@Test public void testSettleTieResolutionPolicy() throws Exception { SecurityRule allowAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("allowAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, ALLOW); SecurityRule denyAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("denyAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, DENY); SecurityRule denyAllTestRightsAnotherUserAndGroup = getMockedSecurityRule("denyAllTestRightsAnotherUserAndGroup", Arrays.asList(anotherUserRef), Arrays.asList(groupRef), allTestRights, DENY); Deque<SecurityRuleEntry> conflictAllowDenySameTarget = getMockedSecurityRuleEntries("conflictAllowDenySameTarget", docRef, Arrays.asList( Arrays.asList(allowAllTestRightsUserAndAnotherGroup, denyAllTestRightsUserAndAnotherGroup))); Deque<SecurityRuleEntry> conflictDenyAllowSameTarget = getMockedSecurityRuleEntries("conflictDenyAllowSameTarget", docRef, Arrays.asList( Arrays.asList(denyAllTestRightsUserAndAnotherGroup, allowAllTestRightsUserAndAnotherGroup))); Deque<SecurityRuleEntry> conflictAllowDenyUserGroup = getMockedSecurityRuleEntries("conflictAllowDenyUserGroup", docRef, Arrays.asList( Arrays.asList(allowAllTestRightsUserAndAnotherGroup, denyAllTestRightsAnotherUserAndGroup))); Deque<SecurityRuleEntry> conflictDenyAllowUserGroup = getMockedSecurityRuleEntries("conflictDenyAllowUserGroup", docRef, Arrays.asList( Arrays.asList(denyAllTestRightsAnotherUserAndGroup, allowAllTestRightsUserAndAnotherGroup))); XWikiSecurityAccess allowAccess = defaultAccess.clone(); for (Right right : allTestRights) { allowAccess.allow(right); } XWikiSecurityAccess denyAccess = defaultAccess.clone(); for (Right right : allTestRights) { denyAccess.deny(right); } XWikiSecurityAccess tieAccess = defaultAccess.clone(); for (Right right : allTestRights) { tieAccess.set(right, right.getTieResolutionPolicy()); } assertAccess("When allowed right for user is denied for same user in another rule, use tie resolution policy", userRef, docRef, tieAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTarget)); assertAccess("When denied right for user is allowed for same user in another rule, use tie resolution policy", userRef, docRef, tieAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictDenyAllowSameTarget)); assertAccess("When allowed right for group is denied for same group in another rule, use tie resolution policy", anotherUserRef, docRef, tieAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTarget)); assertAccess("When denied right for group is allowed for same group in another rule, use tie resolution policy", anotherUserRef, docRef, tieAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictDenyAllowSameTarget)); assertAccess("When allowed right for user is denied for its group in another rule, allow it.", userRef, docRef, allowAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroup)); assertAccess("When allowed right for group is denied for one of its user in another rule, deny it.", anotherUserRef, docRef, denyAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroup)); assertAccess("When denied right for group is allowed for one of its user in another rule, allow it.", userRef, docRef, allowAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictDenyAllowUserGroup)); assertAccess("When denied right for user is allowed for its group in another rule, deny it.", anotherUserRef, docRef, denyAccess, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictDenyAllowUserGroup)); }
@Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; } }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }  }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }   }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }    }