AccessControlManagerImpl extends AbstractAccessControlManager implements PolicyOwner { @NotNull @Override public AccessControlPolicy[] getEffectivePolicies(@Nullable String absPath) throws RepositoryException { String oakPath = getOakPath(absPath); Tree tree = getTree(oakPath, Permissions.READ_ACCESS_CONTROL, true); Root r = getRoot().getContentSession().getLatestRoot(); tree = r.getTree(tree.getPath()); List<AccessControlPolicy> effective = new ArrayList<>(); AccessControlPolicy policy = createACL(oakPath, tree, true, Predicates.alwaysTrue()); if (policy != null) { effective.add(policy); } if (oakPath != null) { String parentPath = Text.getRelativeParent(oakPath, 1); while (!parentPath.isEmpty()) { Tree t = r.getTree(parentPath); AccessControlPolicy plc = createACL(parentPath, t, true, Predicates.alwaysTrue()); if (plc != null) { effective.add(plc); } parentPath = (PathUtils.denotesRoot(parentPath)) ? "" : Text.getRelativeParent(parentPath, 1); } } if (isEffectiveReadPath(oakPath)) { effective.add(ReadPolicy.INSTANCE); } return effective.toArray(new AccessControlPolicy[0]); } AccessControlManagerImpl(@NotNull Root root, @NotNull NamePathMapper namePathMapper,
                                    @NotNull SecurityProvider securityProvider); @NotNull @Override AccessControlPolicy[] getPolicies(@Nullable String absPath); @NotNull @Override AccessControlPolicy[] getEffectivePolicies(@Nullable String absPath); @NotNull @Override AccessControlPolicyIterator getApplicablePolicies(@Nullable String absPath); @Override void setPolicy(@Nullable String absPath, @NotNull AccessControlPolicy policy); @Override void removePolicy(@Nullable String absPath, @NotNull AccessControlPolicy policy); @NotNull @Override JackrabbitAccessControlPolicy[] getApplicablePolicies(@NotNull Principal principal); @NotNull @Override JackrabbitAccessControlPolicy[] getPolicies(@NotNull Principal principal); @NotNull @Override AccessControlPolicy[] getEffectivePolicies(@NotNull Set<Principal> principals); @Override boolean defines(String absPath, @NotNull AccessControlPolicy accessControlPolicy);  }
@Test public void testGetEffectivePoliciesNoPoliciesSet() throws Exception { assertPolicies(acMgr.getEffectivePolicies(testPath), 0); }
@Test public void testGetEffectivePolicies() throws Exception { setupPolicy(testPath); root.commit(); assertPolicies(acMgr.getEffectivePolicies(testPath), 1); }
@Test public void testGetEffectivePoliciesRootPath() throws Exception { assertPolicies(acMgr.getEffectivePolicies(PathUtils.ROOT_PATH), 0); }
@Test public void testGetEffectivePoliciesOnChild() throws Exception { setupPolicy(testPath); Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); root.commit(); String childPath = child.getPath(); assertPolicies(acMgr.getEffectivePolicies(childPath), 1); }
@Test public void testGetEffectivePoliciesOnNewChild() throws Exception { setupPolicy(testPath); root.commit(); Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); String childPath = child.getPath(); assertPolicies(acMgr.getEffectivePolicies(childPath), 1); }
@Test public void testGetEffectivePoliciesOnChild2() throws Exception { Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); String childPath = child.getPath(); setupPolicy(childPath); setupPolicy(testPath); root.commit(); AccessControlPolicy[] policies = acMgr.getEffectivePolicies(childPath); assertPolicies(policies, 2); for (AccessControlPolicy policy : policies) { assertTrue(policy instanceof ImmutableACL); } }
@Test public void testGetEffectivePoliciesMatchingPropertyRestriction() throws Exception { TestUtility.setupPolicy(acMgr, testPath, testPrincipal, privilegesFromNames(JCR_READ), false, null, getMvRestriction(REP_ITEM_NAMES, JcrConstants.JCR_PRIMARYTYPE)); Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); Tree grandChild = TreeUtil.addChild(child, "child", JcrConstants.NT_UNSTRUCTURED); root.commit(); assertPolicies(acMgr.getEffectivePolicies(testPath), 1); assertPolicies(acMgr.getEffectivePolicies(child.getPath()), 1); assertPolicies(acMgr.getEffectivePolicies(grandChild.getPath()), 1); }
@Test public void testGetEffectivePoliciesNotMatchingRestriction() throws Exception { TestUtility.setupPolicy(acMgr, testPath, testPrincipal, privilegesFromNames(JCR_READ), true, null, getMvRestriction(REP_NT_NAMES, NT_OAK_UNSTRUCTURED)); Tree child = TreeUtil.addChild(root.getTree(testPath), "child", NT_OAK_UNSTRUCTURED); Tree grandChild = TreeUtil.addChild(child, "grandChild", JcrConstants.NT_UNSTRUCTURED); Tree other = TreeUtil.addChild(root.getTree(testPath), "other", JcrConstants.NT_UNSTRUCTURED); root.commit(); assertPolicies(acMgr.getEffectivePolicies(testPath), 1); assertPolicies(acMgr.getEffectivePolicies(grandChild.getPath()), 1); assertPolicies(acMgr.getEffectivePolicies(other.getPath()), 1); }
@Test public void testGetEffectivePoliciesNewPolicy() throws Exception { assertPolicies(acMgr.getEffectivePolicies(testPath), 0); setupPolicy(testPath); assertPolicies(acMgr.getEffectivePolicies(testPath), 0); Tree child = TreeUtil.addChild(root.getTree(testPath),"child", JcrConstants.NT_UNSTRUCTURED); String childPath = child.getPath(); assertPolicies(acMgr.getEffectivePolicies(childPath), 0); setupPolicy(childPath); assertPolicies(acMgr.getEffectivePolicies(childPath), 0); }
@Test public void testGetEffectivePoliciesInvalidPath() { for (String invalid : getInvalidPaths()) { try { acMgr.getEffectivePolicies(invalid); fail("Getting policies for an invalid path should fail"); } catch (RepositoryException e) { } } }
@Test(expected = PathNotFoundException.class) public void testGetEffectivePoliciesForPropertyPath() throws Exception { String propertyPath = "/jcr:primaryType"; acMgr.getEffectivePolicies(propertyPath); }
@Test(expected = PathNotFoundException.class) public void testGetEffectivePoliciesNonExistingNodePath() throws Exception { String nonExistingPath = "/not/existing"; acMgr.getEffectivePolicies(nonExistingPath); }
@Test public void testGetEffectivePoliciesForAcContentPaths() throws Exception { for (String path : getAcContentPaths()) { try { acMgr.getEffectivePolicies(path); fail("Getting effective policies for access control content should fail."); } catch (AccessControlException e) { } } }
@Test(expected = AccessControlException.class) public void testGetEffectivePoliciesNullPrincipal() throws Exception { acMgr.getEffectivePolicies((Set) null); }
@Test(expected = AccessControlException.class) public void testGetEffectivePoliciesSetContainingNullPrincipal() throws Exception { acMgr.getEffectivePolicies(new HashSet<>(Arrays.asList(EveryonePrincipal.getInstance(), null, testPrincipal))); }
@Test public void testGetEffectivePoliciesByPrincipal() throws Exception { Set<Set<Principal>> principalSets = new HashSet<>(); principalSets.add(Collections.singleton(testPrincipal)); principalSets.add(Collections.singleton(EveryonePrincipal.getInstance())); principalSets.add(ImmutableSet.of(testPrincipal, EveryonePrincipal.getInstance())); for (Set<Principal> principals : principalSets) { AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); assertPolicies(policies, 0); } setupPolicy(testPath); for (Set<Principal> principals : principalSets) { AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); assertPolicies(policies, 0); } root.commit(); for (Set<Principal> principals : principalSets) { AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); if (principals.contains(testPrincipal)) { assertPolicies(policies, 1); } else { assertPolicies(policies, 0); } } Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); String childPath = child.getPath(); setupPolicy(childPath); for (Set<Principal> principals : principalSets) { AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); if (principals.contains(testPrincipal)) { assertPolicies(policies, 1); } else { assertPolicies(policies, 0); } } root.commit(); for (Set<Principal> principals : principalSets) { AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); if (principals.contains(testPrincipal)) { assertPolicies(policies, 2); } else { assertPolicies(policies, 0); } } }
@Test public void testEffectivePolicyIsolatedAce() throws Exception { Root r = spy(root); ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); when(r.getContentSession()).thenReturn(cs); Tree testTree = r.getTree(testPath); Tree ace = TreeUtil.addChild(testTree, "ace", NT_REP_GRANT_ACE); ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); ResultRow row = when(mock(ResultRow.class).getPath()).thenReturn(ace.getPath()).getMock(); Iterable rows = ImmutableList.of(row); Result res = mock(Result.class); when(res.getRows()).thenReturn(rows).getMock(); QueryEngine qe = mock(QueryEngine.class); when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenReturn(res); when(r.getQueryEngine()).thenReturn(qe); AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); AccessControlPolicy[] policies = mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); assertPolicies(policies, 0); }
@Test public void testEffectivePolicyWrongPrimaryType() throws Exception { Root r = spy(root); ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); when(r.getContentSession()).thenReturn(cs); Tree testTree = r.getTree(testPath); Tree aclWithWrongType = TreeUtil.addChild(testTree, REP_POLICY, NT_OAK_UNSTRUCTURED); Tree ace = TreeUtil.addChild(aclWithWrongType, "ace", NT_REP_GRANT_ACE); ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); ResultRow row = when(mock(ResultRow.class).getPath()).thenReturn(ace.getPath()).getMock(); Iterable rows = ImmutableList.of(row); Result res = mock(Result.class); when(res.getRows()).thenReturn(rows).getMock(); QueryEngine qe = mock(QueryEngine.class); when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenReturn(res); when(r.getQueryEngine()).thenReturn(qe); AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); AccessControlPolicy[] policies = mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); assertPolicies(policies, 0); }
@Test(expected = RepositoryException.class) public void testEffectivePolicyFailingQuery() throws Exception { Root r = spy(root); ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); when(r.getContentSession()).thenReturn(cs); Tree testTree = r.getTree(testPath); Tree ace = TreeUtil.addChild(testTree, "ace", NT_REP_GRANT_ACE); ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); QueryEngine qe = mock(QueryEngine.class); when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenThrow(new ParseException("test", 0)); when(r.getQueryEngine()).thenReturn(qe); AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); }