You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lenya.apache.org by th...@apache.org on 2006/08/22 16:43:07 UTC
svn commit: r433646 - in /lenya/sandbox/ac-restricted-1.4-src:
java/org/apache/lenya/ac/
modules-core/ac-impl/java/src/org/apache/lenya/ac/file/
modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/
modules-core/sitemanagement/usecases/tab/ac/
Author: thorsten
Date: Tue Aug 22 07:43:06 2006
New Revision: 433646
URL: http://svn.apache.org/viewvc?rev=433646&view=rev
Log:
Fixing bug which occured when there have been multiple role childs
in a policy under one accreditable. Changed the savePolicy methods to save now
only one accreditable and one role. Further enhanced the caption of the ac form.
Only one feature is missing (moving the credentials up and down) but I do not consider
it as a blocker for a merge with trunk.
Modified:
lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/PolicyManager.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java
lenya/sandbox/ac-restricted-1.4-src/modules-core/sitemanagement/usecases/tab/ac/ac.jx
Modified: lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/PolicyManager.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/PolicyManager.java?rev=433646&r1=433645&r2=433646&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/PolicyManager.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/java/org/apache/lenya/ac/PolicyManager.java Tue Aug 22 07:43:06 2006
@@ -51,6 +51,9 @@
/**
* Called when an accreditable was added. Used to create the admin interface policy.
+ * This method get invoked, when e.g. a new user is added.
+ * The user always should be able to edit her profile.
+ * Therefore the method normally grant inherit edit rights to the user profile page.
*
* @param manager The accreditable manager the accreditable belonged to.
* @param accreditable The accreditable that was removed.
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java?rev=433646&r1=433645&r2=433646&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/file/FilePolicyManager.java Tue Aug 22 07:43:06 2006
@@ -483,7 +483,7 @@
if (role != null) {
String url = USER_ADMIN_URL + ((User) accreditable).getId() + ".html";
DefaultPolicy policy = (DefaultPolicy) buildSubtreePolicy(manager, url);
- Credential credential = policy.getCredential(accreditable);
+ Credential credential = policy.getCredential(accreditable,role);
if (credential != null && credential.contains(role)) {
policy.removeRole(accreditable, role);
}
@@ -513,9 +513,10 @@
if (role != null) {
String url = USER_ADMIN_URL + ((User) accreditable).getId() + ".html";
ModifiablePolicy policy = (ModifiablePolicy) buildSubtreePolicy(manager, url);
- // FIXME: bug with multiple role childs of an accreditable.
- // to activate we need the method as parameter
- //policy.addRole(accreditable, role, method);
+ // This method get invoked, when a new user is added.
+ // The user always should be able to edit her profile.
+ // Therefore we grant her inherit edit rights to his page
+ policy.addRole(accreditable, role, "grant");
saveSubtreePolicy(url, policy);
}
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java?rev=433646&r1=433645&r2=433646&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/ac-impl/java/src/org/apache/lenya/ac/impl/DefaultPolicy.java Tue Aug 22 07:43:06 2006
@@ -21,6 +21,7 @@
import java.util.Arrays;
import java.util.Collection;
+import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.LinkedHashSet;
import java.util.Map;
@@ -42,26 +43,48 @@
/**
* Adds a credential to this policy.
- * @param credential A credential.
+ *
+ * @param credential
+ * A credential.
*/
public void addCredential(Credential credential) {
assert credential != null;
- assert !this.accreditableToCredential.containsKey(credential.getAccreditable());
- this.accreditableToCredential.put(credential.getAccreditable(), credential);
+ Credential[] credentials = null;
+ Accreditable key = credential.getAccreditable();
+ if (!this.accreditableToCredential.containsKey(key)) {
+ credentials = new Credential[1];
+ credentials[0] = credential;
+ } else {
+ Credential[] oldCredentials = (Credential[]) this.accreditableToCredential
+ .get(key);
+ int oldSize = oldCredentials.length;
+ credentials = new Credential[oldSize + 1];
+ int i;
+ for (i = 0; i < oldSize; i++) {
+ credentials[i] = (Credential) oldCredentials[i];
+ }
+ credentials[i] = credential;
+ }
+ this.accreditableToCredential.put(credential.getAccreditable(),
+ credentials);
}
/**
- * Adds a role to this policy for a certain accreditable and a certain role. If a credenital
- * exists for the accreditable, the role is added to this credential. Otherwise, a new
- * credential is created.
- * @param accreditable An accreditable.
- * @param role A role.
+ * Adds a role to this policy for a certain accreditable and a certain role.
+ * If a credenital exists for the accreditable, the role is added to this
+ * credential. Otherwise, a new credential is created.
+ *
+ * @param accreditable
+ * An accreditable.
+ * @param role
+ * A role.
*/
public void addRole(Accreditable accreditable, Role role, String method) {
assert accreditable != null;
assert role != null;
- CredentialImpl credential = (CredentialImpl) getCredential(accreditable);
+ CredentialImpl credential = (CredentialImpl) getCredential(
+ accreditable, role);
if (credential == null) {
credential = new CredentialImpl(accreditable);
addCredential(credential);
@@ -73,37 +96,53 @@
}
/**
- * Removes a role from this policy for a certain accreditable and a certain role.
- * @param accreditable An accreditable.
- * @param role A role.
- * @throws AccessControlException if the accreditable-role pair is not contained.
+ * Removes a role from this policy for a certain accreditable and a certain
+ * role.
+ *
+ * @param accreditable
+ * An accreditable.
+ * @param role
+ * A role.
+ * @throws AccessControlException
+ * if the accreditable-role pair is not contained.
*/
- public void removeRole(Accreditable accreditable, Role role) throws AccessControlException {
+ public void removeRole(Accreditable accreditable, Role role)
+ throws AccessControlException {
assert accreditable != null;
assert role != null;
- CredentialImpl credential = (CredentialImpl) getCredential(accreditable);
+ CredentialImpl credential = (CredentialImpl) getCredential(
+ accreditable, role);
if (credential == null) {
- throw new AccessControlException("No credential for accreditable [" + accreditable
- + "] [" + this.accreditableToCredential.keySet().size() + "]");
+ throw new AccessControlException("No credential for accreditable ["
+ + accreditable + "] ["
+ + this.accreditableToCredential.keySet().size() + "]");
}
if (!credential.contains(role)) {
- throw new AccessControlException("Credential for accreditable [" + accreditable
- + "] does not contain role [" + role + "]");
- }
- credential.removeRole(role);
-
- if (credential.isEmpty()) {
- removeCredential(credential);
+ throw new AccessControlException("Credential for accreditable ["
+ + accreditable + "] does not contain role [" + role + "]");
}
+ removeCredential(credential);
}
/**
* Returns the credentials of this policy.
+ *
* @return An array of credentials.
*/
public Credential[] getCredentials() {
- Collection values = this.accreditableToCredential.values();
- return (Credential[]) values.toArray(new Credential[values.size()]);
+ Credential[] credentials = null;
+ LinkedHashSet returnCredential = new LinkedHashSet();
+ for (Iterator iter = accreditableToCredential.keySet().iterator(); iter
+ .hasNext();) {
+ Accreditable key = (Accreditable) iter.next();
+ Credential[] oldCredentials = (Credential[]) this.accreditableToCredential
+ .get(key);
+ for (int i = 0; i < oldCredentials.length; i++) {
+ returnCredential.add((Credential) oldCredentials[i]);
+ }
+ }
+ return (Credential[]) returnCredential
+ .toArray(new Credential[returnCredential.size()]);
}
/**
@@ -131,13 +170,36 @@
}
/**
- * Returns the credential for a certain accreditable.
+ * Returns the credentials for a certain accreditable.
*
- * @param accreditable An accreditable.
+ * @param accreditable
+ * An accreditable.
+ * @param role
* @return A credential.
*/
- public Credential getCredential(Accreditable accreditable) {
- return (Credential) this.accreditableToCredential.get(accreditable);
+ public Credential getCredential(Accreditable accreditable, Role role) {
+ Credential returnCredential = null;
+ if (this.accreditableToCredential.containsKey(accreditable)) {
+ Credential[] oldCredentials = (Credential[]) this.accreditableToCredential
+ .get(accreditable);
+ int i;
+ boolean out = false;
+ for (i = 0; i < oldCredentials.length; i++) {
+ Credential current = oldCredentials[i];
+ Role[] checkRole = current.getRoles();
+ for (int j = 0; j < checkRole.length; j++) {
+ Role role2 = checkRole[j];
+ if (role2.equals(role)) {
+ out = true;
+ returnCredential = current;
+ break;
+ }
+ }
+ if (out)
+ break;
+ }
+ }
+ return returnCredential;
}
private boolean isSSL;
@@ -151,7 +213,9 @@
/**
* Sets if this policy requires SSL protection.
- * @param ssl A boolean value.
+ *
+ * @param ssl
+ * A boolean value.
*/
public void setSSL(boolean ssl) {
this.isSSL = ssl;
@@ -166,36 +230,78 @@
/**
* Removes a credential.
- * @param credential The credential to remove.
- * @throws AccessControlException If the credential does not exist.
- */
- protected void removeCredential(Credential credential) throws AccessControlException {
- if (!this.accreditableToCredential.containsValue(credential)) {
- throw new AccessControlException("Credential [" + credential + "] does not exist!");
+ *
+ * @param credential
+ * The credential to remove.
+ * @throws AccessControlException
+ * If the credential does not exist.
+ */
+ protected void removeCredential(Credential credential)
+ throws AccessControlException {
+ Accreditable accreditable = credential.getAccreditable();
+ if (this.accreditableToCredential.containsKey(accreditable)) {
+ Credential[] oldCredentials = (Credential[]) this.accreditableToCredential
+ .get(accreditable);
+ int occurrence;
+ boolean out = false;
+ for (occurrence = 0; occurrence < oldCredentials.length; occurrence++) {
+ Credential current = oldCredentials[occurrence];
+ Role[] checkRole = current.getRoles();
+ for (int j = 0; j < checkRole.length; j++) {
+ Role role2 = checkRole[j];
+ if (role2.equals(credential.getRoles()[0])) {
+ out = true;
+ break;
+ }
+ }
+ if (out)
+ break;
+ }
+ if (out) {
+ Credential[] newCredentials = new Credential[oldCredentials.length - 1];
+ for (int i = 0; i < oldCredentials.length; i++) {
+ if (i < occurrence) {
+ newCredentials[i] = oldCredentials[i];
+ } else if (i > occurrence) {
+ newCredentials[i - 1] = oldCredentials[i];
+ }
+ }
+ this.accreditableToCredential.put(accreditable, newCredentials);
+ }
}
- this.accreditableToCredential.remove(credential.getAccreditable());
}
/**
* Removes all roles for a certain accreditable.
- * @param accreditable The accreditable to remove all roles for.
- * @throws AccessControlException If no credential exists for this accreditable.
+ *
+ * @param accreditable
+ * The accreditable to remove all roles for.
+ * @throws AccessControlException
+ * If no credential exists for this accreditable.
*/
- public void removeRoles(Accreditable accreditable) throws AccessControlException {
+ public void removeRoles(Accreditable accreditable)
+ throws AccessControlException {
if (this.accreditableToCredential.containsKey(accreditable)) {
- Credential credential = getCredential(accreditable);
- removeCredential(credential);
+ this.accreditableToCredential.remove(accreditable);
}
}
- public Credential[] getCredentials(Identity identity) throws AccessControlException {
+ public Credential[] getCredentials(Identity identity)
+ throws AccessControlException {
Accreditable[] accreditables = identity.getAccreditables();
-
- Set credentials = new LinkedHashSet();
- for (int accrIndex = 0; accrIndex < accreditables.length; accrIndex++) {
- credentials.add(getCredential(accreditables[accrIndex]));
+ Credential[] credentials = getCredentials();
+ Set returnCredential = new LinkedHashSet();
+ for (int credIndex = 0; credIndex < credentials.length; credIndex++) {
+ Credential credential = credentials[credIndex];
+ for (int accrIndex = 0; accrIndex < accreditables.length; accrIndex++) {
+ Accreditable accreditable = accreditables[accrIndex];
+ if (credential.getAccreditable().equals(accreditable)) {
+ returnCredential.add(credential);
+ }
+ }
}
- return (Credential[]) credentials.toArray(new Credential[credentials.size()]);
+ return (Credential[]) returnCredential
+ .toArray(new Credential[returnCredential.size()]);
}
}
Modified: lenya/sandbox/ac-restricted-1.4-src/modules-core/sitemanagement/usecases/tab/ac/ac.jx
URL: http://svn.apache.org/viewvc/lenya/sandbox/ac-restricted-1.4-src/modules-core/sitemanagement/usecases/tab/ac/ac.jx?rev=433646&r1=433645&r2=433646&view=diff
==============================================================================
--- lenya/sandbox/ac-restricted-1.4-src/modules-core/sitemanagement/usecases/tab/ac/ac.jx (original)
+++ lenya/sandbox/ac-restricted-1.4-src/modules-core/sitemanagement/usecases/tab/ac/ac.jx Tue Aug 22 07:43:06 2006
@@ -41,9 +41,10 @@
<tr><td colspan="5"> </td></tr>
<tr>
<th colspan="5">
- <h2>
- <i18n:text>URL credentials</i18n:text>
- </h2>
+ <h1>
+ <i18n:text>URL credentials </i18n:text>
+ </h1>
+ (only affect this url)
</th>
</tr>
<tr>
@@ -199,9 +200,9 @@
<tr><td colspan="5"> </td></tr>
<tr>
<th colspan="5">
- <h2>
+ <h1>
<i18n:text>Inherited credentials</i18n:text>
- </h2>
+ </h1>(affect this url and all following child url)
</th>
</tr>
<tr>
@@ -333,7 +334,8 @@
<tr>
<th colspan="5">
- <h1><i18n:text>from parents (starting with direct parent)</i18n:text></h1>
+ <h1><i18n:text>from parents</i18n:text></h1>
+ (starting with direct parent)
</th>
</tr>
<tr>
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@lenya.apache.org
For additional commands, e-mail: commits-help@lenya.apache.org
Re: [Discuss] Merge ac-restricted branch with trunk (was Re: svn
commit: r433646)
Posted by Thorsten Scherler <th...@wyona.com>.
El mar, 22-08-2006 a las 17:45 +0200, Thorsten Scherler escribió:
> El mar, 22-08-2006 a las 14:43 +0000, thorsten@apache.org escribió:
> > Author: thorsten
> > Date: Tue Aug 22 07:43:06 2006
> > New Revision: 433646
> >
> > URL: http://svn.apache.org/viewvc?rev=433646&view=rev
> ...
> > Only one feature is missing (moving the credentials up and down) but I do not consider
> > it as a blocker for a merge with trunk.
>
> Hi all,
>
> besides one feature
> * change credential order (move up/down)
> the ac seems to be stable (I did not say without bugs). ;)
BTW the feature will have to change the order of the accreditable in the
*.acml file.
Like:
<policy xmlns="http://apache.org/cocoon/lenya/ac/1.0">
<group id="editor">
<role id="edit" method="deny"/>
</group>
<group id="admin">
<role id="admin" method="grant"/>
</group>
</policy>
Will lock out *all* editor members, meaning an user that is in both
roles (like e.g. our default user: lenya) will be locked out as well.
That is because the first matched credential (lenya is an editor) will
be returned (ignoring all others) and this matches DENY.
Now changing it to
<policy xmlns="http://apache.org/cocoon/lenya/ac/1.0">
<group id="admin">
<role id="admin" method="grant"/>
</group>
<group id="editor">
<role id="edit" method="deny"/>
</group>
</policy>
Will allow lenya to enter again to the site since the first credential
is granted.
The nicest way to implement the ordering with a gui would be with an
ajax form, since moving a credential up the tree will need a rewrite of
the above file.
When we use ajax one can move the credentials up and down, meanwhile the
policy will be rewritten (using ajax calls).
...or we could implement the rewrite after submitting the form (which
contains the danger that one forget to submit, but may be easier to
implement).
The method should look something like
...., LinkedHashSet newOrder){
HashMap orderedCredential = new LinkedHashMap();
Credential[] returnCredential = new Credential [newOrder.size()];
int y = 0;
for (int i = orderedCredential.size(); i > 0; i--) {
returnCredential[y]=(Credential)
orderedCredential.get(String.valueOf(i));
y++;
}
Trying to say that one would need to use LinkedHash* to keep the order
(most important).
>
> Please test the branch, that we can merge it back to the trunk. Feel
> free to send patches/implement the last feature.
Happy testing/implementing. ;)
salu2
/me having a couple of days off now to move into my new home. :)
--
Thorsten Scherler
COO Spain
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
thorsten.scherler@wyona.com thorsten@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org
[Discuss] Merge ac-restricted branch with trunk (was Re: svn
commit: r433646)
Posted by Thorsten Scherler <th...@wyona.com>.
El mar, 22-08-2006 a las 14:43 +0000, thorsten@apache.org escribió:
> Author: thorsten
> Date: Tue Aug 22 07:43:06 2006
> New Revision: 433646
>
> URL: http://svn.apache.org/viewvc?rev=433646&view=rev
...
> Only one feature is missing (moving the credentials up and down) but I do not consider
> it as a blocker for a merge with trunk.
Hi all,
besides one feature
* change credential order (move up/down)
the ac seems to be stable (I did not say without bugs). ;)
Please test the branch, that we can merge it back to the trunk. Feel
free to send patches/implement the last feature.
salu2
--
Thorsten Scherler
COO Spain
Wyona Inc. - Open Source Content Management - Apache Lenya
http://www.wyona.com http://lenya.apache.org
thorsten.scherler@wyona.com thorsten@apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lenya.apache.org
For additional commands, e-mail: dev-help@lenya.apache.org