ACL extends AbstractAccessControlList { @Override public boolean addEntry(@NotNull Principal principal, @NotNull Privilege[] privileges, boolean isAllow, @Nullable Map<String, Value> restrictions, @Nullable Map<String, Value[]> mvRestrictions) throws RepositoryException { if (privileges == null || privileges.length == 0) { throw new AccessControlException("Privileges may not be null nor an empty array"); } for (Privilege p : privileges) { Privilege pv = getPrivilegeManager().getPrivilege(p.getName()); if (pv.isAbstract()) { throw new AccessControlException("Privilege " + p + " is abstract."); } } if (!checkValidPrincipal(principal)) { return false; } Set<Restriction> rs = validateRestrictions((restrictions == null) ? Collections.emptyMap() : restrictions, (mvRestrictions == null) ? Collections.emptyMap() : mvRestrictions); ACE entry = createACE(principal, getPrivilegeBits(privileges), isAllow, rs); if (entries.contains(entry)) { log.debug("Entry is already contained in policy -> no modification."); return false; } else { return internalAddEntry(entry); } } ACL(@Nullable String oakPath, @Nullable List<ACE> entries,
        @NotNull NamePathMapper namePathMapper); @NotNull @Override List<ACE> getEntries(); @Override void removeAccessControlEntry(AccessControlEntry ace); @Override boolean addEntry(@NotNull Principal principal, @NotNull Privilege[] privileges,
                            boolean isAllow, @Nullable Map<String, Value> restrictions,
                            @Nullable Map<String, Value[]> mvRestrictions); @Override void orderBefore(@NotNull AccessControlEntry srcEntry, @Nullable AccessControlEntry destEntry); @Override String toString();  }
@Test public void testAddEntriesWithCustomPrincipal() throws Exception { Principal oakPrincipal = new PrincipalImpl("anonymous"); Principal principal = () -> "anonymous"; assertTrue(acl.addAccessControlEntry(oakPrincipal, privilegesFromNames(JCR_READ))); assertTrue(acl.addAccessControlEntry(principal, privilegesFromNames(JCR_READ_ACCESS_CONTROL))); assertEquals(1, acl.getAccessControlEntries().length); assertTrue(acl.addEntry(principal, privilegesFromNames(JCR_READ), false)); assertEquals(2, acl.getAccessControlEntries().length); assertArrayEquals(privilegesFromNames(JCR_READ_ACCESS_CONTROL), acl.getAccessControlEntries()[0].getPrivileges()); }
@Test public void testAddEntry() throws Exception { assertTrue(acl.addEntry(testPrincipal, testPrivileges, true)); assertFalse(acl.isEmpty()); }
@Test public void testAddEntry2() throws Exception { assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, Collections.emptyMap())); assertFalse(acl.isEmpty()); }
@Test public void testAddEntryTwice() throws Exception { acl.addEntry(testPrincipal, testPrivileges, true, Collections.emptyMap()); assertFalse(acl.addEntry(testPrincipal, testPrivileges, true, Collections.emptyMap())); }
@Test public void testUpdateGroupEntry() throws Exception { Privilege[] readPriv = privilegesFromNames(JCR_READ); Privilege[] writePriv = privilegesFromNames(JCR_WRITE); Principal everyone = principalManager.getEveryone(); acl.addEntry(testPrincipal, readPriv, true); acl.addEntry(everyone, readPriv, true); acl.addEntry(testPrincipal, writePriv, false); acl.addEntry(everyone, writePriv, true); AccessControlEntry[] entries = acl.getAccessControlEntries(); assertEquals(3, entries.length); JackrabbitAccessControlEntry princ2AllowEntry = (JackrabbitAccessControlEntry) entries[1]; assertEquals(everyone, princ2AllowEntry.getPrincipal()); assertACE(princ2AllowEntry, true, privilegesFromNames(JCR_READ, JCR_WRITE)); }
@Test public void testComplementaryGroupEntry() throws Exception { Privilege[] readPriv = privilegesFromNames(JCR_READ); Privilege[] writePriv = privilegesFromNames(JCR_WRITE); Principal everyone = principalManager.getEveryone(); acl.addEntry(testPrincipal, readPriv, true); acl.addEntry(everyone, readPriv, true); acl.addEntry(testPrincipal, writePriv, false); acl.addEntry(everyone, writePriv, true); acl.addEntry(testPrincipal, readPriv, false); AccessControlEntry[] entries = acl.getAccessControlEntries(); assertEquals(2, entries.length); JackrabbitAccessControlEntry first = (JackrabbitAccessControlEntry) entries[0]; assertEquals(everyone, first.getPrincipal()); JackrabbitAccessControlEntry second = (JackrabbitAccessControlEntry) entries[1]; assertEquals(testPrincipal, second.getPrincipal()); assertACE(second, false, privilegesFromNames(JCR_READ, JCR_WRITE)); }
@Test public void testAllowWriteDenyRemoveGroupEntries() throws Exception { Principal everyone = principalManager.getEveryone(); Privilege[] grPriv = privilegesFromNames(REP_WRITE); Privilege[] dePriv = privilegesFromNames(JCR_REMOVE_CHILD_NODES); acl.addEntry(everyone, grPriv, true, Collections.emptyMap()); acl.addEntry(everyone, dePriv, false, Collections.emptyMap()); Set<Privilege> allows = new HashSet<>(); Set<Privilege> denies = new HashSet<>(); AccessControlEntry[] entries = acl.getAccessControlEntries(); for (AccessControlEntry en : entries) { if (everyone.equals(en.getPrincipal()) && en instanceof JackrabbitAccessControlEntry) { JackrabbitAccessControlEntry ace = (JackrabbitAccessControlEntry) en; Privilege[] privs = ace.getPrivileges(); if (ace.isAllow()) { allows.addAll(Arrays.asList(privs)); } else { denies.addAll(Arrays.asList(privs)); } } } Privilege[] expected = privilegesFromNames(JCR_ADD_CHILD_NODES, JCR_REMOVE_NODE, JCR_MODIFY_PROPERTIES, JCR_NODE_TYPE_MANAGEMENT); assertEquals(expected.length, allows.size()); assertEquals(ImmutableSet.copyOf(expected), allows); assertEquals(1, denies.size()); assertArrayEquals(privilegesFromNames(JCR_REMOVE_CHILD_NODES), denies.toArray(new Privilege[0])); }
@Test public void testDifferentPrivilegeImplementation() throws Exception { Privilege[] readPriv = privilegesFromNames(JCR_READ); acl.addEntry(testPrincipal, readPriv, false); assertFalse(acl.addEntry(new PrincipalImpl(testPrincipal.getName()), readPriv, false)); assertFalse(acl.addEntry(() -> testPrincipal.getName(), readPriv, false)); }
@Test public void testNewEntriesAppendedAtEnd() throws Exception { Privilege[] readPriv = privilegesFromNames(JCR_READ); Privilege[] writePriv = privilegesFromNames(JCR_WRITE); acl.addEntry(testPrincipal, readPriv, true); acl.addEntry(principalManager.getEveryone(), readPriv, true); acl.addEntry(testPrincipal, writePriv, false); AccessControlEntry[] entries = acl.getAccessControlEntries(); assertEquals(3, entries.length); JackrabbitAccessControlEntry last = (JackrabbitAccessControlEntry) entries[2]; assertEquals(testPrincipal, last.getPrincipal()); assertACE(last, false, writePriv); }
@Test public void testRestrictions() throws Exception { String[] names = acl.getRestrictionNames(); assertNotNull(names); assertEquals(4, names.length); assertArrayEquals(new String[] {REP_GLOB, REP_NT_NAMES, REP_PREFIXES, REP_ITEM_NAMES}, names); assertEquals(PropertyType.STRING, acl.getRestrictionType(names[0])); assertEquals(PropertyType.NAME, acl.getRestrictionType(names[1])); assertEquals(PropertyType.STRING, acl.getRestrictionType(names[2])); assertEquals(PropertyType.NAME, acl.getRestrictionType(names[3])); Privilege[] writePriv = privilegesFromNames(JCR_WRITE); assertTrue(acl.addAccessControlEntry(testPrincipal, writePriv)); assertEquals(1, acl.getAccessControlEntries().length); assertFalse(acl.addAccessControlEntry(testPrincipal, writePriv)); assertEquals(1, acl.getAccessControlEntries().length); assertFalse(acl.addEntry(testPrincipal, writePriv, true)); assertEquals(1, acl.getAccessControlEntries().length); assertTrue(acl.addEntry(testPrincipal, writePriv, false)); assertEquals(1, acl.getAccessControlEntries().length); Map<String, Value> restrictions = Collections.singletonMap(REP_GLOB, getValueFactory().createValue("/.*")); assertTrue(acl.addEntry(testPrincipal, writePriv, false, restrictions)); assertEquals(2, acl.getAccessControlEntries().length); assertFalse(acl.addEntry(testPrincipal, writePriv, false, restrictions)); assertEquals(2, acl.getAccessControlEntries().length); assertTrue(acl.addEntry(testPrincipal, writePriv, true, restrictions)); assertEquals(2, acl.getAccessControlEntries().length); }
@Test public void testMvRestrictions() throws Exception { ValueFactory vf = getValueFactory(); Value[] vs = new Value[] { vf.createValue(JcrConstants.NT_FILE, PropertyType.NAME), vf.createValue(JcrConstants.NT_FOLDER, PropertyType.NAME) }; Map<String, Value[]> mvRestrictions = Collections.singletonMap(REP_NT_NAMES, vs); Map<String, Value> restrictions = Collections.singletonMap(REP_GLOB, vf.createValue("/.*")); assertTrue(acl.addEntry(testPrincipal, testPrivileges, false, restrictions, mvRestrictions)); assertFalse(acl.addEntry(testPrincipal, testPrivileges, false, restrictions, mvRestrictions)); assertEquals(1, acl.getAccessControlEntries().length); JackrabbitAccessControlEntry ace = (JackrabbitAccessControlEntry) acl.getAccessControlEntries()[0]; try { ace.getRestriction(REP_NT_NAMES); fail(); } catch (ValueFormatException e) { } Value[] vvs = ace.getRestrictions(REP_NT_NAMES); assertArrayEquals(vs, vvs); }
@Test public void testUnsupportedRestrictions() throws Exception { Map<String, Value> restrictions = Collections.singletonMap("unknownRestriction", getValueFactory().createValue("value")); try { acl.addEntry(testPrincipal, testPrivileges, false, restrictions); fail("Invalid restrictions -> AccessControlException expected"); } catch (AccessControlException e) { } }
@Test(expected = AccessControlException.class) public void testUnsupportedRestrictions2() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("restr", Type.NAME, false); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.singletonMap("unsupported", getValueFactory().createValue("value"))); }
@Test(expected = AccessControlException.class) public void testInvalidRestrictionType() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("restr", Type.NAME, false); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.singletonMap("restr", getValueFactory().createValue(true))); }
@Test(expected = AccessControlException.class) public void testMandatoryRestrictions() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAME, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.emptyMap(), Collections.emptyMap()); }
@Test public void testMandatoryRestrictionsPresent() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAME, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.singletonMap("mandatory", getValueFactory(root).createValue("name", PropertyType.NAME)), Collections.emptyMap()); }
@Test(expected = AccessControlException.class) public void testMandatoryRestrictionsPresentAsMV() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAME, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.emptyMap(), Collections.singletonMap("mandatory", new Value[] {getValueFactory(root).createValue("name", PropertyType.NAME)})); }
@Test(expected = AccessControlException.class) public void testMandatoryMVRestrictions() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAMES, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.emptyMap(), Collections.emptyMap()); }
@Test(expected = AccessControlException.class) public void testMandatoryMVRestrictionsPresentAsSingle() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAMES, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.singletonMap("mandatory", getValueFactory(root).createValue("name", PropertyType.NAME)), Collections.emptyMap()); }
@Test public void testMandatoryMVRestrictionsPresent() throws Exception { RestrictionProvider rp = new TestRestrictionProvider("mandatory", Type.NAMES, true); JackrabbitAccessControlList acl = createACL(TEST_PATH, new ArrayList<>(), namePathMapper, rp); acl.addEntry(testPrincipal, testPrivileges, false, Collections.emptyMap(), Collections.singletonMap("mandatory", new Value[] {getValueFactory(root).createValue("name", PropertyType.NAME)})); }