SpaceReadAccessVoter extends SpaceAccessVoter { public int vote(Authentication auth, Object resource, Collection config) { String label = "SpaceReadAccessVoterImpl"; if (resource != null && !supports(resource.getClass())) { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } HttpServletRequest httpRequest = getHttpServletRequest(resource); if (null == httpRequest) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } HttpVerb verb = getHttpVerb(httpRequest); if (null == verb) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } if (!verb.isRead()) { log.debug(debugText(label, auth, config, resource, ACCESS_ABSTAIN)); return ACCESS_ABSTAIN; } if (isAdmin(auth.getName())) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (isOpenResource(httpRequest)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } Map<String, AclType> acls = getSpaceACLs(httpRequest); if (acls.containsKey(StorageProvider.PROPERTIES_SPACE_ACL_PUBLIC)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (auth instanceof AnonymousAuthenticationToken) { log.debug(debugText(label, auth, config, resource, ACCESS_DENIED)); return ACCESS_DENIED; } String username = auth.getName(); if (hasReadAccess(username, acls)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } List<String> userGroups = getUserGroups(auth); if (groupsHaveReadAccess(userGroups, acls)) { log.debug(debugText(label, auth, config, resource, ACCESS_GRANTED)); return ACCESS_GRANTED; } if (isSnapshotMetadataSpace(httpRequest) && hasContentId(httpRequest)) { return hasSnapshotSpacePermissions(httpRequest, username, userGroups) ? ACCESS_GRANTED : ACCESS_DENIED; } if (matchesPathExemptions(httpRequest)) { return ACCESS_GRANTED; } int grant = ACCESS_DENIED; log.debug(debugText(label, auth, config, resource, grant)); return grant; } SpaceReadAccessVoter(StorageProviderFactory storageProviderFactory,
                                UserDetailsService userDetailsService);  SpaceReadAccessVoter(StorageProviderFactory storageProviderFactory,
                                UserDetailsService userDetailsService, List<String> pathExemptions); int vote(Authentication auth,
                    Object resource,
                    Collection config);  }
@Test public void testUserAccessMethodsGET() { boolean securedSpace = true; Authentication caller = registeredUser(userRead, "none"); createMockInvocation(caller, securedSpace, HttpVerb.GET, 2); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); setupGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_GRANTED, decision); }
@Test public void testUserNoAccessMethodsGET() { boolean securedSpace = true; Authentication caller = registeredUser("joe", "none"); createMockInvocation(caller, securedSpace, HttpVerb.GET, 3); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); setupGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testGroupAccessMethodsGET() { boolean securedSpace = true; Authentication caller = registeredUser("joe", groupWrite); createMockInvocation(caller, securedSpace, HttpVerb.GET, 2); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); setupGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_GRANTED, decision); }
@Test public void testGroupNoAccessMethodsGET() { boolean securedSpace = true; Authentication caller = registeredUser("joe", "none"); createMockInvocation(caller, securedSpace, HttpVerb.GET, 3); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); setupGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_DENIED, decision); }
@Test public void testMethodsPUT() { boolean securedSpace = true; Authentication caller = registeredUser("joe", "none"); createMockInvocation(caller, securedSpace, HttpVerb.PUT); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_ABSTAIN, decision); }
@Test public void testVoteUserPathOverridesReport() { boolean securedSpace = true; Authentication caller = registeredUser("joe", "none"); createMockInvocation(caller, securedSpace, HttpVerb.GET, "/x-service-out/bit-integrity/report", 3); Collection<ConfigAttribute> config = getConfigAttribute(securedSpace); this.userPathOverrides.add("/x-service-out/bit-integrity.*"); setupGetSpaceAcls(); replayMocks(); int decision = voter.vote(caller, resource, config); Assert.assertEquals(ACCESS_GRANTED, decision); }