AccessControlUtil { public static boolean isAuthorized(AccessControlList acl, User user, Organization org, Object action) { if (action == null || user == null || acl == null || org == null) throw new IllegalArgumentException(); if (user.hasRole(GLOBAL_ADMIN_ROLE) || user.hasRole(org.getAdminRole())) return true; Set<Role> userRoles = user.getRoles(); for (AccessControlEntry entry : acl.getEntries()) { if (!action.toString().equals(entry.getAction())) continue; String aceRole = entry.getRole(); for (Role role : userRoles) { if (!role.getName().equals(aceRole)) continue; return entry.isAllow(); } } return false; } private  AccessControlUtil(); static boolean isAuthorized(AccessControlList acl, User user, Organization org, Object action); static boolean isAuthorizedAll(AccessControlList acl, User user, Organization org, Object... actions); static boolean isAuthorizedOne(AccessControlList acl, User user, Organization org, Object... actions); static boolean isProhibitedAll(AccessControlList acl, User user, Organization org, Object... actions); static boolean isProhibitedOne(AccessControlList acl, User user, Organization org, Object... actions); static AccessControlList extendAcl(AccessControlList acl, String role, String action, boolean allow); static AccessControlList reduceAcl(AccessControlList acl, String role, String action); static AccessControlList acl(Either<AccessControlEntry, List<AccessControlEntry>>... entries); static Either<AccessControlEntry, List<AccessControlEntry>> entry(String role, String action, boolean allow); static Either<AccessControlEntry, List<AccessControlEntry>> entries(final String role,
          Tuple<String, Boolean>... actions); static boolean equals(AccessControlList a, AccessControlList b); static Checksum calculateChecksum(AccessControlList acl);  }
@Test public void testIsAuthorized() throws Exception { AccessControlList acl = new AccessControlList(); acl.getEntries().add(new AccessControlEntry("role1", "action1", true)); acl.getEntries().add(new AccessControlEntry("role1", "action2", true)); acl.getEntries().add(new AccessControlEntry("role1", "action3", false)); acl.getEntries().add(new AccessControlEntry("role2", "action1", false)); acl.getEntries().add(new AccessControlEntry("role2", "action2", false)); acl.getEntries().add(new AccessControlEntry("role2", "action3", true)); JaxbOrganization org = new DefaultOrganization(); User user1 = new JaxbUser("user1", "test", org, new JaxbRole("role1", org), new JaxbRole("someRole", org)); User user2 = new JaxbUser("user2", "test", org, new JaxbRole("role2", org), new JaxbRole("someRole", org)); User localAdmin = new JaxbUser("localAdmin", "test", org, new JaxbRole(org.getAdminRole(), org), new JaxbRole( "someRole", org)); User globalAdmin = new JaxbUser("globalAdmin", "test", org, new JaxbRole(GLOBAL_ADMIN_ROLE, org)); assertTrue(AccessControlUtil.isAuthorized(acl, user1, org, "action1")); assertTrue(AccessControlUtil.isAuthorized(acl, user1, org, "action2")); assertFalse(AccessControlUtil.isAuthorized(acl, user1, org, "action3")); assertFalse(AccessControlUtil.isAuthorized(acl, user2, org, "action1")); assertFalse(AccessControlUtil.isAuthorized(acl, user2, org, "action2")); assertTrue(AccessControlUtil.isAuthorized(acl, user2, org, "action3")); assertTrue(AccessControlUtil.isAuthorized(acl, localAdmin, org, "action1")); assertTrue(AccessControlUtil.isAuthorized(acl, localAdmin, org, "action2")); assertTrue(AccessControlUtil.isAuthorized(acl, localAdmin, org, "action3")); assertTrue(AccessControlUtil.isAuthorized(acl, globalAdmin, org, "action1")); assertTrue(AccessControlUtil.isAuthorized(acl, globalAdmin, org, "action2")); assertTrue(AccessControlUtil.isAuthorized(acl, globalAdmin, org, "action3")); assertTrue(AccessControlUtil.isAuthorizedAll(acl, globalAdmin, org, "action1", "action2", "action3")); assertFalse(AccessControlUtil.isAuthorizedAll(acl, user1, org, "action1", "action2", "action3")); assertTrue(AccessControlUtil.isAuthorizedAll(acl, user1, org, "action1", "action2")); assertTrue(AccessControlUtil.isAuthorizedOne(acl, globalAdmin, org, "action1", "action2", "action3")); assertFalse(AccessControlUtil.isAuthorizedOne(acl, user1, org, "action3", "action4", "action5")); assertTrue(AccessControlUtil.isAuthorizedOne(acl, user1, org, "action1", "action3")); assertFalse(AccessControlUtil.isProhibitedAll(acl, globalAdmin, org, "action1", "action2", "action3")); assertFalse(AccessControlUtil.isProhibitedAll(acl, user1, org, "action1", "action2", "action3")); assertTrue(AccessControlUtil.isProhibitedAll(acl, user1, org, "action3", "action4")); assertFalse(AccessControlUtil.isProhibitedOne(acl, globalAdmin, org, "action1", "action2", "action3")); assertFalse(AccessControlUtil.isProhibitedOne(acl, user1, org, "action1", "action2")); assertTrue(AccessControlUtil.isProhibitedOne(acl, user1, org, "action1", "action2", "action3")); }