You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by mr...@apache.org on 2017/03/02 13:32:24 UTC
svn commit: r1785132 - in /jackrabbit/oak/branches/1.4: ./
oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/
oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/
Author: mreutegg
Date: Thu Mar 2 13:32:24 2017
New Revision: 1785132
URL: http://svn.apache.org/viewvc?rev=1785132&view=rev
Log:
OAK-4361: Reduce performance impact of observation ACFilter
Merged revision 1746634 from trunk
Modified:
jackrabbit/oak/branches/1.4/ (props changed)
jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/ACFilter.java
jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
Propchange: jackrabbit/oak/branches/1.4/
------------------------------------------------------------------------------
--- svn:mergeinfo (original)
+++ svn:mergeinfo Thu Mar 2 13:32:24 2017
@@ -1,3 +1,3 @@
/jackrabbit/oak/branches/1.0:1665962
-/jackrabbit/oak/trunk:1733615,1733875,1733913,1733929,1734230,1734254,1734279,1734941,1735052,1735081,1735109,1735141,1735267,1735405,1735484,1735549,1735564,1735588,1735622,1735638,1735919,1735983,1736176,1737309-1737310,1737334,1737349,1737998,1738004,1738136,1738138,1738207,1738234,1738252,1738775,1738795,1738833,1738950,1738957,1738963,1739712,1739760,1739867,1739894,1739959-1739960,1740114,1740116,1740250,1740333,1740349,1740360,1740625-1740626,1740774,1740837,1740879,1740971,1741016,1741032,1741339,1741343,1742077,1742117,1742125,1742363,1742520,1742888,1742916,1743097,1743172,1743343,1743674,1744265,1744292,1744589,1744670,1744672,1744959,1745038,1745127,1745197,1745336,1745368,1746086,1746117,1746342,1746345,1746408,1746696,1746981,1747198,1747200,1747341-1747342,1747380,1747387,1747406,1747492,1747512,1747654,1748505,1748553,1748722,1748870,1749275,1749350,1749424,1749443,1749464,1749475,1749645,1749662,1749815,1749872,1749875,1749899,1750052,1750076-1750077,1750287,1750457
,1750462,1750465,1750495,1750626,1750809,1750886-1750887,1751396,1751410,1751419,1751445-1751446,1751478,1751748,1751753,1751755,1751871,1752198,1752202,1752259,1752273-1752274,1752283,1752292,1752438,1752447-1752448,1752508,1752596,1752616,1752659,1752672,1753262,1753331-1753332,1753335-1753336,1753355,1753444,1754117,1754239,1755157,1755191,1756520,1756580,1757119,1757166,1758213,1758713,1759433,1759795,1759826,1760326,1760340,1760373,1760387,1760486,1760492,1760494,1760661-1760662,1761412,1761444,1761571,1761762,1761787,1761876,1762453,1762612,1762632,1762635,1763347,1763355-1763356,1763378,1763465,1763735,1764678,1764705,1764814,1764898,1765817,1765983,1766071,1766390,1766423,1766496,1766519,1766554,1766644,1767025,1767265,1767704,1768446,1768637,1769078,1770694,1770982,1771022,1771093,1771098,1771739,1771852,1771870,1771902,1772155,1772162,1772228,1772593,1772768,1773190,1774497,1775474,1775622,1775628,1775757,1778423,1778968,1779478,1780388,1780538,1780543,1781068,1781075,1781
386,1781846,1781907,1783066,1783089,1783104-1783105,1783619,1783855,1784023,1784130,1784251
+/jackrabbit/oak/trunk:1733615,1733875,1733913,1733929,1734230,1734254,1734279,1734941,1735052,1735081,1735109,1735141,1735267,1735405,1735484,1735549,1735564,1735588,1735622,1735638,1735919,1735983,1736176,1737309-1737310,1737334,1737349,1737998,1738004,1738136,1738138,1738207,1738234,1738252,1738775,1738795,1738833,1738950,1738957,1738963,1739712,1739760,1739867,1739894,1739959-1739960,1740114,1740116,1740250,1740333,1740349,1740360,1740625-1740626,1740774,1740837,1740879,1740971,1741016,1741032,1741339,1741343,1742077,1742117,1742125,1742363,1742520,1742888,1742916,1743097,1743172,1743343,1743674,1744265,1744292,1744589,1744670,1744672,1744959,1745038,1745127,1745197,1745336,1745368,1746086,1746117,1746342,1746345,1746408,1746634,1746696,1746981,1747198,1747200,1747341-1747342,1747380,1747387,1747406,1747492,1747512,1747654,1748505,1748553,1748722,1748870,1749275,1749350,1749424,1749443,1749464,1749475,1749645,1749662,1749815,1749872,1749875,1749899,1750052,1750076-1750077,1750287
,1750457,1750462,1750465,1750495,1750626,1750809,1750886-1750887,1751396,1751410,1751419,1751445-1751446,1751478,1751748,1751753,1751755,1751871,1752198,1752202,1752259,1752273-1752274,1752283,1752292,1752438,1752447-1752448,1752508,1752596,1752616,1752659,1752672,1753262,1753331-1753332,1753335-1753336,1753355,1753444,1754117,1754239,1755157,1755191,1756520,1756580,1757119,1757166,1758213,1758713,1759433,1759795,1759826,1760326,1760340,1760373,1760387,1760486,1760492,1760494,1760661-1760662,1761412,1761444,1761571,1761762,1761787,1761876,1762453,1762612,1762632,1762635,1763347,1763355-1763356,1763378,1763465,1763735,1764678,1764705,1764814,1764898,1765817,1765983,1766071,1766390,1766423,1766496,1766519,1766554,1766644,1767025,1767265,1767704,1768446,1768637,1769078,1770694,1770982,1771022,1771093,1771098,1771739,1771852,1771870,1771902,1772155,1772162,1772228,1772593,1772768,1773190,1774497,1775474,1775622,1775628,1775757,1778423,1778968,1779478,1780388,1780538,1780543,1781068,1781
075,1781386,1781846,1781907,1783066,1783089,1783104-1783105,1783619,1783855,1784023,1784130,1784251
/jackrabbit/trunk:1345480
Modified: jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/ACFilter.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/ACFilter.java?rev=1785132&r1=1785131&r2=1785132&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/ACFilter.java (original)
+++ jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/observation/filter/ACFilter.java Thu Mar 2 13:32:24 2017
@@ -32,11 +32,30 @@ import org.apache.jackrabbit.oak.spi.sta
/**
* {@code EventTypeFilter} filters based on the access rights of the observing session.
*/
-public class ACFilter implements EventFilter {
- private final TreePermission treePermission;
+public final class ACFilter implements EventFilter {
- private ACFilter(@Nonnull TreePermission treePermission) {
- this.treePermission = checkNotNull(treePermission);
+ private final NodeState before;
+
+ private final NodeState after;
+
+ private final String name;
+
+ private final ACFilter parentFilter;
+
+ private final PermissionProvider permissionProvider;
+
+ private TreePermission treePermission;
+
+ private ACFilter(@Nonnull NodeState before,
+ @Nonnull NodeState after,
+ @Nonnull String name,
+ @Nonnull PermissionProvider permissionProvider,
+ @Nonnull ACFilter parentFilter) {
+ this.before = checkNotNull(before);
+ this.after = checkNotNull(after);
+ this.name = checkNotNull(name);
+ this.permissionProvider = checkNotNull(permissionProvider);
+ this.parentFilter = checkNotNull(parentFilter);
}
/**
@@ -47,52 +66,71 @@ public class ACFilter implements EventFi
* @param after after state
* @param permissionProvider permission provider for access control evaluation
*/
- public ACFilter(@Nonnull NodeState before, @Nonnull NodeState after,
- @Nonnull PermissionProvider permissionProvider) {
- this(permissionProvider.getTreePermission(
- TreeFactory.createReadOnlyTree((after.exists() ? after : before)), TreePermission.EMPTY));
+ public ACFilter(@Nonnull NodeState before,
+ @Nonnull NodeState after,
+ @Nonnull PermissionProvider permissionProvider) {
+ this.before = checkNotNull(before);
+ this.after = checkNotNull(after);
+ this.name = null;
+ this.permissionProvider = checkNotNull(permissionProvider);
+ this.parentFilter = null;
}
@Override
public boolean includeAdd(PropertyState after) {
- return treePermission.canRead(after);
+ return getTreePermission().canRead(after);
}
@Override
public boolean includeChange(PropertyState before, PropertyState after) {
- return treePermission.canRead(after);
+ return getTreePermission().canRead(after);
}
@Override
public boolean includeDelete(PropertyState before) {
- return treePermission.canRead(before);
+ return getTreePermission().canRead(before);
}
@Override
public boolean includeAdd(String name, NodeState after) {
- return treePermission.getChildPermission(name, after).canRead();
+ return getTreePermission().getChildPermission(name, after).canRead();
}
@Override
public boolean includeDelete(String name, NodeState before) {
- return treePermission.getChildPermission(name, before).canRead();
+ return getTreePermission().getChildPermission(name, before).canRead();
}
@Override
public boolean includeMove(String sourcePath, String name, NodeState moved) {
// TODO: check access to the source path, it might not be accessible
- return treePermission.getChildPermission(name, moved).canRead();
+ return getTreePermission().getChildPermission(name, moved).canRead();
}
@Override
public boolean includeReorder(String destName, String name, NodeState reordered) {
// TODO: check access to the dest name, it might not be accessible
- return treePermission.getChildPermission(name, reordered).canRead();
+ return getTreePermission().getChildPermission(name, reordered).canRead();
}
@Override
public EventFilter create(String name, NodeState before, NodeState after) {
- return new ACFilter(treePermission.getChildPermission(name, after));
+ return new ACFilter(before, after, name, permissionProvider, this);
}
+ //-----------------------------< internal >---------------------------------
+
+ private TreePermission getTreePermission() {
+ TreePermission tp = treePermission;
+ if (tp == null) {
+ if (parentFilter == null) {
+ tp = permissionProvider.getTreePermission(
+ TreeFactory.createReadOnlyTree((after.exists() ? after : before)), TreePermission.EMPTY);
+ } else {
+ tp = parentFilter.getTreePermission().getChildPermission(name, after);
+ }
+ treePermission = tp;
+ }
+ return tp;
+ }
}
Modified: jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
URL: http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java?rev=1785132&r1=1785131&r2=1785132&view=diff
==============================================================================
--- jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java (original)
+++ jackrabbit/oak/branches/1.4/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java Thu Mar 2 13:32:24 2017
@@ -48,9 +48,15 @@ public class PermissionProviderImpl impl
private final String workspaceName;
+ private final Set<Principal> principals;
+
+ private final RestrictionProvider restrictionProvider;
+
+ private final ConfigurationParameters options;
+
private final Context ctx;
- private final CompiledPermissions compiledPermissions;
+ private CompiledPermissions compiledPermissions;
private Root immutableRoot;
@@ -61,49 +67,46 @@ public class PermissionProviderImpl impl
@Nonnull Context ctx) {
this.root = root;
this.workspaceName = workspaceName;
+ this.principals = principals;
+ this.restrictionProvider = restrictionProvider;
+ this.options = options;
this.ctx = ctx;
immutableRoot = RootFactory.createReadOnlyRoot(root);
-
- if (PermissionUtil.isAdminOrSystem(principals, options)) {
- compiledPermissions = AllPermissions.getInstance();
- } else {
- compiledPermissions = CompiledPermissionImpl.create(immutableRoot, workspaceName, principals, restrictionProvider, options, ctx);
- }
}
@Override
public void refresh() {
immutableRoot = RootFactory.createReadOnlyRoot(root);
- compiledPermissions.refresh(immutableRoot, workspaceName);
+ getCompiledPermissions().refresh(immutableRoot, workspaceName);
}
@Nonnull
@Override
public Set<String> getPrivileges(@Nullable Tree tree) {
- return compiledPermissions.getPrivileges(PermissionUtil.getImmutableTree(tree, immutableRoot));
+ return getCompiledPermissions().getPrivileges(PermissionUtil.getImmutableTree(tree, immutableRoot));
}
@Override
public boolean hasPrivileges(@Nullable Tree tree, @Nonnull String... privilegeNames) {
- return compiledPermissions.hasPrivileges(PermissionUtil.getImmutableTree(tree, immutableRoot), privilegeNames);
+ return getCompiledPermissions().hasPrivileges(PermissionUtil.getImmutableTree(tree, immutableRoot), privilegeNames);
}
@Nonnull
@Override
public RepositoryPermission getRepositoryPermission() {
- return compiledPermissions.getRepositoryPermission();
+ return getCompiledPermissions().getRepositoryPermission();
}
@Nonnull
@Override
public TreePermission getTreePermission(@Nonnull Tree tree, @Nonnull TreePermission parentPermission) {
- return compiledPermissions.getTreePermission(PermissionUtil.getImmutableTree(tree, immutableRoot), parentPermission);
+ return getCompiledPermissions().getTreePermission(PermissionUtil.getImmutableTree(tree, immutableRoot), parentPermission);
}
@Override
public boolean isGranted(@Nonnull Tree tree, @Nullable PropertyState property, long permissions) {
- return compiledPermissions.isGranted(PermissionUtil.getImmutableTree(tree, immutableRoot), property, permissions);
+ return getCompiledPermissions().isGranted(PermissionUtil.getImmutableTree(tree, immutableRoot), property, permissions);
}
@Override
@@ -145,11 +148,24 @@ public class PermissionProviderImpl impl
@Nonnull
@Override
public TreePermission getTreePermission(@Nonnull Tree tree, @Nonnull TreeType type, @Nonnull TreePermission parentPermission) {
- return compiledPermissions.getTreePermission(PermissionUtil.getImmutableTree(tree, immutableRoot), type, parentPermission);
+ return getCompiledPermissions().getTreePermission(PermissionUtil.getImmutableTree(tree, immutableRoot), type, parentPermission);
}
//--------------------------------------------------------------------------
+ private CompiledPermissions getCompiledPermissions() {
+ CompiledPermissions cp = compiledPermissions;
+ if (cp == null) {
+ if (PermissionUtil.isAdminOrSystem(principals, options)) {
+ cp = AllPermissions.getInstance();
+ } else {
+ cp = CompiledPermissionImpl.create(immutableRoot, workspaceName, principals, restrictionProvider, options, ctx);
+ }
+ compiledPermissions = cp;
+ }
+ return cp;
+ }
+
private static boolean isVersionStorePath(@Nonnull String oakPath) {
return oakPath.startsWith(VersionConstants.VERSION_STORE_PATH);
}
@@ -161,7 +177,7 @@ public class PermissionProviderImpl impl
if (tree != null) {
isGranted = isGranted(tree, property, permissions);
} else if (!isVersionStorePath(location.getPath())) {
- isGranted = compiledPermissions.isGranted(oakPath, permissions);
+ isGranted = getCompiledPermissions().isGranted(oakPath, permissions);
}
return isGranted;
}