@Test public void testSettleOneAllowImpliesDenyForAllOthers() throws Exception { XWikiSecurityAccess defaultAllowRight0 = defaultAccess.clone(); XWikiSecurityAccess defaultDenyRight0 = defaultAccess.clone(); XWikiSecurityAccess defaultAllowRight6 = defaultAccess.clone(); defaultAllowRight0.allow(allTestRights.get(0)); defaultDenyRight0.deny(allTestRights.get(0)); defaultAllowRight6.allow(allTestRights.get(6)); assertAccess("When an allow rules is found, deny any not matching user", anotherUserRef, docRef, defaultDenyRight0, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), getMockedSecurityRuleEntries("onlyRight0", docRef, Arrays.asList(Arrays.asList(getMockedSecurityRule( "onlyRight0", Arrays.asList(userRef), Collections.<GroupSecurityReference>emptyList(), Arrays.asList(allTestRights.get(0)), RuleState.ALLOW)))))); assertAccess("When an allow rules is found, do not deny a user matching in another rule", anotherUserRef, docRef, defaultAllowRight6, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), getMockedSecurityRuleEntries("allowRight6ToAnotherUser", docRef, Arrays.asList(Arrays.asList( getMockedSecurityRule( "allowRight6ToUser", Arrays.asList(userRef), Collections.<GroupSecurityReference>emptyList(), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW), getMockedSecurityRule( "allowRight6ToAnotherUser", Arrays.asList(anotherUserRef), Collections.<GroupSecurityReference>emptyList(), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW)))))); assertAccess("When an allow rules is found, do not deny a user matching in another rule", anotherUserRef, docRef, defaultAllowRight6, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), getMockedSecurityRuleEntries("allowRight6ToAnotherGroup", docRef, Arrays.asList(Arrays.asList( getMockedSecurityRule( "allowRight6ToUserAndGroup", Arrays.asList(userRef), Arrays.asList(groupRef), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW), getMockedSecurityRule( "allowRight6ToAnotherGroup", Collections.<UserSecurityReference>emptyList(), Arrays.asList(anotherGroupRef), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW)))))); assertAccess("When an allow rules is found, do not deny a user matching the rule", userRef, docRef, defaultAllowRight6, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("onlyRight6", docRef, Arrays.asList(Arrays.asList(getMockedSecurityRule( "onlyRight6", Arrays.asList(userRef), Collections.<GroupSecurityReference>emptyList(), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW)))))); assertAccess("When an allow rules is found, do not deny a user matching a group in the rule", anotherUserRef, docRef, defaultAllowRight6, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), getMockedSecurityRuleEntries("allowRight6", docRef, Arrays.asList(Arrays.asList( getMockedSecurityRule( "allowRight6ToUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(allTestRights.get(6)), RuleState.ALLOW)))))); }
@Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; } }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }  }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }   }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }    }