You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by ju...@apache.org on 2014/04/15 06:12:33 UTC
svn commit: r1587399 - in /jackrabbit/oak/trunk:
oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/
oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/
oak-upgrade/src/main/java/org/apache/jackrabbit/oak/u...
Author: jukka
Date: Tue Apr 15 04:12:32 2014
New Revision: 1587399
URL: http://svn.apache.org/r1587399
Log:
OAK-1719: Missing commit hooks in upgrade
Add an editor for upgrading rep:glob entries in existing Jackrabbit Classic ACEs to the rep:restrictions structure used in Oak
Make the RepositoryUpgrade class easier to extend and customize.
Use the after instead of the before state to get privilege bits in PermissionHook, as otherwise newly added privileges won't be reflected in the permission store.
Also: Avoid NPE in SegmentNodeState.getStringValue("jcr:primaryType") in the unexpected case when a primary type is not set.
Added:
jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java (with props)
jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java (with props)
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/SegmentNodeState.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/RepositoryUpgrade.java
Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/SegmentNodeState.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/SegmentNodeState.java?rev=1587399&r1=1587398&r2=1587399&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/SegmentNodeState.java (original)
+++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/segment/SegmentNodeState.java Tue Apr 15 04:12:32 2014
@@ -219,10 +219,12 @@ public class SegmentNodeState extends Re
Template template = getTemplate();
if (JCR_PRIMARYTYPE.equals(name)) {
PropertyState primary = template.getPrimaryType();
- if (type == NAME) {
- return primary.getValue(NAME);
- } else if (primary != null) {
- return null;
+ if (primary != null) {
+ if (type == NAME) {
+ return primary.getValue(NAME);
+ } else {
+ return null;
+ }
}
} else if (JCR_MIXINTYPES.equals(name)
&& template.getMixinTypes() != null) {
Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java?rev=1587399&r1=1587398&r2=1587399&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java (original)
+++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java Tue Apr 15 04:12:32 2014
@@ -92,7 +92,7 @@ public class PermissionHook implements P
NodeBuilder rootAfter = after.builder();
permissionRoot = getPermissionRoot(rootAfter);
- bitsProvider = new PrivilegeBitsProvider(new ImmutableRoot(before));
+ bitsProvider = new PrivilegeBitsProvider(new ImmutableRoot(after));
isACL = new TypePredicate(after, NT_REP_ACL);
isACE = new TypePredicate(after, NT_REP_ACE);
Modified: jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/RepositoryUpgrade.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/RepositoryUpgrade.java?rev=1587399&r1=1587398&r2=1587399&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/RepositoryUpgrade.java (original)
+++ jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/RepositoryUpgrade.java Tue Apr 15 04:12:32 2014
@@ -55,6 +55,7 @@ import org.apache.jackrabbit.oak.spi.com
import org.apache.jackrabbit.oak.spi.commit.CompositeEditorProvider;
import org.apache.jackrabbit.oak.spi.commit.CompositeHook;
import org.apache.jackrabbit.oak.spi.commit.EditorHook;
+import org.apache.jackrabbit.oak.spi.lifecycle.RepositoryInitializer;
import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
import org.apache.jackrabbit.oak.spi.security.SecurityConfiguration;
import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
@@ -65,6 +66,7 @@ import org.apache.jackrabbit.oak.spi.sta
import org.apache.jackrabbit.oak.spi.state.NodeState;
import org.apache.jackrabbit.oak.spi.state.NodeStore;
import org.apache.jackrabbit.oak.upgrade.security.GroupEditorProvider;
+import org.apache.jackrabbit.oak.upgrade.security.RestrictionEditorProvider;
import org.apache.jackrabbit.spi.Name;
import org.apache.jackrabbit.spi.QItemDefinition;
import org.apache.jackrabbit.spi.QNodeDefinition;
@@ -173,7 +175,7 @@ public class RepositoryUpgrade {
throws RepositoryException {
RepositoryContext context = RepositoryContext.create(source);
try {
- new RepositoryUpgrade(context, target).copy();
+ new RepositoryUpgrade(context, target).copy(null);
} finally {
context.getRepository().shutdown();
}
@@ -206,15 +208,14 @@ public class RepositoryUpgrade {
* The source repository <strong>must not be modified</strong> while
* the copy operation is running to avoid an inconsistent copy.
* <p>
- * This method leaves the search indexes of the target repository in
- * an
* Note that both the source and the target repository must be closed
* during the copy operation as this method requires exclusive access
* to the repositories.
*
+ * @param initializer optional extra repository initializer to use
* @throws RepositoryException if the copy operation fails
*/
- public void copy() throws RepositoryException {
+ public void copy(RepositoryInitializer initializer) throws RepositoryException {
RepositoryConfig config = source.getRepositoryConfig();
logger.info(
"Copying repository content from {} to Oak", config.getHomeDir());
@@ -228,6 +229,9 @@ public class RepositoryUpgrade {
// init target repository first
new InitialContent().initialize(builder);
+ if (initializer != null) {
+ initializer.initialize(builder);
+ }
for (SecurityConfiguration sc : security.getConfigurations()) {
sc.getWorkspaceInitializer().initialize(builder, workspace);
}
@@ -251,25 +255,31 @@ public class RepositoryUpgrade {
String groupsPath = userConf.getParameters().getConfigValue(
UserConstants.PARAM_GROUP_PATH,
UserConstants.DEFAULT_GROUP_PATH);
- hooks.add(new EditorHook(new GroupEditorProvider(groupsPath)));
+
+ // hooks specific to the upgrade, need to run first
hooks.add(new EditorHook(new CompositeEditorProvider(
- new GroupEditorProvider(groupsPath),
- new TypeEditorProvider(false),
- new IndexUpdateProvider(new CompositeIndexEditorProvider(
- new ReferenceEditorProvider(),
- new PropertyIndexEditorProvider())))));
+ new RestrictionEditorProvider(),
+ new GroupEditorProvider(groupsPath))));
+ // security-related hooks
for (SecurityConfiguration sc : security.getConfigurations()) {
hooks.addAll(sc.getCommitHooks(workspace));
}
+ // type validation, reference and indexing hooks
+ hooks.add(new EditorHook(new CompositeEditorProvider(
+ new TypeEditorProvider(false),
+ new IndexUpdateProvider(new CompositeIndexEditorProvider(
+ new ReferenceEditorProvider(),
+ new PropertyIndexEditorProvider())))));
+
target.merge(builder, CompositeHook.compose(hooks), CommitInfo.EMPTY);
} catch (Exception e) {
throw new RepositoryException("Failed to copy content", e);
}
}
- private ConfigurationParameters mapSecurityConfig(SecurityConfig config) {
+ protected ConfigurationParameters mapSecurityConfig(SecurityConfig config) {
ConfigurationParameters loginConfig = mapConfigurationParameters(
config.getLoginModuleConfig(),
LoginModuleConfig.PARAM_ADMIN_ID, UserConstants.PARAM_ADMIN_ID,
@@ -286,7 +296,7 @@ public class RepositoryUpgrade {
ConfigurationParameters.of(loginConfig, userConfig)));
}
- private ConfigurationParameters mapConfigurationParameters(
+ protected ConfigurationParameters mapConfigurationParameters(
BeanConfig config, String... mapping) {
Map<String, String> map = newHashMap();
if (config != null) {
Added: jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java?rev=1587399&view=auto
==============================================================================
--- jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java (added)
+++ jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java Tue Apr 15 04:12:32 2014
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.upgrade.security;
+
+import static org.apache.jackrabbit.JcrConstants.JCR_PRIMARYTYPE;
+import static org.apache.jackrabbit.oak.api.Type.NAME;
+import static org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants.NT_REP_RESTRICTIONS;
+import static org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants.REP_GLOB;
+import static org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants.REP_RESTRICTIONS;
+
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.plugins.nodetype.TypePredicate;
+import org.apache.jackrabbit.oak.spi.commit.DefaultEditor;
+import org.apache.jackrabbit.oak.spi.commit.Editor;
+import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
+import org.apache.jackrabbit.oak.spi.state.NodeState;
+
+public class RestrictionEditor extends DefaultEditor {
+
+ private final NodeBuilder builder;
+
+ private final TypePredicate isACE;
+
+ private PropertyState glob = null;
+
+ public RestrictionEditor(NodeBuilder builder, TypePredicate isACE) {
+ this.builder = builder;
+ this.isACE = isACE;
+ }
+
+ private RestrictionEditor(RestrictionEditor parent, String name) {
+ this.builder = parent.builder.getChildNode(name);
+ this.isACE = parent.isACE;
+ }
+
+ @Override
+ public void leave(NodeState before, NodeState after) {
+ if (glob != null
+ && isACE.apply(after)
+ && !builder.hasChildNode(REP_RESTRICTIONS)) {
+ NodeBuilder restrictions = builder.setChildNode(REP_RESTRICTIONS);
+ restrictions.setProperty(JCR_PRIMARYTYPE, NT_REP_RESTRICTIONS, NAME);
+ restrictions.setProperty(glob);
+ builder.removeProperty(REP_GLOB);
+ }
+ }
+
+ @Override
+ public void propertyAdded(PropertyState after) {
+ if (REP_GLOB.equals(after.getName())) {
+ glob = after;
+ }
+ }
+
+ @Override
+ public void propertyChanged(PropertyState before, PropertyState after) {
+ if (REP_GLOB.equals(after.getName())) {
+ glob = after;
+ }
+ }
+
+ @Override
+ public Editor childNodeAdded(String name, NodeState after) {
+ return new RestrictionEditor(this, name);
+ }
+
+ @Override
+ public Editor childNodeChanged(
+ String name, NodeState before, NodeState after) {
+ return new RestrictionEditor(this, name);
+ }
+
+}
Propchange: jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditor.java
------------------------------------------------------------------------------
svn:eol-style = native
Added: jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java?rev=1587399&view=auto
==============================================================================
--- jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java (added)
+++ jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java Tue Apr 15 04:12:32 2014
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.upgrade.security;
+
+import static org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants.NT_REP_ACE;
+
+import org.apache.jackrabbit.oak.plugins.nodetype.TypePredicate;
+import org.apache.jackrabbit.oak.spi.commit.CommitInfo;
+import org.apache.jackrabbit.oak.spi.commit.Editor;
+import org.apache.jackrabbit.oak.spi.commit.EditorProvider;
+import org.apache.jackrabbit.oak.spi.state.NodeBuilder;
+import org.apache.jackrabbit.oak.spi.state.NodeState;
+
+/**
+ * Editor provider for upgrading ACL restrictions (rep:glob) from
+ * Jackrabbit Classic to Oak.
+ */
+public class RestrictionEditorProvider implements EditorProvider {
+
+ @Override
+ public Editor getRootEditor(
+ NodeState before, NodeState after,
+ NodeBuilder builder, CommitInfo info) {
+ TypePredicate isACE = new TypePredicate(after, NT_REP_ACE);
+ return new RestrictionEditor(builder, isACE);
+ }
+
+}
Propchange: jackrabbit/oak/trunk/oak-upgrade/src/main/java/org/apache/jackrabbit/oak/upgrade/security/RestrictionEditorProvider.java
------------------------------------------------------------------------------
svn:eol-style = native