svn commit: r1040088 - /myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java

[gp...@apache.org]

Author: gpetracek
Date: Mon Nov 29 12:36:01 2010
New Revision: 1040088

URL: http://svn.apache.org/viewvc?rev=1040088&view=rev
Log:
EXTCDI-60 fallback if there isn't a view-root

Modified:
    myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java

Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java?rev=1040088&r1=1040087&r2=1040088&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViewListener.java Mon Nov 29 12:36:01 2010
@@ -19,7 +19,7 @@
 package org.apache.myfaces.extensions.cdi.jsf.impl.security;
 
 import org.apache.myfaces.extensions.cdi.jsf.api.listener.phase.AfterPhase;
-import org.apache.myfaces.extensions.cdi.jsf.api.listener.phase.JsfPhaseId;
+import static org.apache.myfaces.extensions.cdi.jsf.api.listener.phase.JsfPhaseId.*;
 import static org.apache.myfaces.extensions.cdi.jsf.impl.util.SecurityUtils.tryToHandleSecurityViolation;
 import org.apache.myfaces.extensions.cdi.jsf.impl.config.view.ViewConfigCache;
 import org.apache.myfaces.extensions.cdi.jsf.impl.config.view.ViewConfigEntry;
@@ -30,14 +30,33 @@ import javax.enterprise.event.Observes;
 import javax.enterprise.inject.spi.BeanManager;
 import javax.faces.event.PhaseEvent;
 import javax.faces.context.FacesContext;
+import java.util.Map;
 
 /**
+ * If you don't need it or there is any issue, deactivate it via a CDI extension via
+ * {@link javax.enterprise.inject.spi.ProcessAnnotatedType#veto()} .
+ * 
  * @author Gerhard Petracek
  */
 public class SecurityViewListener
 {
-    public void checkPermission(
-            @Observes @AfterPhase(JsfPhaseId.RESTORE_VIEW) PhaseEvent event, BeanManager beanManager)
+    private static final String LAZY_SECURITY_CHECK_KEY = "LAZY_SECURITY_CHECK";
+
+    public void checkPermission(@Observes @AfterPhase(RESTORE_VIEW) PhaseEvent event, BeanManager beanManager)
+    {
+        FacesContext facesContext = event.getFacesContext();
+
+        if(facesContext.getViewRoot() == null)
+        {
+            triggerFallback(facesContext);
+            return;
+        }
+
+        checkPermission(beanManager, facesContext);
+    }
+
+    public void checkPermissionBeforeRendering(
+            @Observes @AfterPhase(RENDER_RESPONSE) PhaseEvent event, BeanManager beanManager)
     {
         FacesContext facesContext = event.getFacesContext();
 
@@ -47,6 +66,16 @@ public class SecurityViewListener
             return;
         }
 
+        Map<String, Object> requestMap = getRequestMap(facesContext);
+
+        if(requestMap != null && Boolean.TRUE.equals(requestMap.get(LAZY_SECURITY_CHECK_KEY)))
+        {
+            checkPermission(beanManager, facesContext);
+        }
+    }
+
+    private void checkPermission(BeanManager beanManager, FacesContext facesContext)
+    {
         ViewConfigEntry entry = ViewConfigCache.getViewDefinition(facesContext.getViewRoot().getViewId());
 
         if(entry == null)
@@ -64,4 +93,25 @@ public class SecurityViewListener
             facesContext.renderResponse();
         }
     }
+
+    private void triggerFallback(FacesContext facesContext)
+    {
+        Map<String, Object> requestMap = getRequestMap(facesContext);
+
+        if(requestMap != null)
+        {
+            requestMap.put(LAZY_SECURITY_CHECK_KEY, Boolean.TRUE);
+        }
+    }
+
+    private Map<String, Object> getRequestMap(FacesContext facesContext)
+    {
+        if(facesContext.getExternalContext() == null || facesContext.getExternalContext().getRequestMap() == null)
+        {
+            //TODO log warning
+            return null;
+        }
+
+        return facesContext.getExternalContext().getRequestMap();
+    }
 }