CugAccessControlManager extends AbstractAccessControlManager implements CugConstants, PolicyOwner { @Override public AccessControlPolicy[] getEffectivePolicies(String absPath) throws RepositoryException { String oakPath = getOakPath(absPath); getTree(oakPath, Permissions.READ_ACCESS_CONTROL, true); boolean enabled = config.getConfigValue(CugConstants.PARAM_CUG_ENABLED, false); if (enabled) { Root r = getLatestRoot(); List<AccessControlPolicy> effective = new ArrayList<>(); while (oakPath != null) { if (CugUtil.isSupportedPath(oakPath, supportedPaths)) { CugPolicy cug = getCugPolicy(oakPath, r.getTree(oakPath), true); if (cug != null) { effective.add(cug); } } oakPath = (PathUtils.denotesRoot(oakPath)) ? null : PathUtils.getAncestorPath(oakPath, 1); } return effective.toArray(new AccessControlPolicy[0]); } else { return new AccessControlPolicy[0]; } } CugAccessControlManager(@NotNull Root root,
                            @NotNull NamePathMapper namePathMapper,
                            @NotNull SecurityProvider securityProvider,
                            @NotNull Set<String> supportedPaths,
                            @NotNull CugExclude cugExclude, RootProvider rootProvider); @NotNull @Override Privilege[] getSupportedPrivileges(@Nullable String absPath); @Override AccessControlPolicy[] getPolicies(String absPath); @Override AccessControlPolicy[] getEffectivePolicies(String absPath); @Override AccessControlPolicyIterator getApplicablePolicies(String absPath); @Override void removePolicy(String absPath, AccessControlPolicy policy); @Override void setPolicy(String absPath, AccessControlPolicy policy); @NotNull @Override JackrabbitAccessControlPolicy[] getApplicablePolicies(@NotNull Principal principal); @NotNull @Override JackrabbitAccessControlPolicy[] getPolicies(@NotNull Principal principal); @NotNull @Override AccessControlPolicy[] getEffectivePolicies(@NotNull Set<Principal> principals); @Override boolean defines(@Nullable String absPath, @NotNull AccessControlPolicy accessControlPolicy);  }
@Test public void testGetEffectivePolicies() throws Exception { AccessControlPolicy[] policies = cugAccessControlManager.getEffectivePolicies(SUPPORTED_PATH); assertEquals(0, policies.length); cugAccessControlManager.setPolicy(SUPPORTED_PATH, createCug(SUPPORTED_PATH)); root.commit(); policies = cugAccessControlManager.getEffectivePolicies(SUPPORTED_PATH); assertEquals(1, policies.length); AccessControlPolicy[] effectiveOnChild = cugAccessControlManager.getEffectivePolicies(SUPPORTED_PATH + "/subtree"); assertEquals(1, policies.length); assertEquals(policies.length, effectiveOnChild.length); assertEquals(((JackrabbitAccessControlPolicy) policies[0]).getPath(), ((JackrabbitAccessControlPolicy) effectiveOnChild[0]).getPath()); }
@Test(expected = PathNotFoundException.class) public void testGetEffectivePoliciesInvalidPath() throws Exception { cugAccessControlManager.getEffectivePolicies(INVALID_PATH); }
@Test public void testGetEffectivePoliciesUnsupportedPath() throws Exception { AccessControlPolicy[] policies = cugAccessControlManager.getEffectivePolicies(UNSUPPORTED_PATH); assertEquals(0, policies.length); }
@Test public void testGetEffectivePoliciesNullPath() throws Exception { AccessControlPolicy[] policies = cugAccessControlManager.getEffectivePolicies((String) null); assertEquals(0, policies.length); }
@Test(expected = AccessControlException.class) public void testGetEffectivePoliciesNoReadAcPermission() throws Exception { setupCugsAndAcls(); try (ContentSession cs = createTestSession()) { Root r = cs.getLatestRoot(); CugAccessControlManager m = new CugAccessControlManager(r, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); AccessControlPolicy[] effective = m.getEffectivePolicies("/content"); assertEquals(0, effective.length); } }
@Test(expected = PathNotFoundException.class) public void testGetEffectivePoliciesNoReadPermission() throws Exception { setupCugsAndAcls(); try (ContentSession cs = createTestSession()) { Root r = cs.getLatestRoot(); CugAccessControlManager m = new CugAccessControlManager(r, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); m.getEffectivePolicies("/content2"); } }
@Test public void testGetEffectivePoliciesLimitedReadAcPermission() throws Exception { setupCugsAndAcls(); try (ContentSession cs = createTestSession2()) { Root r = cs.getLatestRoot(); CugAccessControlManager m = new CugAccessControlManager(r, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); AccessControlPolicy[] effective = m.getEffectivePolicies("/content/a/b/c"); assertEquals(2, effective.length); } }
@Test public void testGetEffectiveByPrincipalNoCugPresent() { AccessControlPolicy[] effective = cugAccessControlManager.getEffectivePolicies(Collections.singleton(EveryonePrincipal.getInstance())); assertEquals(0, effective.length); }
@Test public void testGetEffectiveByPrincipalTransientChanges() throws Exception { Principal p = getTestGroupPrincipal(); createCug(SUPPORTED_PATH, p); createCug(SUPPORTED_PATH + "/subtree", p); AccessControlPolicy[] effective = cugAccessControlManager.getEffectivePolicies(Collections.singleton(p)); assertEquals(0, effective.length); }
@Test public void testGetEffectiveByPrincipalNotListed() throws Exception { createCug(SUPPORTED_PATH + "/subtree", getTestGroupPrincipal()); root.commit(); Principal na = new PrincipalImpl("testNA"); AccessControlPolicy[] effective = cugAccessControlManager.getEffectivePolicies(ImmutableSet.of(na)); assertEquals(0, effective.length); }
@Test(expected = AccessControlException.class) public void testGetEffectiveByPrincipalIsImmutable() throws Exception { Principal p = getTestGroupPrincipal(); createCug(SUPPORTED_PATH, p); root.commit(); Principal na = new PrincipalImpl("testNA"); Set<Principal> pp = ImmutableSet.of(p, na); AccessControlPolicy[] effective = cugAccessControlManager.getEffectivePolicies(pp); assertEquals(1, effective.length); assertTrue(effective[0] instanceof CugPolicy); ((CugPolicy) effective[0]).addPrincipals(EveryonePrincipal.getInstance()); }
@Test public void testGetEffectivePrincipalDistributed() throws Exception { setupCugsAndAcls(); AccessControlPolicy[] effective = cugAccessControlManager.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal(), EveryonePrincipal.getInstance())); assertEquals(4, effective.length); AccessControlPolicy[] everyoneEffective = cugAccessControlManager.getEffectivePolicies(ImmutableSet.of(EveryonePrincipal.getInstance())); assertEquals(2, everyoneEffective.length); AccessControlPolicy[] testgroupEffective = cugAccessControlManager.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal())); assertEquals(2, testgroupEffective.length); assertTrue(Sets.intersection(ImmutableSet.copyOf(everyoneEffective), ImmutableSet.copyOf(testgroupEffective)).isEmpty()); }
@Test public void testGetEffectivePrincipalNoReadAcPermission() throws Exception { setupCugsAndAcls(); try (ContentSession cs = createTestSession()) { Root r = cs.getLatestRoot(); CugAccessControlManager m = new CugAccessControlManager(r, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); AccessControlPolicy[] effective = m.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal(), EveryonePrincipal.getInstance())); assertEquals(0, effective.length); } }
@Test public void testGetEffectivePrincipalLimitedReadAcPermission() throws Exception { setupCugsAndAcls(); try (ContentSession cs = createTestSession2()) { Root r = cs.getLatestRoot(); CugAccessControlManager m = new CugAccessControlManager(r, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); AccessControlPolicy[] effective = m.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal(), EveryonePrincipal.getInstance())); assertEquals(3, effective.length); } }
@Test public void tesetGetEffectiveByPrincipalRootIncludedIsSupportedPath() throws Exception { setupCugsAndAcls(); CugAccessControlManager acMgr = new CugAccessControlManager(root, NamePathMapper.DEFAULT, getSecurityProvider(), ImmutableSet.of(PathUtils.ROOT_PATH), getExclude(), getRootProvider()); assertEquals(4, acMgr.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal(), EveryonePrincipal.getInstance())).length); }
@Test public void tesetGetEffectiveByPrincipalNotEnabled() throws Exception { setupCugsAndAcls(); ConfigurationParameters config = ConfigurationParameters.of(AuthorizationConfiguration.NAME, ConfigurationParameters.of( CugConstants.PARAM_CUG_SUPPORTED_PATHS, SUPPORTED_PATHS, CugConstants.PARAM_CUG_ENABLED, false)); CugAccessControlManager acMgr = new CugAccessControlManager(root, NamePathMapper.DEFAULT, CugSecurityProvider.newTestSecurityProvider(config), ImmutableSet.copyOf(SUPPORTED_PATHS), getExclude(), getRootProvider()); assertEquals(0, acMgr.getEffectivePolicies(ImmutableSet.of(getTestGroupPrincipal(), EveryonePrincipal.getInstance())).length); }