PentahoACLProvider extends ACLProvider { protected boolean requireRootAclUpdate( ACLEditor editor ) throws RepositoryException { final String rootPath = session.getRootNode().getPath(); final AccessControlPolicy[] acls = editor.getPolicies( rootPath ); if ( acls != null && acls.length > 0 ) { final PrincipalManager pMgr = session.getPrincipalManager(); final AccessControlManager acMgr = session.getAccessControlManager(); final Privilege jcrReadAccessControlPriv = acMgr.privilegeFromName( Privilege.JCR_READ_ACCESS_CONTROL ); final Principal everyone = pMgr.getEveryone(); final AccessControlList acList = (AccessControlList) acls[0]; final AccessControlEntry[] acEntries = acList.getAccessControlEntries(); if ( acEntries != null ) { for ( AccessControlEntry acEntry : acEntries ) { if ( acEntry.getPrincipal() != null && acEntry.getPrincipal().equals( everyone ) && acEntry.getPrivileges() != null ) { return !Arrays.asList( acEntry.getPrivileges() ).contains( jcrReadAccessControlPriv ); } } } } return true; }  @Override @SuppressWarnings( "rawtypes" ) void init( final Session systemSession, final Map conf ); @Override CompiledPermissions compilePermissions( Set<Principal> principals ); @Override boolean canAccessRoot( Set<Principal> principals );  }
@Test public void testRequireRootAclUpdate() throws Exception { assertTrue( provider.requireRootAclUpdate( editor ) ); when( aclEntry.getPrincipal() ).thenReturn( everyone ); assertTrue( provider.requireRootAclUpdate( editor ) ); Privilege[] privs = new Privilege[] { jcrReadAccessControlPriv }; when( aclEntry.getPrivileges() ).thenReturn( privs ); assertFalse( provider.requireRootAclUpdate( editor ) ); }