CugAccessControlManager extends AbstractAccessControlManager implements CugConstants, PolicyOwner { @Override public void setPolicy(String absPath, AccessControlPolicy policy) throws RepositoryException { String oakPath = getOakPath(absPath); if (isSupportedPath(oakPath)) { checkValidPolicy(absPath, policy); Tree tree = getTree(oakPath, Permissions.MODIFY_ACCESS_CONTROL, true); Tree typeRoot = getRoot().getTree(NodeTypeConstants.NODE_TYPES_PATH); if (!TreeUtil.isNodeType(tree, MIX_REP_CUG_MIXIN, typeRoot)) { TreeUtil.addMixin(tree, MIX_REP_CUG_MIXIN, typeRoot, null); } Tree cug; if (tree.hasChild(REP_CUG_POLICY)) { cug = tree.getChild(REP_CUG_POLICY); if (!CugUtil.definesCug(cug)) { throw new AccessControlException("Unexpected primary type of node rep:cugPolicy."); } } else { cug = TreeUtil.addChild(tree, REP_CUG_POLICY, NT_REP_CUG_POLICY, typeRoot, null); } cug.setProperty(REP_PRINCIPAL_NAMES, ((CugPolicyImpl) policy).getPrincipalNames(), Type.STRINGS); } else { throw new AccessControlException("Unsupported path: " + absPath); } } CugAccessControlManager(@NotNull Root root,
                            @NotNull NamePathMapper namePathMapper,
                            @NotNull SecurityProvider securityProvider,
                            @NotNull Set<String> supportedPaths,
                            @NotNull CugExclude cugExclude, RootProvider rootProvider); @NotNull @Override Privilege[] getSupportedPrivileges(@Nullable String absPath); @Override AccessControlPolicy[] getPolicies(String absPath); @Override AccessControlPolicy[] getEffectivePolicies(String absPath); @Override AccessControlPolicyIterator getApplicablePolicies(String absPath); @Override void removePolicy(String absPath, AccessControlPolicy policy); @Override void setPolicy(String absPath, AccessControlPolicy policy); @NotNull @Override JackrabbitAccessControlPolicy[] getApplicablePolicies(@NotNull Principal principal); @NotNull @Override JackrabbitAccessControlPolicy[] getPolicies(@NotNull Principal principal); @NotNull @Override AccessControlPolicy[] getEffectivePolicies(@NotNull Set<Principal> principals); @Override boolean defines(@Nullable String absPath, @NotNull AccessControlPolicy accessControlPolicy);  }
@Test public void testSetPolicy() throws Exception { CugPolicy cug = getApplicableCug(); cug.addPrincipals(EveryonePrincipal.getInstance()); cugAccessControlManager.setPolicy(SUPPORTED_PATH, cug); AccessControlPolicy[] policies = cugAccessControlManager.getPolicies(SUPPORTED_PATH); assertEquals(1, policies.length); AccessControlPolicy policy = policies[0]; assertTrue(policy instanceof CugPolicyImpl); Set<Principal> principals = ((CugPolicy) policy).getPrincipals(); assertEquals(1, principals.size()); assertEquals(EveryonePrincipal.getInstance(), principals.iterator().next()); }
@Test public void testSetPolicyPersisted() throws Exception { CugPolicy cug = getApplicableCug(); cug.addPrincipals(EveryonePrincipal.getInstance()); cugAccessControlManager.setPolicy(SUPPORTED_PATH, cug); root.commit(); Tree tree = root.getTree(SUPPORTED_PATH); assertTrue(TreeUtil.isNodeType(tree, CugConstants.MIX_REP_CUG_MIXIN, root.getTree(NodeTypeConstants.NODE_TYPES_PATH))); Tree cugTree = tree.getChild(CugConstants.REP_CUG_POLICY); assertTrue(cugTree.exists()); assertEquals(CugConstants.NT_REP_CUG_POLICY, TreeUtil.getPrimaryTypeName(cugTree)); PropertyState prop = cugTree.getProperty(CugConstants.REP_PRINCIPAL_NAMES); assertNotNull(prop); assertTrue(prop.isArray()); assertEquals(Type.STRINGS, prop.getType()); assertEquals(1, prop.count()); assertEquals(EveryonePrincipal.NAME, prop.getValue(Type.STRING, 0)); }
@Test public void testSetInvalidPolicy() throws Exception { List<AccessControlPolicy> invalidPolicies = ImmutableList.of( new AccessControlPolicy() {}, (NamedAccessControlPolicy) () -> "name", InvalidCug.INSTANCE ); for (AccessControlPolicy policy : invalidPolicies) { try { cugAccessControlManager.setPolicy(SUPPORTED_PATH, policy); fail("Invalid cug policy must be detected."); } catch (AccessControlException e) { } } }
@Test(expected = PathNotFoundException.class) public void testSetPolicyInvalidPath() throws Exception { cugAccessControlManager.setPolicy(INVALID_PATH, createCug(INVALID_PATH)); }
@Test(expected = AccessControlException.class) public void testSetPolicyUnsupportedPath() throws Exception { cugAccessControlManager.setPolicy(UNSUPPORTED_PATH, createCug(UNSUPPORTED_PATH)); }
@Test(expected = AccessControlException.class) public void testSetPolicyPathMismatch() throws Exception { cugAccessControlManager.setPolicy(SUPPORTED_PATH, createCug(SUPPORTED_PATH + "/subtree")); }
@Test(expected = AccessControlException.class) public void testSetInvalidCugNode() throws Exception { Tree supportedTree = root.getTree(SUPPORTED_PATH); TreeUtil.addChild(supportedTree, REP_CUG_POLICY, NodeTypeConstants.NT_OAK_UNSTRUCTURED); cugAccessControlManager.setPolicy(SUPPORTED_PATH, new CugPolicyImpl(SUPPORTED_PATH, NamePathMapper.DEFAULT, getPrincipalManager(root), ImportBehavior.BESTEFFORT, getExclude())); }
@Test public void testSetPolicyMixinAlreadyPresent() throws Exception { CugPolicy cug = getApplicableCug(); cug.addPrincipals(EveryonePrincipal.getInstance()); TreeUtil.addMixin(root.getTree(SUPPORTED_PATH), MIX_REP_CUG_MIXIN, root.getTree(NODE_TYPES_PATH), "uid"); cugAccessControlManager.setPolicy(SUPPORTED_PATH, cug); root.commit(); ReadOnlyNodeTypeManager ntMgr = ReadOnlyNodeTypeManager.getInstance(root, NamePathMapper.DEFAULT); assertTrue(ntMgr.isNodeType(root.getTree(SUPPORTED_PATH), MIX_REP_CUG_MIXIN)); }