You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@myfaces.apache.org by gp...@apache.org on 2010/09/19 15:35:22 UTC
svn commit: r998659 - in /myfaces/extensions/cdi/trunk:
core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/
jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/
jee-modules/jsf-module/i...
Author: gpetracek
Date: Sun Sep 19 13:35:21 2010
New Revision: 998659
URL: http://svn.apache.org/viewvc?rev=998659&view=rev
Log:
EXTCDI-59 first draft
Added:
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDecisionVoter.java
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDeniedException.java
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/DefaultErrorPage.java
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/Secured.java
myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/SecurityViolation.java
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityInterceptor.java
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViolationAwareActionListener.java
Modified:
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/Page.java
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/config/view/ViewConfigCache.java
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/beans.xml
myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/faces-config.xml
myfaces/extensions/cdi/trunk/jee-modules/jsf20-module/impl/src/main/resources/META-INF/faces-config.xml
Added: myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDecisionVoter.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDecisionVoter.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDecisionVoter.java (added)
+++ myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDecisionVoter.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.core.api.security;
+
+import javax.interceptor.InvocationContext;
+import java.util.Set;
+
+/**
+ * @author Gerhard Petracek
+ */
+public interface AccessDecisionVoter
+{
+ Set<SecurityViolation> checkPermission(InvocationContext invocationContext);
+}
Added: myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDeniedException.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDeniedException.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDeniedException.java (added)
+++ myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/AccessDeniedException.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.core.api.security;
+
+import org.apache.myfaces.extensions.cdi.core.api.config.view.ViewConfig;
+
+import java.util.Set;
+
+/**
+ * @author Gerhard Petracek
+ */
+public class AccessDeniedException extends SecurityException
+{
+ private static final long serialVersionUID = -4066763895951237969L;
+
+ private Set<SecurityViolation> violations;
+ private Class<? extends ViewConfig> errorPage;
+
+ public AccessDeniedException(Set<SecurityViolation> violations, Class<? extends ViewConfig> errorPage)
+ {
+ this.violations = violations;
+ this.errorPage = errorPage;
+ }
+
+ public Set<SecurityViolation> getViolations()
+ {
+ return violations;
+ }
+
+ public Class<? extends ViewConfig> getErrorPage()
+ {
+ return errorPage;
+ }
+}
Added: myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/DefaultErrorPage.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/DefaultErrorPage.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/DefaultErrorPage.java (added)
+++ myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/DefaultErrorPage.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.core.api.security;
+
+import org.apache.myfaces.extensions.cdi.core.api.config.view.ViewConfig;
+
+/**
+ * @author Gerhard Petracek
+ */
+public interface DefaultErrorPage extends ViewConfig
+{
+}
Added: myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/Secured.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/Secured.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/Secured.java (added)
+++ myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/Secured.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.core.api.security;
+
+import org.apache.myfaces.extensions.cdi.core.api.config.view.ViewConfig;
+
+import javax.interceptor.InterceptorBinding;
+import javax.enterprise.util.Nonbinding;
+import java.lang.annotation.Target;
+import java.lang.annotation.Retention;
+import java.lang.annotation.Documented;
+import static java.lang.annotation.RetentionPolicy.RUNTIME;
+import static java.lang.annotation.ElementType.TYPE;
+import static java.lang.annotation.ElementType.METHOD;
+
+/**
+ * @author Gerhard Petracek
+ */
+@InterceptorBinding
+@Target({TYPE, METHOD})
+@Retention(RUNTIME)
+@Documented
+public @interface Secured
+{
+ @Nonbinding
+ Class<? extends AccessDecisionVoter>[] value();
+
+ @Nonbinding
+ Class<? extends ViewConfig> errorPage() default DefaultErrorPage.class;
+}
Added: myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/SecurityViolation.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/SecurityViolation.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/SecurityViolation.java (added)
+++ myfaces/extensions/cdi/trunk/core/api/src/main/java/org/apache/myfaces/extensions/cdi/core/api/security/SecurityViolation.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.core.api.security;
+
+/**
+ * @author Gerhard Petracek
+ */
+public interface SecurityViolation
+{
+ String getReason();
+}
Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/Page.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/Page.java?rev=998659&r1=998658&r2=998659&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/Page.java (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/api/src/main/java/org/apache/myfaces/extensions/cdi/jsf/api/config/view/Page.java Sun Sep 19 13:35:21 2010
@@ -41,6 +41,7 @@ public @interface Page
String name() default "";
+ //TODO config for default extension
String extension() default JsfViewExtension.XHTML;
NavigationMode navigation() default NavigationMode.FORWARD;
Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/config/view/ViewConfigCache.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/config/view/ViewConfigCache.java?rev=998659&r1=998658&r2=998659&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/config/view/ViewConfigCache.java (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/config/view/ViewConfigCache.java Sun Sep 19 13:35:21 2010
@@ -19,11 +19,14 @@
package org.apache.myfaces.extensions.cdi.jsf.impl.config.view;
import org.apache.myfaces.extensions.cdi.core.api.config.view.ViewConfig;
+import org.apache.myfaces.extensions.cdi.core.api.security.DefaultErrorPage;
import java.util.HashMap;
import java.util.Map;
/**
+ * TODO move exceptions to util class
+ *
* @author Gerhard Petracek
*/
public class ViewConfigCache
@@ -35,8 +38,12 @@ public class ViewConfigCache
private static Map<Class<? extends ViewConfig>, ViewConfigEntry> viewDefinitionToViewDefinitionEntryMapping
= new HashMap<Class<? extends ViewConfig>, ViewConfigEntry>();
+ private static ViewConfigEntry defaultErrorPage;
+
static void addViewDefinition(String viewId, ViewConfigEntry viewDefinitionEntry)
{
+ tryToStorePageAsDefaultErrorPage(viewDefinitionEntry);
+
if(viewIdToViewDefinitionEntryMapping.containsKey(viewId))
{
throw new IllegalArgumentException(viewId + " is already mapped to "
@@ -48,6 +55,21 @@ public class ViewConfigCache
.put(viewDefinitionEntry.getViewDefinitionClass(), viewDefinitionEntry);
}
+ private static void tryToStorePageAsDefaultErrorPage(ViewConfigEntry viewDefinitionEntry)
+ {
+ if(DefaultErrorPage.class.isAssignableFrom(viewDefinitionEntry.getViewDefinitionClass()))
+ {
+ if(defaultErrorPage != null)
+ {
+ throw new IllegalStateException("multiple error pages found " +
+ defaultErrorPage.getViewDefinitionClass().getClass().getName() + " and " +
+ viewDefinitionEntry.getViewDefinitionClass().getName());
+ }
+
+ defaultErrorPage = viewDefinitionEntry;
+ }
+ }
+
public static ViewConfigEntry getViewDefinition(String viewId)
{
return viewIdToViewDefinitionEntryMapping.get(viewId);
@@ -57,4 +79,9 @@ public class ViewConfigCache
{
return viewDefinitionToViewDefinitionEntryMapping.get(viewDefinitionClass);
}
+
+ public static ViewConfigEntry getDefaultErrorPage()
+ {
+ return defaultErrorPage;
+ }
}
Added: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityInterceptor.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityInterceptor.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityInterceptor.java (added)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityInterceptor.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.jsf.impl.security;
+
+import org.apache.myfaces.extensions.cdi.core.api.security.Secured;
+import org.apache.myfaces.extensions.cdi.core.api.security.AccessDecisionVoter;
+import org.apache.myfaces.extensions.cdi.core.api.security.SecurityViolation;
+import org.apache.myfaces.extensions.cdi.core.api.security.AccessDeniedException;
+import static org.apache.myfaces.extensions.cdi.core.impl.utils.CodiUtils.getOrCreateScopedInstanceOfBeanByClass;
+
+import javax.interceptor.AroundInvoke;
+import javax.interceptor.InvocationContext;
+import javax.interceptor.Interceptor;
+import java.lang.reflect.Method;
+import java.util.Set;
+
+/**
+ * @author Gerhard Petracek
+ */
+@Secured(SecurityInterceptor.PlaceHolderVoter.class)
+@Interceptor
+public class SecurityInterceptor
+{
+ interface PlaceHolderVoter extends AccessDecisionVoter
+ {}
+
+ @AroundInvoke
+ public Object filterDeniedInvocations(InvocationContext invocationContext) throws Exception
+ {
+ Secured secured = getSecuredAnnotation(invocationContext);
+
+ Class<? extends AccessDecisionVoter>[] voterClasses = secured.value();
+
+ AccessDecisionVoter voter;
+ Set<SecurityViolation> violations;
+ for(Class<? extends AccessDecisionVoter> voterClass : voterClasses)
+ {
+ voter = getOrCreateScopedInstanceOfBeanByClass(voterClass);
+
+ violations = voter.checkPermission(invocationContext);
+ if(violations.size() > 0)
+ {
+ throw new AccessDeniedException(violations, secured.errorPage());
+ }
+ }
+
+ return invocationContext.proceed();
+ }
+
+ //TODO refactor it to a generic impl. and move it to an util class
+ private Secured getSecuredAnnotation(InvocationContext invocationContext)
+ {
+ Secured secured;
+ Method method = invocationContext.getMethod();
+
+ if(method.isAnnotationPresent(Secured.class))
+ {
+ secured = method.getAnnotation(Secured.class);
+ }
+ else
+ {
+ secured = method.getDeclaringClass().getAnnotation(Secured.class);
+ }
+ return secured;
+ }
+}
Added: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViolationAwareActionListener.java
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViolationAwareActionListener.java?rev=998659&view=auto
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViolationAwareActionListener.java (added)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/java/org/apache/myfaces/extensions/cdi/jsf/impl/security/SecurityViolationAwareActionListener.java Sun Sep 19 13:35:21 2010
@@ -0,0 +1,138 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.myfaces.extensions.cdi.jsf.impl.security;
+
+import org.apache.myfaces.extensions.cdi.core.api.security.AccessDeniedException;
+import org.apache.myfaces.extensions.cdi.core.api.security.SecurityViolation;
+import org.apache.myfaces.extensions.cdi.core.api.security.DefaultErrorPage;
+import org.apache.myfaces.extensions.cdi.core.api.tools.DefaultAnnotation;
+import org.apache.myfaces.extensions.cdi.core.api.config.view.ViewConfig;
+import static org.apache.myfaces.extensions.cdi.core.impl.utils.CodiUtils.getOrCreateScopedInstanceOfBeanByClass;
+import org.apache.myfaces.extensions.cdi.jsf.impl.config.view.ViewConfigCache;
+import org.apache.myfaces.extensions.cdi.jsf.impl.config.view.ViewConfigEntry;
+import org.apache.myfaces.extensions.cdi.jsf.api.Jsf;
+import org.apache.myfaces.extensions.cdi.message.api.MessageContext;
+import org.apache.myfaces.extensions.cdi.message.api.payload.MessageSeverity;
+
+import javax.faces.event.ActionListener;
+import javax.faces.event.ActionEvent;
+import javax.faces.event.AbortProcessingException;
+import javax.faces.context.FacesContext;
+import javax.faces.FacesException;
+import java.util.Set;
+
+/**
+ * @author Gerhard Petracek
+ */
+public class SecurityViolationAwareActionListener implements ActionListener
+{
+ private static final Jsf JSF_QUALIFIER = DefaultAnnotation.of(Jsf.class);
+
+ private ActionListener wrapped;
+
+ public SecurityViolationAwareActionListener(ActionListener wrapped)
+ {
+ this.wrapped = wrapped;
+ }
+
+ public void processAction(ActionEvent actionEvent) throws AbortProcessingException
+ {
+ try
+ {
+ this.wrapped.processAction(actionEvent);
+ }
+ catch (FacesException facesException)
+ {
+ AccessDeniedException exception = extractException(facesException);
+
+ if(exception == null)
+ {
+ throw facesException;
+ }
+
+ Class<? extends ViewConfig> errorPage = null;
+
+ Class<? extends ViewConfig> inlineErrorPage = exception.getErrorPage();
+
+ if(!DefaultErrorPage.class.getName().equals(inlineErrorPage.getName()))
+ {
+ errorPage = inlineErrorPage;
+ }
+
+ if(errorPage == null)
+ {
+ ViewConfigEntry errorPageEntry = ViewConfigCache.getDefaultErrorPage();
+
+ if(errorPageEntry != null)
+ {
+ errorPage = errorPageEntry.getViewDefinitionClass();
+ }
+ }
+
+ if(errorPage == null)
+ {
+ throw exception;
+ }
+
+ processApplicationSecurityException(exception, errorPage);
+ }
+ }
+
+ private AccessDeniedException extractException(Throwable exception)
+ {
+ if(exception == null)
+ {
+ return null;
+ }
+
+ if(exception instanceof AccessDeniedException)
+ {
+ return (AccessDeniedException)exception;
+ }
+
+ return extractException(exception.getCause());
+ }
+
+ private void processApplicationSecurityException(AccessDeniedException exception,
+ Class<? extends ViewConfig> errorPage)
+ {
+ FacesContext facesContext = FacesContext.getCurrentInstance();
+
+ addViolationsAsMessage(exception.getViolations());
+
+ facesContext.getApplication().getNavigationHandler()
+ .handleNavigation(facesContext, null, errorPage.getName());
+ }
+
+ private void addViolationsAsMessage(Set<SecurityViolation> violations)
+ {
+ MessageContext messageContext = getOrCreateScopedInstanceOfBeanByClass(
+ MessageContext.class, true, JSF_QUALIFIER);
+
+ if(messageContext == null)
+ {
+ return;
+ }
+
+ for(SecurityViolation violation : violations)
+ {
+ messageContext.message().text(violation.getReason()).payload(MessageSeverity.ERROR).add();
+ }
+ }
+}
Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/beans.xml
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/beans.xml?rev=998659&r1=998658&r2=998659&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/beans.xml (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/beans.xml Sun Sep 19 13:35:21 2010
@@ -22,6 +22,7 @@
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/beans_1_0.xsd">
<interceptors>
+ <class>org.apache.myfaces.extensions.cdi.jsf.impl.security.SecurityInterceptor</class>
<class>org.apache.myfaces.extensions.cdi.jsf.impl.listener.phase.ViewControllerInterceptor</class>
</interceptors>
</beans>
Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/faces-config.xml
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/faces-config.xml?rev=998659&r1=998658&r2=998659&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/faces-config.xml (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf-module/impl/src/main/resources/META-INF/faces-config.xml Sun Sep 19 13:35:21 2010
@@ -24,6 +24,7 @@
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-facesconfig_1_2.xsd">
<application>
+ <action-listener>org.apache.myfaces.extensions.cdi.jsf.impl.security.SecurityViolationAwareActionListener</action-listener>
<navigation-handler>org.apache.myfaces.extensions.cdi.jsf.impl.navigation.AccessScopeAwareNavigationHandler</navigation-handler>
<navigation-handler>org.apache.myfaces.extensions.cdi.jsf.impl.navigation.FlowNavigationHandler</navigation-handler>
Modified: myfaces/extensions/cdi/trunk/jee-modules/jsf20-module/impl/src/main/resources/META-INF/faces-config.xml
URL: http://svn.apache.org/viewvc/myfaces/extensions/cdi/trunk/jee-modules/jsf20-module/impl/src/main/resources/META-INF/faces-config.xml?rev=998659&r1=998658&r2=998659&view=diff
==============================================================================
--- myfaces/extensions/cdi/trunk/jee-modules/jsf20-module/impl/src/main/resources/META-INF/faces-config.xml (original)
+++ myfaces/extensions/cdi/trunk/jee-modules/jsf20-module/impl/src/main/resources/META-INF/faces-config.xml Sun Sep 19 13:35:21 2010
@@ -23,6 +23,7 @@
version="2.0">
<application>
+ <action-listener>org.apache.myfaces.extensions.cdi.jsf.impl.security.SecurityViolationAwareActionListener</action-listener>
<navigation-handler>org.apache.myfaces.extensions.cdi.jsf.impl.navigation.FlowNavigationHandler</navigation-handler>
<navigation-handler>org.apache.myfaces.extensions.cdi.jsf2.impl.scope.conversation.AccessScopeAwareNavigationHandler</navigation-handler>