Examples with Restriction org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction used on opensource projects

Example 21 with Restriction

use of org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction in project jackrabbit-oak by apache.

the class ACETest method testGetRestrictionForSingleValued.

@Test
public void testGetRestrictionForSingleValued() throws Exception {
    // single valued restriction
    Restriction globRestr = createRestriction(AccessControlConstants.REP_GLOB, globValue);
    ACE ace = createEntry(globRestr);
    Value val = ace.getRestriction(AccessControlConstants.REP_GLOB);
    assertNotNull(val);
    assertEquals(globValue, val);
}

Example 22 with Restriction

use of org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction in project jackrabbit-oak by apache.

the class AccessControlManagerImpl method setPrincipalBasedAcl.

private void setPrincipalBasedAcl(PrincipalACL principalAcl) throws RepositoryException {
    AccessControlPolicy[] plcs = getPolicies(principalAcl.principal);
    PrincipalACL existing = (plcs.length == 0) ? null : (PrincipalACL) plcs[0];
    List<ACE> toAdd = Lists.newArrayList(principalAcl.getEntries());
    List<ACE> toRemove = Collections.emptyList();
    if (existing != null) {
        toAdd.removeAll(existing.getEntries());
        toRemove = existing.getEntries();
        toRemove.removeAll(principalAcl.getEntries());
    }
    // add new entries
    for (ACE ace : toAdd) {
        String path = getNodePath(ace);
        Tree tree = getTree(path, Permissions.MODIFY_ACCESS_CONTROL, true);
        ACL acl = (ACL) createACL(path, tree, false);
        if (acl == null) {
            acl = new NodeACL(path);
        }
        // calculate single and mv restriction and drop the rep:nodePath restriction
        // present with the principal-based-entries.
        Map<String, Value> restrictions = new HashMap();
        Map<String, Value[]> mvRestrictions = new HashMap();
        for (Restriction r : ace.getRestrictions()) {
            String name = r.getDefinition().getName();
            if (REP_NODE_PATH.equals(name)) {
                continue;
            }
            if (r.getDefinition().getRequiredType().isArray()) {
                mvRestrictions.put(name, ace.getRestrictions(name));
            } else {
                restrictions.put(name, ace.getRestriction(name));
            }
        }
        acl.addEntry(ace.getPrincipal(), ace.getPrivileges(), ace.isAllow(), restrictions, mvRestrictions);
        setNodeBasedAcl(path, tree, acl);
    }
    // remove entries that are not longer present in the acl to write
    for (ACE ace : toRemove) {
        String path = getNodePath(ace);
        Tree tree = getTree(path, Permissions.MODIFY_ACCESS_CONTROL, true);
        ACL acl = (ACL) createACL(path, tree, false);
        if (acl != null) {
            // remove rep:nodePath restriction before removing the entry from
            // the node-based policy (see above for adding entries without
            // this special restriction).
            Set<Restriction> rstr = Sets.newHashSet(ace.getRestrictions());
            Iterator<Restriction> it = rstr.iterator();
            while (it.hasNext()) {
                Restriction r = it.next();
                if (REP_NODE_PATH.equals(r.getDefinition().getName())) {
                    it.remove();
                }
            }
            acl.removeAccessControlEntry(new Entry(ace.getPrincipal(), ace.getPrivilegeBits(), ace.isAllow(), rstr, getNamePathMapper()));
            setNodeBasedAcl(path, tree, acl);
        } else {
            log.debug("Missing ACL at {}; cannot remove entry {}", path, ace);
        }
    }
}

Example 23 with Restriction

use of org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction in project jackrabbit-oak by apache.

the class PrincipalRestrictionProvider method writeRestrictions.

@Override
public void writeRestrictions(String oakPath, Tree aceTree, Set<Restriction> restrictions) throws RepositoryException {
    Iterator<Restriction> it = Sets.newHashSet(restrictions).iterator();
    while (it.hasNext()) {
        Restriction r = it.next();
        if (REP_NODE_PATH.equals(r.getDefinition().getName())) {
            it.remove();
        }
    }
    base.writeRestrictions(oakPath, aceTree, restrictions);
}

Example 24 with Restriction

use of org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction in project jackrabbit-oak by apache.

the class AccessControlManagerImpl method setNodeBasedAcl.

private void setNodeBasedAcl(@Nullable String oakPath, @Nonnull Tree tree, @Nonnull ACL acl) throws RepositoryException {
    Tree aclTree = getAclTree(oakPath, tree);
    if (aclTree != null) {
        // remove all existing aces
        for (Tree aceTree : aclTree.getChildren()) {
            aceTree.remove();
        }
    } else {
        aclTree = createAclTree(oakPath, tree);
    }
    aclTree.setOrderableChildren(true);
    List<ACE> entries = acl.getEntries();
    for (int i = 0; i < entries.size(); i++) {
        ACE ace = entries.get(i);
        String nodeName = Util.generateAceName(ace, i);
        String ntName = (ace.isAllow()) ? NT_REP_GRANT_ACE : NT_REP_DENY_ACE;
        Tree aceNode = TreeUtil.addChild(aclTree, nodeName, ntName);
        aceNode.setProperty(REP_PRINCIPAL_NAME, ace.getPrincipal().getName());
        aceNode.setProperty(REP_PRIVILEGES, ImmutableList.copyOf(AccessControlUtils.namesFromPrivileges(ace.getPrivileges())), Type.NAMES);
        Set<Restriction> restrictions = ace.getRestrictions();
        restrictionProvider.writeRestrictions(oakPath, aceNode, restrictions);
    }
}

Example 25 with Restriction

use of org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction in project jackrabbit-oak by apache.

the class EntryTest method testGetRestrictionNames.

@Test
public void testGetRestrictionNames() throws Exception {
    // empty restrictions
    String[] restrictionNames = createEntry(Collections.<Restriction>emptySet()).getRestrictionNames();
    assertNotNull(restrictionNames);
    assertEquals(0, restrictionNames.length);
    Restriction globRestr = createRestriction(AccessControlConstants.REP_GLOB, globValue);
    Restriction nameRestr = createRestriction(AccessControlConstants.REP_NT_NAMES, nameValues);
    // single restriction
    restrictionNames = createEntry(ImmutableSet.of(globRestr)).getRestrictionNames();
    assertEquals(1, restrictionNames.length);
    // 2 restrictions
    restrictionNames = createEntry(ImmutableSet.of(globRestr, nameRestr)).getRestrictionNames();
    assertEquals(2, restrictionNames.length);
}