableSet;
import org.apache.jackrabbit.JcrConstants;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
import org.apache.jackrabbit.api.security.user.Group;
import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils;
import org.apache.jackrabbit.oak.api.ContentSession;
+import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.api.Tree;
import org.apache.jackrabbit.oak.api.Type;
+import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AbstractAccessControlTest;
import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants;
import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionConstants;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions;
import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants;
@@ -347,4 +353,58 @@ public class PermissionHookTest extends
principalRoot = getPrincipalRoot(EveryonePrincipal.NAME);
assertEquals(2, cntEntries(principalRoot));
}
+
+ /**
+ * @see <a href="https://issues.apache.org/jira/browse/OAK-2015">OAK-2015</a>
+ */
+ @Test
+ public void testDynamicJcrAll() throws Exception {
+ AccessControlManager acMgr = getAccessControlManager(root);
+
+ // grant 'everyone' jcr:all at the child path.
+ JackrabbitAccessControlList acl = AccessControlUtils.getAccessControlList(acMgr, childPath);
+ acl.addAccessControlEntry(EveryonePrincipal.getInstance(), privilegesFromNames(JCR_ALL));
+ acMgr.setPolicy(childPath, acl);
+ root.commit();
+
+ // verify that the permission store contains an entry for everyone at childPath
+ // and the privilegeBits for jcr:all are reflect with a placeholder value.
+ Tree allEntry = getEntry(EveryonePrincipal.NAME, childPath, 0);
+ assertTrue(allEntry.exists());
+ PropertyState ps = allEntry.getProperty(PermissionConstants.REP_PRIVILEGE_BITS);
+ assertEquals(1, ps.count());
+ assertEquals(PermissionStore.DYNAMIC_ALL_BITS, ps.getValue(Type.LONG, 0).longValue());
+
+ // verify that the permission provider still exposes the correct privilege
+ // (jcr:all) for the given childPath irrespective of the dynamic nature of
+ // the privilege bits in the persisted permission entry.
+ Set<Principal> principalSet = ImmutableSet.<Principal>of(EveryonePrincipal.getInstance());
+ PermissionProvider permissionProvider = getConfig(AuthorizationConfiguration.class).getPermissionProvider(root, root.getContentSession().getWorkspaceName(), principalSet);
+ Tree childTree = root.getTree(childPath);
+ assertTrue(permissionProvider.hasPrivileges(childTree, PrivilegeConstants.JCR_ALL));
+ assertTrue(permissionProvider.getPrivileges(childTree).contains(PrivilegeConstants.JCR_ALL));
+
+ // also verify the permission evaluation
+ long diff = Permissions.diff(Permissions.ALL, Permissions.REMOVE_NODE|Permissions.ADD_NODE);
+ assertFalse(permissionProvider.isGranted(childTree, null, Permissions.REMOVE_NODE));
+ assertFalse(permissionProvider.isGranted(childTree, null, Permissions.ADD_NODE));
+ assertTrue(permissionProvider.isGranted(childTree, null, diff));
+
+ // remove the ACE again
+ acl = AccessControlUtils.getAccessControlList(acMgr, childPath);
+ for (AccessControlEntry ace : acl.getAccessControlEntries()) {
+ if (EveryonePrincipal.NAME.equals(ace.getPrincipal().getName())) {
+ acl.removeAccessControlEntry(ace);
+ }
+ }
+ acMgr.setPolicy(childPath, acl);
+ root.commit();
+
+ // verify that the corresponding permission entry has been removed.
+ Tree everyoneRoot = getPrincipalRoot(EveryonePrincipal.NAME);
+ Tree parent = everyoneRoot.getChild(PermissionUtil.getEntryName(childPath));
+ if (parent.exists()) {
+ assertFalse(parent.getChild("0").exists());
+ }
+ }
}
\ No newline at end of file
Modified: jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImplTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImplTest.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImplTest.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/restriction/RestrictionProviderImplTest.java Thu Dec 11 10:29:48 2014
@@ -94,7 +94,7 @@ public class RestrictionProviderImplTest
map.put(PropertyStates.createProperty(REP_NT_NAMES, ntNames, Type.NAMES), new NodeTypePattern(ntNames));
NodeUtil tree = new NodeUtil(root.getTree("/")).getOrAddTree("testPath", JcrConstants.NT_UNSTRUCTURED);
- Tree restrictions = tree.addChild("restrictions", NT_REP_RESTRICTIONS).getTree();
+ Tree restrictions = tree.addChild(REP_RESTRICTIONS, NT_REP_RESTRICTIONS).getTree();
// test restrictions individually
for (Map.Entry<PropertyState, RestrictionPattern> entry : map.entrySet()) {
@@ -114,6 +114,54 @@ public class RestrictionProviderImplTest
assertTrue(pattern instanceof CompositePattern);
}
+ @Test
+ public void testGetPatternForAllSupported() throws Exception {
+ Map<PropertyState, RestrictionPattern> map = newHashMap();
+ map.put(PropertyStates.createProperty(REP_GLOB, "/*/jcr:content"), GlobPattern.create("/testPath", "/*/jcr:content"));
+ List<String> ntNames = ImmutableList.of(JcrConstants.NT_FOLDER, JcrConstants.NT_LINKEDFILE);
+ map.put(PropertyStates.createProperty(REP_NT_NAMES, ntNames, Type.NAMES), new NodeTypePattern(ntNames));
+ List<String> prefixes = ImmutableList.of("rep", "jcr");
+ map.put(PropertyStates.createProperty(REP_PREFIXES, prefixes, Type.STRINGS), new PrefixPattern(prefixes));
+
+ NodeUtil tree = new NodeUtil(root.getTree("/")).getOrAddTree("testPath", JcrConstants.NT_UNSTRUCTURED);
+ Tree restrictions = tree.addChild(REP_RESTRICTIONS, NT_REP_RESTRICTIONS).getTree();
+ for (Map.Entry<PropertyState, RestrictionPattern> entry : map.entrySet()) {
+ restrictions.setProperty(entry.getKey());
+ }
+
+ RestrictionPattern pattern = provider.getPattern("/testPath", restrictions);
+ assertTrue(pattern instanceof CompositePattern);
+ }
+
+ @Test
+ public void testGetPatternFromRestrictions() throws Exception {
+ Map<PropertyState, RestrictionPattern> map = newHashMap();
+ map.put(PropertyStates.createProperty(REP_GLOB, "/*/jcr:content"), GlobPattern.create("/testPath", "/*/jcr:content"));
+ List<String> ntNames = ImmutableList.of(JcrConstants.NT_FOLDER, JcrConstants.NT_LINKEDFILE);
+ map.put(PropertyStates.createProperty(REP_NT_NAMES, ntNames, Type.NAMES), new NodeTypePattern(ntNames));
+ List<String> prefixes = ImmutableList.of("rep", "jcr");
+ map.put(PropertyStates.createProperty(REP_PREFIXES, prefixes, Type.STRINGS), new PrefixPattern(prefixes));
+
+ NodeUtil tree = new NodeUtil(root.getTree("/")).getOrAddTree("testPath", JcrConstants.NT_UNSTRUCTURED);
+ Tree restrictions = tree.addChild(REP_RESTRICTIONS, NT_REP_RESTRICTIONS).getTree();
+
+ // test restrictions individually
+ for (Map.Entry<PropertyState, RestrictionPattern> entry : map.entrySet()) {
+ restrictions.setProperty(entry.getKey());
+
+ RestrictionPattern pattern = provider.getPattern("/testPath", provider.readRestrictions("/testPath", tree.getTree()));
+ assertEquals(entry.getValue(), pattern);
+ restrictions.removeProperty(entry.getKey().getName());
+ }
+
+ // test combination on multiple restrictions
+ for (Map.Entry<PropertyState, RestrictionPattern> entry : map.entrySet()) {
+ restrictions.setProperty(entry.getKey());
+ }
+ RestrictionPattern pattern = provider.getPattern("/testPath", provider.readRestrictions("/testPath", tree.getTree()));
+ assertTrue(pattern instanceof CompositePattern);
+ }
+
@Test
public void testValidateGlobRestriction() throws Exception {
Tree t = new NodeUtil(root.getTree("/")).addChild("testTree", "nt:unstructured").getTree();
Modified: jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/TestProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/TestProvider.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/TestProvider.java (original)
+++ jackrabbit/oak/branches/1.0/oak-core/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/restriction/TestProvider.java Thu Dec 11 10:29:48 2014
@@ -17,6 +17,7 @@
package org.apache.jackrabbit.oak.spi.security.authorization.restriction;
import java.util.Map;
+import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
@@ -45,6 +46,17 @@ final class TestProvider extends Abstrac
return (hasRestriction) ? new MatchingPattern() : RestrictionPattern.EMPTY;
}
+ @Nonnull
+ @Override
+ public RestrictionPattern getPattern(@Nullable String oakPath, @Nonnull Set<Restriction> restrictions) {
+ for (Restriction r : restrictions) {
+ if (getSupportedRestrictions(oakPath).contains(r.getDefinition())) {
+ return new MatchingPattern();
+ }
+ }
+ return RestrictionPattern.EMPTY;
+ }
+
private static final class MatchingPattern implements RestrictionPattern {
@Override
Modified: jackrabbit/oak/branches/1.0/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/privilege/PrivilegeRegistrationTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.0/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/privilege/PrivilegeRegistrationTest.java?rev=1644589&r1=1644588&r2=1644589&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.0/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/privilege/PrivilegeRegistrationTest.java (original)
+++ jackrabbit/oak/branches/1.0/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/privilege/PrivilegeRegistrationTest.java Thu Dec 11 10:29:48 2014
@@ -16,12 +16,13 @@
*/
package org.apache.jackrabbit.oak.jcr.security.privilege;
+import java.security.Principal;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
-
+import java.util.Set;
import javax.jcr.AccessDeniedException;
import javax.jcr.InvalidItemStateException;
import javax.jcr.NamespaceException;
@@ -33,6 +34,8 @@ import javax.jcr.Workspace;
import javax.jcr.security.AccessControlException;
import javax.jcr.security.Privilege;
+import com.google.common.collect.ImmutableSet;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager;
import org.apache.jackrabbit.api.security.authorization.PrivilegeManager;
import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils;
import org.apache.jackrabbit.oak.jcr.Jcr;
@@ -413,4 +416,26 @@ public class PrivilegeRegistrationTest e
superuser.refresh(false);
}
}
+
+ /**
+ * @see <a href="https://issues.apache.org/jira/browse/OAK-2015">OAK-2015</a>
+ */
+ @Test
+ public void testJcrAllWithCustomPrivileges() throws Exception {
+ Node testNode = session.getRootNode().addNode("test");
+ String testPath = testNode.getPath();
+
+ AccessControlUtils.grantAllToEveryone(session, testPath);
+ session.save();
+
+ JackrabbitAccessControlManager acMgr = (JackrabbitAccessControlManager) session.getAccessControlManager();
+ Privilege[] allPrivileges = AccessControlUtils.privilegesFromNames(session, Privilege.JCR_ALL);
+ Set<Principal> principalSet = ImmutableSet.<Principal>of(EveryonePrincipal.getInstance());
+
+ assertTrue(acMgr.hasPrivileges(testPath, principalSet, allPrivileges));
+
+ privilegeManager.registerPrivilege("customPriv", false, null);
+
+ assertTrue(acMgr.hasPrivileges(testPath, principalSet, allPrivileges));
+ }
}
\ No newline at end of file