You are viewing a plain text version of this content. The canonical link for it is here.
Posted to oak-commits@jackrabbit.apache.org by th...@apache.org on 2022/06/16 13:34:01 UTC
[jackrabbit-oak] 05/32: OAK-9798 : Inconsistent handling of supported permissions in CompositePermissionProviderOr
This is an automated email from the ASF dual-hosted git repository.
thomasm pushed a commit to branch OAK-9780
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
commit b223fe9f8a27f711c29d056386c5e3e5d45a404f
Author: angela <an...@adobe.com>
AuthorDate: Fri Jun 10 16:00:19 2022 +0200
OAK-9798 : Inconsistent handling of supported permissions in CompositePermissionProviderOr
---
.../composite/CompositePermissionProvider.java | 1 -
.../composite/CompositePermissionProviderOr.java | 6 +-
.../composite/AbstractCompositeProviderTest.java | 53 ++--
.../CompositePermissionProviderOrTest.java | 267 +++++++++++++++++++++
4 files changed, 299 insertions(+), 28 deletions(-)
diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProvider.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProvider.java
index 20fe464362..73ef193aae 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProvider.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProvider.java
@@ -38,7 +38,6 @@ import org.jetbrains.annotations.NotNull;
import org.jetbrains.annotations.Nullable;
import java.util.List;
-import java.util.Set;
import java.util.function.Function;
/**
diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOr.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOr.java
index e31819e6be..ff69a4d51d 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOr.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOr.java
@@ -117,7 +117,7 @@ final class CompositePermissionProviderOr extends CompositePermissionProvider {
for (AggregatedPermissionProvider aggregatedPermissionProvider : getPermissionProviders()) {
long supportedPermissions = aggregatedPermissionProvider.supportedPermissions(immParent, property, permissions);
if (Util.doEvaluate(supportedPermissions)) {
- for (long p : Permissions.aggregates(permissions)) {
+ for (long p : Permissions.aggregates(supportedPermissions)) {
if (aggregatedPermissionProvider.isGranted(immParent, property, p)) {
coveredPermissions |= p;
isGranted = true;
@@ -144,7 +144,7 @@ final class CompositePermissionProviderOr extends CompositePermissionProvider {
for (AggregatedPermissionProvider aggregatedPermissionProvider : getPermissionProviders()) {
long supportedPermissions = aggregatedPermissionProvider.supportedPermissions(location, permissions);
if (Util.doEvaluate(supportedPermissions)) {
- for (long p : Permissions.aggregates(permissions)) {
+ for (long p : Permissions.aggregates(supportedPermissions)) {
if (aggregatedPermissionProvider.isGranted(location, p)) {
coveredPermissions |= p;
isGranted = true;
@@ -171,7 +171,7 @@ final class CompositePermissionProviderOr extends CompositePermissionProvider {
long supportedPermissions = aggregatedPermissionProvider.supportedPermissions((Tree) null, null, repositoryPermissions);
if (Util.doEvaluate(supportedPermissions)) {
RepositoryPermission rp = aggregatedPermissionProvider.getRepositoryPermission();
- for (long p : Permissions.aggregates(repositoryPermissions)) {
+ for (long p : Permissions.aggregates(supportedPermissions)) {
if (rp.isGranted(p)) {
coveredPermissions |= p;
isGranted = true;
diff --git a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
index 980100b2f5..10def7d131 100644
--- a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
+++ b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/AbstractCompositeProviderTest.java
@@ -101,16 +101,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
public void before() throws Exception {
super.before();
- Tree rootNode = root.getTree("/");
-
- Tree test = TreeUtil.addChild(rootNode, "test", NT_OAK_UNSTRUCTURED);
- TreeUtil.addChild(test, "child", NT_OAK_UNSTRUCTURED);
- Tree a = TreeUtil.addChild(test, "a", NT_OAK_UNSTRUCTURED);
- TreeUtil.addChild(a, "b2", NT_OAK_UNSTRUCTURED);
- Tree b = TreeUtil.addChild(a, "b", NT_OAK_UNSTRUCTURED);
- TreeUtil.addChild(b, "c", NT_OAK_UNSTRUCTURED);
-
- TreeUtil.addChild(rootNode, "test2", NT_OAK_UNSTRUCTURED);
+ setupTestContent(root);
AccessControlManager acMgr = getAccessControlManager(root);
Principal everyone = EveryonePrincipal.getInstance();
@@ -156,8 +147,8 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
Permissions.VERSION_MANAGEMENT).
build();
defPrivileges = ImmutableMap.<String, Set<String>>builder().
- put(ROOT_PATH, ImmutableSet.<String>of()).
- put(TEST_PATH_2, ImmutableSet.<String>of()).
+ put(ROOT_PATH, ImmutableSet.of()).
+ put(TEST_PATH_2, ImmutableSet.of()).
put(TEST_PATH, ImmutableSet.of(JCR_READ)).
put(TEST_CHILD_PATH, ImmutableSet.of(JCR_READ, JCR_READ_ACCESS_CONTROL)).
put(TEST_A_PATH, ImmutableSet.of(JCR_READ, JCR_WRITE, JCR_VERSION_MANAGEMENT)).
@@ -193,6 +184,20 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
super.after();
}
}
+
+ static void setupTestContent(@NotNull Root root) throws Exception {
+ Tree rootNode = root.getTree("/");
+
+ Tree test = TreeUtil.addChild(rootNode, "test", NT_OAK_UNSTRUCTURED);
+ TreeUtil.addChild(test, "child", NT_OAK_UNSTRUCTURED);
+ Tree a = TreeUtil.addChild(test, "a", NT_OAK_UNSTRUCTURED);
+ TreeUtil.addChild(a, "b2", NT_OAK_UNSTRUCTURED);
+ Tree b = TreeUtil.addChild(a, "b", NT_OAK_UNSTRUCTURED);
+ TreeUtil.addChild(b, "c", NT_OAK_UNSTRUCTURED);
+
+ TreeUtil.addChild(rootNode, "test2", NT_OAK_UNSTRUCTURED);
+ root.commit();
+ }
private static void allow(@NotNull AccessControlManager acMgr,
@NotNull Principal principal,
@@ -267,13 +272,13 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testRefresh() throws Exception {
+ public void testRefresh() {
createPermissionProvider().refresh();
createPermissionProviderOR().refresh();
}
@Test
- public void testHasPrivilegesJcrAll() throws Exception {
+ public void testHasPrivilegesJcrAll() {
PermissionProvider pp = createPermissionProvider();
for (String p : NODE_PATHS) {
Tree tree = readOnlyRoot.getTree(p);
@@ -291,7 +296,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testHasPrivilegesNone() throws Exception {
+ public void testHasPrivilegesNone() {
PermissionProvider pp = createPermissionProvider();
PermissionProvider ppo = createPermissionProviderOR();
for (String p : NODE_PATHS) {
@@ -310,7 +315,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testHasPrivilegesOnRepoNone() throws Exception {
+ public void testHasPrivilegesOnRepoNone() {
PermissionProvider pp = createPermissionProvider();
assertTrue(pp.hasPrivileges(null));
PermissionProvider ppo = createPermissionProviderOR();
@@ -334,7 +339,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testIsGrantedNone() throws Exception {
+ public void testIsGrantedNone() {
PermissionProvider pp = createPermissionProvider();
PermissionProvider ppo = createPermissionProviderOR();
@@ -366,7 +371,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testIsGrantedActionNone() throws Exception {
+ public void testIsGrantedActionNone() {
PermissionProvider pp = createPermissionProvider();
PermissionProvider ppo = createPermissionProviderOR();
String actions = "";
@@ -407,7 +412,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testGetTreePermissionAllParent() throws Exception {
+ public void testGetTreePermissionAllParent() {
TreePermission tp = createPermissionProvider().getTreePermission(readOnlyRoot.getTree(TEST_PATH), TreePermission.ALL);
assertSame(TreePermission.ALL, tp);
TreePermission tpo = createPermissionProviderOR().getTreePermission(readOnlyRoot.getTree(TEST_PATH), TreePermission.ALL);
@@ -415,7 +420,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testGetTreePermissionEmptyParent() throws Exception {
+ public void testGetTreePermissionEmptyParent() {
TreePermission tp = createPermissionProvider().getTreePermission(readOnlyRoot.getTree(TEST_PATH), TreePermission.EMPTY);
assertSame(TreePermission.EMPTY, tp);
TreePermission tpo = createPermissionProviderOR().getTreePermission(readOnlyRoot.getTree(TEST_PATH), TreePermission.EMPTY);
@@ -423,7 +428,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testTreePermissionIsGrantedAll() throws Exception {
+ public void testTreePermissionIsGrantedAll() {
PermissionProvider pp = createPermissionProvider();
TreePermission parentPermission = TreePermission.EMPTY;
@@ -459,7 +464,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testTreePermissionIsNotGranted() throws Exception {
+ public void testTreePermissionIsNotGranted() {
PermissionProvider pp = createPermissionProvider();
TreePermission parentPermission = TreePermission.EMPTY;
@@ -499,7 +504,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testTreePermissionCanReadAll() throws Exception {
+ public void testTreePermissionCanReadAll() {
PermissionProvider pp = createPermissionProvider();
TreePermission parentPermission = TreePermission.EMPTY;
PermissionProvider ppO = createPermissionProviderOR();
@@ -517,7 +522,7 @@ public abstract class AbstractCompositeProviderTest extends AbstractSecurityTest
}
@Test
- public void testTreePermissionCanReadProperties() throws Exception {
+ public void testTreePermissionCanReadProperties() {
PermissionProvider pp = createPermissionProvider();
TreePermission parentPermission = TreePermission.EMPTY;
diff --git a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOrTest.java b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOrTest.java
new file mode 100644
index 0000000000..175776e38e
--- /dev/null
+++ b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOrTest.java
@@ -0,0 +1,267 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.authorization.composite;
+
+import com.google.common.collect.ImmutableList;
+import com.google.common.collect.Lists;
+import org.apache.jackrabbit.oak.AbstractSecurityTest;
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.api.Root;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.plugins.tree.TreeLocation;
+import org.apache.jackrabbit.oak.plugins.tree.TreeType;
+import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.AggregatedPermissionProvider;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.RepositoryPermission;
+import org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission;
+import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal;
+import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits;
+import org.apache.jackrabbit.util.Text;
+import org.jetbrains.annotations.NotNull;
+import org.jetbrains.annotations.Nullable;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import sun.reflect.generics.reflectiveObjects.NotImplementedException;
+
+import java.security.Principal;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.Set;
+
+import static org.apache.jackrabbit.oak.commons.PathUtils.ROOT_PATH;
+import static org.apache.jackrabbit.oak.security.authorization.composite.AbstractCompositeProviderTest.TEST_A_B_C_PATH;
+import static org.apache.jackrabbit.oak.security.authorization.composite.AbstractCompositeProviderTest.TEST_A_PATH;
+import static org.apache.jackrabbit.oak.security.authorization.composite.AbstractCompositeProviderTest.TEST_CHILD_PATH;
+import static org.apache.jackrabbit.oak.security.authorization.composite.AbstractCompositeProviderTest.TEST_PATH;
+import static org.apache.jackrabbit.oak.security.authorization.composite.AbstractCompositeProviderTest.TEST_PATH_2;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.ADD_NODE;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.ALL;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.MODIFY_ACCESS_CONTROL;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.NODE_TYPE_DEFINITION_MANAGEMENT;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.NO_PERMISSION;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.READ;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.READ_NODE;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.SET_PROPERTY;
+import static org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions.WORKSPACE_MANAGEMENT;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Tests for OAK-9798
+ *
+ * @see CompositeTreePermissionOrTest#testIsGrantedUncoveredPermissions() for a similar test covering the behavior of {@code CompositeTreePermissionOr}.
+ */
+@RunWith(Parameterized.class)
+public class CompositePermissionProviderOrTest extends AbstractSecurityTest {
+
+ private final boolean extraVerification;
+
+ private CompositePermissionProvider pp;
+ private Root readOnlyRoot;
+
+ @Parameterized.Parameters(name = "name={1}")
+ public static Collection<Object[]> parameters() {
+ return Lists.newArrayList(
+ new Object[] { true, "Extra verification of supported permissions in 'isGranted'" },
+ new Object[] { false, "No verification of supported permissions in 'isGranted'" });
+ }
+ public CompositePermissionProviderOrTest(boolean extraVerification, @NotNull String name) {
+ this.extraVerification = extraVerification;
+ }
+
+ @Before()
+ public void before() throws Exception {
+ super.before();
+ AbstractCompositeProviderTest.setupTestContent(root);
+ this.pp = createPermissionProviderOR(Collections.singleton(EveryonePrincipal.getInstance()));
+
+ readOnlyRoot = getRootProvider().createReadOnlyRoot(root);
+ }
+
+ private CompositePermissionProvider createPermissionProviderOR(Set<Principal> principals) {
+ String workspaceName = root.getContentSession().getWorkspaceName();
+ AuthorizationConfiguration config = getConfig(AuthorizationConfiguration.class);
+
+ ImmutableList<AggregatedPermissionProvider> l = ImmutableList.of(
+ (AggregatedPermissionProvider) config.getPermissionProvider(root, workspaceName, principals),
+ new ReadNodeGrantedInSupportedTree());
+
+ return new CompositePermissionProviderOr(root, l, config.getContext(), getRootProvider(), getTreeProvider());
+ }
+
+ private Tree getTree(@NotNull String path) {
+ return readOnlyRoot.getTree(path);
+ }
+
+ private TreeLocation getTreeLocation(@NotNull String path) {
+ return TreeLocation.create(readOnlyRoot, path);
+ }
+
+ @Test
+ public void testIsGrantedTreeUnsupportedPath() {
+ for (long permissions : new long[]{READ_NODE, READ, SET_PROPERTY, ADD_NODE, MODIFY_ACCESS_CONTROL, ALL}) {
+ assertFalse(pp.isGranted(getTree(TEST_PATH), null, permissions));
+ assertFalse(pp.isGranted(getTree(ROOT_PATH), null, permissions));
+ assertFalse(pp.isGranted(getTree(TEST_CHILD_PATH), null, permissions));
+ assertFalse(pp.isGranted(getTree(TEST_PATH_2), null, permissions));
+ }
+ }
+
+ @Test
+ public void testIsGrantedTreeSupportedPath() {
+ assertTrue(pp.isGranted(getTree(TEST_A_PATH), null, READ_NODE));
+ assertTrue(pp.isGranted(getTree(TEST_A_B_C_PATH), null, READ_NODE));
+
+ for (long permissions : new long[]{READ, SET_PROPERTY, ADD_NODE, MODIFY_ACCESS_CONTROL, ALL}) {
+ assertFalse(pp.isGranted(getTree(TEST_A_PATH), null, permissions));
+ assertFalse(pp.isGranted(getTree(TEST_A_B_C_PATH), null, permissions));
+ }
+ }
+
+ @Test
+ public void testIsGrantedTreeLocationUnsupportedPath() {
+ for (long permissions : new long[]{READ_NODE, READ, SET_PROPERTY, ADD_NODE, MODIFY_ACCESS_CONTROL, ALL}) {
+ assertFalse(pp.isGranted(getTreeLocation(TEST_PATH), permissions));
+ assertFalse(pp.isGranted(getTreeLocation(ROOT_PATH), permissions));
+ assertFalse(pp.isGranted(getTreeLocation(TEST_CHILD_PATH), permissions));
+ assertFalse(pp.isGranted(getTreeLocation(TEST_PATH_2), permissions));
+ }
+ }
+
+ @Test
+ public void testIsGrantedTreeLocationSupportedPath() {
+ assertTrue(pp.isGranted(getTreeLocation(TEST_A_PATH), READ_NODE));
+ assertTrue(pp.isGranted(getTreeLocation(TEST_A_B_C_PATH), READ_NODE));
+
+ for (long permissions : new long[]{READ, SET_PROPERTY, ADD_NODE, MODIFY_ACCESS_CONTROL, ALL}) {
+ assertFalse(pp.isGranted(getTreeLocation(TEST_A_PATH), permissions));
+ assertFalse(pp.isGranted(getTreeLocation(TEST_A_B_C_PATH), permissions));
+ }
+ }
+
+ @Test
+ public void testRepositoryPermissions() {
+ RepositoryPermission rp = pp.getRepositoryPermission();
+
+ assertTrue(rp.isGranted(WORKSPACE_MANAGEMENT));
+
+ assertFalse(rp.isGranted(ALL));
+ assertFalse(rp.isGranted(WORKSPACE_MANAGEMENT|NODE_TYPE_DEFINITION_MANAGEMENT));
+ }
+
+ private final class ReadNodeGrantedInSupportedTree implements AggregatedPermissionProvider {
+
+ private boolean isSupportedPath(@NotNull String path) {
+ return Text.isDescendantOrEqual(TEST_A_PATH, path);
+ }
+
+ private boolean includesSupportedPermission(long permissions) {
+ return Permissions.includes(permissions, READ_NODE);
+ }
+
+ private boolean isGranted(@NotNull String path, long permissions) {
+ if (extraVerification) {
+ return isSupportedPath(path) && permissions == READ_NODE;
+ } else {
+ return isSupportedPath(path);
+ }
+ }
+
+ @Override
+ public @NotNull PrivilegeBits supportedPrivileges(@Nullable Tree tree, @Nullable PrivilegeBits privilegeBits) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public long supportedPermissions(@Nullable Tree tree, @Nullable PropertyState property, long permissions) {
+ if (tree == null) {
+ return (Permissions.includes(permissions, WORKSPACE_MANAGEMENT)) ? WORKSPACE_MANAGEMENT : NO_PERMISSION;
+ }
+ if (isSupportedPath(tree.getPath()) && includesSupportedPermission(permissions)) {
+ return READ_NODE;
+ }
+ return NO_PERMISSION;
+ }
+
+ @Override
+ public long supportedPermissions(@NotNull TreeLocation location, long permissions) {
+ if (isSupportedPath(location.getPath()) && includesSupportedPermission(permissions)) {
+ return READ_NODE;
+ }
+ return NO_PERMISSION;
+ }
+
+ @Override
+ public long supportedPermissions(@NotNull TreePermission treePermission, @Nullable PropertyState property, long permissions) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public boolean isGranted(@NotNull TreeLocation location, long permissions) {
+ return isGranted(location.getPath(), permissions);
+ }
+
+ @Override
+ public @NotNull TreePermission getTreePermission(@NotNull Tree tree, @NotNull TreeType type, @NotNull TreePermission parentPermission) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public void refresh() {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public @NotNull Set<String> getPrivileges(@Nullable Tree tree) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public boolean hasPrivileges(@Nullable Tree tree, @NotNull String... privilegeNames) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public @NotNull RepositoryPermission getRepositoryPermission() {
+ return repositoryPermissions -> {
+ if (extraVerification) {
+ return repositoryPermissions == WORKSPACE_MANAGEMENT;
+ } else {
+ return true;
+ }
+ };
+ }
+
+ @Override
+ public @NotNull TreePermission getTreePermission(@NotNull Tree tree, @NotNull TreePermission parentPermission) {
+ throw new NotImplementedException();
+ }
+
+ @Override
+ public boolean isGranted(@NotNull Tree tree, @Nullable PropertyState property, long permissions) {
+ return isGranted(tree.getPath(), permissions);
+ }
+
+ @Override
+ public boolean isGranted(@NotNull String oakPath, @NotNull String jcrActions) {
+ return isGranted(oakPath, Permissions.getPermissions(jcrActions, TreeLocation.create(readOnlyRoot, oakPath), false));
+ }
+ }
+}
\ No newline at end of file