jackrabbit-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ang...@apache.org
Subject svn commit: r954964 - in /jackrabbit/trunk: jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/ jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/ jackrabbit-core/sr...
Date Tue, 15 Jun 2010 16:55:41 GMT
Author: angela
Date: Tue Jun 15 16:55:41 2010
New Revision: 954964

URL: http://svn.apache.org/viewvc?rev=954964&view=rev
Log:
JCR-2646 : AccessControlManager#getEffectivePolicies(String) may expose AC content without proper permissions
JCR-2657 : DefaultAccessManager#hasPrivileges(String,Set,Privilege[]) doesn't close compiled permissions
JCR-2649 : Provide means to display the effective policies for a given set of principals

Added:
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java   (with props)
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java   (with props)
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java   (with props)
Modified:
    jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SystemSession.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/DefaultAccessManager.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlEditor.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlProvider.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/acl/ACLProvider.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/combined/CombinedProvider.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/principalbased/ACLProvider.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/simple/SimpleAccessManager.java
    jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/user/UserAccessControlProvider.java
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/TestAll.java
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/WriteTest.java
    jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/TestAll.java

Modified: jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.java (original)
+++ jackrabbit/trunk/jackrabbit-api/src/main/java/org/apache/jackrabbit/api/security/JackrabbitAccessControlManager.java Tue Jun 15 16:55:41 2010
@@ -22,6 +22,7 @@ import javax.jcr.UnsupportedRepositoryOp
 import javax.jcr.PathNotFoundException;
 import javax.jcr.security.AccessControlException;
 import javax.jcr.security.AccessControlManager;
+import javax.jcr.security.AccessControlPolicy;
 import javax.jcr.security.Privilege;
 import java.security.Principal;
 import java.util.Set;
@@ -70,6 +71,23 @@ public interface JackrabbitAccessControl
     JackrabbitAccessControlPolicy[] getPolicies(Principal principal) throws AccessDeniedException, AccessControlException, UnsupportedRepositoryOperationException, RepositoryException;
 
     /**
+     * Returns the <code>AccessControlPolicy</code> objects that are in effect
+     * for the given <code>Principal</code>s. This may be policies set through
+     * this API or some implementation specific (default) policies.
+     *
+     * @param principals A set of valid principals.
+     * @return The policies defined for the given principal or an empty array.
+     * @throws AccessDeniedException if the session lacks
+     * <code>READ_ACCESS_CONTROL</code> privilege.
+     * @throws AccessControlException  if the specified principal does not exist
+     * or if another access control related exception occurs.
+     * @throws UnsupportedRepositoryOperationException if editing access control
+     * policies by principal is not supported.
+     * @throws RepositoryException If another error occurs.
+     */
+    AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals) throws AccessDeniedException, AccessControlException, UnsupportedRepositoryOperationException, RepositoryException;
+
+    /**
      * Returns whether the given set of <code>Principal</code>s has the specified
      * privileges for absolute path <code>absPath</code>, which must be an
      * existing node.

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SystemSession.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SystemSession.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SystemSession.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/SystemSession.java Tue Jun 15 16:55:41 2010
@@ -24,6 +24,8 @@ import java.security.Principal;
 import javax.jcr.AccessDeniedException;
 import javax.jcr.PathNotFoundException;
 import javax.jcr.RepositoryException;
+import javax.jcr.UnsupportedRepositoryOperationException;
+import javax.jcr.security.AccessControlException;
 import javax.jcr.security.AccessControlPolicy;
 import javax.jcr.security.Privilege;
 import javax.security.auth.Subject;
@@ -279,8 +281,16 @@ class SystemSession extends SessionImpl 
         }
 
         /**
-     * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#hasPrivileges(String, Set, Privilege[])
-     */
+         * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#getEffectivePolicies(Set)
+         */
+        public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principal) throws AccessDeniedException, AccessControlException, UnsupportedRepositoryOperationException, RepositoryException {
+            // cannot determine the effective policies for the system session.
+            return new AccessControlPolicy[0];
+        }
+
+        /**
+         * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#hasPrivileges(String, Set, Privilege[])
+         */
         public boolean hasPrivileges(String absPath, Set<Principal> principals, Privilege[] privileges) throws PathNotFoundException, RepositoryException {
             throw new UnsupportedOperationException("not implemented");
         }

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/DefaultAccessManager.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/DefaultAccessManager.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/DefaultAccessManager.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/DefaultAccessManager.java Tue Jun 15 16:55:41 2010
@@ -314,7 +314,7 @@ public class DefaultAccessManager extend
         checkInitialized();
         checkPermission(absPath, Permission.READ_AC);
 
-        return acProvider.getEffectivePolicies(getPath(absPath));
+        return acProvider.getEffectivePolicies(getPath(absPath), compiledPermissions);
     }
 
     /**
@@ -389,6 +389,14 @@ public class DefaultAccessManager extend
     }
 
     /**
+     * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#getEffectivePolicies(Set)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals) throws AccessDeniedException, AccessControlException, UnsupportedRepositoryOperationException, RepositoryException {
+        checkInitialized();
+        return acProvider.getEffectivePolicies(principals, compiledPermissions);
+    }
+
+    /**
      * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#hasPrivileges(String, Set, Privilege[])
      */
     public boolean hasPrivileges(String absPath, Set<Principal> principals, Privilege[] privileges) throws PathNotFoundException, RepositoryException {
@@ -403,7 +411,12 @@ public class DefaultAccessManager extend
         } else {
             int privs = PrivilegeRegistry.getBits(privileges);
             Path p = resolver.getQPath(absPath);
-            return (acProvider.compilePermissions(principals).getPrivileges(p) | ~privs) == -1;
+            CompiledPermissions perms = acProvider.compilePermissions(principals);
+            try {
+                return (perms.getPrivileges(p) | ~privs) == -1;
+            } finally {
+                perms.close();
+            }
         }
     }
 
@@ -414,6 +427,7 @@ public class DefaultAccessManager extend
         checkInitialized();
         checkValidNodePath(absPath);
         checkPermission(absPath, Permission.READ_AC);
+
         CompiledPermissions perms = acProvider.compilePermissions(principals);
         try {
             int bits = perms.getPrivileges(resolver.getQPath(absPath));

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlEditor.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlEditor.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlEditor.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlEditor.java Tue Jun 15 16:55:41 2010
@@ -40,7 +40,7 @@ public interface AccessControlEditor {
      * Modification will therefore not take effect, until they are written back to
      * the editor and persisted.
      * <p/>
-     * Compared to the policy returned by {@link AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path)},
+     * Compared to the policy returned by {@link AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path, CompiledPermissions)},
      * the scope of the policies it limited to the Node itself and does
      * not take inherited elements into account.
      *
@@ -90,7 +90,7 @@ public interface AccessControlEditor {
      * the editable policies that have been set to the node at
      * <code>nodePath</code> before.
      * <p/>
-     * Compared to the policies returned by {@link AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path)},
+     * Compared to the policies returned by {@link AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path, CompiledPermissions)},
      * the scope of the policies returned by this methods it limited to the Node
      * itself and does never not take inherited elements into account.
      *

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlProvider.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlProvider.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/AccessControlProvider.java Tue Jun 15 16:55:41 2010
@@ -17,6 +17,7 @@
 package org.apache.jackrabbit.core.security.authorization;
 
 import javax.jcr.security.AccessControlPolicy;
+
 import org.apache.jackrabbit.spi.Path;
 
 import javax.jcr.ItemNotFoundException;
@@ -86,6 +87,8 @@ public interface AccessControlProvider {
      * Returns the effective policies for the node at the given absPath.
      *
      * @param absPath an absolute path.
+     * @param permissions The effective permissions of the editing
+     * sessions that attempts to view the effective policies.
      * @return The effective policies that apply at <code>absPath</code> or
      * an empty array if the implementation cannot determine the effective
      * policy at the given path.
@@ -94,7 +97,19 @@ public interface AccessControlProvider {
      * @throws RepositoryException If another error occurs.
      * @see javax.jcr.security.AccessControlManager#getEffectivePolicies(String)
      */
-    AccessControlPolicy[] getEffectivePolicies(Path absPath) throws ItemNotFoundException, RepositoryException;
+    AccessControlPolicy[] getEffectivePolicies(Path absPath, CompiledPermissions permissions) throws ItemNotFoundException, RepositoryException;
+
+    /**
+     * Returns the effective policies for the given principals.
+     *
+     * @param principals A set of principal.
+     * @param permissions The effective permissions of the editing
+     * sessions that attempts to view the effective policies.  @return The effective policies that are in effect for the given
+     * <code>principal</code> or an empty array.
+     * @throws RepositoryException If error occurs.
+     * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#getEffectivePolicies(Set)
+     */
+    AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals, CompiledPermissions permissions) throws RepositoryException;
 
     /**
      * Returns an <code>AccessControlEditor</code> for the given Session object

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/acl/ACLProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/acl/ACLProvider.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/acl/ACLProvider.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/acl/ACLProvider.java Tue Jun 15 16:55:41 2010
@@ -39,12 +39,19 @@ import org.apache.jackrabbit.core.securi
 import org.apache.jackrabbit.core.security.authorization.UnmodifiableAccessControlList;
 import org.apache.jackrabbit.spi.Name;
 import org.apache.jackrabbit.spi.Path;
+import org.apache.jackrabbit.util.ISO9075;
+import org.apache.jackrabbit.util.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import javax.jcr.AccessDeniedException;
 import javax.jcr.ItemNotFoundException;
+import javax.jcr.NodeIterator;
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
+import javax.jcr.query.Query;
+import javax.jcr.query.QueryManager;
+import javax.jcr.query.QueryResult;
 import javax.jcr.security.AccessControlEntry;
 import javax.jcr.security.AccessControlList;
 import javax.jcr.security.AccessControlManager;
@@ -54,6 +61,7 @@ import java.security.Principal;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.Iterator;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -133,10 +141,9 @@ public class ACLProvider extends Abstrac
     }
 
     /**
-     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(Path)
-     * @param absPath absolute path
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path,org.apache.jackrabbit.core.security.authorization.CompiledPermissions)
      */
-    public AccessControlPolicy[] getEffectivePolicies(Path absPath) throws ItemNotFoundException, RepositoryException {
+    public AccessControlPolicy[] getEffectivePolicies(Path absPath, CompiledPermissions permissions) throws ItemNotFoundException, RepositoryException {
         checkInitialized();
 
         NodeImpl targetNode = (NodeImpl) session.getNode(session.getJCRPath(absPath));
@@ -144,18 +151,69 @@ public class ACLProvider extends Abstrac
         List<AccessControlList> acls = new ArrayList<AccessControlList>();
 
         // collect all ACLs effective at node
-        collectAcls(node, acls);
+        collectAcls(node, permissions, acls);
         // if no effective ACLs are present -> add a default, empty acl.
         if (acls.isEmpty()) {
             // no access control information can be retrieved for the specified
             // node, since neither the node nor any of its parents is access
-            // controlled.
+            // controlled. TODO: there should be a default policy in this case (see JCR-2331)
             log.warn("No access controlled node present in item hierarchy starting from " + targetNode.getPath());
         }
         return acls.toArray(new AccessControlList[acls.size()]);
     }
 
     /**
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(java.util.Set, CompiledPermissions)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals, CompiledPermissions permissions) throws RepositoryException {
+        String propName = ISO9075.encode(session.getJCRName(P_PRINCIPAL_NAME));
+
+        StringBuilder stmt = new StringBuilder("/jcr:root");
+        stmt.append("//element(*,");
+        stmt.append(session.getJCRName(NT_REP_ACE));
+        stmt.append(")[");
+        int i = 0;
+        for (Principal principal : principals) {
+            if (i > 0) {
+                stmt.append(" or ");
+            }
+            stmt.append("@");
+            stmt.append(propName);
+            stmt.append("='");
+            stmt.append(principal.getName().replaceAll("'", "''"));
+            stmt.append("'");
+            i++;
+        }
+        stmt.append("]");
+        
+        QueryResult result;
+        try {
+            QueryManager qm = session.getWorkspace().getQueryManager();
+            Query q = qm.createQuery(stmt.toString(), Query.XPATH);
+            result = q.execute();
+        } catch (RepositoryException e) {
+            log.error("Unexpected error while searching effective policies.", e.getMessage());            
+            throw new UnsupportedOperationException("Retrieve effective policies for set of principals not supported.", e);
+        }
+
+        Set<AccessControlPolicy> acls = new LinkedHashSet<AccessControlPolicy>();
+        for (NodeIterator it = result.getNodes(); it.hasNext();) {
+            NodeImpl aclNode = (NodeImpl) it.nextNode().getParent();
+            NodeImpl accessControlledNode = (NodeImpl) aclNode.getParent();
+            
+            if (isAccessControlled(accessControlledNode)) {
+                if (permissions.canRead(aclNode.getPrimaryPath(), aclNode.getNodeId())) {
+                    acls.add(new UnmodifiableAccessControlList(entryCollector.getEntries(accessControlledNode), accessControlledNode.getPath(), Collections.<String, Integer>emptyMap()));
+                } else {
+                    throw new AccessDeniedException("Access denied at " + Text.getRelativeParent(aclNode.getPath(), 1));
+                }
+            }
+        }
+
+        return acls.toArray(new AccessControlPolicy[acls.size()]);
+    }
+
+    /**
      * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEditor(Session)
      */
     public AccessControlEditor getEditor(Session session) {
@@ -255,17 +313,21 @@ public class ACLProvider extends Abstrac
      * @param acls List used to collect the effective acls.
      * @throws RepositoryException if an error occurs
      */
-    private void collectAcls(NodeImpl node, List<AccessControlList> acls) throws RepositoryException {
+    private void collectAcls(NodeImpl node, CompiledPermissions permissions, List<AccessControlList> acls) throws RepositoryException {
         // if the given node is access-controlled, construct a new ACL and add
         // it to the list
         if (isAccessControlled(node)) {
-            // retrieve the entries for the access controlled node
-            acls.add(new UnmodifiableAccessControlList(entryCollector.getEntries(node), node.getPath(), Collections.<String, Integer>emptyMap()));
+            if (permissions.grants(node.getPrimaryPath(), Permission.READ_AC)) {
+                // retrieve the entries for the access controlled node
+                acls.add(new UnmodifiableAccessControlList(entryCollector.getEntries(node), node.getPath(), Collections.<String, Integer>emptyMap()));
+            } else {
+                throw new AccessDeniedException("Access denied at " + node.getPath());
+            }
         }
         // then, recursively look for access controlled parents up the hierarchy.
         if (!rootNodeId.equals(node.getId())) {
             NodeImpl parentNode = (NodeImpl) node.getParent();
-            collectAcls(parentNode, acls);
+            collectAcls(parentNode, permissions, acls);
         }
     }
 

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/combined/CombinedProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/combined/CombinedProvider.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/combined/CombinedProvider.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/combined/CombinedProvider.java Tue Jun 15 16:55:41 2010
@@ -117,13 +117,24 @@ public class CombinedProvider extends Ab
     }
 
     /**
-     * @see AccessControlProvider#getEffectivePolicies(Path)
+     * @see AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path,org.apache.jackrabbit.core.security.authorization.CompiledPermissions)
      */
-    public AccessControlPolicy[] getEffectivePolicies(Path absPath)
+    public AccessControlPolicy[] getEffectivePolicies(Path absPath, CompiledPermissions permissions)
             throws ItemNotFoundException, RepositoryException {
         List<AccessControlPolicy> l = new ArrayList<AccessControlPolicy>();
         for (AccessControlProvider provider : providers) {
-            l.addAll(Arrays.asList(provider.getEffectivePolicies(absPath)));
+            l.addAll(Arrays.asList(provider.getEffectivePolicies(absPath, permissions)));
+        }
+        return l.toArray(new AccessControlPolicy[l.size()]);
+    }
+
+    /**
+     * @see AccessControlProvider#getEffectivePolicies(java.util.Set, CompiledPermissions)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals, CompiledPermissions permissions) throws RepositoryException {
+        List<AccessControlPolicy> l = new ArrayList<AccessControlPolicy>();
+        for (AccessControlProvider provider : providers) {
+            l.addAll(Arrays.asList(provider.getEffectivePolicies(principals, permissions)));
         }
         return l.toArray(new AccessControlPolicy[l.size()]);
     }

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/principalbased/ACLProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/principalbased/ACLProvider.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/principalbased/ACLProvider.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/authorization/principalbased/ACLProvider.java Tue Jun 15 16:55:41 2010
@@ -32,26 +32,36 @@ import org.apache.jackrabbit.core.securi
 import org.apache.jackrabbit.core.security.authorization.CompiledPermissions;
 import org.apache.jackrabbit.core.security.authorization.Permission;
 import org.apache.jackrabbit.core.security.authorization.PrivilegeRegistry;
+import org.apache.jackrabbit.core.security.authorization.UnmodifiableAccessControlList;
 import org.apache.jackrabbit.spi.Path;
+import org.apache.jackrabbit.util.ISO9075;
 import org.apache.jackrabbit.util.Text;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import javax.jcr.AccessDeniedException;
 import javax.jcr.ItemNotFoundException;
+import javax.jcr.Node;
+import javax.jcr.NodeIterator;
 import javax.jcr.PropertyType;
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
 import javax.jcr.Value;
 import javax.jcr.ValueFactory;
+import javax.jcr.query.Query;
+import javax.jcr.query.QueryManager;
+import javax.jcr.query.QueryResult;
 import javax.jcr.security.AccessControlEntry;
 import javax.jcr.security.AccessControlException;
 import javax.jcr.security.AccessControlManager;
 import javax.jcr.security.AccessControlPolicy;
 import javax.jcr.security.Privilege;
 import java.security.Principal;
+import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -63,9 +73,6 @@ public class ACLProvider extends Abstrac
 
     private static Logger log = LoggerFactory.getLogger(ACLProvider.class);
 
-    // TODO: add means to show effective-policy to a user.
-    private static final AccessControlPolicy effectivePolicy = EffectivePrincipalBasedPolicy.getInstance();
-
     private NodeImpl acRoot;    
     private ACLEditor editor;
 
@@ -157,20 +164,89 @@ public class ACLProvider extends Abstrac
     }
 
     /**
-     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(Path)
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path,org.apache.jackrabbit.core.security.authorization.CompiledPermissions)
      */
-    public AccessControlPolicy[] getEffectivePolicies(Path absPath)
-            throws ItemNotFoundException, RepositoryException {
-        /*
-           since the per-node effect of the policies is defined by the
-           rep:nodePath restriction present with the individual access control
-           entries, returning the principal-based policy at 'absPath' (which for
-           most nodes in the repository isn't available anyway) doesn't
-           provide the desired information.
-           As tmp. solution some default policy is returned instead.
-           TODO: add proper evaluation and return a set of ACLs that take effect on the node at abs path
-        */
-        return new AccessControlPolicy[] {effectivePolicy};
+    public AccessControlPolicy[] getEffectivePolicies(Path absPath, CompiledPermissions permissions) throws ItemNotFoundException, RepositoryException {
+        String jcrPath = session.getJCRPath(absPath);
+        String pName = ISO9075.encode(session.getJCRName(ACLTemplate.P_NODE_PATH));
+        int ancestorCnt = absPath.getAncestorCount();
+
+        // search all ACEs whose rep:nodePath property equals the specified
+        // absPath or any of it's ancestors
+        StringBuilder stmt = new StringBuilder("/jcr:root");
+        stmt.append(acRoot.getPath());
+        stmt.append("//element(*,");
+        stmt.append(session.getJCRName(NT_REP_ACE));
+        stmt.append(")[");
+        for (int i = 0; i <= ancestorCnt; i++) {
+            String path = Text.getRelativeParent(jcrPath, i);
+            if (i > 0) {
+                stmt.append(" or ");
+            }
+            stmt.append("@");
+            stmt.append(pName);
+            stmt.append("='");
+            stmt.append(path.replaceAll("'", "''"));
+            stmt.append("'");
+        }
+        stmt.append("]");
+        
+        QueryResult result;
+        try {
+            QueryManager qm = session.getWorkspace().getQueryManager();
+            Query q = qm.createQuery(stmt.toString(), Query.XPATH);
+            result = q.execute();
+        } catch (RepositoryException e) {
+            log.error("Unexpected error while searching effective policies.", e.getMessage());
+            throw new UnsupportedOperationException("Retrieve effective policies at absPath '" +jcrPath+ "' not supported.", e);
+        }
+
+        /**
+         * Loop over query results and verify that
+         * - the corresponding ACE really takes effect on the specified absPath.
+         * - the corresponding ACL can be read by the editing session.
+         */
+        Set<AccessControlPolicy> acls = new LinkedHashSet<AccessControlPolicy>();
+        for (NodeIterator it = result.getNodes(); it.hasNext();) {
+            Node aceNode = it.nextNode();
+            String accessControlledNodePath = Text.getRelativeParent(aceNode.getPath(), 2);
+            Path acPath = session.getQPath(accessControlledNodePath);
+
+            AccessControlPolicy[] policies = editor.getPolicies(accessControlledNodePath);
+            if (policies.length > 0) {
+                ACLTemplate acl = (ACLTemplate) policies[0];
+                for (AccessControlEntry ace : acl.getAccessControlEntries()) {
+                    ACLTemplate.Entry entry = (ACLTemplate.Entry) ace;
+                    if (entry.matches(jcrPath)) {
+                        if (permissions.grants(acPath, Permission.READ_AC)) {
+                            acls.add(new UnmodifiableAccessControlList(acl));
+                            break;
+                        } else {
+                            throw new AccessDeniedException("Access denied at " + accessControlledNodePath);
+                        }
+                    }
+                }
+            }
+        }
+        return acls.toArray(new AccessControlPolicy[acls.size()]);
+    }
+
+    /**
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(java.util.Set, CompiledPermissions)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals, CompiledPermissions permissions) throws RepositoryException {
+        List<AccessControlPolicy> acls = new ArrayList<AccessControlPolicy>(principals.size());
+        for (Principal principal : principals) {
+            ACLTemplate acl = editor.getACL(principal);
+            if (acl != null) {
+                if (permissions.grants(session.getQPath(acl.getPath()), Permission.READ_AC)) {
+                    acls.add(new UnmodifiableAccessControlList(acl));
+                } else {
+                    throw new AccessDeniedException("Access denied at " + acl.getPath());
+                }
+            }
+        }
+        return acls.toArray(new AccessControlPolicy[acls.size()]);
     }
 
     /**
@@ -425,19 +501,4 @@ public class ACLProvider extends Abstrac
             }
         }
     }
-
-    //--------------------------------------------------------------------------
-    /**
-     * Dummy effective policy 
-     */
-    private static final class EffectivePrincipalBasedPolicy implements AccessControlPolicy {
-
-        private static EffectivePrincipalBasedPolicy INSTANCE = new EffectivePrincipalBasedPolicy();
-        private EffectivePrincipalBasedPolicy() {
-        }
-
-        private static EffectivePrincipalBasedPolicy getInstance() {
-            return INSTANCE;
-        }
-    }
 }

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/simple/SimpleAccessManager.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/simple/SimpleAccessManager.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/simple/SimpleAccessManager.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/simple/SimpleAccessManager.java Tue Jun 15 16:55:41 2010
@@ -16,6 +16,8 @@
  */
 package org.apache.jackrabbit.core.security.simple;
 
+import javax.jcr.UnsupportedRepositoryOperationException;
+import javax.jcr.security.AccessControlException;
 import javax.jcr.security.AccessControlPolicy;
 import javax.jcr.security.Privilege;
 import org.apache.jackrabbit.core.HierarchyManager;
@@ -299,6 +301,21 @@ public class SimpleAccessManager extends
     }
 
     /**
+     * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#getEffectivePolicies(Set)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals) throws AccessDeniedException, AccessControlException, UnsupportedRepositoryOperationException, RepositoryException {
+        checkInitialized();
+        /*
+         TOBEFIXED:
+         check permissions on the root node as a workaround to only expose
+         effective policies for principals that are allowed to see ac content.
+        */
+        checkPermission(resolver.getQPath("/"), Permission.READ_AC);
+
+        return new AccessControlPolicy[] {POLICY};
+    }
+
+    /**
      * @see org.apache.jackrabbit.api.security.JackrabbitAccessControlManager#hasPrivileges(String, Set, Privilege[])
      */
     public boolean hasPrivileges(String absPath, Set<Principal> principals, Privilege[] privileges) throws PathNotFoundException, RepositoryException {

Modified: jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/user/UserAccessControlProvider.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/user/UserAccessControlProvider.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/user/UserAccessControlProvider.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/main/java/org/apache/jackrabbit/core/security/user/UserAccessControlProvider.java Tue Jun 15 16:55:41 2010
@@ -163,9 +163,17 @@ public class UserAccessControlProvider e
     }
 
     /**
-     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(Path)
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(org.apache.jackrabbit.spi.Path,org.apache.jackrabbit.core.security.authorization.CompiledPermissions)
      */
-    public AccessControlPolicy[] getEffectivePolicies(Path absPath) throws ItemNotFoundException, RepositoryException {
+    public AccessControlPolicy[] getEffectivePolicies(Path absPath, CompiledPermissions permissions) throws ItemNotFoundException, RepositoryException {
+        checkInitialized();
+        return new AccessControlPolicy[] {policy};
+    }
+
+    /**
+     * @see org.apache.jackrabbit.core.security.authorization.AccessControlProvider#getEffectivePolicies(java.util.Set, CompiledPermissions)
+     */
+    public AccessControlPolicy[] getEffectivePolicies(Set<Principal> principals, CompiledPermissions permission) throws ItemNotFoundException, RepositoryException {
         checkInitialized();
         return new AccessControlPolicy[] {policy};
     }

Added: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java?rev=954964&view=auto
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java (added)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java Tue Jun 15 16:55:41 2010
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.core.security.authorization;
+
+import org.apache.jackrabbit.test.NotExecutableException;
+
+import javax.jcr.AccessDeniedException;
+import javax.jcr.Node;
+import javax.jcr.Property;
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
+import javax.jcr.security.AccessControlManager;
+import javax.jcr.security.Privilege;
+
+/**
+ * <code>AbstractEffectivePolicyTest</code>...
+ */
+public abstract class AbstractEffectivePolicyTest extends AbstractEvaluationTest {
+
+    protected String path;
+    protected String childNPath;
+    protected String childNPath2;
+    protected String siblingPath;
+
+    @Override
+    protected void setUp() throws Exception {
+        super.setUp();
+
+        // create some nodes below the test root in order to apply ac-stuff
+        Node node = testRootNode.addNode(nodeName1, testNodeType);
+        Node cn1 = node.addNode(nodeName2, testNodeType);
+        Property cp1 = node.setProperty(propertyName1, "anyValue");
+        Node cn2 = node.addNode(nodeName3, testNodeType);
+        Node n2 = testRootNode.addNode(nodeName2, testNodeType);
+        superuser.save();
+
+        path = node.getPath();
+        childNPath = cn1.getPath();
+        childNPath2 = cn2.getPath();
+        siblingPath = n2.getPath();
+    }
+}
\ No newline at end of file

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/AbstractEffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:keywords = Author Date Id Revision Rev URL

Added: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java?rev=954964&view=auto
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java (added)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java Tue Jun 15 16:55:41 2010
@@ -0,0 +1,136 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.core.security.authorization.acl;
+
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager;
+import org.apache.jackrabbit.core.SessionImpl;
+import org.apache.jackrabbit.core.security.authorization.AbstractEffectivePolicyTest;
+import org.apache.jackrabbit.test.NotExecutableException;
+
+import javax.jcr.AccessDeniedException;
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
+import javax.jcr.Value;
+import javax.jcr.security.AccessControlManager;
+import javax.jcr.security.Privilege;
+import java.security.Principal;
+import java.util.Collections;
+import java.util.Map;
+import java.util.Set;
+
+/**
+ * <code>EffectivePolicyTest</code>...
+ */
+public class EffectivePolicyTest extends AbstractEffectivePolicyTest {
+
+    @Override
+    protected boolean isExecutable() {
+        return EvaluationUtil.isExecutable(acMgr);
+    }
+
+    @Override
+    protected JackrabbitAccessControlList getPolicy(AccessControlManager acM, String path, Principal principal) throws RepositoryException, AccessDeniedException, NotExecutableException {
+        return EvaluationUtil.getPolicy(acM, path, principal);
+    }
+
+    @Override
+    protected Map<String, Value> getRestrictions(Session s, String path) {
+        return Collections.emptyMap();
+    }
+
+    public void testEffectivePoliciesByPath() throws RepositoryException, NotExecutableException {
+        /*
+         precondition:
+         testuser must have READ-only permission on test-node and below
+        */
+        checkReadOnly(path);
+
+        // give 'testUser' READ_AC privileges at 'path'
+        Privilege[] privileges = privilegesFromNames(new String[] {
+                Privilege.JCR_READ_ACCESS_CONTROL,
+        });
+
+        givePrivileges(path, privileges, getRestrictions(superuser, path));
+
+        Session testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+
+        assertFalse(testAcMgr.hasPrivileges("/", privileges));
+        assertTrue(testAcMgr.hasPrivileges(path, privileges));
+
+        // since read-ac access is denied on the root that by default is
+        // access controlled, getEffectivePolicies must fail due to missing
+        // permissions to view all the effective policies.
+        try {
+            testAcMgr.getEffectivePolicies(path);
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+
+        // ... and same on childNPath.
+        try {
+            testAcMgr.getEffectivePolicies(childNPath);
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+    
+    public void testGetEffectivePoliciesByPrincipal() throws Exception {
+        /*
+         precondition:
+         testuser must have READ-only permission on test-node and below
+        */
+        checkReadOnly(path);
+
+        // give 'testUser' READ_AC privileges at 'path'
+        Privilege[] privileges = privilegesFromNames(new String[] {
+                Privilege.JCR_READ_ACCESS_CONTROL,
+        });
+
+        givePrivileges(path, privileges, getRestrictions(superuser, path));
+
+        Session testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+
+        // effective policies for testPrinicpal only on path -> must succeed.
+        ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(Collections.singleton(testUser.getPrincipal()));
+
+        // effective policies for a combination of principals -> must fail since
+        // policy for 'everyone' at root node cannot be read by testuser
+        Set<Principal> principals = ((SessionImpl) testSession).getSubject().getPrincipals();
+        try {
+            ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(principals);
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+
+        withdrawPrivileges(childNPath, privileges, getRestrictions(superuser, childNPath));
+
+        // the effective policies included the allowed acl at 'path' and
+        // the denied acl at 'childNPath' -> must fail
+        try {
+            ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(Collections.singleton(testUser.getPrincipal()));
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+}
\ No newline at end of file

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/EffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:keywords = Author Date Id Revision Rev URL

Modified: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/TestAll.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/TestAll.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/TestAll.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/TestAll.java Tue Jun 15 16:55:41 2010
@@ -46,6 +46,7 @@ public class TestAll extends TestCase {
         suite.addTestSuite(LockTest.class);
         suite.addTestSuite(VersionTest.class);
         suite.addTestSuite(NodeTypeTest.class);
+        suite.addTestSuite(EffectivePolicyTest.class);
 
         return suite;
     }

Modified: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/WriteTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/WriteTest.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/WriteTest.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/acl/WriteTest.java Tue Jun 15 16:55:41 2010
@@ -96,8 +96,7 @@ public class WriteTest extends AbstractW
         // test if testuser can READ access control on the path and on the
         // entire subtree that gets the policy inherited.
         AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
-        testAcMgr.getEffectivePolicies(path);
-        testAcMgr.getEffectivePolicies(childNPath);
+        testAcMgr.getPolicies(childNPath);
 
         // test: READ_AC privilege does not apply outside of the tree.
         try {
@@ -243,7 +242,7 @@ public class WriteTest extends AbstractW
         withdrawPrivileges(childNPath, EveryonePrincipal.getInstance(), privileges, getRestrictions(superuser, path));
 
         // result at 'child path' must be deny
-        assertFalse(testAcMgr.hasPrivileges(childNPath, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));    
+        assertFalse(testAcMgr.hasPrivileges(childNPath, privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES)));
     }
 
     public void testInheritedGroupPermissions2() throws NotExecutableException, RepositoryException {
@@ -395,7 +394,7 @@ public class WriteTest extends AbstractW
             /* after reordering the permissions must be denied */
             assertFalse(getTestSession().hasPermission(path, actions));
             assertFalse(testAcMgr.hasPrivileges(path, privs));
-            
+
         } finally {
             group2.remove();
         }

Added: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java?rev=954964&view=auto
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java (added)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java Tue Jun 15 16:55:41 2010
@@ -0,0 +1,141 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.core.security.authorization.principalbased;
+
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager;
+import org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy;
+import org.apache.jackrabbit.core.SessionImpl;
+import org.apache.jackrabbit.core.security.authorization.AbstractEffectivePolicyTest;
+import org.apache.jackrabbit.test.NotExecutableException;
+
+import javax.jcr.AccessDeniedException;
+import javax.jcr.RepositoryException;
+import javax.jcr.Session;
+import javax.jcr.Value;
+import javax.jcr.security.AccessControlManager;
+import javax.jcr.security.AccessControlPolicy;
+import javax.jcr.security.Privilege;
+import java.security.Principal;
+import java.util.Collections;
+import java.util.Map;
+
+/**
+ * <code>EffectivePolicyTest</code>...
+ */
+public class EffectivePolicyTest extends AbstractEffectivePolicyTest {
+
+    @Override
+    protected boolean isExecutable() {
+        return EvaluationUtil.isExecutable((SessionImpl) superuser, acMgr);
+    }
+
+    @Override
+    protected JackrabbitAccessControlList getPolicy(AccessControlManager acM, String path, Principal principal) throws RepositoryException, AccessDeniedException, NotExecutableException {
+        return EvaluationUtil.getPolicy(acM, path, principal);
+    }
+
+    @Override
+    protected Map<String, Value> getRestrictions(Session s, String path) throws RepositoryException, NotExecutableException {
+        return EvaluationUtil.getRestrictions(s, path);
+    }
+
+    public void testGetEffectivePoliciesByPrincipal() throws Exception {
+        Privilege[] privileges = privilegesFromNames(new String[] {
+                Privilege.JCR_READ_ACCESS_CONTROL,
+        });
+
+        JackrabbitAccessControlManager jacMgr = (JackrabbitAccessControlManager) acMgr;
+
+        Principal everyone = ((SessionImpl) superuser).getPrincipalManager().getEveryone();
+        AccessControlPolicy[] acp = jacMgr.getEffectivePolicies(Collections.singleton(everyone));
+        assertNotNull(acp);
+        assertEquals(1, acp.length);
+        assertTrue(acp[0] instanceof JackrabbitAccessControlPolicy);
+
+        JackrabbitAccessControlPolicy jacp = (JackrabbitAccessControlPolicy) acp[0];
+
+        assertFalse(jacMgr.hasPrivileges(jacp.getPath(), Collections.singleton(testUser.getPrincipal()), privileges));
+        assertFalse(jacMgr.hasPrivileges(jacp.getPath(), Collections.singleton(everyone), privileges));
+
+
+        acp = jacMgr.getApplicablePolicies(testUser.getPrincipal());
+        if (acp.length == 0) {
+            acp = jacMgr.getPolicies(testUser.getPrincipal());
+        }
+
+        assertNotNull(acp);
+        assertEquals(1, acp.length);
+        assertTrue(acp[0] instanceof JackrabbitAccessControlList);
+
+        // let testuser read the ACL defined for 'testUser' principal.
+        JackrabbitAccessControlList acl = (JackrabbitAccessControlList) acp[0];
+        acl.addEntry(testUser.getPrincipal(), privileges, true, getRestrictions(superuser, acl.getPath()));
+        jacMgr.setPolicy(acl.getPath(), acl);
+        superuser.save();
+
+        Session testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+
+        // effective policies for testPrinicpal only on path -> must succeed.
+        ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(Collections.singleton(testUser.getPrincipal()));
+
+        // effective policies for a combination of principals -> must fail
+        try {
+            ((JackrabbitAccessControlManager) testAcMgr).getEffectivePolicies(((SessionImpl) testSession).getSubject().getPrincipals());
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+
+    public void testEffectivePoliciesByPath() throws RepositoryException, NotExecutableException {
+        /*
+         precondition:
+         testuser must have READ-only permission on test-node and below
+        */
+        checkReadOnly(path);
+
+        // give 'testUser' READ_AC privileges at 'path'
+        Privilege[] privileges = privilegesFromNames(new String[] {
+                Privilege.JCR_READ_ACCESS_CONTROL,
+        });
+
+        givePrivileges(path, privileges, getRestrictions(superuser, path));
+
+        Session testSession = getTestSession();
+        AccessControlManager testAcMgr = getTestACManager();
+
+        assertTrue(testAcMgr.hasPrivileges(path, privileges));
+
+        // reading the policies stored at 'path' must succeed.
+        // however, principalbased-ac stores ac information in a separate tree.
+        // no policy must be present at 'path'.
+        AccessControlPolicy[] policies = testAcMgr.getPolicies(path);
+        assertNotNull(policies);
+        assertEquals(0, policies.length);
+
+        // since read-ac access denied on the acl storing node itself obtaining
+        // the effective policy for 'path' must fail.
+        try {
+            testAcMgr.getEffectivePolicies(path);
+            fail();
+        } catch (AccessDeniedException e) {
+            // success
+        }
+    }
+}
\ No newline at end of file

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:eol-style = native

Propchange: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/EffectivePolicyTest.java
------------------------------------------------------------------------------
    svn:keywords = Author Date Id Revision Rev URL

Modified: jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/TestAll.java
URL: http://svn.apache.org/viewvc/jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/TestAll.java?rev=954964&r1=954963&r2=954964&view=diff
==============================================================================
--- jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/TestAll.java (original)
+++ jackrabbit/trunk/jackrabbit-core/src/test/java/org/apache/jackrabbit/core/security/authorization/principalbased/TestAll.java Tue Jun 15 16:55:41 2010
@@ -43,6 +43,7 @@ public class TestAll extends TestCase {
         suite.addTestSuite(LockTest.class);
         suite.addTestSuite(VersionTest.class);
         suite.addTestSuite(NodeTypeTest.class);
+        suite.addTestSuite(EffectivePolicyTest.class);
 
         return suite;
     }



Mime
View raw message