[seam-commits] Seam SVN: r10986 - modules/trunk/security/src/main/java/org/jboss/seam/security.

[seam-commits at lists.jboss.org]

Author: dan.j.allen
Date: 2009-05-26 11:24:08 -0400 (Tue, 26 May 2009)
New Revision: 10986

Added:
   modules/trunk/security/src/main/java/org/jboss/seam/security/SecurityException.java
Modified:
   modules/trunk/security/src/main/java/org/jboss/seam/security/AuthorizationException.java
   modules/trunk/security/src/main/java/org/jboss/seam/security/Identity.java
   modules/trunk/security/src/main/java/org/jboss/seam/security/NotLoggedInException.java
Log:
create exception hierarchy
evaluate expression in permission check

Modified: modules/trunk/security/src/main/java/org/jboss/seam/security/AuthorizationException.java
===================================================================
--- modules/trunk/security/src/main/java/org/jboss/seam/security/AuthorizationException.java	2009-05-26 15:23:49 UTC (rev 10985)
+++ modules/trunk/security/src/main/java/org/jboss/seam/security/AuthorizationException.java	2009-05-26 15:24:08 UTC (rev 10986)
@@ -5,7 +5,7 @@
  * 
  * @author Shane Bryzak
  */
-public class AuthorizationException extends RuntimeException
+public class AuthorizationException extends SecurityException
 { 
    private static final long serialVersionUID = -981091398588455903L;
 

Modified: modules/trunk/security/src/main/java/org/jboss/seam/security/Identity.java
===================================================================
--- modules/trunk/security/src/main/java/org/jboss/seam/security/Identity.java	2009-05-26 15:23:49 UTC (rev 10985)
+++ modules/trunk/security/src/main/java/org/jboss/seam/security/Identity.java	2009-05-26 15:24:08 UTC (rev 10986)
@@ -12,6 +12,7 @@
 
 import javax.annotation.Named;
 import javax.context.SessionScoped;
+import javax.el.ValueExpression;
 import javax.inject.Current;
 import javax.inject.Initializer;
 import javax.inject.manager.Bean;
@@ -26,6 +27,7 @@
 import javax.security.auth.login.LoginContext;
 import javax.security.auth.login.LoginException;
 
+import org.jboss.seam.el.Expressions;
 import org.jboss.seam.security.callbacks.AuthenticatorCallback;
 import org.jboss.seam.security.callbacks.IdentityCallback;
 import org.jboss.seam.security.callbacks.IdentityManagerCallback;
@@ -63,6 +65,7 @@
    @Current private Manager manager;
    @Current private Credentials credentials;
    @Current private PermissionMapper permissionMapper;
+   @Current private Expressions expressions;
    
    private Principal principal;   
    private Subject subject;
@@ -132,7 +135,7 @@
    {
       return subject;
    }
-      
+   
    /**
     * Performs an authorization check, based on the specified security expression.
     * 
@@ -142,28 +145,51 @@
     * @throws AuthorizationException Thrown if the authorization check fails and
     * the user is authenticated
     */
-   public void checkRestriction(String expr)
-   {      
-      if (!securityEnabled) return;
+   // QUESTION should we add the dependency on el-api for the sake of avoiding reinstantiating the VE?
+   public void checkRestriction(ValueExpression expression)
+   {
+      if (!securityEnabled)
+      {
+         return;
+      }
       
-      if ( !evaluateExpression(expr) )
+      if (!expressions.getValue(expression, Boolean.class))
       {
-         if ( !isLoggedIn() )
+         if (!isLoggedIn())
          {           
             manager.fireEvent(new NotLoggedInEvent());
             
             log.debug(String.format(
-               "Error evaluating expression [%s] - User not logged in", expr));
+               "Error evaluating expression [%s] - User not logged in", expression.getExpressionString()));
             throw new NotLoggedInException();
          }
          else
          {
             manager.fireEvent(new NotAuthorizedEvent());
             throw new AuthorizationException(String.format(
-               "Authorization check failed for expression [%s]", expr));
+               "Authorization check failed for expression [%s]", expression.getExpressionString()));
          }
       }
    }
+   
+   /**
+    * Performs an authorization check, based on the specified security expression string.
+    * 
+    * @param expr The security expression string to evaluate
+    * @throws NotLoggedInException Thrown if the authorization check fails and 
+    * the user is not authenticated
+    * @throws AuthorizationException Thrown if the authorization check fails and
+    * the user is authenticated
+    */
+   public void checkRestriction(String expr)
+   {      
+      if (!securityEnabled)
+      {
+         return;
+      }
+      
+      checkRestriction(expressions.createValueExpression(expr, Boolean.class).toUnifiedValueExpression());
+   }
 
    /**
     * Attempts to authenticate the user.  This method is distinct to the 
@@ -599,9 +625,7 @@
     */
    protected boolean evaluateExpression(String expr) 
    {     
-      // TODO - EL evaluation
-      // return Expressions.instance().createValueExpression(expr, Boolean.class).getValue();
-      return false;
+      return expressions.createValueExpression(expr, Boolean.class).getValue();
    }   
    
    public String getJaasConfigName()

Modified: modules/trunk/security/src/main/java/org/jboss/seam/security/NotLoggedInException.java
===================================================================
--- modules/trunk/security/src/main/java/org/jboss/seam/security/NotLoggedInException.java	2009-05-26 15:23:49 UTC (rev 10985)
+++ modules/trunk/security/src/main/java/org/jboss/seam/security/NotLoggedInException.java	2009-05-26 15:24:08 UTC (rev 10986)
@@ -8,4 +8,4 @@
  * @author Shane Bryzak
  */
 //@ApplicationException(rollback=true)
-public class NotLoggedInException extends RuntimeException {}
+public class NotLoggedInException extends SecurityException {}

Added: modules/trunk/security/src/main/java/org/jboss/seam/security/SecurityException.java
===================================================================
--- modules/trunk/security/src/main/java/org/jboss/seam/security/SecurityException.java	                        (rev 0)
+++ modules/trunk/security/src/main/java/org/jboss/seam/security/SecurityException.java	2009-05-26 15:24:08 UTC (rev 10986)
@@ -0,0 +1,31 @@
+package org.jboss.seam.security;
+
+/**
+ * Any exception that is raised by the security module extends from this runtime
+ * exception class, making it easy for other modules and extensions to catch all
+ * security-related exceptions in a single catch block, if need be.
+ * 
+ * @author Dan Allen
+ */
+public abstract class SecurityException extends RuntimeException
+{
+   public SecurityException()
+   {
+      super();
+   }
+
+   public SecurityException(String message, Throwable cause)
+   {
+      super(message, cause);
+   }
+
+   public SecurityException(String message)
+   {
+      super(message);
+   }
+
+   public SecurityException(Throwable cause)
+   {
+      super(cause);
+   }
+}