Examples with SecurityRuleEntry org.xwiki.security.authorization.SecurityRuleEntry used on opensource projects

Example 11 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class AbstractAuthorizationSettler method settle.

@Override
public SecurityAccessEntry settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, Deque<SecurityRuleEntry> ruleEntries) {
    XWikiSecurityAccess access = new XWikiSecurityAccess();
    SecurityReference reference = null;
    Policies policies = new Policies();
    for (SecurityRuleEntry entry : ruleEntries) {
        if (!entry.isEmpty()) {
            // Chose the highest possible level to store the resulting access
            if (reference == null) {
                reference = entry.getReference();
            }
            // Compute access of this level and merge it with previous access result
            merge(settle(user, groups, entry, policies), access, entry.getReference(), policies);
        }
        if (reference == null && entry.getReference().getType() == EntityType.WIKI) {
            reference = entry.getReference();
        }
    }
    // Apply defaults and return the resulting access entry
    return new InternalSecurityAccessEntry(user, reference, applyDefaults(user, reference, access));
}

Example 12 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultAuthorizationSettlerTest method testSettleRightWithImpliedRights.

@Test
public void testSettleRightWithImpliedRights() throws Exception {
    SecurityRule allowImpliedADT = getMockedSecurityRule("allowImpliedADT", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsADT), ALLOW);
    SecurityRule denyImpliedADT = getMockedSecurityRule("denyImpliedADT", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsADT), DENY);
    SecurityRule allowImpliedDAF = getMockedSecurityRule("allowImpliedDAF", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsDAF), ALLOW);
    SecurityRule denyImpliedDAF = getMockedSecurityRule("denyImpliedDAF", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsDAF), DENY);
    XWikiSecurityAccess allowAccessADT = defaultAccess.clone();
    allowAccessADT.set(impliedTestRightsADT, ALLOW);
    for (Right right : allTestRights) {
        allowAccessADT.allow(right);
    }
    XWikiSecurityAccess tieADT = defaultAccess.clone();
    tieADT.set(impliedTestRightsADT, ALLOW);
    for (Right right : allTestRights) {
        tieADT.set(right, right.getTieResolutionPolicy());
    }
    XWikiSecurityAccess allowAccessDAF = defaultAccess.clone();
    allowAccessDAF.set(impliedTestRightsDAF, ALLOW);
    for (Right right : allTestRights) {
        allowAccessDAF.allow(right);
    }
    XWikiSecurityAccess denyADTAccess = defaultAccess.clone();
    denyADTAccess.deny(impliedTestRightsADT);
    XWikiSecurityAccess denyDAFAccess = defaultAccess.clone();
    denyDAFAccess.deny(impliedTestRightsDAF);
    XWikiSecurityAccess denyAccessADT = defaultAccess.clone();
    denyAccessADT.set(impliedTestRightsADT, ALLOW);
    for (Right right : allTestRights) {
        denyAccessADT.deny(right);
    }
    XWikiSecurityAccess denyAccessDAF = defaultAccess.clone();
    denyAccessDAF.set(impliedTestRightsDAF, ALLOW);
    for (Right right : allTestRights) {
        denyAccessDAF.deny(right);
    }
    assertAccess("When a right implying others rights is allowed, imply those rights (ADT)", userRef, docRef, allowAccessADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("allowAccessADT", docRef, Arrays.asList(Arrays.asList(allowImpliedADT)))));
    assertAccess("When a right implying others rights is allowed, imply those rights (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("allowAccessDAF", docRef, Arrays.asList(Arrays.asList(allowImpliedDAF)))));
    assertAccess("When a right implying others rights is denied, do not denied implied rights (ADT)", userRef, docRef, denyADTAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("denyAccessADT", docRef, Arrays.asList(Arrays.asList(denyImpliedADT)))));
    assertAccess("When a right implying others rights is denied, do not denied implied rights (DAF)", userRef, docRef, denyDAFAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("denyAccessDAF", docRef, Arrays.asList(Arrays.asList(denyImpliedDAF)))));
    SecurityRule allowAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("allowAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, ALLOW);
    SecurityRule denyAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("denyAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, DENY);
    SecurityRule denyAllTestRightsAnotherUserAndGroup = getMockedSecurityRule("denyAllTestRightsAnotherUserAndGroup", Arrays.asList(anotherUserRef), Arrays.asList(groupRef), allTestRights, DENY);
    Deque<SecurityRuleEntry> conflictAllowDenySameTargetADT = getMockedSecurityRuleEntries("conflictAllowDenySameTargetADT", docRef, Arrays.asList(Arrays.asList(allowImpliedADT, denyAllTestRightsUserAndAnotherGroup)));
    Deque<SecurityRuleEntry> conflictAllowDenySameTargetDAF = getMockedSecurityRuleEntries("conflictAllowDenySameTargetDAF", docRef, Arrays.asList(Arrays.asList(allowImpliedDAF, denyAllTestRightsUserAndAnotherGroup)));
    Deque<SecurityRuleEntry> conflictAllowDenyUserGroupADT = getMockedSecurityRuleEntries("conflictAllowDenyUserGroupADT", docRef, Arrays.asList(Arrays.asList(allowImpliedADT, denyAllTestRightsAnotherUserAndGroup)));
    Deque<SecurityRuleEntry> conflictAllowDenyUserGroupDAF = getMockedSecurityRuleEntries("conflictAllowDenyUserGroupDAF", docRef, Arrays.asList(Arrays.asList(allowImpliedDAF, denyAllTestRightsAnotherUserAndGroup)));
    assertAccess("When allowed implied right for user is denied for same user in another rule, use most favorable tie resolution policy (ADT)", userRef, docRef, tieADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTargetADT));
    assertAccess("When allowed implied right for user is denied for same user in another rule, use most favorable tie resolution policy (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTargetDAF));
    assertAccess("When allowed implied right for group is denied for same group in another rule, use most favorable tie resolution policy (ADT)", anotherUserRef, docRef, tieADT, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTargetADT));
    assertAccess("When allowed implied right for group is denied for same group in another rule, use most favorable tie resolution policy (DAF)", anotherUserRef, docRef, allowAccessDAF, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTargetDAF));
    assertAccess("When allowed implied right for user is denied for its group in another rule, allow it. (ADT)", userRef, docRef, allowAccessADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroupADT));
    assertAccess("When allowed implied right for user is denied for its group in another rule, allow it. (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroupDAF));
    assertAccess("When allowed implied right for group is denied for one of its user in another rule, deny it. (ADT)", anotherUserRef, docRef, denyAccessADT, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroupADT));
    assertAccess("When allowed implied right for group is denied for one of its user in another rule, deny it. (DAF)", anotherUserRef, docRef, denyAccessDAF, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroupDAF));
}

Example 13 with SecurityRuleEntry

use of org.xwiki.security.authorization.SecurityRuleEntry in project xwiki-platform by xwiki.

the class DefaultAuthorizationSettlerTest method testSettleInheritancePolicy.

@Test
public void testSettleInheritancePolicy() throws Exception {
    SecurityRule allowAllTestRightsRulesToXuser = getMockedSecurityRule("allowAllTestRightsRulesToXuser", Arrays.asList(xuserRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, ALLOW);
    SecurityRule denyAllTestRightsRulesToXuser = getMockedSecurityRule("denyAllTestRightsRulesToXuser", Arrays.asList(xuserRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, DENY);
    SecurityRule allowAllTestRightsRulesToUser = getMockedSecurityRule("allowAllTestRightsRulesToUser", Arrays.asList(userRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, ALLOW);
    SecurityRule denyAllTestRightsRulesToUser = getMockedSecurityRule("denyAllTestRightsRulesToUser", Arrays.asList(userRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, DENY);
    SecurityRule allowAllTestRightsRulesToAnotherWikiUser = getMockedSecurityRule("allowAllTestRightsRulesToAnotherWikiUser", Arrays.asList(anotherWikiUserRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, ALLOW);
    SecurityRule denyAllTestRightsRulesToAnotherWikiUser = getMockedSecurityRule("denyAllTestRightsRulesToAnotherWikiUser", Arrays.asList(anotherWikiUserRef), Collections.<GroupSecurityReference>emptyList(), allTestRights, DENY);
    Deque<SecurityRuleEntry> allowThenDenyRulesForXdocSpace = getMockedSecurityRuleEntries("allowThenDenyRulesForXdocSpace", xdocRef, Arrays.asList(Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser), Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> denyThenAllowRulesForXdocSpace = getMockedSecurityRuleEntries("denyThenAllowRulesForXdocSpace", xdocRef, Arrays.asList(Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser), Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> allowThenDenyRulesForDocSpace = getMockedSecurityRuleEntries("allowThenDenyRulesForDocSpace", docRef, Arrays.asList(Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser), Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> denyThenAllowRulesForDocSpace = getMockedSecurityRuleEntries("denyThenAllowRulesForDocSpace", docRef, Arrays.asList(Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser), Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> allowThenDenyRulesForXDocWiki = getMockedSecurityRuleEntries("allowThenDenyRulesForXDocWiki", xdocRef, Arrays.asList(Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> denyThenAllowRulesForXdocWiki = getMockedSecurityRuleEntries("denyThenAllowRulesForXdocWiki", xdocRef, Arrays.asList(Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> allowThenDenyRulesForDocWiki = getMockedSecurityRuleEntries("allowThenDenyRulesForDocWiki", docRef, Arrays.asList(Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> denyThenAllowRulesForDocWiki = getMockedSecurityRuleEntries("denyThenAllowRulesForDocWiki", docRef, Arrays.asList(Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> allowThenDenyRulesForDocXWiki = getMockedSecurityRuleEntries("allowThenDenyRulesForDocXWiki", docRef, Arrays.asList(Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Collections.<SecurityRule>emptyList(), Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser)));
    Deque<SecurityRuleEntry> denyThenAllowRulesForDocXWiki = getMockedSecurityRuleEntries("denyThenAllowRulesForDocXWiki", docRef, Arrays.asList(Arrays.asList(denyAllTestRightsRulesToXuser, denyAllTestRightsRulesToUser, denyAllTestRightsRulesToAnotherWikiUser), Collections.<SecurityRule>emptyList(), Collections.<SecurityRule>emptyList(), Arrays.asList(allowAllTestRightsRulesToXuser, allowAllTestRightsRulesToUser, allowAllTestRightsRulesToAnotherWikiUser)));
    XWikiSecurityAccess allowDenyAccess = new XWikiSecurityAccess();
    for (Right right : allTestRights) {
        allowDenyAccess.allow(right);
    }
    XWikiSecurityAccess denyAllowAccess = new XWikiSecurityAccess();
    for (Right right : allTestRights) {
        denyAllowAccess.set(right, right.getInheritanceOverridePolicy() ? DENY : ALLOW);
    }
    assertAccess("When allowed right on doc are denied on space from main wiki for main wiki user, use inheritance policy", xuserRef, xdocRef, allowDenyAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForXdocSpace));
    assertAccess("When denied right on doc are allowed on space from main wiki for main wiki user, use inheritance policy", xuserRef, xdocRef, denyAllowAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForXdocSpace));
    assertAccess("When allowed right on doc are denied on space from local wiki for main wiki user, use inheritance policy", xuserRef, docRef, allowDenyAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocSpace));
    assertAccess("When denied right on doc are allowed on space from local wiki for main wiki user, use inheritance policy", xuserRef, docRef, denyAllowAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocSpace));
    assertAccess("When allowed right on doc are denied on space from local wiki for local wiki user, use inheritance policy", userRef, docRef, allowDenyAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocSpace));
    assertAccess("When denied right on doc are allowed on space from local wiki for local wiki user, use inheritance policy", userRef, docRef, denyAllowAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocSpace));
    assertAccess("When allowed right on doc are denied on space from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, allowDenyAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocSpace));
    assertAccess("When denied right on doc are allowed on space from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, denyAllowAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocSpace));
    // 
    assertAccess("When allowed right on doc are denied on wiki from main wiki for main wiki user, use inheritance policy", xuserRef, xdocRef, allowDenyAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForXDocWiki));
    assertAccess("When denied right on doc are allowed on wiki from main wiki for main wiki user, use inheritance policy", xuserRef, xdocRef, denyAllowAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForXdocWiki));
    assertAccess("When allowed right on doc are denied on wiki from local wiki for main wiki user, use inheritance policy", xuserRef, docRef, allowDenyAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocWiki));
    assertAccess("When denied right on doc are allowed on wiki from local wiki for main wiki user, use inheritance policy", xuserRef, docRef, denyAllowAccess, authorizationSettler.settle(xuserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocWiki));
    assertAccess("When allowed right on doc are denied on wiki from local wiki for local wiki user, use inheritance policy", userRef, docRef, allowDenyAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocWiki));
    assertAccess("When denied right on doc are allowed on wiki from local wiki for local wiki user, use inheritance policy", userRef, docRef, denyAllowAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocWiki));
    assertAccess("When allowed right on doc are denied on wiki from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, allowDenyAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocWiki));
    assertAccess("When denied right on doc are allowed on wiki from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, denyAllowAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocWiki));
    // 
    assertAccess("When allowed right on doc are denied on main wiki from local wiki for local wiki user, use inheritance policy", userRef, docRef, allowDenyAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocXWiki));
    assertAccess("When denied right on doc are allowed on main wiki from local wiki for local wiki user, use inheritance policy", userRef, docRef, denyAllowAccess, authorizationSettler.settle(userRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocXWiki));
    assertAccess("When allowed right on doc are denied on main wiki from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, allowDenyAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), allowThenDenyRulesForDocXWiki));
    assertAccess("When denied right on doc are allowed on main wiki from local wiki for another wiki user, use inheritance policy", anotherWikiUserRef, docRef, denyAllowAccess, authorizationSettler.settle(anotherWikiUserRef, Collections.<GroupSecurityReference>emptyList(), denyThenAllowRulesForDocXWiki));
}