[exo-jcr-commits] exo-jcr SVN: r3782 - in jcr/branches/1.12.x/exo.jcr.component.core/src: main/java/org/exoplatform/services/jcr/impl/core/version and 2 other directories.

Author: tolusha Date: 2011-01-10 02:39:07 -0500 (Mon, 10 Jan 2011) New Revision: 3782 Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/access/AccessControlEntry.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/FrozenNodeInitializer.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/ItemDataRestoreVisitor.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/VersionHistoryImpl.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/DefaultItemDataCopyVisitor.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/ItemDataMoveVisitor.java jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/TransientNodeData.java jcr/branches/1.12.x/exo.jcr.component.core/src/test/java/org/exoplatform/services/jcr/impl/access/TestPermissions.java Log: JCR-1567: Code review of ACL managment in case of copy/moving nodes Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/access/AccessControlEntry.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/access/AccessControlEntry.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/access/AccessControlEntry.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -37,6 +37,10 @@ public static final String DELIMITER = " "; + private Integer hashcode = null; + + private String asString = null; + public AccessControlEntry(String identity, String permission) { this.identity = identity; @@ -70,9 +74,26 @@ public String getAsString() { - return identity + AccessControlEntry.DELIMITER + permission; + if (asString == null) + { + asString = identity + AccessControlEntry.DELIMITER + permission; + } + + return asString; } + @Override + public int hashCode() + { + if (hashcode == null) + { + hashcode = getAsString().hashCode(); + } + + return hashcode; + } + + @Override public boolean equals(Object obj) { if (obj == this) Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/FrozenNodeInitializer.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/FrozenNodeInitializer.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/FrozenNodeInitializer.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -18,6 +18,7 @@ */ package org.exoplatform.services.jcr.impl.core.version; +import org.exoplatform.services.jcr.access.AccessControlEntry; import org.exoplatform.services.jcr.access.AccessControlList; import org.exoplatform.services.jcr.core.nodetype.NodeDefinitionData; import org.exoplatform.services.jcr.core.nodetype.NodeTypeDataManager; @@ -42,6 +43,7 @@ import org.exoplatform.services.log.ExoLogger; import org.exoplatform.services.log.Log; +import java.util.ArrayList; import java.util.List; import java.util.Stack; @@ -75,9 +77,7 @@ private final ValueFactory valueFactory; public FrozenNodeInitializer(NodeData frozen, SessionDataManager dataManager, NodeTypeDataManager ntManager, - PlainChangesLog changesLog, ValueFactory valueFactory - - ) throws RepositoryException + PlainChangesLog changesLog, ValueFactory valueFactory) throws RepositoryException { super(dataManager); this.dataManager = dataManager; @@ -250,15 +250,29 @@ } else if (action == OnParentVersionAction.COPY) { - AccessControlList acl = - ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()) - ? node.getACL() : currentNode().getACL(); + AccessControlList acl = currentNode().getACL(); + boolean isPrivilegeable = + ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + boolean isOwneable = + ntManager.isNodeType(Constants.EXO_OWNEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + if (isPrivilegeable || isOwneable) + { + List<AccessControlEntry> permissionEntries = new ArrayList<AccessControlEntry>(); + permissionEntries.addAll((isPrivilegeable ? node.getACL() : currentNode().getACL()).getPermissionEntries()); + + String owner = isOwneable ? node.getACL().getOwner() : currentNode().getACL().getOwner(); + + acl = new AccessControlList(owner, permissionEntries); + } + QPath frozenPath = QPath.makeChildPath(currentNode().getQPath(), qname, node.getQPath().getIndex()); frozenNode = - new TransientNodeData(frozenPath, IdGenerator.generate(), node.getPersistedVersion(), node - .getPrimaryTypeName(), node.getMixinTypeNames(), node.getOrderNumber(), currentNode().getIdentifier(), // parent - acl); + new TransientNodeData(frozenPath, IdGenerator.generate(), node.getPersistedVersion(), + node.getPrimaryTypeName(), node.getMixinTypeNames(), node.getOrderNumber(), currentNode() + .getIdentifier(), acl); contextNodes.push(frozenNode); changesLog.add(ItemState.createAddedState(frozenNode)); @@ -290,16 +304,30 @@ } else { // behaviour of COPY - AccessControlList acl = - ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()) - ? node.getACL() : currentNode().getACL(); + AccessControlList acl = currentNode().getACL(); + boolean isPrivilegeable = + ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + boolean isOwneable = + ntManager.isNodeType(Constants.EXO_OWNEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + if (isPrivilegeable || isOwneable) + { + List<AccessControlEntry> accessList = new ArrayList<AccessControlEntry>(); + accessList.addAll((isPrivilegeable ? node.getACL() : currentNode().getACL()) + .getPermissionEntries()); + + String owner = isOwneable ? node.getACL().getOwner() : currentNode().getACL().getOwner(); + + acl = new AccessControlList(owner, accessList); + } + QPath frozenPath = QPath.makeChildPath(currentNode().getQPath(), qname, node.getQPath().getIndex()); frozenNode = - new TransientNodeData(frozenPath, IdGenerator.generate(), node.getPersistedVersion(), node - .getPrimaryTypeName(), node.getMixinTypeNames(), node.getOrderNumber(), - currentNode().getIdentifier(), // parent - acl); + new TransientNodeData(frozenPath, IdGenerator.generate(), node.getPersistedVersion(), + node.getPrimaryTypeName(), node.getMixinTypeNames(), node.getOrderNumber(), currentNode() + .getIdentifier(), acl); contextNodes.push(frozenNode); changesLog.add(ItemState.createAddedState(frozenNode)); @@ -325,7 +353,7 @@ // On checkin of N, a new node C will be created and placed in version // storage as a child of VN. This new C will be initialized by some // procedure defined for that type of child node. - // [PN] 10.04.06 Creatimg simply an new node with same name and same node + // [PN] 10.04.06 Creating simply as new node with same name and same node // type frozenNode = TransientNodeData.createNodeData(currentNode(), qname, node.getPrimaryTypeName(), node.getQPath() Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/ItemDataRestoreVisitor.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/ItemDataRestoreVisitor.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/ItemDataRestoreVisitor.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -323,10 +323,12 @@ (PropertyData)dataManager.getItemData(frozen, new QPathEntry(Constants.JCR_FROZENMIXINTYPES, 0), ItemType.PROPERTY); - AccessControlList acl = parentData.getACL(); + List<AccessControlEntry> accessList = + new ArrayList<AccessControlEntry>(parentData.getACL().getPermissionEntries()); + + String owner = parentData.getACL().getOwner(); + InternalQName[] mixins = null; - String owner = null; - if (frozenMixinTypes != null) { try @@ -344,13 +346,15 @@ (PropertyData)dataManager.getItemData(frozen, new QPathEntry(Constants.EXO_PERMISSIONS, 0), ItemType.PROPERTY); - acl = new AccessControlList(); + AccessControlList acl = new AccessControlList(); acl.removePermissions(SystemIdentity.ANY); for (ValueData value : aclData.getValues()) { acl.addPermissions(new String(value.getAsByteArray(), Constants.DEFAULT_ENCODING)); } + + accessList = acl.getPermissionEntries(); } else if (mixins[i].equals(Constants.EXO_OWNEABLE)) { @@ -379,8 +383,7 @@ } } - // set new owner if exists - acl.setOwner(owner != null ? owner : parentData.getACL().getOwner()); + AccessControlList acl = new AccessControlList(owner, accessList); InternalQName ptName = null; try @@ -621,6 +624,8 @@ } } + AccessControlList acl = currentNode().getACL(); + boolean isPrivilegeable = nodeTypeDataManager.isNodeType(Constants.EXO_PRIVILEGEABLE, frozen.getPrimaryTypeName(), frozen.getMixinTypeNames()); @@ -629,19 +634,15 @@ nodeTypeDataManager.isNodeType(Constants.EXO_OWNEABLE, frozen.getPrimaryTypeName(), frozen.getMixinTypeNames()); - AccessControlList acl = currentNode().getACL(); if (isPrivilegeable || isOwneable) { - acl = new AccessControlList(); - acl.removePermissions(SystemIdentity.ANY); + List<AccessControlEntry> permissionEntries = new ArrayList<AccessControlEntry>(); + permissionEntries.addAll((isPrivilegeable ? frozen.getACL() : currentNode().getACL()) + .getPermissionEntries()); - for (AccessControlEntry entry : (isPrivilegeable ? frozen.getACL() : currentNode().getACL()) - .getPermissionEntries()) - { - acl.addPermissions(entry.getIdentity(), new String[]{entry.getPermission()}); - } + String owner = isOwneable ? frozen.getACL().getOwner() : currentNode().getACL().getOwner(); - acl.setOwner(isOwneable ? frozen.getACL().getOwner() : currentNode().getACL().getOwner()); + acl = new AccessControlList(owner, permissionEntries); } NodeData restoredData = Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/VersionHistoryImpl.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/VersionHistoryImpl.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/core/version/VersionHistoryImpl.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -18,6 +18,10 @@ */ package org.exoplatform.services.jcr.impl.core.version; +import org.exoplatform.services.jcr.access.AccessControlEntry; +import org.exoplatform.services.jcr.access.AccessControlList; +import org.exoplatform.services.jcr.core.ExtendedPropertyType; +import org.exoplatform.services.jcr.core.nodetype.NodeTypeDataManager; import org.exoplatform.services.jcr.dataflow.ItemState; import org.exoplatform.services.jcr.dataflow.PlainChangesLog; import org.exoplatform.services.jcr.dataflow.PlainChangesLogImpl; @@ -43,7 +47,9 @@ import java.io.IOException; import java.util.ArrayList; +import java.util.HashSet; import java.util.List; +import java.util.Set; import javax.jcr.AccessDeniedException; import javax.jcr.InvalidItemStateException; @@ -95,6 +101,7 @@ /** * {@inheritDoc} */ + @Override public VersionHistoryDataHelper getData() { return (VersionHistoryDataHelper)super.getData(); @@ -539,10 +546,45 @@ public void addVersion(NodeData versionableNodeData, String uuid, SessionChangesLog changesLog) throws RepositoryException { + checkValid(); + + NodeTypeDataManager ntManager = session.getWorkspace().getNodeTypesHolder(); + + boolean isPrivilegeable = + ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, versionableNodeData.getPrimaryTypeName(), + versionableNodeData.getMixinTypeNames()); + + boolean isOwneable = + ntManager.isNodeType(Constants.EXO_OWNEABLE, versionableNodeData.getPrimaryTypeName(), + versionableNodeData.getMixinTypeNames()); + + List<InternalQName> mixinsList = new ArrayList<InternalQName>(); + mixinsList.add(Constants.MIX_REFERENCEABLE); + + Set<AccessControlEntry> accessList = new HashSet<AccessControlEntry>(); + accessList.addAll(nodeData().getACL().getPermissionEntries()); + + String owner = nodeData().getACL().getOwner(); + + if (isPrivilegeable) + { + accessList.addAll(versionableNodeData.getACL().getPermissionEntries()); + mixinsList.add(Constants.EXO_PRIVILEGEABLE); + } + + if (isOwneable) + { + owner = versionableNodeData.getACL().getOwner(); + mixinsList.add(Constants.EXO_OWNEABLE); + } + + AccessControlList acl = new AccessControlList(owner, new ArrayList<AccessControlEntry>(accessList)); + InternalQName[] mixins = mixinsList.toArray(new InternalQName[mixinsList.size()]); + // nt:version NodeData versionData = TransientNodeData.createNodeData(nodeData(), new InternalQName(null, nextVersionName()), Constants.NT_VERSION, - uuid); + mixins, uuid, acl); changesLog.add(ItemState.createAddedState(versionData)); // jcr:primaryType @@ -552,11 +594,40 @@ changesLog.add(ItemState.createAddedState(propData)); // jcr:mixinTypes - propData = + List<ValueData> mixValues = new ArrayList<ValueData>(); + for (InternalQName mixin : mixins) + { + mixValues.add(new TransientValueData(mixin)); + } + TransientPropertyData exoMixinTypes = TransientPropertyData.createPropertyData(versionData, Constants.JCR_MIXINTYPES, PropertyType.NAME, true, - new TransientValueData(Constants.MIX_REFERENCEABLE)); - changesLog.add(ItemState.createAddedState(propData)); + mixValues); + changesLog.add(ItemState.createAddedState(exoMixinTypes)); + // exo:owner + if (isOwneable) + { + TransientPropertyData exoOwner = + TransientPropertyData.createPropertyData(versionData, Constants.EXO_OWNER, PropertyType.STRING, false, + new TransientValueData(acl.getOwner())); + changesLog.add(ItemState.createAddedState(exoOwner)); + } + + // exo:permissions + if (isPrivilegeable) + { + List<ValueData> permsValues = new ArrayList<ValueData>(); + for (AccessControlEntry entry : acl.getPermissionEntries()) + { + permsValues.add(new TransientValueData(entry)); + } + + TransientPropertyData exoPerms = + TransientPropertyData.createPropertyData(versionData, Constants.EXO_PERMISSIONS, + ExtendedPropertyType.PERMISSION, true, permsValues); + changesLog.add(ItemState.createAddedState(exoPerms)); + } + // jcr:uuid propData = TransientPropertyData.createPropertyData(versionData, Constants.JCR_UUID, PropertyType.STRING, false, Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/DefaultItemDataCopyVisitor.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/DefaultItemDataCopyVisitor.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/DefaultItemDataCopyVisitor.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -18,6 +18,8 @@ */ package org.exoplatform.services.jcr.impl.dataflow; +import org.exoplatform.services.jcr.access.AccessControlEntry; +import org.exoplatform.services.jcr.access.AccessControlList; import org.exoplatform.services.jcr.core.nodetype.NodeTypeDataManager; import org.exoplatform.services.jcr.dataflow.ItemState; import org.exoplatform.services.jcr.datamodel.InternalQName; @@ -163,9 +165,27 @@ String id = keepIdentifiers ? node.getIdentifier() : IdGenerator.generate(); + AccessControlList acl = parent.getACL(); + + boolean isPrivilegeable = + ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + boolean isOwneable = + ntManager.isNodeType(Constants.EXO_OWNEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + if (isPrivilegeable || isOwneable) + { + List<AccessControlEntry> permissionEntries = new ArrayList<AccessControlEntry>(); + permissionEntries.addAll((isPrivilegeable ? node.getACL() : parent.getACL()).getPermissionEntries()); + + String owner = isOwneable ? node.getACL().getOwner() : parent.getACL().getOwner(); + + acl = new AccessControlList(owner, permissionEntries); + } + TransientNodeData newNode = - new TransientNodeData(qpath, id, -1, node.getPrimaryTypeName(), node.getMixinTypeNames(), orderNum, parent - .getIdentifier(), node.getACL()); + new TransientNodeData(qpath, id, -1, node.getPrimaryTypeName(), node.getMixinTypeNames(), orderNum, + parent.getIdentifier(), acl); parents.push(newNode); Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/ItemDataMoveVisitor.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/ItemDataMoveVisitor.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/ItemDataMoveVisitor.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -18,6 +18,8 @@ */ package org.exoplatform.services.jcr.impl.dataflow; +import org.exoplatform.services.jcr.access.AccessControlEntry; +import org.exoplatform.services.jcr.access.AccessControlList; import org.exoplatform.services.jcr.core.nodetype.NodeTypeDataManager; import org.exoplatform.services.jcr.dataflow.ItemDataTraversingVisitor; import org.exoplatform.services.jcr.dataflow.ItemState; @@ -200,9 +202,27 @@ QPath qpath = QPath.makeChildPath(parent.getQPath(), qname, destIndex); + AccessControlList acl = parent.getACL(); + + boolean isPrivilegeable = + ntManager.isNodeType(Constants.EXO_PRIVILEGEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + boolean isOwneable = + ntManager.isNodeType(Constants.EXO_OWNEABLE, node.getPrimaryTypeName(), node.getMixinTypeNames()); + + if (isPrivilegeable || isOwneable) + { + List<AccessControlEntry> permissionEntries = new ArrayList<AccessControlEntry>(); + permissionEntries.addAll((isPrivilegeable ? node.getACL() : parent.getACL()).getPermissionEntries()); + + String owner = isOwneable ? node.getACL().getOwner() : parent.getACL().getOwner(); + + acl = new AccessControlList(owner, permissionEntries); + } + TransientNodeData newNode = - new TransientNodeData(qpath, id, -1, node.getPrimaryTypeName(), node.getMixinTypeNames(), destOrderNum, parent - .getIdentifier(), node.getACL()); + new TransientNodeData(qpath, id, -1, node.getPrimaryTypeName(), node.getMixinTypeNames(), destOrderNum, + parent.getIdentifier(), acl); parents.push(newNode); Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/TransientNodeData.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/TransientNodeData.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/main/java/org/exoplatform/services/jcr/impl/dataflow/TransientNodeData.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -260,6 +260,27 @@ return nodeData; } + /** + * Factory method + * + * @param parent NodeData + * @param name InternalQName + * @param primaryTypeName InternalQName + * @param mixinTypesName InternalQName[] + * @param identifier String + * @param acl AccessControlList + * @return + */ + public static TransientNodeData createNodeData(NodeData parent, InternalQName name, InternalQName primaryTypeName, + InternalQName[] mixinTypesName, String identifier, AccessControlList acl) + { + TransientNodeData nodeData = null; + QPath path = QPath.makeChildPath(parent.getQPath(), name); + nodeData = + new TransientNodeData(path, identifier, -1, primaryTypeName, mixinTypesName, 0, parent.getIdentifier(), acl); + return nodeData; + } + // ------------- Comparable ///// public int compareTo(Object obj) Modified: jcr/branches/1.12.x/exo.jcr.component.core/src/test/java/org/exoplatform/services/jcr/impl/access/TestPermissions.java =================================================================== --- jcr/branches/1.12.x/exo.jcr.component.core/src/test/java/org/exoplatform/services/jcr/impl/access/TestPermissions.java 2011-01-06 13:49:47 UTC (rev 3781) +++ jcr/branches/1.12.x/exo.jcr.component.core/src/test/java/org/exoplatform/services/jcr/impl/access/TestPermissions.java 2011-01-10 07:39:07 UTC (rev 3782) @@ -25,11 +25,18 @@ import org.exoplatform.services.jcr.datamodel.NodeData; import org.exoplatform.services.jcr.impl.core.NodeImpl; import org.exoplatform.services.jcr.impl.core.SessionImpl; +import org.exoplatform.services.jcr.impl.core.version.VersionHistoryImpl; +import org.exoplatform.services.jcr.impl.core.version.VersionImpl; +import java.util.ArrayList; +import java.util.List; + import javax.jcr.AccessDeniedException; import javax.jcr.Credentials; import javax.jcr.Node; +import javax.jcr.NodeIterator; import javax.jcr.Repository; +import javax.jcr.Session; import javax.jcr.version.Version; /** @@ -91,22 +98,47 @@ @Override public void tearDown() throws Exception { - if (sessionWS1.getRootNode().hasNode("MARY-ReadOnly")) - { - sessionWS1.getRootNode().getNode("MARY-ReadOnly").remove(); - } + List<SessionImpl> sessions = new ArrayList<SessionImpl>(); - if (sessionWS1.getRootNode().hasNode("MARY-ReadWrite")) + sessions.add(sessionMaryWS); + sessions.add(sessionMaryWS1); + sessions.add(sessionWS); + sessions.add(sessionWS1); + + for (SessionImpl session : sessions) { - sessionWS1.getRootNode().getNode("MARY-ReadWrite").remove(); + if (session != null) + { + Session sysSession = repository.getSystemSession(session.getWorkspace().getName()); + try + { + Node rootNode = sysSession.getRootNode(); + if (rootNode.hasNodes()) + { + // clean test root + for (NodeIterator children = rootNode.getNodes(); children.hasNext();) + { + Node node = children.nextNode(); + if (!node.getPath().startsWith("/jcr:system")) + { + node.remove(); + } + } + sysSession.save(); + } + } + catch (Exception e) + { + log.error("tearDown() ERROR " + getClass().getName() + "." + getName() + " " + e, e); + } + finally + { + sysSession.logout(); + session.logout(); + } + } } - sessionWS1.save(); - sessionMaryWS.logout(); - sessionMaryWS1.logout(); - sessionWS.logout(); - sessionWS1.logout(); - super.tearDown(); } @@ -268,29 +300,58 @@ sessionWS1.save(); node.addMixin("exo:privilegeable"); node.getSession().save(); + node.setPermission("admin", new String[]{"read", "add_node", "set_property", "remove"}); node.removePermission(SystemIdentity.ANY); NodeImpl subNode = (NodeImpl)node.addNode("subNode"); node.getSession().save(); + node.checkin(); node.setPermission(SystemIdentity.ANY, new String[]{"read"}); node.getSession().save(); - SessionImpl sessionJohnWS1 = null; + Credentials credentials = new CredentialsImpl("john", "exo".toCharArray()); + SessionImpl sessionJohnWS1 = (SessionImpl)repositoryService.getRepository("db2").login(credentials, "ws1"); + + Credentials anonCredentials = new CredentialsImpl(SystemIdentity.ANONIM, "".toCharArray()); + SessionImpl anonSession = (SessionImpl)repositoryService.getRepository("db2").login(anonCredentials, "ws1"); try { - Credentials credentials = new CredentialsImpl("john", "exo".toCharArray()); - sessionJohnWS1 = (SessionImpl)repositoryService.getRepository("db2").login(credentials, "ws1"); - Node vNode = sessionJohnWS1.getRootNode().getNode("testAccessPermission"); + + NodeImpl vNode = (NodeImpl)sessionJohnWS1.getRootNode().getNode("testAccessPermission"); assertNotNull(vNode); - vNode = vNode.getVersionHistory().getVersion("1"); + VersionHistoryImpl vHist = (VersionHistoryImpl)vNode.getVersionHistory(); + assertEquals(vHist.getACL().getPermissions("admin").size(), 0); + assertEquals(vHist.getACL().getPermissions("any").size(), 1); // there is a workaround in ScratchWorkspaceInitializer + + vNode = (NodeImpl)vHist.getVersion("1"); + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); // there is a workaround in ScratchWorkspaceInitializer + assertNotNull(vNode); - vNode = vNode.getNode("jcr:frozenNode"); + vNode = (NodeImpl)vNode.getNode("jcr:frozenNode"); assertNotNull(vNode); assertNotNull(vNode.getNode("subNode")); + + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); // there is a workaround in ScratchWorkspaceInitializer + + // try + // { + // anonSession.getNodeByUUID(vNode.getUUID()); + // fail("Anonim shoul not have permission to node"); + // } + // catch (Exception e) + // { + // } } finally { + if (anonSession != null) + { + anonSession.logout(); + } + if (sessionJohnWS1 != null) { sessionJohnWS1.logout(); @@ -298,6 +359,210 @@ } } + public void testAccessPermissionForAny() throws Exception + { + // At creation time + NodeImpl node = (NodeImpl)sessionWS1.getRootNode().addNode("testAccessPermissionAny"); + node.addMixin("mix:versionable"); + sessionWS1.save(); + node.addMixin("exo:privilegeable"); + node.getSession().save(); + + node.clearACL(); + node.setPermission("admin", new String[]{"read", "add_node", "set_property", "remove"}); + node.setPermission(SystemIdentity.ANY, new String[]{"read"}); + + NodeImpl subNode = (NodeImpl)node.addNode("subNode"); + node.getSession().save(); + + Version version = node.checkin(); + + Credentials credentials = new CredentialsImpl("john", "exo".toCharArray()); + SessionImpl sessionJohnWS1 = (SessionImpl)repositoryService.getRepository("db2").login(credentials, "ws1"); + + Credentials anonCredentials = new CredentialsImpl(SystemIdentity.ANONIM, "".toCharArray()); + SessionImpl anonSession = (SessionImpl)repositoryService.getRepository("db2").login(anonCredentials, "ws1"); + try + { + NodeImpl vNode = (NodeImpl)sessionJohnWS1.getRootNode().getNode("testAccessPermissionAny"); + assertNotNull(vNode); + VersionHistoryImpl vHist = (VersionHistoryImpl)vNode.getVersionHistory(); + assertEquals(vHist.getACL().getPermissions("admin").size(), 0); + assertEquals(vHist.getACL().getPermissions("any").size(), 1); // there is a workaround in ScratchWorkspaceInitializer + + vNode = (NodeImpl)vHist.getVersion("1"); + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); + + assertNotNull(vNode); + vNode = (NodeImpl)vNode.getNode("jcr:frozenNode"); + assertNotNull(vNode); + assertNotNull(vNode.getNode("subNode")); + + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); + + vNode = (NodeImpl)anonSession.getRootNode().getNode("testAccessPermissionAny"); + assertNotNull(vNode); + vHist = (VersionHistoryImpl)vNode.getVersionHistory(); + assertEquals(vHist.getACL().getPermissions("admin").size(), 0); + assertEquals(vHist.getACL().getPermissions("any").size(), 1); // there is a workaround in ScratchWorkspaceInitializer + + vNode = (NodeImpl)vHist.getVersion("1"); + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); + + assertNotNull(vNode); + vNode = (NodeImpl)vNode.getNode("jcr:frozenNode"); + assertNotNull(vNode); + assertNotNull(vNode.getNode("subNode")); + + assertEquals(vNode.getACL().getPermissions("admin").size(), 4); + assertEquals(vNode.getACL().getPermissions("any").size(), 1); + + vNode = (NodeImpl)anonSession.getNodeByUUID(vNode.getUUID()); + assertNotNull(vNode); + assertNotNull(vNode.getNode("subNode")); + } + finally + { + if (anonSession != null) + { + anonSession.logout(); + } + + if (sessionJohnWS1 != null) + { + sessionJohnWS1.logout(); + } + } + } + + public void testAccessPermissionDuringMove1() throws Exception + { + NodeImpl node = (NodeImpl)sessionWS1.getRootNode().addNode("srcNode"); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 0); + assertEquals(node.getACL().getOwner(), SystemIdentity.SYSTEM); + + // destination node has its own permissions and owner + node = (NodeImpl)sessionWS1.getRootNode().addNode("dstNode"); + node.addMixin("exo:privilegeable"); + node.addMixin("exo:owneable"); + node.setPermission("mary", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getOwner(), "admin"); + + // move node to new destination with new ACL + sessionWS1.move("/srcNode", "/dstNode/newSrc"); + sessionWS1.save(); + + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + + // acl should be changed + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getOwner(), "admin"); + } + + public void testAccessPermissionDuringMove2() throws Exception + { + NodeImpl node = (NodeImpl)sessionWS1.getRootNode().addNode("srcNode"); + node.addMixin("exo:privilegeable"); + node.addMixin("exo:owneable"); + node.setPermission("mary", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getPermissions("admin").size(), 0); + assertEquals(node.getACL().getOwner(), "admin"); + + node = (NodeImpl)sessionWS1.getRootNode().addNode("dstNode"); + node.addMixin("exo:privilegeable"); + node.setPermission("admin", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("admin").size(), 4); + assertEquals(node.getACL().getOwner(), SystemIdentity.SYSTEM); + + // move node to new destination with new ACL + sessionWS1.move("/srcNode", "/dstNode/newSrc"); + sessionWS1.save(); + + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + + // acl should not be changed + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getPermissions("admin").size(), 0); + assertEquals(node.getACL().getOwner(), "admin"); + } + + public void testAccessPermissionDuringCopy1() throws Exception + { + NodeImpl node = (NodeImpl)sessionWS1.getRootNode().addNode("srcNode"); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 0); + assertEquals(node.getACL().getOwner(), SystemIdentity.SYSTEM); + + // destination node has its own permissions and owner + node = (NodeImpl)sessionWS1.getRootNode().addNode("dstNode"); + node.addMixin("exo:privilegeable"); + node.addMixin("exo:owneable"); + node.setPermission("mary", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getOwner(), "admin"); + + // move node to new destination with new ACL + sessionWS1.getWorkspace().copy("/srcNode", "/dstNode/newSrc"); + + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + + // acl should be changed + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getOwner(), "admin"); + } + + public void testAccessPermissionDuringCopy2() throws Exception + { + NodeImpl node = (NodeImpl)sessionWS1.getRootNode().addNode("srcNode"); + node.addMixin("exo:privilegeable"); + node.addMixin("exo:owneable"); + node.setPermission("mary", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getPermissions("admin").size(), 0); + assertEquals(node.getACL().getOwner(), "admin"); + + node = (NodeImpl)sessionWS1.getRootNode().addNode("dstNode"); + node.addMixin("exo:privilegeable"); + node.setPermission("admin", new String[]{"read", "add_node", "set_property", "remove"}); + sessionWS1.save(); + + assertEquals(node.getACL().getPermissions("admin").size(), 4); + assertEquals(node.getACL().getOwner(), SystemIdentity.SYSTEM); + + // move node to new destination with new ACL + sessionWS1.getWorkspace().copy("/srcNode", "/dstNode/newSrc"); + sessionWS1.save(); + + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + + // acl should not be changed + node = (NodeImpl)sessionWS1.getRootNode().getNode("dstNode/newSrc"); + assertEquals(node.getACL().getPermissions("mary").size(), 4); + assertEquals(node.getACL().getPermissions("admin").size(), 0); + assertEquals(node.getACL().getOwner(), "admin"); + } + /** * Test restore of exo:privilegeable. */ @@ -399,9 +664,46 @@ } // v1 - node.checkin(); + VersionImpl version = (VersionImpl)node.checkin(); node.checkout(); + // check frozen node and its children nodes + NodeImpl frozenNode = + (NodeImpl)sessionMaryWS1.getRootNode().getNode(TESTNODE_NAME).getVersionHistory().getVersion("1") + .getNode("jcr:frozenNode"); + + assertTrue(frozenNode.hasPermission(PermissionType.READ)); + assertTrue(frozenNode.hasPermission(PermissionType.SET_PROPERTY)); + assertTrue(frozenNode.hasPermission(PermissionType.ADD_NODE)); + assertFalse(frozenNode.hasPermission(PermissionType.REMOVE)); + assertEquals(((NodeData)frozenNode.getData()).getACL().getOwner(), "admin"); + + marysChildNode1 = (NodeImpl)frozenNode.getNode(CHILD_TESTNODE_NAME1); + assertTrue(marysChildNode1.hasPermission(PermissionType.READ)); + assertTrue(marysChildNode1.hasPermission(PermissionType.SET_PROPERTY)); + assertFalse(marysChildNode1.hasPermission(PermissionType.ADD_NODE)); + assertEquals(((NodeData)marysChildNode1.getData()).getACL().getOwner(), "admin"); + + marysChildNode2 = (NodeImpl)frozenNode.getNode(CHILD_TESTNODE_NAME2); + assertTrue(marysNode.hasPermission(PermissionType.READ)); + assertTrue(marysNode.hasPermission(PermissionType.SET_PROPERTY)); + assertTrue(marysNode.hasPermission(PermissionType.ADD_NODE)); + assertFalse(marysNode.hasPermission(PermissionType.REMOVE));; + assertEquals(((NodeData)marysChildNode2.getData()).getACL().getOwner(), "admin"); + + marysChildNode3 = (NodeImpl)frozenNode.getNode(CHILD_TESTNODE_NAME3); + assertTrue(marysChildNode3.hasPermission(PermissionType.READ)); + assertTrue(marysChildNode3.hasPermission(PermissionType.SET_PROPERTY)); + assertTrue(marysChildNode3.hasPermission(PermissionType.ADD_NODE)); + assertFalse(marysChildNode3.hasPermission(PermissionType.REMOVE)); + assertEquals(((NodeData)marysChildNode3.getData()).getACL().getOwner(), "john"); + + marysChildNode4 = (NodeImpl)frozenNode.getNode(CHILD_TESTNODE_NAME4); + assertTrue(marysChildNode4.hasPermission(PermissionType.READ)); + assertTrue(marysChildNode4.hasPermission(PermissionType.SET_PROPERTY)); + assertFalse(marysChildNode4.hasPermission(PermissionType.REMOVE));; + assertEquals(((NodeData)marysChildNode2.getData()).getACL().getOwner(), "admin"); + try { // restore v1