@Test public void testGetPrincipalAceBeansForActionReadCreateModifyDelete() throws Exception { AceBean bean2Clone = bean2.clone(); bean2Clone.setPrincipalName(FAKE_PRINCIPAL_ID); AceBean bean2ContentClone = bean2Content.clone(); bean2ContentClone.setPrincipalName(FAKE_PRINCIPAL_ID); doReturn(new JackrabbitAccessControlEntry[] { aceBeanToAce(bean2Clone), aceBeanToAce(bean2ContentClone) }).when(jackrabbitAccessControlList).getAccessControlEntries(); Set<AceBean> resultAceBeans = aceBeanInstallerIncremental.getPrincipalAceBeansForActionAceBean(beanWithAction2, session); assertEquals(2, resultAceBeans.size()); Iterator<AceBean> resultAceBeansIt = resultAceBeans.iterator(); AceBean firstResult = resultAceBeansIt.next(); assertEquals(bean2.getPrincipalName(), firstResult.getPrincipalName()); assertEquals(bean2.getPermission(), firstResult.getPermission()); assertEquals(bean2.getJcrPath(), firstResult.getJcrPath()); assertArrayEquals(bean2.getPrivileges(), firstResult.getPrivileges()); assertArrayEquals(null, firstResult.getActions()); assertTrue(firstResult.getRestrictions().isEmpty()); AceBean secondResult = resultAceBeansIt.next(); assertEquals(bean2Content.getPrincipalName(), secondResult.getPrincipalName()); assertEquals(bean2Content.getPermission(), secondResult.getPermission()); assertEquals(bean2Content.getJcrPath(), secondResult.getJcrPath()); assertArrayEquals(bean2Content.getPrivileges(), secondResult.getPrivileges()); assertArrayEquals(null, secondResult.getActions()); assertEquals(1, secondResult.getRestrictions().size()); assertEquals(AceBean.RESTRICTION_NAME_GLOB, secondResult.getRestrictions().get(0).getName()); assertEquals("*/jcr:content*", secondResult.getRestrictions().get(0).getValue()); }
Set<AceBean> getPrincipalAceBeansForActionAceBean(AceBean origAceBean, Session session) throws RepositoryException { Set<AceBean> aceBeansForActionEntry = new LinkedHashSet<AceBean>(); Principal testActionMapperPrincipal = getTestActionMapperPrincipal(); applyCqActions(origAceBean, session, testActionMapperPrincipal); JackrabbitAccessControlList newAcl = getAccessControlList(session.getAccessControlManager(), origAceBean.getJcrPathForPolicyApi()); boolean isFirst = true; for (AccessControlEntry newAce : newAcl.getAccessControlEntries()) { if (!newAce.getPrincipal().equals(testActionMapperPrincipal)) { continue; } AceBean privilegesAceBeanForAction = AcHelper.getAceBean(newAce, newAcl); privilegesAceBeanForAction.setPrincipalName(origAceBean.getPrincipalName()); if (isFirst) { if (origAceBean.containsRestriction(AceBean.RESTRICTION_NAME_GLOB) && privilegesAceBeanForAction.containsRestriction(AceBean.RESTRICTION_NAME_GLOB)) { throw new IllegalArgumentException( "When using actions that produce rep:glob restrictions (e.g. for page paths), rep:glob cannot be configured (origAceBean=" + origAceBean.getRestrictions() + ", privilegesAceBeanForAction=" + privilegesAceBeanForAction.getRestrictions() + "), check configuration for " + origAceBean); } else { privilegesAceBeanForAction.getRestrictions().addAll(origAceBean.getRestrictions()); } } aceBeansForActionEntry.add(privilegesAceBeanForAction); newAcl.removeAccessControlEntry(newAce); isFirst = false; } AccessControlManager acMgr = session.getAccessControlManager(); acMgr.setPolicy(origAceBean.getJcrPath(), newAcl); AceBean firstMappedBean = aceBeansForActionEntry.iterator().next(); Set<String> newPrivilegesFirstMappedBean = new LinkedHashSet<String>(); if (firstMappedBean.getPrivileges() != null) { newPrivilegesFirstMappedBean.addAll(Arrays.asList(firstMappedBean.getPrivileges())); } Set<String> flatSetPrincipalsOfFirstMappedBean = flatSetResolvedAggregates(firstMappedBean.getPrivileges(), acMgr, true); if (origAceBean.getPrivileges() != null) { for (String origBeanPrivString : origAceBean.getPrivileges()) { if (!flatSetPrincipalsOfFirstMappedBean.contains(origBeanPrivString)) { newPrivilegesFirstMappedBean.add(origBeanPrivString); } } } firstMappedBean.setPrivilegesString(StringUtils.join(newPrivilegesFirstMappedBean, ",")); if (LOG.isDebugEnabled()) { StringBuilder buf = new StringBuilder(); buf.append("CqActions at path " + origAceBean.getJcrPath() + " with authorizableId=" + origAceBean.getAuthorizableId() + "/" + testActionMapperPrincipal.getName() + " produced \n"); for (AceBean aceBean : aceBeansForActionEntry) { buf.append(" " + toAceCompareString(aceBean, acMgr) + "\n"); } LOG.debug(buf.toString()); } return aceBeansForActionEntry; }
AceBeanInstallerIncremental extends BaseAceBeanInstaller implements AceBeanInstaller { Set<AceBean> getPrincipalAceBeansForActionAceBean(AceBean origAceBean, Session session) throws RepositoryException { Set<AceBean> aceBeansForActionEntry = new LinkedHashSet<AceBean>(); Principal testActionMapperPrincipal = getTestActionMapperPrincipal(); applyCqActions(origAceBean, session, testActionMapperPrincipal); JackrabbitAccessControlList newAcl = getAccessControlList(session.getAccessControlManager(), origAceBean.getJcrPathForPolicyApi()); boolean isFirst = true; for (AccessControlEntry newAce : newAcl.getAccessControlEntries()) { if (!newAce.getPrincipal().equals(testActionMapperPrincipal)) { continue; } AceBean privilegesAceBeanForAction = AcHelper.getAceBean(newAce, newAcl); privilegesAceBeanForAction.setPrincipalName(origAceBean.getPrincipalName()); if (isFirst) { if (origAceBean.containsRestriction(AceBean.RESTRICTION_NAME_GLOB) && privilegesAceBeanForAction.containsRestriction(AceBean.RESTRICTION_NAME_GLOB)) { throw new IllegalArgumentException( "When using actions that produce rep:glob restrictions (e.g. for page paths), rep:glob cannot be configured (origAceBean=" + origAceBean.getRestrictions() + ", privilegesAceBeanForAction=" + privilegesAceBeanForAction.getRestrictions() + "), check configuration for " + origAceBean); } else { privilegesAceBeanForAction.getRestrictions().addAll(origAceBean.getRestrictions()); } } aceBeansForActionEntry.add(privilegesAceBeanForAction); newAcl.removeAccessControlEntry(newAce); isFirst = false; } AccessControlManager acMgr = session.getAccessControlManager(); acMgr.setPolicy(origAceBean.getJcrPath(), newAcl); AceBean firstMappedBean = aceBeansForActionEntry.iterator().next(); Set<String> newPrivilegesFirstMappedBean = new LinkedHashSet<String>(); if (firstMappedBean.getPrivileges() != null) { newPrivilegesFirstMappedBean.addAll(Arrays.asList(firstMappedBean.getPrivileges())); } Set<String> flatSetPrincipalsOfFirstMappedBean = flatSetResolvedAggregates(firstMappedBean.getPrivileges(), acMgr, true); if (origAceBean.getPrivileges() != null) { for (String origBeanPrivString : origAceBean.getPrivileges()) { if (!flatSetPrincipalsOfFirstMappedBean.contains(origBeanPrivString)) { newPrivilegesFirstMappedBean.add(origBeanPrivString); } } } firstMappedBean.setPrivilegesString(StringUtils.join(newPrivilegesFirstMappedBean, ",")); if (LOG.isDebugEnabled()) { StringBuilder buf = new StringBuilder(); buf.append("CqActions at path " + origAceBean.getJcrPath() + " with authorizableId=" + origAceBean.getAuthorizableId() + "/" + testActionMapperPrincipal.getName() + " produced \n"); for (AceBean aceBean : aceBeansForActionEntry) { buf.append(" " + toAceCompareString(aceBean, acMgr) + "\n"); } LOG.debug(buf.toString()); } return aceBeansForActionEntry; } }
AceBeanInstallerIncremental extends BaseAceBeanInstaller implements AceBeanInstaller { Set<AceBean> getPrincipalAceBeansForActionAceBean(AceBean origAceBean, Session session) throws RepositoryException { Set<AceBean> aceBeansForActionEntry = new LinkedHashSet<AceBean>(); Principal testActionMapperPrincipal = getTestActionMapperPrincipal(); applyCqActions(origAceBean, session, testActionMapperPrincipal); JackrabbitAccessControlList newAcl = getAccessControlList(session.getAccessControlManager(), origAceBean.getJcrPathForPolicyApi()); boolean isFirst = true; for (AccessControlEntry newAce : newAcl.getAccessControlEntries()) { if (!newAce.getPrincipal().equals(testActionMapperPrincipal)) { continue; } AceBean privilegesAceBeanForAction = AcHelper.getAceBean(newAce, newAcl); privilegesAceBeanForAction.setPrincipalName(origAceBean.getPrincipalName()); if (isFirst) { if (origAceBean.containsRestriction(AceBean.RESTRICTION_NAME_GLOB) && privilegesAceBeanForAction.containsRestriction(AceBean.RESTRICTION_NAME_GLOB)) { throw new IllegalArgumentException( "When using actions that produce rep:glob restrictions (e.g. for page paths), rep:glob cannot be configured (origAceBean=" + origAceBean.getRestrictions() + ", privilegesAceBeanForAction=" + privilegesAceBeanForAction.getRestrictions() + "), check configuration for " + origAceBean); } else { privilegesAceBeanForAction.getRestrictions().addAll(origAceBean.getRestrictions()); } } aceBeansForActionEntry.add(privilegesAceBeanForAction); newAcl.removeAccessControlEntry(newAce); isFirst = false; } AccessControlManager acMgr = session.getAccessControlManager(); acMgr.setPolicy(origAceBean.getJcrPath(), newAcl); AceBean firstMappedBean = aceBeansForActionEntry.iterator().next(); Set<String> newPrivilegesFirstMappedBean = new LinkedHashSet<String>(); if (firstMappedBean.getPrivileges() != null) { newPrivilegesFirstMappedBean.addAll(Arrays.asList(firstMappedBean.getPrivileges())); } Set<String> flatSetPrincipalsOfFirstMappedBean = flatSetResolvedAggregates(firstMappedBean.getPrivileges(), acMgr, true); if (origAceBean.getPrivileges() != null) { for (String origBeanPrivString : origAceBean.getPrivileges()) { if (!flatSetPrincipalsOfFirstMappedBean.contains(origBeanPrivString)) { newPrivilegesFirstMappedBean.add(origBeanPrivString); } } } firstMappedBean.setPrivilegesString(StringUtils.join(newPrivilegesFirstMappedBean, ",")); if (LOG.isDebugEnabled()) { StringBuilder buf = new StringBuilder(); buf.append("CqActions at path " + origAceBean.getJcrPath() + " with authorizableId=" + origAceBean.getAuthorizableId() + "/" + testActionMapperPrincipal.getName() + " produced \n"); for (AceBean aceBean : aceBeansForActionEntry) { buf.append(" " + toAceCompareString(aceBean, acMgr) + "\n"); } LOG.debug(buf.toString()); } return aceBeansForActionEntry; }  }
AceBeanInstallerIncremental extends BaseAceBeanInstaller implements AceBeanInstaller { Set<AceBean> getPrincipalAceBeansForActionAceBean(AceBean origAceBean, Session session) throws RepositoryException { Set<AceBean> aceBeansForActionEntry = new LinkedHashSet<AceBean>(); Principal testActionMapperPrincipal = getTestActionMapperPrincipal(); applyCqActions(origAceBean, session, testActionMapperPrincipal); JackrabbitAccessControlList newAcl = getAccessControlList(session.getAccessControlManager(), origAceBean.getJcrPathForPolicyApi()); boolean isFirst = true; for (AccessControlEntry newAce : newAcl.getAccessControlEntries()) { if (!newAce.getPrincipal().equals(testActionMapperPrincipal)) { continue; } AceBean privilegesAceBeanForAction = AcHelper.getAceBean(newAce, newAcl); privilegesAceBeanForAction.setPrincipalName(origAceBean.getPrincipalName()); if (isFirst) { if (origAceBean.containsRestriction(AceBean.RESTRICTION_NAME_GLOB) && privilegesAceBeanForAction.containsRestriction(AceBean.RESTRICTION_NAME_GLOB)) { throw new IllegalArgumentException( "When using actions that produce rep:glob restrictions (e.g. for page paths), rep:glob cannot be configured (origAceBean=" + origAceBean.getRestrictions() + ", privilegesAceBeanForAction=" + privilegesAceBeanForAction.getRestrictions() + "), check configuration for " + origAceBean); } else { privilegesAceBeanForAction.getRestrictions().addAll(origAceBean.getRestrictions()); } } aceBeansForActionEntry.add(privilegesAceBeanForAction); newAcl.removeAccessControlEntry(newAce); isFirst = false; } AccessControlManager acMgr = session.getAccessControlManager(); acMgr.setPolicy(origAceBean.getJcrPath(), newAcl); AceBean firstMappedBean = aceBeansForActionEntry.iterator().next(); Set<String> newPrivilegesFirstMappedBean = new LinkedHashSet<String>(); if (firstMappedBean.getPrivileges() != null) { newPrivilegesFirstMappedBean.addAll(Arrays.asList(firstMappedBean.getPrivileges())); } Set<String> flatSetPrincipalsOfFirstMappedBean = flatSetResolvedAggregates(firstMappedBean.getPrivileges(), acMgr, true); if (origAceBean.getPrivileges() != null) { for (String origBeanPrivString : origAceBean.getPrivileges()) { if (!flatSetPrincipalsOfFirstMappedBean.contains(origBeanPrivString)) { newPrivilegesFirstMappedBean.add(origBeanPrivString); } } } firstMappedBean.setPrivilegesString(StringUtils.join(newPrivilegesFirstMappedBean, ",")); if (LOG.isDebugEnabled()) { StringBuilder buf = new StringBuilder(); buf.append("CqActions at path " + origAceBean.getJcrPath() + " with authorizableId=" + origAceBean.getAuthorizableId() + "/" + testActionMapperPrincipal.getName() + " produced \n"); for (AceBean aceBean : aceBeansForActionEntry) { buf.append(" " + toAceCompareString(aceBean, acMgr) + "\n"); } LOG.debug(buf.toString()); } return aceBeansForActionEntry; }   }
AceBeanInstallerIncremental extends BaseAceBeanInstaller implements AceBeanInstaller { Set<AceBean> getPrincipalAceBeansForActionAceBean(AceBean origAceBean, Session session) throws RepositoryException { Set<AceBean> aceBeansForActionEntry = new LinkedHashSet<AceBean>(); Principal testActionMapperPrincipal = getTestActionMapperPrincipal(); applyCqActions(origAceBean, session, testActionMapperPrincipal); JackrabbitAccessControlList newAcl = getAccessControlList(session.getAccessControlManager(), origAceBean.getJcrPathForPolicyApi()); boolean isFirst = true; for (AccessControlEntry newAce : newAcl.getAccessControlEntries()) { if (!newAce.getPrincipal().equals(testActionMapperPrincipal)) { continue; } AceBean privilegesAceBeanForAction = AcHelper.getAceBean(newAce, newAcl); privilegesAceBeanForAction.setPrincipalName(origAceBean.getPrincipalName()); if (isFirst) { if (origAceBean.containsRestriction(AceBean.RESTRICTION_NAME_GLOB) && privilegesAceBeanForAction.containsRestriction(AceBean.RESTRICTION_NAME_GLOB)) { throw new IllegalArgumentException( "When using actions that produce rep:glob restrictions (e.g. for page paths), rep:glob cannot be configured (origAceBean=" + origAceBean.getRestrictions() + ", privilegesAceBeanForAction=" + privilegesAceBeanForAction.getRestrictions() + "), check configuration for " + origAceBean); } else { privilegesAceBeanForAction.getRestrictions().addAll(origAceBean.getRestrictions()); } } aceBeansForActionEntry.add(privilegesAceBeanForAction); newAcl.removeAccessControlEntry(newAce); isFirst = false; } AccessControlManager acMgr = session.getAccessControlManager(); acMgr.setPolicy(origAceBean.getJcrPath(), newAcl); AceBean firstMappedBean = aceBeansForActionEntry.iterator().next(); Set<String> newPrivilegesFirstMappedBean = new LinkedHashSet<String>(); if (firstMappedBean.getPrivileges() != null) { newPrivilegesFirstMappedBean.addAll(Arrays.asList(firstMappedBean.getPrivileges())); } Set<String> flatSetPrincipalsOfFirstMappedBean = flatSetResolvedAggregates(firstMappedBean.getPrivileges(), acMgr, true); if (origAceBean.getPrivileges() != null) { for (String origBeanPrivString : origAceBean.getPrivileges()) { if (!flatSetPrincipalsOfFirstMappedBean.contains(origBeanPrivString)) { newPrivilegesFirstMappedBean.add(origBeanPrivString); } } } firstMappedBean.setPrivilegesString(StringUtils.join(newPrivilegesFirstMappedBean, ",")); if (LOG.isDebugEnabled()) { StringBuilder buf = new StringBuilder(); buf.append("CqActions at path " + origAceBean.getJcrPath() + " with authorizableId=" + origAceBean.getAuthorizableId() + "/" + testActionMapperPrincipal.getName() + " produced \n"); for (AceBean aceBean : aceBeansForActionEntry) { buf.append(" " + toAceCompareString(aceBean, acMgr) + "\n"); } LOG.debug(buf.toString()); } return aceBeansForActionEntry; }    }