@Test public void testSettleRightWithImpliedRights() throws Exception { SecurityRule allowImpliedADT = getMockedSecurityRule("allowImpliedADT", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsADT), ALLOW); SecurityRule denyImpliedADT = getMockedSecurityRule("denyImpliedADT", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsADT), DENY); SecurityRule allowImpliedDAF = getMockedSecurityRule("allowImpliedDAF", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsDAF), ALLOW); SecurityRule denyImpliedDAF = getMockedSecurityRule("denyImpliedDAF", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), Arrays.asList(impliedTestRightsDAF), DENY); XWikiSecurityAccess allowAccessADT = defaultAccess.clone(); allowAccessADT.set(impliedTestRightsADT, ALLOW); for (Right right : allTestRights) { allowAccessADT.allow(right); } XWikiSecurityAccess tieADT = defaultAccess.clone(); tieADT.set(impliedTestRightsADT, ALLOW); for (Right right : allTestRights) { tieADT.set(right, right.getTieResolutionPolicy()); } XWikiSecurityAccess allowAccessDAF = defaultAccess.clone(); allowAccessDAF.set(impliedTestRightsDAF, ALLOW); for (Right right : allTestRights) { allowAccessDAF.allow(right); } XWikiSecurityAccess denyADTAccess = defaultAccess.clone(); denyADTAccess.deny(impliedTestRightsADT); XWikiSecurityAccess denyDAFAccess = defaultAccess.clone(); denyDAFAccess.deny(impliedTestRightsDAF); XWikiSecurityAccess denyAccessADT = defaultAccess.clone(); denyAccessADT.set(impliedTestRightsADT, ALLOW); for (Right right : allTestRights) { denyAccessADT.deny(right); } XWikiSecurityAccess denyAccessDAF = defaultAccess.clone(); denyAccessDAF.set(impliedTestRightsDAF, ALLOW); for (Right right : allTestRights) { denyAccessDAF.deny(right); } assertAccess("When a right implying others rights is allowed, imply those rights (ADT)", userRef, docRef, allowAccessADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("allowAccessADT", docRef, Arrays.asList(Arrays.asList(allowImpliedADT))))); assertAccess("When a right implying others rights is allowed, imply those rights (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("allowAccessDAF", docRef, Arrays.asList(Arrays.asList(allowImpliedDAF))))); assertAccess("When a right implying others rights is denied, do not denied implied rights (ADT)", userRef, docRef, denyADTAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("denyAccessADT", docRef, Arrays.asList(Arrays.asList(denyImpliedADT))))); assertAccess("When a right implying others rights is denied, do not denied implied rights (DAF)", userRef, docRef, denyDAFAccess, authorizationSettler.settle(userRef, Arrays.asList(groupRef), getMockedSecurityRuleEntries("denyAccessDAF", docRef, Arrays.asList(Arrays.asList(denyImpliedDAF))))); SecurityRule allowAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("allowAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, ALLOW); SecurityRule denyAllTestRightsUserAndAnotherGroup = getMockedSecurityRule("denyAllTestRightsUserAndAnotherGroup", Arrays.asList(userRef), Arrays.asList(anotherGroupRef), allTestRights, DENY); SecurityRule denyAllTestRightsAnotherUserAndGroup = getMockedSecurityRule("denyAllTestRightsAnotherUserAndGroup", Arrays.asList(anotherUserRef), Arrays.asList(groupRef), allTestRights, DENY); Deque<SecurityRuleEntry> conflictAllowDenySameTargetADT = getMockedSecurityRuleEntries("conflictAllowDenySameTargetADT", docRef, Arrays.asList( Arrays.asList(allowImpliedADT, denyAllTestRightsUserAndAnotherGroup))); Deque<SecurityRuleEntry> conflictAllowDenySameTargetDAF = getMockedSecurityRuleEntries("conflictAllowDenySameTargetDAF", docRef, Arrays.asList( Arrays.asList(allowImpliedDAF, denyAllTestRightsUserAndAnotherGroup))); Deque<SecurityRuleEntry> conflictAllowDenyUserGroupADT = getMockedSecurityRuleEntries("conflictAllowDenyUserGroupADT", docRef, Arrays.asList( Arrays.asList(allowImpliedADT, denyAllTestRightsAnotherUserAndGroup))); Deque<SecurityRuleEntry> conflictAllowDenyUserGroupDAF = getMockedSecurityRuleEntries("conflictAllowDenyUserGroupDAF", docRef, Arrays.asList( Arrays.asList(allowImpliedDAF, denyAllTestRightsAnotherUserAndGroup))); assertAccess("When allowed implied right for user is denied for same user in another rule, use most favorable tie resolution policy (ADT)", userRef, docRef, tieADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTargetADT)); assertAccess("When allowed implied right for user is denied for same user in another rule, use most favorable tie resolution policy (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenySameTargetDAF)); assertAccess("When allowed implied right for group is denied for same group in another rule, use most favorable tie resolution policy (ADT)", anotherUserRef, docRef, tieADT, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTargetADT)); assertAccess("When allowed implied right for group is denied for same group in another rule, use most favorable tie resolution policy (DAF)", anotherUserRef, docRef, allowAccessDAF, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenySameTargetDAF)); assertAccess("When allowed implied right for user is denied for its group in another rule, allow it. (ADT)", userRef, docRef, allowAccessADT, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroupADT)); assertAccess("When allowed implied right for user is denied for its group in another rule, allow it. (DAF)", userRef, docRef, allowAccessDAF, authorizationSettler.settle(userRef, Arrays.asList(groupRef), conflictAllowDenyUserGroupDAF)); assertAccess("When allowed implied right for group is denied for one of its user in another rule, deny it. (ADT)", anotherUserRef, docRef, denyAccessADT, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroupADT)); assertAccess("When allowed implied right for group is denied for one of its user in another rule, deny it. (DAF)", anotherUserRef, docRef, denyAccessDAF, authorizationSettler.settle(anotherUserRef, Arrays.asList(anotherGroupRef), conflictAllowDenyUserGroupDAF)); }
@Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; } }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }  }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }   }
DefaultAuthorizationSettler extends AbstractAuthorizationSettler { @Override protected XWikiSecurityAccess settle(UserSecurityReference user, Collection<GroupSecurityReference> groups, SecurityRuleEntry entry, Policies policies) { Set<Right> enabledRights = Right.getEnabledRights(entry.getReference().getSecurityType()); Set<Right> fromUser = new RightSet(); Set<Right> allowed = new RightSet(); XWikiSecurityAccess access = new XWikiSecurityAccess(); for (Right right : enabledRights) { for (SecurityRule rule : entry.getRules()) { if (rule.match(right)) { if (rule.getState() == ALLOW) { allowed.add(right); } resolveLevel(right, user, groups, rule, access, policies, fromUser); if (access.get(right) == ALLOW) { implyRights(right, access, enabledRights, policies, fromUser); } } } } for (Right right : allowed) { if (access.get(right) == UNDETERMINED) { access.deny(right); } } return access; }    }