You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jena.apache.org by cl...@apache.org on 2015/08/07 20:56:22 UTC

[11/13] jena git commit: Added throw exception documentation

Added throw exception documentation


Project: http://git-wip-us.apache.org/repos/asf/jena/repo
Commit: http://git-wip-us.apache.org/repos/asf/jena/commit/2c0454c6
Tree: http://git-wip-us.apache.org/repos/asf/jena/tree/2c0454c6
Diff: http://git-wip-us.apache.org/repos/asf/jena/diff/2c0454c6

Branch: refs/heads/master
Commit: 2c0454c63f71b4bda5c55e448f8cdacadb6b9008
Parents: b44125a
Author: Claude Warren <cl...@apache.org>
Authored: Sat Jul 25 21:29:28 2015 +0100
Committer: Claude Warren <cl...@apache.org>
Committed: Sat Jul 25 21:29:28 2015 +0100

----------------------------------------------------------------------
 .../permissions/example/ExampleEvaluator.java   |    5 +
 .../example/ShiroExampleEvaluator.java          |    3 +-
 .../apache/jena/permissions/SecuredItem.java    |  142 +-
 .../jena/permissions/SecurityEvaluator.java     |  114 +-
 .../jena/permissions/graph/SecuredGraph.java    |  102 +-
 .../graph/SecuredGraphEventManager.java         |  233 ++--
 .../permissions/graph/SecuredPrefixMapping.java |   81 +-
 .../graph/impl/SecuredGraphImpl.java            |  184 ++-
 .../graph/impl/SecuredPrefixMappingImpl.java    |   89 +-
 .../impl/CachedSecurityEvaluator.java           |   23 +-
 .../jena/permissions/impl/SecuredItemImpl.java  |  779 +++++------
 .../jena/permissions/model/SecuredAlt.java      |  163 ++-
 .../permissions/model/SecuredContainer.java     |  133 +-
 .../jena/permissions/model/SecuredLiteral.java  |   93 +-
 .../jena/permissions/model/SecuredModel.java    | 1243 ++++++++++++------
 .../jena/permissions/model/SecuredProperty.java |   11 +-
 .../jena/permissions/model/SecuredRDFList.java  |  236 +++-
 .../jena/permissions/model/SecuredRDFNode.java  |   26 +-
 .../model/SecuredReifiedStatement.java          |   12 +-
 .../jena/permissions/model/SecuredResource.java |  214 ++-
 .../jena/permissions/model/SecuredSeq.java      |  288 ++--
 .../permissions/model/SecuredStatement.java     |  166 ++-
 .../permissions/model/impl/SecuredAltImpl.java  |  207 ++-
 .../model/impl/SecuredContainerImpl.java        |  438 ++----
 .../model/impl/SecuredLiteralImpl.java          |  162 ++-
 .../model/impl/SecuredModelImpl.java            |  610 +++++----
 .../model/impl/SecuredPropertyImpl.java         |   51 +-
 .../model/impl/SecuredRDFListImpl.java          |  704 ++++------
 .../model/impl/SecuredRDFNodeImpl.java          |  211 ++-
 .../model/impl/SecuredReifiedStatementImpl.java |   29 +-
 .../model/impl/SecuredResourceImpl.java         |  570 ++++----
 .../permissions/model/impl/SecuredSelector.java |   39 +-
 .../permissions/model/impl/SecuredSeqImpl.java  |  326 ++---
 .../model/impl/SecuredStatementImpl.java        |  278 ++--
 .../permissions/query/SecuredQueryEngine.java   |   95 +-
 .../permissions/query/rewriter/OpRewriter.java  |  379 +++---
 .../query/rewriter/SecuredFunction.java         |  104 +-
 .../permissions/utils/PermStatementFilter.java  |   48 +-
 .../permissions/utils/PermTripleFilter.java     |   45 +-
 .../permissions/utils/RDFListSecFilter.java     |   23 +-
 .../jena/permissions/graph/TDBGraphTest.java    |    3 -
 .../permissions/model/SecuredModelTest.java     |    6 +-
 .../jena/permissions/query/DataSetTest.java     |   15 +-
 .../jena/permissions/query/QueryEngineTest.java |    9 +-
 44 files changed, 4641 insertions(+), 4051 deletions(-)
----------------------------------------------------------------------


http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/example/java/org/apache/jena/permissions/example/ExampleEvaluator.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/example/java/org/apache/jena/permissions/example/ExampleEvaluator.java b/jena-permissions/src/example/java/org/apache/jena/permissions/example/ExampleEvaluator.java
index 2c74c4e..a5659e1 100644
--- a/jena-permissions/src/example/java/org/apache/jena/permissions/example/ExampleEvaluator.java
+++ b/jena-permissions/src/example/java/org/apache/jena/permissions/example/ExampleEvaluator.java
@@ -25,6 +25,7 @@ import org.apache.jena.graph.Node;
 import org.apache.jena.graph.Triple;
 import org.apache.jena.permissions.SecurityEvaluator ;
 import org.apache.jena.rdf.model.* ;
+import org.apache.jena.shared.AuthenticationRequiredException;
 import org.apache.jena.vocabulary.RDF ;
 
 /**
@@ -61,6 +62,10 @@ public class ExampleEvaluator implements SecurityEvaluator {
 		// a message is only available to sender or recipient
 		if (r.hasProperty( RDF.type, msgType ))
 		{
+			if (principal == null)
+			{
+				throw new AuthenticationRequiredException();
+			}
 			return r.hasProperty( pTo, principal.getName() ) ||
 					r.hasProperty( pFrom, principal.getName());
 		}

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/example/java/org/apache/jena/permissions/example/ShiroExampleEvaluator.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/example/java/org/apache/jena/permissions/example/ShiroExampleEvaluator.java b/jena-permissions/src/example/java/org/apache/jena/permissions/example/ShiroExampleEvaluator.java
index 4bac59b..3f71957 100644
--- a/jena-permissions/src/example/java/org/apache/jena/permissions/example/ShiroExampleEvaluator.java
+++ b/jena-permissions/src/example/java/org/apache/jena/permissions/example/ShiroExampleEvaluator.java
@@ -20,7 +20,6 @@ package org.apache.jena.permissions.example;
 import java.util.Set ;
 
 import org.apache.jena.graph.Node;
-import org.apache.jena.graph.NodeFactory ;
 import org.apache.jena.graph.Triple;
 import org.apache.jena.permissions.SecurityEvaluator ;
 import org.apache.jena.rdf.model.* ;
@@ -81,6 +80,8 @@ public class ShiroExampleEvaluator implements SecurityEvaluator {
 		Subject subject = (Subject)principalObj;
 		if (! subject.isAuthenticated())
 		{
+			// we could throw an AuthenticationRequiredException but
+			// in our case we just return false.
 			LOG.info( "User not authenticated");
 			return false;
 		}

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/SecuredItem.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/SecuredItem.java b/jena-permissions/src/main/java/org/apache/jena/permissions/SecuredItem.java
index 6c4021f..c982c99 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/SecuredItem.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/SecuredItem.java
@@ -20,20 +20,19 @@ package org.apache.jena.permissions;
 import org.apache.jena.graph.FrontsTriple;
 import org.apache.jena.graph.Node;
 import org.apache.jena.graph.Triple;
+import org.apache.jena.shared.AuthenticationRequiredException;
 
 /**
  * The secured item interface is mixed into instances of secured objects by the
  * proxy. It provides the security context for the security checks as well as
  * several useful shorthand methods for common checks.
  */
-public interface SecuredItem
-{
-	
+public interface SecuredItem {
+
 	/**
 	 * Utilities for SecuredItem implementations.
 	 */
-	public static class Util
-	{
+	public static class Util {
 		/**
 		 * Secured items are equivalent if their security evaluators and
 		 * modelIRIs are equal.
@@ -44,48 +43,45 @@ public interface SecuredItem
 		 *            A second secured item to check
 		 * @return true if si1 is equivalent to si2.
 		 */
-		public static boolean isEquivalent( final SecuredItem si1,
-				final SecuredItem si2 )
-		{
+		public static boolean isEquivalent(final SecuredItem si1,
+				final SecuredItem si2) {
 			return si1.getSecurityEvaluator()
 					.equals(si2.getSecurityEvaluator())
 					&& si1.getModelIRI().equals(si2.getModelIRI());
 		}
-		
-		public static String modelPermissionMsg( final Node modelURI )
-		{
+
+		public static String modelPermissionMsg(final Node modelURI) {
 			return String.format("Model permissions violation: %s", modelURI);
 		}
-		
-		public static String triplePermissionMsg( final Node modelURI )
-		{
+
+		public static String triplePermissionMsg(final Node modelURI) {
 			return String.format("Triple permissions violation: %s", modelURI);
 		}
 	}
 
 	/**
 	 * @return true if the securedModel allows items to to be created.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canCreate();
+	public boolean canCreate() throws AuthenticationRequiredException;
 
 	/**
-	 * Return true if the triple can be created.
-	 * If any s,p or o is SecNode.ANY then this method must return false if
-	 * there
-	 * are
-	 * any restrictions where the remaining nodes and held constant and the ANY
-	 * node
-	 * is allowed to vary.
+	 * Return true if the triple can be created. If any s,p or o is SecNode.ANY
+	 * then this method must return false if there are any restrictions where
+	 * the remaining nodes and held constant and the ANY node is allowed to
+	 * vary.
 	 * 
 	 * See canRead(Triple t)
 	 * 
 	 * @param t
 	 *            The triple to check
 	 * @return true if the triple can be created.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canCreate( Triple t );
+	public boolean canCreate(Triple t) throws AuthenticationRequiredException;
 
-	
 	/**
 	 * Return true if the fronted triple can be created.
 	 * 
@@ -94,31 +90,35 @@ public interface SecuredItem
 	 * @param t
 	 *            The fronted triple to check
 	 * @return true if the triple can be created.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canCreate( FrontsTriple t );
-	
+	public boolean canCreate(FrontsTriple t)
+			throws AuthenticationRequiredException;
+
 	/**
 	 * @return true if the securedModel allows items to to be deleted.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canDelete();
+	public boolean canDelete() throws AuthenticationRequiredException;
 
 	/**
-	 * Return true if the triple can be deleted.
-	 * If any s,p or o is SecNode.ANY then this method must return false if
-	 * there
-	 * are
-	 * any restrictions where the remaining nodes and held constant and the ANY
-	 * node
-	 * is allowed to vary.
+	 * Return true if the triple can be deleted. If any s,p or o is SecNode.ANY
+	 * then this method must return false if there are any restrictions where
+	 * the remaining nodes and held constant and the ANY node is allowed to
+	 * vary.
 	 * 
 	 * See canRead(Triple t)
 	 * 
 	 * @param t
 	 *            The triple to check
 	 * @return true if the triple can be deleted.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canDelete( Triple t );
-	
+	public boolean canDelete(Triple t) throws AuthenticationRequiredException;
+
 	/**
 	 * Return true if the fronted triple can be deleted.
 	 * 
@@ -127,33 +127,37 @@ public interface SecuredItem
 	 * @param t
 	 *            The fronted triple to check
 	 * @return true if the triple can be deleted.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canDelete( FrontsTriple t );
+	public boolean canDelete(FrontsTriple t)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * @return true if the securedModel allows items to to be read.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canRead();
+	public boolean canRead() throws AuthenticationRequiredException;
 
 	/**
-	 * Return true if the triple can be read.
-	 * If any s,p or o is SecNode.ANY then this method must return false if
-	 * there
-	 * are
-	 * any restrictions where the remaining nodes and held constant and the ANY
-	 * node
-	 * is allowed to vary.
+	 * Return true if the triple can be read. If any s,p or o is SecNode.ANY
+	 * then this method must return false if there are any restrictions where
+	 * the remaining nodes and held constant and the ANY node is allowed to
+	 * vary.
 	 * 
-	 * (S, P, O) check if S,P,O can be read.
-	 * (S, P, ANY) check if there are any S,P,x restrictions.
-	 * (S, ANY, P) check if there are any S,x,P restrictions.
-	 * (ANY, ANY, ANY) check if there are any restricitons on reading.
+	 * (S, P, O) check if S,P,O can be read. (S, P, ANY) check if there are any
+	 * S,P,x restrictions. (S, ANY, P) check if there are any S,x,P
+	 * restrictions. (ANY, ANY, ANY) check if there are any restricitons on
+	 * reading.
 	 * 
 	 * @param t
 	 *            The triple to check
 	 * @return true if the triple can be read.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canRead( Triple t );
+	public boolean canRead(Triple t) throws AuthenticationRequiredException;
 
 	/**
 	 * Return true if the fronted triple can be read.
@@ -161,22 +165,24 @@ public interface SecuredItem
 	 * @param t
 	 *            The frontedtriple to check
 	 * @return true if the triple can be read.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canRead( FrontsTriple t );
-	
+	public boolean canRead(FrontsTriple t)
+			throws AuthenticationRequiredException;
+
 	/**
 	 * @return true if the securedModel allows items to to be updated.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canUpdate();
+	public boolean canUpdate() throws AuthenticationRequiredException;
 
 	/**
-	 * Return true if the triple can be updated.
-	 * If any s,p or o is SecNode.ANY then this method must return false if
-	 * there
-	 * are
-	 * any restrictions where the remaining nodes and held constant and the ANY
-	 * node
-	 * is allowed to vary.
+	 * Return true if the triple can be updated. If any s,p or o is SecNode.ANY
+	 * then this method must return false if there are any restrictions where
+	 * the remaining nodes and held constant and the ANY node is allowed to
+	 * vary.
 	 * 
 	 * See canRead(Triple t)
 	 * 
@@ -185,8 +191,11 @@ public interface SecuredItem
 	 * @param to
 	 *            The resulting triple.
 	 * @return true if the from triple can be updated as the to triple.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canUpdate( Triple from, Triple to );
+	public boolean canUpdate(Triple from, Triple to)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * Return true if the fronted triple can be updated.
@@ -199,11 +208,14 @@ public interface SecuredItem
 	 * @param to
 	 *            The resulting fronted triple.
 	 * @return true if the from triple can be updated as the to triple.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean canUpdate( FrontsTriple from, FrontsTriple to );
-	
+	public boolean canUpdate(FrontsTriple from, FrontsTriple to)
+			throws AuthenticationRequiredException;
+
 	@Override
-	public boolean equals( Object o );
+	public boolean equals(Object o);
 
 	/**
 	 * @return the base item that is being secured.
@@ -236,6 +248,6 @@ public interface SecuredItem
 	 *            the other secured item.
 	 * @return True if they are equivalent, false otherwise.
 	 */
-	public boolean isEquivalent( SecuredItem securedItem );
+	public boolean isEquivalent(SecuredItem securedItem);
 
 }
\ No newline at end of file

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/SecurityEvaluator.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/SecurityEvaluator.java b/jena-permissions/src/main/java/org/apache/jena/permissions/SecurityEvaluator.java
index 898c41f..1ee4d2a 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/SecurityEvaluator.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/SecurityEvaluator.java
@@ -25,7 +25,7 @@ import java.util.Set;
 import org.apache.jena.graph.Node;
 import org.apache.jena.graph.Triple;
 import org.apache.jena.graph.NodeFactory;
-
+import org.apache.jena.shared.AuthenticationRequiredException;
 
 /**
  * SecurityEvaluator.
@@ -76,8 +76,8 @@ import org.apache.jena.graph.NodeFactory;
  * the user can execute the CRUD action against any arbitrary triple the system
  * should return <code>false</code>. </li>
  * <li>See <code>Node.ANY</code>, <code>SecurityEvaluator.FUTURE</code>, and
- * <code>SecurityEvaluator.VARIABLE</code> for discussion of specifics of their respective
- * usages.</li>
+ * <code>SecurityEvaluator.VARIABLE</code> for discussion of specifics of their
+ * respective usages.</li>
  * </ul>
  * </p>
  * </dd>
@@ -143,8 +143,7 @@ public interface SecurityEvaluator {
 		public static Set<Action> asSet(final Collection<Action> actions) {
 			if (actions instanceof Set) {
 				return (Set<Action>) actions;
-			}
-			else {
+			} else {
 				return new LinkedHashSet<Action>(actions);
 			}
 		}
@@ -154,62 +153,63 @@ public interface SecurityEvaluator {
 	 * Indicates a variable in the triple.
 	 * <p>
 	 * </p>
-	 * This differs from <code>ANY</code> in that the system is asking if
-	 * there are any prohibitions not if the user may perform. Thus queries
-	 * with the VARIABLE type node should return <code>true</code> where
-	 * <code>ANY</code> returns <code>false</code>. In general this type is
-	 * used in the query to determine if triple level filtering of results
-	 * must be performed.
+	 * This differs from <code>ANY</code> in that the system is asking if there
+	 * are any prohibitions not if the user may perform. Thus queries with the
+	 * VARIABLE type node should return <code>true</code> where <code>ANY</code>
+	 * returns <code>false</code>. In general this type is used in the query to
+	 * determine if triple level filtering of results must be performed.
 	 * <p>
 	 * </p>
 	 * <p>
 	 * <dl>
 	 * <dt><code>(VARIABLE, X, Y )</code></dt>
 	 * <dd>
-	 * Asks if there are any prohibitions against the user seeing all
-	 * subjects that have property X and object Y.</dd>
+	 * Asks if there are any prohibitions against the user seeing all subjects
+	 * that have property X and object Y.</dd>
 	 * <dt>
 	 * <code>(X, VARIABLE, Y )</code></dt>
 	 * <dd>
-	 * Asks if there are any prohibitions against the user seeing all
-	 * predicates that have subject X and object Y.</dd>
+	 * Asks if there are any prohibitions against the user seeing all predicates
+	 * that have subject X and object Y.</dd>
 	 * <dt>
 	 * <code>(X, Y, VARIABLE)</code></dt>
 	 * <dd>
-	 * Asks if there are any prohibitions against the user seeing all
-	 * objects that have subject X and predicate Y.</dd>
+	 * Asks if there are any prohibitions against the user seeing all objects
+	 * that have subject X and predicate Y.</dd>
 	 * </dl>
-	 * The <code>VARIABLE</code> may occur multiple times and may occur with
-	 * the <code>ANY</code> node.
+	 * The <code>VARIABLE</code> may occur multiple times and may occur with the
+	 * <code>ANY</code> node.
 	 * </p>
 	 * 
 	 */
-	public static final Node VARIABLE = NodeFactory.createBlankNode( "urn:jena-permissions:VARIABLE");
+	public static final Node VARIABLE = NodeFactory
+			.createBlankNode("urn:jena-permissions:VARIABLE");
 
 	/**
 	 * This is a blank (anonymous) node that will be created in the future.
 	 * <p>
-	 * FUTURE is used to check that a blank node may be created in as
-	 * specific position in a triple.
+	 * FUTURE is used to check that a blank node may be created in as specific
+	 * position in a triple.
 	 * </p>
 	 * <p>
 	 * <dl>
 	 * <dt><code>(FUTURE, X, Y )</code></dt>
 	 * <dd>
-	 * Asks if there the user may create a blank node that has property
-	 * X and object Y.</dd>
+	 * Asks if there the user may create a blank node that has property X and
+	 * object Y.</dd>
 	 * <dt>
 	 * <code>(X, Y, FUTURE)</code></dt>
 	 * <dd>
-	 * Asks if there the user may create a blank node that has subject
-	 * X and property Y.</dd>
+	 * Asks if there the user may create a blank node that has subject X and
+	 * property Y.</dd>
 	 * </dl>
-	 * The <code>FUTURE</code> may occur multiple times and may occur with
-	 * the <code>ANY</code> node.
+	 * The <code>FUTURE</code> may occur multiple times and may occur with the
+	 * <code>ANY</code> node.
 	 * </p>
 	 */
-	public static final Node FUTURE = NodeFactory.createBlankNode( "urn:jena-permissions:FUTURE");
-	
+	public static final Node FUTURE = NodeFactory
+			.createBlankNode("urn:jena-permissions:FUTURE");
+
 	/**
 	 * Determine if the action is allowed on the graph.
 	 *
@@ -221,9 +221,11 @@ public interface SecurityEvaluator {
 	 * @param graphIRI
 	 *            The IRI of the graph to check
 	 * @return true if the action is allowed, false otherwise.
-	 * 
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean evaluate(Object principal, Action action, Node graphIRI);
+	public boolean evaluate(Object principal, Action action, Node graphIRI)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if the action is allowed on the triple within the graph.
@@ -268,9 +270,11 @@ public interface SecurityEvaluator {
 	 * @return true if the action is allowed, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	public boolean evaluate(Object principal, Action action, Node graphIRI,
-			Triple triple);
+			Triple triple) throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if all actions are allowed on the graph.
@@ -286,9 +290,11 @@ public interface SecurityEvaluator {
 	 * @return true if all the actions are allowed, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean evaluate(Object principal, Set<Action> actions,
-			Node graphIRI);
+	public boolean evaluate(Object principal, Set<Action> actions, Node graphIRI)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if all the actions are allowed on the triple within the graph.
@@ -307,9 +313,12 @@ public interface SecurityEvaluator {
 	 * @return true if all the actions are allowed, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	public boolean evaluate(Object principal, Set<Action> actions,
-			Node graphIRI, Triple triple);
+			Node graphIRI, Triple triple)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if any of the actions are allowed on the graph.
@@ -325,9 +334,11 @@ public interface SecurityEvaluator {
 	 * @return true true if any the actions are allowed, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	public boolean evaluateAny(Object principal, Set<Action> actions,
-			Node graphIRI);
+			Node graphIRI) throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if any of the actions are allowed on the triple within the
@@ -350,9 +361,12 @@ public interface SecurityEvaluator {
 	 * @return true if any the actions are allowed, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	public boolean evaluateAny(Object principal, Set<Action> actions,
-			Node graphIRI, Triple triple);
+			Node graphIRI, Triple triple)
+			throws AuthenticationRequiredException;
 
 	/**
 	 * Determine if the user is allowed to update the "from" triple to the "to"
@@ -374,9 +388,11 @@ public interface SecurityEvaluator {
 	 * @return true if the user may make the change, false otherwise.
 	 * @throws IllegalArgumentException
 	 *             if any argument is null.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
-	public boolean evaluateUpdate(Object principal, Node graphIRI,
-			Triple from, Triple to);
+	public boolean evaluateUpdate(Object principal, Node graphIRI, Triple from,
+			Triple to) throws AuthenticationRequiredException;
 
 	/**
 	 * returns the current principal or null if there is no current principal.
@@ -389,18 +405,20 @@ public interface SecurityEvaluator {
 	 * @return The current principal
 	 */
 	public Object getPrincipal();
-	
+
 	/**
-	 * Returns true if the principal is recognized as an authenticated principal by the
-	 * underlying authentication mechanism.
+	 * Returns true if the principal is recognized as an authenticated principal
+	 * by the underlying authentication mechanism.
 	 * 
-	 * This is to handle the case where an authentication mechanism returns a non-null object to
-	 * indicate a non-authenticated principal.  (e.g. Shiro).
+	 * This is to handle the case where an authentication mechanism returns a
+	 * non-null object to indicate a non-authenticated principal. (e.g. Shiro).
 	 * 
-	 * The principal is guaranteed to have been the return value from an earlier getPrincipal() call.
+	 * The principal is guaranteed to have been the return value from an earlier
+	 * getPrincipal() call.
 	 * 
-	 * @param principal The principal to check.
+	 * @param principal
+	 *            The principal to check.
 	 * @return true if authenticated, false if not.
 	 */
-	public boolean isPrincipalAuthenticated( Object principal );
+	public boolean isPrincipalAuthenticated(Object principal);
 }

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraph.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraph.java b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraph.java
index 4274bc4..378a39b 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraph.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraph.java
@@ -17,82 +17,105 @@
  */
 package org.apache.jena.permissions.graph;
 
-import org.apache.jena.graph.Graph ;
-import org.apache.jena.graph.GraphStatisticsHandler ;
-import org.apache.jena.graph.Node ;
-import org.apache.jena.graph.Triple ;
+import org.apache.jena.graph.Graph;
+import org.apache.jena.graph.GraphStatisticsHandler;
+import org.apache.jena.graph.Node;
+import org.apache.jena.graph.Triple;
 import org.apache.jena.permissions.SecuredItem;
 import org.apache.jena.permissions.SecurityEvaluator;
-import org.apache.jena.shared.AddDeniedException ;
-import org.apache.jena.shared.DeleteDeniedException ;
+import org.apache.jena.shared.AddDeniedException;
+import org.apache.jena.shared.AuthenticationRequiredException;
+import org.apache.jena.shared.DeleteDeniedException;
 import org.apache.jena.shared.ReadDeniedException;
-import org.apache.jena.util.iterator.ExtendedIterator ;
+import org.apache.jena.shared.UpdateDeniedException;
+import org.apache.jena.util.iterator.ExtendedIterator;
 
 /**
  * The interface for secured Graph instances.
  * 
  * Use the SecuredGraph.Factory to create instances
  */
-public interface SecuredGraph extends Graph, SecuredItem
-{
+public interface SecuredGraph extends Graph, SecuredItem {
 
 	/**
 	 * @sec.graph Update
 	 * @sec.triple Create
 	 * @throws AddDeniedException
+	 * @throws UpdateDeniedException
+	 *             if the graph can not be updated.
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public void add( final Triple t ) throws AddDeniedException;
+	public void add(final Triple t) throws AddDeniedException,
+			UpdateDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @sec.triple Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean contains( final Node s, final Node p, final Node o )
-			throws ReadDeniedException;
+	public boolean contains(final Node s, final Node p, final Node o)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @sec.triple Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean contains( final Triple t ) throws ReadDeniedException;
+	public boolean contains(final Triple t) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @sec.triple Delete
 	 * @throws DeleteDeniedException
+	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public void delete( final Triple t ) throws DeleteDeniedException;
+	public void delete(final Triple t) throws DeleteDeniedException,
+			UpdateDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean dependsOn( final Graph other ) throws ReadDeniedException;
+	public boolean dependsOn(final Graph other) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @sec.triple Read, otherwise filtered from iterator.
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public ExtendedIterator<Triple> find( final Node s, final Node p,
-			final Node o ) throws ReadDeniedException;
+	public ExtendedIterator<Triple> find(final Node s, final Node p,
+			final Node o) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
-    /**
+	/**
 	 * @sec.graph Read
 	 * @sec.triple Read, otherwise filtered from iterator.
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public ExtendedIterator<Triple> find( final Triple triple )
-			throws ReadDeniedException;
+	public ExtendedIterator<Triple> find(final Triple triple)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	@Override
 	public SecuredCapabilities getCapabilities();
@@ -102,63 +125,80 @@ public interface SecuredGraph extends Graph, SecuredItem
 
 	/**
 	 * Return the name of the graph.
+	 * 
 	 * @return The name of the graph as a node.
 	 */
 	@Override
-    public Node getModelNode();
+	public Node getModelNode();
 
 	@Override
 	public SecuredPrefixMapping getPrefixMapping();
 
 	@Override
-    public SecurityEvaluator getSecurityEvaluator();
+	public SecurityEvaluator getSecurityEvaluator();
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
 	public GraphStatisticsHandler getStatisticsHandler()
-			throws ReadDeniedException;
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean isEmpty() throws ReadDeniedException;
+	public boolean isEmpty() throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @sec.triple Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean isIsomorphicWith( final Graph g )
-			throws ReadDeniedException;
-
+	public boolean isIsomorphicWith(final Graph g) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public int size() throws ReadDeniedException;
-	
+	public int size() throws ReadDeniedException,
+			AuthenticationRequiredException;
+
 	/**
 	 * @sec.graph Update
 	 * @sec.triple Delete for every triple
 	 * @throws DeleteDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public void clear() throws DeleteDeniedException;
+	public void clear() throws DeleteDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @sec.triple Delete (s, p, o )
 	 * @throws DeleteDeniedException
+	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public void remove( Node s, Node p, Node o ) throws DeleteDeniedException;
+	public void remove(Node s, Node p, Node o) throws DeleteDeniedException,
+			UpdateDeniedException, AuthenticationRequiredException;
 
 }

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraphEventManager.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraphEventManager.java b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraphEventManager.java
index 192b015..e660f07 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraphEventManager.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredGraphEventManager.java
@@ -28,18 +28,19 @@ import java.util.Map;
 import java.util.Set;
 import java.util.Stack;
 
-import org.apache.jena.graph.Graph ;
-import org.apache.jena.graph.GraphEventManager ;
-import org.apache.jena.graph.GraphListener ;
-import org.apache.jena.graph.Triple ;
-import org.apache.jena.graph.impl.CollectionGraph ;
+import org.apache.jena.graph.Graph;
+import org.apache.jena.graph.GraphEventManager;
+import org.apache.jena.graph.GraphListener;
+import org.apache.jena.graph.Triple;
+import org.apache.jena.graph.impl.CollectionGraph;
 import org.apache.jena.permissions.SecurityEvaluator;
 import org.apache.jena.permissions.SecurityEvaluator.Action;
 import org.apache.jena.permissions.impl.CachedSecurityEvaluator;
 import org.apache.jena.permissions.utils.PermTripleFilter;
-import org.apache.jena.util.iterator.ExtendedIterator ;
-import org.apache.jena.util.iterator.NiceIterator ;
-import org.apache.jena.util.iterator.WrappedIterator ;
+import org.apache.jena.shared.AuthenticationRequiredException;
+import org.apache.jena.util.iterator.ExtendedIterator;
+import org.apache.jena.util.iterator.NiceIterator;
+import org.apache.jena.util.iterator.WrappedIterator;
 
 /**
  * Since we sit between the graph and other items we have to determine when the
@@ -60,11 +61,12 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		private Triple[] getArray(final Graph g, final Triple[] triples,
-				final Set<Action> perms) {
+				final Set<Action> perms) throws AuthenticationRequiredException {
 			Triple[] retval = triples;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs, perms, sg.getModelNode())) {
 					if (!evaluator.evaluateAny(runAs, perms, sg.getModelNode(),
 							Triple.ANY)) {
@@ -72,12 +74,10 @@ public class SecuredGraphEventManager implements GraphEventManager {
 								Arrays.asList(triples).iterator(), perms)
 								.toList();
 						retval = list.toArray(new Triple[list.size()]);
-					}
-					else {
+					} else {
 						retval = triples;
 					}
-				}
-				else {
+				} else {
 					retval = new Triple[0];
 				}
 			}
@@ -85,7 +85,8 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyAddArray(final Graph g, final Triple[] triples) {
+		public void notifyAddArray(final Graph g, final Triple[] triples)
+				throws AuthenticationRequiredException {
 			final Triple[] added = getArray(g, triples,
 					SecuredGraphEventManager.ADD);
 
@@ -95,11 +96,13 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyAddGraph(final Graph g, final Graph added) {
+		public void notifyAddGraph(final Graph g, final Graph added)
+				throws AuthenticationRequiredException {
 			Graph addGraph = added;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs, SecuredGraphEventManager.ADD,
 						sg.getModelNode())) {
 					if (!evaluator.evaluateAny(runAs,
@@ -110,12 +113,10 @@ public class SecuredGraphEventManager implements GraphEventManager {
 						addGraph = new CollectionGraph(Arrays.asList(getArray(
 								g, lst.toArray(new Triple[lst.size()]),
 								SecuredGraphEventManager.ADD)));
-					}
-					else {
+					} else {
 						addGraph = added;
 					}
-				}
-				else {
+				} else {
 					addGraph = new CollectionGraph(
 							Collections.<Triple> emptyList());
 				}
@@ -127,11 +128,13 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyAddIterator(final Graph g, final Iterator<Triple> it) {
+		public void notifyAddIterator(final Graph g, final Iterator<Triple> it)
+				throws AuthenticationRequiredException {
 
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				// only report if we can write to the graph
 				if (evaluator.evaluateAny(runAs, SecuredGraphEventManager.ADD,
 						sg.getModelNode())) {
@@ -143,19 +146,20 @@ public class SecuredGraphEventManager implements GraphEventManager {
 						iter.close();
 					}
 				}
-			}
-			else {
+			} else {
 				wrapped.notifyAddIterator(g, it);
 			}
 
 		}
 
 		@Override
-		public void notifyAddList(final Graph g, final List<Triple> triples) {
+		public void notifyAddList(final Graph g, final List<Triple> triples)
+				throws AuthenticationRequiredException {
 			List<Triple> list = triples;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs, SecuredGraphEventManager.ADD,
 						sg.getModelNode())) {
 					if (!evaluator.evaluateAny(runAs,
@@ -163,12 +167,10 @@ public class SecuredGraphEventManager implements GraphEventManager {
 							Triple.ANY)) {
 						list = wrapPermIterator(sg, triples.iterator(),
 								SecuredGraphEventManager.ADD).toList();
-					}
-					else {
+					} else {
 						list = triples;
 					}
-				}
-				else {
+				} else {
 					list = Collections.emptyList();
 				}
 			}
@@ -180,19 +182,20 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyAddTriple(final Graph g, final Triple t) {
+		public void notifyAddTriple(final Graph g, final Triple t)
+				throws AuthenticationRequiredException {
 			boolean notify = false;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				notify = evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.ADD, sg.getModelNode());
 				if (notify) {
 					notify = evaluator.evaluateAny(runAs,
 							SecuredGraphEventManager.ADD, sg.getModelNode(), t);
 				}
-			}
-			else {
+			} else {
 				notify = true;
 			}
 			if (notify) {
@@ -201,11 +204,13 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyDeleteArray(final Graph g, final Triple[] triples) {
+		public void notifyDeleteArray(final Graph g, final Triple[] triples)
+				throws AuthenticationRequiredException {
 			Triple[] deleted = triples;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.DELETE, sg.getModelNode())) {
 					if (!evaluator.evaluateAny(runAs,
@@ -215,12 +220,10 @@ public class SecuredGraphEventManager implements GraphEventManager {
 								Arrays.asList(triples).iterator(),
 								SecuredGraphEventManager.DELETE).toList();
 						deleted = list.toArray(new Triple[list.size()]);
-					}
-					else {
+					} else {
 						deleted = triples;
 					}
-				}
-				else {
+				} else {
 					deleted = new Triple[0];
 				}
 			}
@@ -231,10 +234,12 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyDeleteGraph(final Graph g, final Graph removed) {
+		public void notifyDeleteGraph(final Graph g, final Graph removed)
+				throws AuthenticationRequiredException {
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.DELETE, sg.getModelNode())) {
 					Graph g2 = removed;
@@ -243,31 +248,31 @@ public class SecuredGraphEventManager implements GraphEventManager {
 							Triple.ANY)) {
 						g2 = new CollectionGraph(
 								removed.find(Triple.ANY)
-								.filterKeep(
-										new PermTripleFilter(
-												SecuredGraphEventManager.DELETE,
-												sg, evaluator))
-												.toList());
+										.filterKeep(
+												new PermTripleFilter(
+														SecuredGraphEventManager.DELETE,
+														sg, evaluator))
+										.toList());
 
 					}
 					wrapped.notifyDeleteGraph(g, g2);
-				}
-				else {
+				} else {
 					// do nothing.
 				}
-			}
-			else {
+			} else {
 				wrapped.notifyDeleteGraph(g, removed);
 			}
 		}
 
 		@Override
 		public void notifyDeleteIterator(final Graph g,
-				final Iterator<Triple> it) {
+				final Iterator<Triple> it)
+				throws AuthenticationRequiredException {
 			Iterator<Triple> iter = it;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.DELETE, sg.getModelNode())) {
 
@@ -281,23 +286,23 @@ public class SecuredGraphEventManager implements GraphEventManager {
 					}
 					// else use the default list as all can bee seen
 					wrapped.notifyDeleteIterator(g, iter);
-				}
-				else {
+				} else {
 					// do nothing.
 				}
-			}
-			else {
+			} else {
 				wrapped.notifyDeleteIterator(g, iter);
 			}
 
 		}
 
 		@Override
-		public void notifyDeleteList(final Graph g, final List<Triple> triples) {
+		public void notifyDeleteList(final Graph g, final List<Triple> triples)
+				throws AuthenticationRequiredException {
 			List<Triple> list = triples;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				if (evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.DELETE, sg.getModelNode())) {
 					if (!evaluator.evaluateAny(runAs,
@@ -311,8 +316,7 @@ public class SecuredGraphEventManager implements GraphEventManager {
 												sg, evaluator)).toList();
 					}
 					// else use the default list as all can bee seen
-				}
-				else {
+				} else {
 					list = Collections.emptyList();
 				}
 			}
@@ -323,19 +327,21 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		}
 
 		@Override
-		public void notifyDeleteTriple(final Graph g, final Triple t) {
+		public void notifyDeleteTriple(final Graph g, final Triple t)
+				throws AuthenticationRequiredException {
 			boolean notify = false;
 			if (g instanceof SecuredGraph) {
 				final SecuredGraph sg = (SecuredGraph) g;
-				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+						sg.getSecurityEvaluator(), runAs);
 				notify = evaluator.evaluateAny(runAs,
 						SecuredGraphEventManager.DELETE, sg.getModelNode());
 				if (notify) {
 					notify = evaluator.evaluateAny(runAs,
-							SecuredGraphEventManager.DELETE, sg.getModelNode(), t);
+							SecuredGraphEventManager.DELETE, sg.getModelNode(),
+							t);
 				}
-			}
-			else {
+			} else {
 				notify = true;
 			}
 			if (notify) {
@@ -350,8 +356,9 @@ public class SecuredGraphEventManager implements GraphEventManager {
 
 		private ExtendedIterator<Triple> wrapPermIterator(
 				final SecuredGraph sg, final Iterator<Triple> it,
-				final Set<Action> perms) {
-			final SecurityEvaluator evaluator = new CachedSecurityEvaluator(sg.getSecurityEvaluator(), runAs);
+				final Set<Action> perms) throws AuthenticationRequiredException {
+			final SecurityEvaluator evaluator = new CachedSecurityEvaluator(
+					sg.getSecurityEvaluator(), runAs);
 			if (!evaluator.evaluateAny(runAs, perms, sg.getModelNode(),
 					Triple.ANY)) {
 				// nope so wrap the iterator with security iterator
@@ -359,7 +366,7 @@ public class SecuredGraphEventManager implements GraphEventManager {
 						new PermTripleFilter(perms, sg, evaluator));
 			}
 			return WrappedIterator.create(it);
-				}
+		}
 
 	}
 
@@ -372,13 +379,9 @@ public class SecuredGraphEventManager implements GraphEventManager {
 
 	static {
 		SecuredGraphEventManager.ADD = new HashSet<Action>(
-				Arrays.asList(new Action[] {
-						Action.Create, Action.Read
-				}));
+				Arrays.asList(new Action[] { Action.Create, Action.Read }));
 		SecuredGraphEventManager.DELETE = new HashSet<Action>(
-				Arrays.asList(new Action[] {
-						Action.Delete, Action.Read
-				}));
+				Arrays.asList(new Action[] { Action.Delete, Action.Read }));
 	}
 
 	public SecuredGraphEventManager(final SecuredGraph securedGraph,
@@ -403,170 +406,171 @@ public class SecuredGraphEventManager implements GraphEventManager {
 	}
 
 	@Override
-	public void notifyAddArray(final Graph g, final Triple[] triples) {
+	public void notifyAddArray(final Graph g, final Triple[] triples)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyAddArray(securedGraph, triples);
-			}
-			else {
+			} else {
 				sgl.notifyAddArray(g, triples);
 			}
 		}
 	}
 
 	@Override
-	public void notifyAddGraph(final Graph g, final Graph added) {
+	public void notifyAddGraph(final Graph g, final Graph added)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyAddGraph(securedGraph, added);
-			}
-			else {
+			} else {
 				sgl.notifyAddGraph(g, added);
 			}
 		}
 	}
 
 	@Override
-	public void notifyAddIterator(final Graph g, final Iterator<Triple> it) {
+	public void notifyAddIterator(final Graph g, final Iterator<Triple> it)
+			throws AuthenticationRequiredException {
 		notifyAddIterator(g, WrappedIterator.create(it).toList());
 		baseGraph.equals(g);
 	}
 
 	@Override
-	public void notifyAddIterator(final Graph g, final List<Triple> triples) {
+	public void notifyAddIterator(final Graph g, final List<Triple> triples)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyAddIterator(securedGraph, triples.iterator());
-			}
-			else {
+			} else {
 				sgl.notifyAddIterator(g, triples.iterator());
 			}
 		}
 	}
 
 	@Override
-	public void notifyAddList(final Graph g, final List<Triple> triples) {
+	public void notifyAddList(final Graph g, final List<Triple> triples)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyAddList(securedGraph, triples);
-			}
-			else {
+			} else {
 				sgl.notifyAddList(g, triples);
 			}
 		}
 	}
 
 	@Override
-	public void notifyAddTriple(final Graph g, final Triple t) {
+	public void notifyAddTriple(final Graph g, final Triple t)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyAddTriple(securedGraph, t);
-			}
-			else {
+			} else {
 				sgl.notifyAddTriple(g, t);
 			}
 		}
 	}
 
 	@Override
-	public void notifyDeleteArray(final Graph g, final Triple[] triples) {
+	public void notifyDeleteArray(final Graph g, final Triple[] triples)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyDeleteArray(securedGraph, triples);
-			}
-			else {
+			} else {
 				sgl.notifyDeleteArray(g, triples);
 			}
 		}
 	}
 
 	@Override
-	public void notifyDeleteGraph(final Graph g, final Graph removed) {
+	public void notifyDeleteGraph(final Graph g, final Graph removed)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyDeleteGraph(securedGraph, removed);
-			}
-			else {
+			} else {
 				sgl.notifyDeleteGraph(g, removed);
 			}
 		}
 	}
 
 	@Override
-	public void notifyDeleteIterator(final Graph g, final Iterator<Triple> it) {
+	public void notifyDeleteIterator(final Graph g, final Iterator<Triple> it)
+			throws AuthenticationRequiredException {
 		notifyDeleteIterator(g, WrappedIterator.create(it).toList());
 	}
 
 	@Override
-	public void notifyDeleteIterator(final Graph g, final List<Triple> triples) {
+	public void notifyDeleteIterator(final Graph g, final List<Triple> triples)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyDeleteIterator(securedGraph, triples.iterator());
-			}
-			else {
+			} else {
 				sgl.notifyDeleteIterator(g, triples.iterator());
 			}
 		}
 	}
 
 	@Override
-	public void notifyDeleteList(final Graph g, final List<Triple> L) {
+	public void notifyDeleteList(final Graph g, final List<Triple> L)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyDeleteList(securedGraph, L);
-			}
-			else {
+			} else {
 				sgl.notifyDeleteList(g, L);
 			}
 		}
 	}
 
 	@Override
-	public void notifyDeleteTriple(final Graph g, final Triple t) {
+	public void notifyDeleteTriple(final Graph g, final Triple t)
+			throws AuthenticationRequiredException {
 		final boolean wrap = baseGraph.equals(g);
 
 		for (final SecuredGraphListener sgl : getListenerCollection()) {
 			if (wrap) {
 				sgl.notifyDeleteTriple(securedGraph, t);
-			}
-			else {
+			} else {
 				sgl.notifyDeleteTriple(g, t);
 			}
 		}
 	}
 
 	@Override
-	public void notifyEvent(final Graph source, final Object value) {
+	public void notifyEvent(final Graph source, final Object value)
+			throws AuthenticationRequiredException {
 		if ((source instanceof SecuredGraph) && securedGraph.equals(source)) {
 			baseGraph.getEventManager().notifyEvent(baseGraph, value);
-		}
-		else {
+		} else {
 
 			final boolean wrap = baseGraph.equals(source);
 
 			for (final SecuredGraphListener sgl : getListenerCollection()) {
 				if (wrap) {
 					sgl.notifyEvent(securedGraph, value);
-				}
-				else {
+				} else {
 					sgl.notifyEvent(source, value);
 				}
 			}
@@ -591,8 +595,7 @@ public class SecuredGraphEventManager implements GraphEventManager {
 		if (sgl != null) {
 			if (sgl.size() == 1) {
 				listenerMap.remove(listener);
-			}
-			else {
+			} else {
 				sgl.pop();
 				listenerMap.put(listener, sgl);
 			}

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredPrefixMapping.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredPrefixMapping.java b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredPrefixMapping.java
index 0888aa4..13d8fa4 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredPrefixMapping.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/SecuredPrefixMapping.java
@@ -20,7 +20,8 @@ package org.apache.jena.permissions.graph;
 import java.util.Map;
 
 import org.apache.jena.permissions.SecuredItem;
-import org.apache.jena.shared.PrefixMapping ;
+import org.apache.jena.shared.AuthenticationRequiredException;
+import org.apache.jena.shared.PrefixMapping;
 import org.apache.jena.shared.ReadDeniedException;
 import org.apache.jena.shared.UpdateDeniedException;
 
@@ -29,106 +30,136 @@ import org.apache.jena.shared.UpdateDeniedException;
  * 
  * Use the SecuredPrefixMapping.Factory to create instances
  */
-public interface SecuredPrefixMapping extends PrefixMapping, SecuredItem
-{
+public interface SecuredPrefixMapping extends PrefixMapping, SecuredItem {
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public String expandPrefix( final String prefixed )
-			throws ReadDeniedException;
+	public String expandPrefix(final String prefixed)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public Map<String, String> getNsPrefixMap() throws ReadDeniedException;
+	public Map<String, String> getNsPrefixMap() throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public String getNsPrefixURI( final String prefix )
-			throws ReadDeniedException;
+	public String getNsPrefixURI(final String prefix)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public String getNsURIPrefix( final String uri )
-			throws ReadDeniedException;
+	public String getNsURIPrefix(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping lock() throws ReadDeniedException;
+	public SecuredPrefixMapping lock() throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public String qnameFor( final String uri ) throws ReadDeniedException;
+	public String qnameFor(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping removeNsPrefix( final String prefix )
-			throws ReadDeniedException;
+	public SecuredPrefixMapping removeNsPrefix(final String prefix)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public boolean samePrefixMappingAs( final PrefixMapping other )
-			throws ReadDeniedException;
+	public boolean samePrefixMappingAs(final PrefixMapping other)
+			throws ReadDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping setNsPrefix( final String prefix,
-			final String uri ) throws UpdateDeniedException;
+	public SecuredPrefixMapping setNsPrefix(final String prefix,
+			final String uri) throws UpdateDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping setNsPrefixes( final Map<String, String> map )
-			throws UpdateDeniedException;
+	public SecuredPrefixMapping setNsPrefixes(final Map<String, String> map)
+			throws UpdateDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping setNsPrefixes( final PrefixMapping other )
-			throws UpdateDeniedException;
+	public SecuredPrefixMapping setNsPrefixes(final PrefixMapping other)
+			throws UpdateDeniedException, AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Read
 	 * @throws ReadDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public String shortForm( final String uri ) throws ReadDeniedException;
+	public String shortForm(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException;
 
 	/**
 	 * @sec.graph Update
 	 * @throws UpdateDeniedException
+	 * @throws AuthenticationRequiredException
+	 *             if user is not authenticated and is required to be.
 	 */
 	@Override
-	public SecuredPrefixMapping withDefaultMappings( final PrefixMapping map )
-			throws UpdateDeniedException;
+	public SecuredPrefixMapping withDefaultMappings(final PrefixMapping map)
+			throws UpdateDeniedException, AuthenticationRequiredException;
 
 }

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredGraphImpl.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredGraphImpl.java b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredGraphImpl.java
index 3f147ee..01e9029 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredGraphImpl.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredGraphImpl.java
@@ -17,7 +17,7 @@
  */
 package org.apache.jena.permissions.graph.impl;
 
-import org.apache.jena.graph.* ;
+import org.apache.jena.graph.*;
 import org.apache.jena.permissions.SecuredItem;
 import org.apache.jena.permissions.SecurityEvaluator;
 import org.apache.jena.permissions.SecurityEvaluator.Action;
@@ -25,16 +25,17 @@ import org.apache.jena.permissions.graph.*;
 import org.apache.jena.permissions.impl.ItemHolder;
 import org.apache.jena.permissions.impl.SecuredItemImpl;
 import org.apache.jena.permissions.utils.PermTripleFilter;
-import org.apache.jena.shared.AddDeniedException ;
-import org.apache.jena.shared.DeleteDeniedException ;
+import org.apache.jena.shared.AddDeniedException;
+import org.apache.jena.shared.AuthenticationRequiredException;
+import org.apache.jena.shared.DeleteDeniedException;
+import org.apache.jena.shared.ReadDeniedException;
 import org.apache.jena.shared.UpdateDeniedException;
-import org.apache.jena.util.iterator.ExtendedIterator ;
+import org.apache.jena.util.iterator.ExtendedIterator;
 
 /**
  * Implementation of SecuredGraph to be used by a SecuredItemInvoker proxy.
  */
-public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph
-{
+public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph {
 
 	// the prefixMapping for this graph.
 	private SecuredPrefixMapping prefixMapping;
@@ -53,19 +54,17 @@ public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph
 	 * @param holder
 	 *            The item holder that will contain this SecuredGraph.
 	 */
-	SecuredGraphImpl( final SecuredItem securedItem,
-			final ItemHolder<Graph, SecuredGraphImpl> holder )
-	{
+	SecuredGraphImpl(final SecuredItem securedItem,
+			final ItemHolder<Graph, SecuredGraphImpl> holder) {
 		super(securedItem, holder);
 		this.holder = holder;
 		this.eventManager = new SecuredGraphEventManager(this,
 				holder.getBaseItem(), holder.getBaseItem().getEventManager());
 	}
 
-	SecuredGraphImpl( final SecurityEvaluator securityEvaluator,
+	SecuredGraphImpl(final SecurityEvaluator securityEvaluator,
 			final String modelURI,
-			final ItemHolder<Graph, SecuredGraphImpl> holder )
-	{
+			final ItemHolder<Graph, SecuredGraphImpl> holder) {
 		super(securityEvaluator, modelURI, holder);
 		this.holder = holder;
 		this.eventManager = new SecuredGraphEventManager(this,
@@ -73,123 +72,107 @@ public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph
 	}
 
 	@Override
-	public void add( final Triple t ) throws AddDeniedException, UpdateDeniedException
-	{
+	public void add(final Triple t) throws AddDeniedException,
+			UpdateDeniedException, AuthenticationRequiredException {
 		checkUpdate();
 		checkCreate(t);
 		holder.getBaseItem().add(t);
 	}
 
 	@Override
-	public void close()
-	{
+	public void close() {
 		holder.getBaseItem().close();
 	}
 
 	@Override
-	public boolean contains( final Node s, final Node p, final Node o )
-	{
+	public boolean contains(final Node s, final Node p, final Node o)
+			throws ReadDeniedException, AuthenticationRequiredException {
 		return contains(new Triple(s, p, o));
 	}
 
 	@Override
-	public boolean contains( final Triple t )
-	{
+	public boolean contains(final Triple t) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
-		if (canRead(t))
-		{
+		if (canRead(t)) {
 			return holder.getBaseItem().contains(t);
 		}
 		final ExtendedIterator<Triple> iter = holder.getBaseItem().find(t);
-		try
-		{
-			while (iter.hasNext())
-			{
-				if (canRead(iter.next()))
-				{
+		try {
+			while (iter.hasNext()) {
+				if (canRead(iter.next())) {
 					return true;
 				}
 			}
 			return false;
-		}
-		finally
-		{
+		} finally {
 			iter.close();
 		}
 
 	}
 
-	private synchronized void createPrefixMapping()
-	{
-		if (prefixMapping == null)
-		{
+	private synchronized void createPrefixMapping() {
+		if (prefixMapping == null) {
 			prefixMapping = org.apache.jena.permissions.graph.impl.Factory
 					.getInstance(this, holder.getBaseItem().getPrefixMapping());
 		}
 	}
 
 	@Override
-	public void delete( final Triple t ) throws DeleteDeniedException
-	{
+	public void delete(final Triple t) throws DeleteDeniedException,
+			AuthenticationRequiredException {
 		checkUpdate();
 		checkDelete(t);
 		holder.getBaseItem().delete(t);
 	}
 
 	@Override
-	public boolean dependsOn( final Graph other )
-	{
+	public boolean dependsOn(final Graph other) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
-		if (other.equals(holder.getBaseItem()))
-		{
+		if (other.equals(holder.getBaseItem())) {
 			return true;
 		}
 		return holder.getBaseItem().dependsOn(other);
 	}
 
 	@Override
-	public ExtendedIterator<Triple> find( final Node s, final Node p,
-			final Node o )
-	{
+	public ExtendedIterator<Triple> find(final Node s, final Node p,
+			final Node o) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		ExtendedIterator<Triple> retval = holder.getBaseItem().find(s, p, o);
-		if (!canRead(Triple.ANY))
-		{
+		if (!canRead(Triple.ANY)) {
+			retval = retval.filterKeep(new PermTripleFilter(Action.Read, this));
+		}
+		return retval;
+	}
+
+	@Override
+	public ExtendedIterator<Triple> find(final Triple m)
+			throws ReadDeniedException, AuthenticationRequiredException {
+		checkRead();
+		ExtendedIterator<Triple> retval = holder.getBaseItem().find(m);
+		if (!canRead(Triple.ANY)) {
 			retval = retval.filterKeep(new PermTripleFilter(Action.Read, this));
 		}
 		return retval;
 	}
-	
-    @Override
-    public ExtendedIterator<Triple> find( final Triple m )
-    {
-        checkRead();
-        ExtendedIterator<Triple> retval = holder.getBaseItem().find(m);
-        if (!canRead(Triple.ANY))
-        {
-            retval = retval.filterKeep(new PermTripleFilter(Action.Read, this));
-        }
-        return retval;
-    }
 
-    @Override
-	public SecuredCapabilities getCapabilities()
-	{
+	@Override
+	public SecuredCapabilities getCapabilities() {
 		return new SecuredCapabilities(getSecurityEvaluator(), getModelIRI(),
 				holder.getBaseItem().getCapabilities());
 	}
 
 	@Override
-	public SecuredGraphEventManager getEventManager()
-	{
+	public SecuredGraphEventManager getEventManager() {
 		return eventManager;
 	}
 
 	@Override
-	public SecuredPrefixMapping getPrefixMapping()
-	{
-		if (prefixMapping == null)
-		{
+	public SecuredPrefixMapping getPrefixMapping() {
+		if (prefixMapping == null) {
 			createPrefixMapping();
 		}
 		return prefixMapping;
@@ -197,44 +180,39 @@ public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph
 
 	@Override
 	public GraphStatisticsHandler getStatisticsHandler()
-	{
+			throws ReadDeniedException, AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().getStatisticsHandler();
 	}
 
 	@Override
-	public TransactionHandler getTransactionHandler()
-	{
+	public TransactionHandler getTransactionHandler() {
 		return holder.getBaseItem().getTransactionHandler();
 	}
 
 	@Override
-	public boolean isClosed()
-	{
+	public boolean isClosed() {
 		return holder.getBaseItem().isClosed();
 	}
 
 	@Override
-	public boolean isEmpty()
-	{
+	public boolean isEmpty() throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().isEmpty();
 	}
 
 	@Override
-	public boolean isIsomorphicWith( final Graph g )
-	{
+	public boolean isIsomorphicWith(final Graph g) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
-		if (g.size() != holder.getBaseItem().size())
-		{
+		if (g.size() != holder.getBaseItem().size()) {
 			return false;
 		}
 		final Triple t = new Triple(Node.ANY, Node.ANY, Node.ANY);
-		if (!canRead(t))
-		{
+		if (!canRead(t)) {
 			final ExtendedIterator<Triple> iter = g.find(t);
-			while (iter.hasNext())
-			{
+			while (iter.hasNext()) {
 				checkRead(iter.next());
 			}
 		}
@@ -242,42 +220,38 @@ public class SecuredGraphImpl extends SecuredItemImpl implements SecuredGraph
 	}
 
 	@Override
-	public int size()
-	{
+	public int size() throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().size();
 	}
 
 	@Override
-	public void clear()
-	{
+	public void clear() throws UpdateDeniedException,
+			AuthenticationRequiredException {
 		checkUpdate();
-		if (! canDelete( Triple.ANY ))
-		{
-			ExtendedIterator<Triple> iter = holder.getBaseItem().find( Triple.ANY );
-			while (iter.hasNext())
-			{
-				checkDelete( iter.next() );
+		if (!canDelete(Triple.ANY)) {
+			ExtendedIterator<Triple> iter = holder.getBaseItem().find(
+					Triple.ANY);
+			while (iter.hasNext()) {
+				checkDelete(iter.next());
 			}
 		}
 		holder.getBaseItem().clear();
 	}
 
 	@Override
-	public void remove( Node s, Node p, Node o )
-	{
+	public void remove(Node s, Node p, Node o) throws UpdateDeniedException,
+			DeleteDeniedException, AuthenticationRequiredException {
 		checkUpdate();
-		Triple t = new Triple( s, p, o );
-		if (t.isConcrete())
-		{
-			checkDelete( t );
-		}
-		else
-		{
-			ExtendedIterator<Triple> iter = holder.getBaseItem().find( Triple.ANY );
-			while (iter.hasNext())
-			{
-				checkDelete( iter.next() );
+		Triple t = new Triple(s, p, o);
+		if (t.isConcrete()) {
+			checkDelete(t);
+		} else {
+			ExtendedIterator<Triple> iter = holder.getBaseItem().find(
+					Triple.ANY);
+			while (iter.hasNext()) {
+				checkDelete(iter.next());
 			}
 		}
 		holder.getBaseItem().remove(s, p, o);

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredPrefixMappingImpl.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredPrefixMappingImpl.java b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredPrefixMappingImpl.java
index 610ed92..daa6a0f 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredPrefixMappingImpl.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/graph/impl/SecuredPrefixMappingImpl.java
@@ -23,16 +23,18 @@ import java.util.Map.Entry;
 import org.apache.jena.permissions.graph.SecuredPrefixMapping;
 import org.apache.jena.permissions.impl.ItemHolder;
 import org.apache.jena.permissions.impl.SecuredItemImpl;
-import org.apache.jena.shared.PrefixMapping ;
-import org.apache.jena.shared.impl.PrefixMappingImpl ;
+import org.apache.jena.shared.AuthenticationRequiredException;
+import org.apache.jena.shared.PrefixMapping;
+import org.apache.jena.shared.ReadDeniedException;
+import org.apache.jena.shared.UpdateDeniedException;
+import org.apache.jena.shared.impl.PrefixMappingImpl;
 
 /**
  * Implementation of SecuredPrefixMapping to be used by a SecuredItemInvoker
  * proxy.
  */
 public class SecuredPrefixMappingImpl extends SecuredItemImpl implements
-		SecuredPrefixMapping
-{
+		SecuredPrefixMapping {
 	// the item holder that holds this SecuredPrefixMapping
 	private final ItemHolder<PrefixMapping, SecuredPrefixMapping> holder;
 
@@ -44,121 +46,120 @@ public class SecuredPrefixMappingImpl extends SecuredItemImpl implements
 	 * @param holder
 	 *            The item holder that will contain this SecuredPrefixMapping.
 	 */
-	SecuredPrefixMappingImpl( final SecuredGraphImpl graph,
-			final ItemHolder<PrefixMapping, SecuredPrefixMapping> holder )
-	{
+	SecuredPrefixMappingImpl(final SecuredGraphImpl graph,
+			final ItemHolder<PrefixMapping, SecuredPrefixMapping> holder) {
 		super(graph, holder);
 		this.holder = holder;
 	}
 
 	@Override
-	public String expandPrefix( final String prefixed )
-	{
+	public String expandPrefix(final String prefixed)
+			throws ReadDeniedException, AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().expandPrefix(prefixed);
 	}
 
 	@Override
-	public Map<String, String> getNsPrefixMap()
-	{
+	public Map<String, String> getNsPrefixMap() throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().getNsPrefixMap();
 	}
 
 	@Override
-	public String getNsPrefixURI( final String prefix )
-	{
+	public String getNsPrefixURI(final String prefix)
+			throws ReadDeniedException, AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().getNsPrefixURI(prefix);
 	}
 
 	@Override
-	public String getNsURIPrefix( final String uri )
-	{
+	public String getNsURIPrefix(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().getNsURIPrefix(uri);
 	}
 
 	@Override
-	public SecuredPrefixMapping lock()
-	{
+	public SecuredPrefixMapping lock() throws UpdateDeniedException,
+			AuthenticationRequiredException {
 		checkUpdate();
 		holder.getBaseItem().lock();
 		return holder.getSecuredItem();
 	}
 
 	@Override
-	public String qnameFor( final String uri )
-	{
+	public String qnameFor(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().qnameFor(uri);
 	}
 
 	@Override
-	public SecuredPrefixMapping removeNsPrefix( final String prefix )
-	{
+	public SecuredPrefixMapping removeNsPrefix(final String prefix)
+			throws UpdateDeniedException, AuthenticationRequiredException {
 		checkUpdate();
 		holder.getBaseItem().removeNsPrefix(prefix);
 		return holder.getSecuredItem();
 	}
 
 	@Override
-	public boolean samePrefixMappingAs( final PrefixMapping other )
-	{
+	public boolean samePrefixMappingAs(final PrefixMapping other)
+			throws ReadDeniedException, AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().samePrefixMappingAs(other);
 	}
 
 	@Override
-	public SecuredPrefixMapping setNsPrefix( final String prefix,
-			final String uri )
-	{
+	public SecuredPrefixMapping setNsPrefix(final String prefix,
+			final String uri) throws UpdateDeniedException,
+			AuthenticationRequiredException {
 		checkUpdate();
 		holder.getBaseItem().setNsPrefix(prefix, uri);
 		return holder.getSecuredItem();
 	}
 
 	@Override
-	public SecuredPrefixMapping setNsPrefixes( final Map<String, String> map )
-	{
+	public SecuredPrefixMapping setNsPrefixes(final Map<String, String> map)
+			throws UpdateDeniedException, AuthenticationRequiredException {
 		checkUpdate();
 		holder.getBaseItem().setNsPrefixes(map);
 		return holder.getSecuredItem();
 	}
 
 	@Override
-	public SecuredPrefixMapping setNsPrefixes( final PrefixMapping other )
-	{
+	public SecuredPrefixMapping setNsPrefixes(final PrefixMapping other)
+			throws UpdateDeniedException, AuthenticationRequiredException {
 		checkUpdate();
 		holder.getBaseItem().setNsPrefixes(other);
 		return holder.getSecuredItem();
 	}
 
 	@Override
-	public String shortForm( final String uri )
-	{
+	public String shortForm(final String uri) throws ReadDeniedException,
+			AuthenticationRequiredException {
 		checkRead();
 		return holder.getBaseItem().shortForm(uri);
 	}
 
 	@Override
-	public SecuredPrefixMapping withDefaultMappings( final PrefixMapping map )
-	{
-		// mapping only updates if there are map entries to add.  Since this gets called
-		// when we are doing deep triple checks while writing we need to attempt the 
+	public SecuredPrefixMapping withDefaultMappings(final PrefixMapping map)
+			throws UpdateDeniedException, AuthenticationRequiredException {
+		// mapping only updates if there are map entries to add. Since this gets
+		// called
+		// when we are doing deep triple checks while writing we need to attempt
+		// the
 		// update only if there are new updates to add.
-		
+
 		PrefixMapping m = holder.getBaseItem();
 		PrefixMappingImpl pm = new PrefixMappingImpl();
-		for ( Entry<String, String> e : map.getNsPrefixMap().entrySet())
-		{
-			if (m.getNsPrefixURI(e.getKey()) == null && m.getNsURIPrefix(e.getValue()) == null )
-			{
-				pm.setNsPrefix( e.getKey(), e.getValue() );
+		for (Entry<String, String> e : map.getNsPrefixMap().entrySet()) {
+			if (m.getNsPrefixURI(e.getKey()) == null
+					&& m.getNsURIPrefix(e.getValue()) == null) {
+				pm.setNsPrefix(e.getKey(), e.getValue());
 			}
 		}
-		if ( !pm.getNsPrefixMap().isEmpty())
-		{
+		if (!pm.getNsPrefixMap().isEmpty()) {
 			checkUpdate();
 			holder.getBaseItem().withDefaultMappings(pm);
 		}

http://git-wip-us.apache.org/repos/asf/jena/blob/2c0454c6/jena-permissions/src/main/java/org/apache/jena/permissions/impl/CachedSecurityEvaluator.java
----------------------------------------------------------------------
diff --git a/jena-permissions/src/main/java/org/apache/jena/permissions/impl/CachedSecurityEvaluator.java b/jena-permissions/src/main/java/org/apache/jena/permissions/impl/CachedSecurityEvaluator.java
index 5b7b07d..41ee222 100644
--- a/jena-permissions/src/main/java/org/apache/jena/permissions/impl/CachedSecurityEvaluator.java
+++ b/jena-permissions/src/main/java/org/apache/jena/permissions/impl/CachedSecurityEvaluator.java
@@ -22,6 +22,7 @@ import java.util.Set;
 import org.apache.jena.graph.Node;
 import org.apache.jena.graph.Triple;
 import org.apache.jena.permissions.SecurityEvaluator;
+import org.apache.jena.shared.AuthenticationRequiredException;
 
 /**
  * A SecurityEvaluator that can be cached for later use.
@@ -43,44 +44,48 @@ public class CachedSecurityEvaluator implements SecurityEvaluator {
 
 	@Override
 	public boolean evaluate(final Object principal, final Action action,
-			final Node graphIRI) {
+			final Node graphIRI) throws AuthenticationRequiredException {
 		return wrapped.evaluate(principal, action, graphIRI);
 	}
 
 	@Override
 	public boolean evaluate(final Object principal, final Action action,
-			final Node graphIRI, final Triple triple) {
+			final Node graphIRI, final Triple triple)
+			throws AuthenticationRequiredException {
 		return wrapped.evaluate(principal, action, graphIRI, triple);
 	}
 
 	@Override
 	public boolean evaluate(final Object principal, final Set<Action> actions,
-			final Node graphIRI) {
+			final Node graphIRI) throws AuthenticationRequiredException {
 		return wrapped.evaluate(principal, actions, graphIRI);
 	}
 
 	@Override
 	public boolean evaluate(final Object principal, final Set<Action> actions,
-			final Node graphIRI, final Triple triple) {
+			final Node graphIRI, final Triple triple)
+			throws AuthenticationRequiredException {
 		return wrapped.evaluate(principal, actions, graphIRI, triple);
 	}
 
 	@Override
 	public boolean evaluateAny(final Object principal,
-			final Set<Action> actions, final Node graphIRI) {
+			final Set<Action> actions, final Node graphIRI)
+			throws AuthenticationRequiredException {
 		return wrapped.evaluateAny(principal, actions, graphIRI);
 	}
 
 	@Override
 	public boolean evaluateAny(final Object principal,
-			final Set<Action> actions, final Node graphIRI,
-			final Triple triple) {
+			final Set<Action> actions, final Node graphIRI, final Triple triple)
+			throws AuthenticationRequiredException {
 		return wrapped.evaluateAny(principal, actions, graphIRI, triple);
 	}
 
 	@Override
-	public boolean evaluateUpdate(final Object principal,
-			final Node graphIRI, final Triple from, final Triple to) {
+	public boolean evaluateUpdate(final Object principal, final Node graphIRI,
+			final Triple from, final Triple to)
+			throws AuthenticationRequiredException {
 		return wrapped.evaluateUpdate(principal, graphIRI, from, to);
 	}