Examples with RepositoryFileSid org.pentaho.platform.api.repository2.unified.RepositoryFileSid used on opensource projects

Example 31 with RepositoryFileSid

use of org.pentaho.platform.api.repository2.unified.RepositoryFileSid in project pentaho-platform by pentaho.

the class DefaultUnifiedRepositoryAuthorizationIT method testOwnership.

@Test
public void testOwnership() throws Exception {
    loginAsSysTenantAdmin();
    ITenant tenantAcme = tenantManager.createTenant(systemTenant, TENANT_ID_ACME, tenantAdminRoleName, tenantAuthenticatedRoleName, ANONYMOUS_ROLE_NAME);
    userRoleDao.createUser(tenantAcme, USERNAME_ADMIN, PASSWORD, "", new String[] { tenantAdminRoleName });
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    userRoleDao.createUser(tenantAcme, USERNAME_SUZY, PASSWORD, "", null);
    userRoleDao.createUser(tenantAcme, USERNAME_TIFFANY, PASSWORD, "", null);
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    // Suzy gives Tiffany all rights to her home folder
    final String parentFolderPath = ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName());
    RepositoryFile parentFolder = repo.getFile(parentFolderPath);
    RepositoryFileAcl parentAcl = repo.getAcl(parentFolder.getId());
    RepositoryFileAcl newParentAcl = new RepositoryFileAcl.Builder(parentAcl).ace(userNameUtils.getPrincipleId(tenantAcme, USERNAME_TIFFANY), RepositoryFileSid.Type.USER, RepositoryFilePermission.ALL).build();
    repo.updateAcl(newParentAcl);
    // suzy now creates a new folder inside of her home folder
    RepositoryFile newFolder = new RepositoryFile.Builder("test").folder(true).versioned(true).build();
    final String testFolderPath = parentFolderPath + RepositoryFile.SEPARATOR + "test";
    newFolder = repo.createFolder(parentFolder.getId(), newFolder, null);
    assertEquals(new RepositoryFileSid(USERNAME_SUZY), repo.getAcl(newFolder.getId()).getOwner());
    // tiffany will set acl removing suzy's rights to this folder
    login(USERNAME_TIFFANY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    RepositoryFileAcl testFolderAcl = repo.getAcl(newFolder.getId());
    // do a new Ace List filtering suzy's rights out
    List<RepositoryFileAce> newAceList = new ArrayList<RepositoryFileAce>();
    for (RepositoryFileAce ace : newParentAcl.getAces()) {
        if (!ace.getSid().getName().equals(USERNAME_SUZY)) {
            newAceList.add(ace);
        }
    }
    RepositoryFileAcl newTestAcl = new RepositoryFileAcl.Builder(testFolderAcl).aces(newAceList).build();
    repo.updateAcl(newTestAcl);
    // but suzy is still the owner--she should be able to "acl" herself back into the folder
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    assertNotNull(repo.getFile(testFolderPath));
    // tiffany still have permissions
    login(USERNAME_TIFFANY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    assertNotNull(repo.getFile(testFolderPath));
}

Example 32 with RepositoryFileSid

use of org.pentaho.platform.api.repository2.unified.RepositoryFileSid in project pentaho-platform by pentaho.

the class DefaultUnifiedRepositoryAuthorizationIT method testAclsOnDefaultFolders.

/**
 * This test method depends on {@code DefaultBackingRepositoryLifecycleManager} behavior.
 */
@Test
public void testAclsOnDefaultFolders() throws Exception {
    loginAsSysTenantAdmin();
    ITenant tenantAcme = tenantManager.createTenant(systemTenant, TENANT_ID_ACME, tenantAdminRoleName, tenantAuthenticatedRoleName, ANONYMOUS_ROLE_NAME);
    userRoleDao.createUser(tenantAcme, USERNAME_ADMIN, PASSWORD, "", new String[] { tenantAdminRoleName });
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    userRoleDao.createUser(tenantAcme, USERNAME_SUZY, PASSWORD, "", null);
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    final RepositoryFileSid suzySid = new RepositoryFileSid(USERNAME_SUZY, RepositoryFileSid.Type.USER);
    final RepositoryFileSid acmeAuthenticatedAuthoritySid = new RepositoryFileSid(tenantAuthenticatedRoleName, RepositoryFileSid.Type.ROLE);
    final RepositoryFileSid sysAdminSid = new RepositoryFileSid(sysAdminUserName, RepositoryFileSid.Type.USER);
    final RepositoryFileSid tenantAdminSid = new RepositoryFileSid(USERNAME_ADMIN, RepositoryFileSid.Type.USER);
    final RepositoryFileSid tenantCreatorSid = new RepositoryFileSid(sysAdminUserName, RepositoryFileSid.Type.USER);
    RepositoryFile file = tenantManager.getTenantRootFolder(tenantAcme);
    String tenantRootFolderAbsPath = pathConversionHelper.relToAbs(file.getPath());
    // pentaho root folder
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_READ));
    // TODO mlowery possible issue
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_READ_ACCESS_CONTROL));
    assertFalse(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_WRITE));
    // TODO mlowery possible issue
    assertFalse(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_MODIFY_ACCESS_CONTROL));
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_READ_ACCESS_CONTROL));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_WRITE));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, tenantRootFolderAbsPath, Privilege.JCR_MODIFY_ACCESS_CONTROL));
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    // tenant root folder
    // there is no ace that gives authenticated acme users access to /pentaho/acme; it's in logic on the server
    assertFalse(repo.getAcl(repo.getFile(ClientRepositoryPaths.getRootFolderPath()).getId()).isEntriesInheriting());
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getRootFolderPath()).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantRootFolderPath(), Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantRootFolderPath(), Privilege.JCR_READ_ACCESS_CONTROL));
    assertFalse(repo.getAcl(repo.getFile(ClientRepositoryPaths.getPublicFolderPath()).getId()).isEntriesInheriting());
    // tenant public folder
    assertLocalAceExists(repo.getFile(ClientRepositoryPaths.getPublicFolderPath()), acmeAuthenticatedAuthoritySid, EnumSet.of(RepositoryFilePermission.READ));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getPublicFolderPath()).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_READ_ACCESS_CONTROL));
    // tenant home folder
    assertFalse(repo.getAcl(repo.getFile(ClientRepositoryPaths.getHomeFolderPath()).getId()).isEntriesInheriting());
    assertLocalAceExists(repo.getFile(ClientRepositoryPaths.getHomeFolderPath()), acmeAuthenticatedAuthoritySid, EnumSet.of(RepositoryFilePermission.READ));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getHomeFolderPath()).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantHomeFolderPath(), Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantHomeFolderPath(), Privilege.JCR_READ_ACCESS_CONTROL));
    Serializable fileId = repo.getFile(ClientRepositoryPaths.getEtcFolderPath()).getId();
    assertLocalAceExists(repo.getFile(ClientRepositoryPaths.getEtcFolderPath()), acmeAuthenticatedAuthoritySid, EnumSet.of(RepositoryFilePermission.READ));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getEtcFolderPath()).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantEtcFolderPath(), Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantEtcFolderPath(), Privilege.JCR_READ_ACCESS_CONTROL));
    // suzy home folder
    assertEquals(suzySid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(USERNAME_SUZY)).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getUserHomeFolderPath(tenantAcme, USERNAME_SUZY), Privilege.JCR_ALL));
    // tenant etc/pdi folder
    final String pdiPath = ClientRepositoryPaths.getEtcFolderPath() + RepositoryFile.SEPARATOR + "pdi";
    assertTrue(repo.getAcl(repo.getFile(pdiPath).getId()).isEntriesInheriting());
    assertLocalAclEmpty(repo.getFile(pdiPath));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(pdiPath).getId()).getOwner());
    // tenant etc/databases folder
    final String databasesPath = pdiPath + RepositoryFile.SEPARATOR + "databases";
    assertTrue(repo.getAcl(repo.getFile(databasesPath).getId()).isEntriesInheriting());
    assertLocalAclEmpty(repo.getFile(databasesPath));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(databasesPath).getId()).getOwner());
    // tenant etc/slaveServers folder
    final String slaveServersPath = pdiPath + RepositoryFile.SEPARATOR + "slaveServers";
    assertTrue(repo.getAcl(repo.getFile(slaveServersPath).getId()).isEntriesInheriting());
    assertLocalAclEmpty(repo.getFile(slaveServersPath));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(slaveServersPath).getId()).getOwner());
    // tenant etc/clusterSchemas folder
    final String clusterSchemasPath = pdiPath + RepositoryFile.SEPARATOR + "clusterSchemas";
    assertTrue(repo.getAcl(repo.getFile(clusterSchemasPath).getId()).isEntriesInheriting());
    assertLocalAclEmpty(repo.getFile(clusterSchemasPath));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(clusterSchemasPath).getId()).getOwner());
    // tenant etc/partitionSchemas folder
    final String partitionSchemasPath = pdiPath + RepositoryFile.SEPARATOR + "partitionSchemas";
    assertTrue(repo.getAcl(repo.getFile(partitionSchemasPath).getId()).isEntriesInheriting());
    assertLocalAclEmpty(repo.getFile(partitionSchemasPath));
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(partitionSchemasPath).getId()).getOwner());
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getUserHomeFolderPath(tenantAcme, USERNAME_SUZY), Privilege.JCR_WRITE));
    assertLocalAceExists(repo.getFile(ClientRepositoryPaths.getPublicFolderPath()), acmeAuthenticatedAuthoritySid, EnumSet.of(RepositoryFilePermission.READ));
    // Test admin access ot tenant public folder
    assertEquals(tenantCreatorSid, repo.getAcl(repo.getFile(ClientRepositoryPaths.getPublicFolderPath()).getId()).getOwner());
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_READ));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_READ_ACCESS_CONTROL));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_ADD_CHILD_NODES));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_MODIFY_PROPERTIES));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_NODE_TYPE_MANAGEMENT));
    assertTrue(SimpleJcrTestUtils.hasPrivileges(testJcrTemplate, ServerRepositoryPaths.getTenantPublicFolderPath(), Privilege.JCR_MODIFY_ACCESS_CONTROL));
}

Example 33 with RepositoryFileSid

use of org.pentaho.platform.api.repository2.unified.RepositoryFileSid in project pentaho-platform by pentaho.

the class DefaultUnifiedRepositoryAuthorizationIT method testGetAcl.

@Test
public void testGetAcl() throws Exception {
    loginAsSysTenantAdmin();
    ITenant tenantAcme = tenantManager.createTenant(systemTenant, TENANT_ID_ACME, tenantAdminRoleName, tenantAuthenticatedRoleName, ANONYMOUS_ROLE_NAME);
    userRoleDao.createUser(tenantAcme, USERNAME_ADMIN, PASSWORD, "", new String[] { tenantAdminRoleName });
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    userRoleDao.createUser(tenantAcme, USERNAME_SUZY, PASSWORD, "", null);
    userRoleDao.createUser(tenantAcme, USERNAME_TIFFANY, PASSWORD, "", null);
    defaultBackingRepositoryLifecycleManager.newTenant();
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    RepositoryFile parentFolder = repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()));
    RepositoryFile newFolder = new RepositoryFile.Builder("test").folder(true).versioned(true).build();
    newFolder = repo.createFolder(parentFolder.getId(), newFolder, null);
    RepositoryFileAcl acl = repo.getAcl(newFolder.getId());
    assertEquals(true, acl.isEntriesInheriting());
    assertEquals(new RepositoryFileSid(USERNAME_SUZY), acl.getOwner());
    assertEquals(newFolder.getId(), acl.getId());
    assertTrue(acl.getAces().isEmpty());
    RepositoryFileAcl newAcl = new RepositoryFileAcl.Builder(acl).ace(userNameUtils.getPrincipleId(tenantAcme, USERNAME_TIFFANY), RepositoryFileSid.Type.USER, RepositoryFilePermission.READ).entriesInheriting(true).build();
    RepositoryFileAcl fetchedAcl = repo.updateAcl(newAcl);
    // since isEntriesInheriting is true, ace addition should not have taken
    assertTrue(fetchedAcl.getAces().isEmpty());
    newAcl = new RepositoryFileAcl.Builder(acl).ace(userNameUtils.getPrincipleId(tenantAcme, USERNAME_TIFFANY), RepositoryFileSid.Type.USER, RepositoryFilePermission.READ).build();
    // entriesInheriting to false
    fetchedAcl = repo.updateAcl(newAcl);
    // since isEntriesInheriting is false, ace addition should have taken
    assertFalse(fetchedAcl.getAces().isEmpty());
}

Example 34 with RepositoryFileSid

use of org.pentaho.platform.api.repository2.unified.RepositoryFileSid in project pentaho-platform by pentaho.

the class DefaultUnifiedRepositoryContentIT method testCopyFile.

@Test
public void testCopyFile() throws Exception {
    loginAsSysTenantAdmin();
    ITenant tenantAcme = tenantManager.createTenant(systemTenant, TENANT_ID_ACME, tenantAdminRoleName, tenantAuthenticatedRoleName, ANONYMOUS_ROLE_NAME);
    userRoleDao.createUser(tenantAcme, USERNAME_ADMIN, PASSWORD, "", new String[] { tenantAdminRoleName });
    login(USERNAME_ADMIN, tenantAcme, new String[] { tenantAdminRoleName, tenantAuthenticatedRoleName });
    userRoleDao.createUser(tenantAcme, USERNAME_SUZY, PASSWORD, "", null);
    login(USERNAME_SUZY, tenantAcme, new String[] { tenantAuthenticatedRoleName });
    RepositoryFile parentFolder = repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()));
    RepositoryFile copyTest1Folder = new RepositoryFile.Builder("copyTest1").folder(true).versioned(true).build();
    RepositoryFileSid fileOwnerSid = new RepositoryFileSid(userNameUtils.getPrincipleId(tenantAcme, USERNAME_SUZY));
    copyTest1Folder = repo.createFolder(parentFolder.getId(), copyTest1Folder, new RepositoryFileAcl.Builder(fileOwnerSid).build(), null);
    RepositoryFile copyTest2Folder = new RepositoryFile.Builder("copyTest2").folder(true).versioned(true).build();
    copyTest2Folder = repo.createFolder(parentFolder.getId(), copyTest2Folder, new RepositoryFileAcl.Builder(fileOwnerSid).build(), null);
    RepositoryFile testFolder = new RepositoryFile.Builder("test").folder(true).build();
    testFolder = repo.createFolder(copyTest1Folder.getId(), testFolder, new RepositoryFileAcl.Builder(fileOwnerSid).build(), null);
    // copy folder into new folder
    repo.copyFile(testFolder.getId(), copyTest2Folder.getPath() + RepositoryFile.SEPARATOR + testFolder.getName(), null);
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest1" + RepositoryFile.SEPARATOR + "test"));
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest2" + RepositoryFile.SEPARATOR + "test"));
    // copy folder into new folder and rename
    repo.copyFile(testFolder.getId(), copyTest2Folder.getPath() + RepositoryFile.SEPARATOR + "newTest2", null);
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest1" + RepositoryFile.SEPARATOR + "test"));
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest2" + RepositoryFile.SEPARATOR + "newTest2"));
    // copy within same folder
    repo.copyFile(testFolder.getId(), copyTest2Folder.getPath() + RepositoryFile.SEPARATOR + "newTest", null);
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest2" + RepositoryFile.SEPARATOR + "test"));
    assertNotNull(repo.getFile(ClientRepositoryPaths.getUserHomeFolderPath(PentahoSessionHolder.getSession().getName()) + RepositoryFile.SEPARATOR + "copyTest2" + RepositoryFile.SEPARATOR + "newTest"));
    RepositoryFile newFile = createSampleFile(copyTest2Folder.getPath(), "helloworld.sample", "ddfdf", false, 83);
    try {
        repo.copyFile(testFolder.getId(), copyTest2Folder.getPath() + RepositoryFile.SEPARATOR + "doesnotexist" + RepositoryFile.SEPARATOR + "newTest2", null);
        fail();
    } catch (UnifiedRepositoryException e) {
    // copying a folder to a path with a non-existent parent folder is illegal
    }
    try {
        repo.copyFile(testFolder.getId(), newFile.getPath(), null);
        fail();
    } catch (UnifiedRepositoryException e) {
    // copying a folder to a file is illegal
    }
    JcrRepositoryDumpToFile dumpToFile = new JcrRepositoryDumpToFile(testJcrTemplate, jcrTransactionTemplate, repositoryAdminUsername, "c:/build/testrepo_17", Mode.CUSTOM);
    dumpToFile.execute();
}

Example 35 with RepositoryFileSid

use of org.pentaho.platform.api.repository2.unified.RepositoryFileSid in project pentaho-platform by pentaho.

the class RepositoryTenantManager method createPublicFolder.

private RepositoryFile createPublicFolder(ITenant tenant, RepositoryFile tenantRootFolder, RepositoryFileSid fileOwnerSid) {
    String tenantAdminRoleId = tenantedRoleNameResolver.getPrincipleId(tenant, tenantAdminRoleName);
    RepositoryFileSid tenantAdminRoleSid = new RepositoryFileSid(tenantAdminRoleId, Type.ROLE);
    String tenantAuthenticatedRoleId = tenantedRoleNameResolver.getPrincipleId(tenant, tenantAuthenticatedRoleName);
    RepositoryFileSid tenantAuthenticatedRoleSid = new RepositoryFileSid(tenantAuthenticatedRoleId, Type.ROLE);
    RepositoryFile publicFolder = repositoryFileDao.createFolder(tenantRootFolder.getId(), new RepositoryFile.Builder(ServerRepositoryPaths.getTenantPublicFolderName()).folder(true).title(Messages.getInstance().getString("RepositoryTenantManager.publicFolderDisplayName")).build(), new RepositoryFileAcl.Builder(fileOwnerSid).ace(tenantAdminRoleSid, EnumSet.of(RepositoryFilePermission.ALL)).ace(tenantAuthenticatedRoleSid, EnumSet.of(RepositoryFilePermission.READ)).build(), null);
    return publicFolder;
}