| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.jackrabbit.oak.security.authorization.accesscontrol; |
| |
| import com.google.common.collect.ImmutableList; |
| import com.google.common.collect.ImmutableMap; |
| import com.google.common.collect.ImmutableSet; |
| import com.google.common.collect.Iterables; |
| import com.google.common.collect.Lists; |
| import org.apache.jackrabbit.JcrConstants; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlList; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy; |
| import org.apache.jackrabbit.api.security.authorization.PrivilegeManager; |
| import org.apache.jackrabbit.api.security.principal.GroupPrincipal; |
| import org.apache.jackrabbit.api.security.principal.PrincipalManager; |
| import org.apache.jackrabbit.oak.AbstractSecurityTest; |
| import org.apache.jackrabbit.oak.api.ContentSession; |
| import org.apache.jackrabbit.oak.api.QueryEngine; |
| import org.apache.jackrabbit.oak.api.Result; |
| import org.apache.jackrabbit.oak.api.ResultRow; |
| import org.apache.jackrabbit.oak.api.Root; |
| import org.apache.jackrabbit.oak.api.Tree; |
| import org.apache.jackrabbit.oak.api.Type; |
| import org.apache.jackrabbit.oak.commons.PathUtils; |
| import org.apache.jackrabbit.oak.namepath.NameMapper; |
| import org.apache.jackrabbit.oak.namepath.NamePathMapper; |
| import org.apache.jackrabbit.oak.namepath.impl.GlobalNameMapper; |
| import org.apache.jackrabbit.oak.namepath.impl.LocalNameMapper; |
| import org.apache.jackrabbit.oak.namepath.impl.NamePathMapperImpl; |
| import org.apache.jackrabbit.oak.plugins.name.ReadWriteNamespaceRegistry; |
| import org.apache.jackrabbit.oak.plugins.tree.TreeUtil; |
| import org.apache.jackrabbit.oak.plugins.value.jcr.ValueFactoryImpl; |
| import org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants; |
| import org.apache.jackrabbit.oak.spi.security.authorization.AuthorizationConfiguration; |
| import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ACE; |
| import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AbstractAccessControlList; |
| import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.AccessControlConstants; |
| import org.apache.jackrabbit.oak.spi.security.authorization.accesscontrol.ImmutableACL; |
| import org.apache.jackrabbit.oak.spi.security.authorization.restriction.Restriction; |
| import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider; |
| import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal; |
| import org.apache.jackrabbit.oak.spi.security.principal.PrincipalImpl; |
| import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits; |
| import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider; |
| import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants; |
| import org.jetbrains.annotations.NotNull; |
| import org.jetbrains.annotations.Nullable; |
| import org.junit.After; |
| import org.junit.Before; |
| import org.junit.Test; |
| |
| import javax.jcr.NamespaceRegistry; |
| import javax.jcr.PathNotFoundException; |
| import javax.jcr.PropertyType; |
| import javax.jcr.RepositoryException; |
| import javax.jcr.Value; |
| import javax.jcr.ValueFactory; |
| import javax.jcr.ValueFormatException; |
| import javax.jcr.security.AccessControlEntry; |
| import javax.jcr.security.AccessControlException; |
| import javax.jcr.security.AccessControlList; |
| import javax.jcr.security.AccessControlManager; |
| import javax.jcr.security.AccessControlPolicy; |
| import javax.jcr.security.AccessControlPolicyIterator; |
| import javax.jcr.security.Privilege; |
| import java.security.Principal; |
| import java.text.ParseException; |
| import java.util.ArrayList; |
| import java.util.Arrays; |
| import java.util.Collections; |
| import java.util.HashMap; |
| import java.util.HashSet; |
| import java.util.Iterator; |
| import java.util.List; |
| import java.util.Map; |
| import java.util.Set; |
| |
| import static com.google.common.base.Preconditions.checkNotNull; |
| import static com.google.common.collect.Sets.newHashSet; |
| import static java.util.Collections.singletonMap; |
| import static org.apache.jackrabbit.oak.spi.nodetype.NodeTypeConstants.NT_OAK_UNSTRUCTURED; |
| import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.JCR_LOCK_MANAGEMENT; |
| import static org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants.JCR_READ; |
| import static org.junit.Assert.assertArrayEquals; |
| import static org.junit.Assert.assertEquals; |
| import static org.junit.Assert.assertFalse; |
| import static org.junit.Assert.assertNotNull; |
| import static org.junit.Assert.assertNull; |
| import static org.junit.Assert.assertSame; |
| import static org.junit.Assert.assertTrue; |
| import static org.junit.Assert.fail; |
| import static org.mockito.ArgumentMatchers.any; |
| import static org.mockito.ArgumentMatchers.anyString; |
| import static org.mockito.Mockito.mock; |
| import static org.mockito.Mockito.spy; |
| import static org.mockito.Mockito.when; |
| |
| /** |
| * Tests for the default {@code AccessControlManager} implementation. |
| */ |
| public class AccessControlManagerImplTest extends AbstractSecurityTest implements AccessControlConstants { |
| |
| private static final String TEST_LOCAL_PREFIX = "test"; |
| private static final String TEST_PREFIX = "jr"; |
| private static final String TEST_URI = "http://jackrabbit.apache.org"; |
| |
| private final String testName = TEST_PREFIX + ":testRoot"; |
| private final String testPath = '/' + testName; |
| |
| private Principal testPrincipal; |
| private Privilege[] testPrivileges; |
| |
| private AccessControlManagerImpl acMgr; |
| private NamePathMapper npMapper; |
| private ValueFactory valueFactory; |
| |
| @Override |
| @Before |
| public void before() throws Exception { |
| super.before(); |
| |
| NamespaceRegistry nsRegistry = new ReadWriteNamespaceRegistry(root) { |
| @Override |
| protected Root getWriteRoot() { |
| return root; |
| } |
| }; |
| nsRegistry.registerNamespace(TEST_PREFIX, TEST_URI); |
| |
| NameMapper nameMapper = new GlobalNameMapper(root); |
| npMapper = new NamePathMapperImpl(nameMapper); |
| |
| acMgr = new AccessControlManagerImpl(root, npMapper, getSecurityProvider()); |
| |
| TreeUtil.addChild(root.getTree(PathUtils.ROOT_PATH), testName, JcrConstants.NT_UNSTRUCTURED); |
| root.commit(); |
| |
| valueFactory = new ValueFactoryImpl(root, npMapper); |
| |
| testPrivileges = privilegesFromNames(PrivilegeConstants.JCR_ADD_CHILD_NODES, JCR_READ); |
| testPrincipal = getTestUser().getPrincipal(); |
| } |
| |
| @After |
| public void after() throws Exception { |
| try { |
| root.refresh(); |
| root.getTree(testPath).remove(); |
| root.commit(); |
| } finally { |
| super.after(); |
| } |
| } |
| |
| @NotNull |
| @Override |
| protected NamePathMapper getNamePathMapper() { |
| return npMapper; |
| } |
| |
| @NotNull |
| private NamePathMapper getNamePathMapperWithLocalRemapping() { |
| NameMapper remapped = new LocalNameMapper(root, singletonMap(TEST_LOCAL_PREFIX, TEST_URI)); |
| return new NamePathMapperImpl(remapped); |
| } |
| |
| @NotNull |
| private AccessControlManagerImpl createAccessControlManager(@NotNull Root root, @NotNull NamePathMapper namePathMapper) { |
| return new AccessControlManagerImpl(root, namePathMapper, getSecurityProvider()); |
| } |
| |
| @NotNull |
| private RestrictionProvider getRestrictionProvider() { |
| return getConfig(AuthorizationConfiguration.class).getRestrictionProvider(); |
| } |
| |
| @NotNull |
| private PrivilegeBitsProvider getBitsProvider() { |
| return new PrivilegeBitsProvider(root); |
| } |
| |
| @NotNull |
| private static Set<Principal> getEveryonePrincipalSet() { |
| return ImmutableSet.of(EveryonePrincipal.getInstance()); |
| } |
| |
| private static void assertPolicies(@Nullable AccessControlPolicy[] policies, long expectedSize) { |
| assertNotNull(policies); |
| assertEquals(expectedSize, policies.length); |
| } |
| |
| @NotNull |
| private ACL createPolicy(@Nullable String path) { |
| final PrincipalManager pm = getPrincipalManager(root); |
| final PrivilegeManager pvMgr = getPrivilegeManager(root); |
| final RestrictionProvider rp = getRestrictionProvider(); |
| return new ACL(path, null, getNamePathMapper()) { |
| |
| @Override |
| ACE createACE(Principal principal, PrivilegeBits privilegeBits, boolean isAllow, Set<Restriction> restrictions) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| @Override |
| boolean checkValidPrincipal(Principal principal) throws AccessControlException { |
| Util.checkValidPrincipal(principal, pm); |
| return true; |
| } |
| |
| @Override |
| PrivilegeManager getPrivilegeManager() { |
| return pvMgr; |
| } |
| |
| @Override |
| PrivilegeBits getPrivilegeBits(Privilege[] privileges) { |
| return getBitsProvider().getBits(privileges, getNamePathMapper()); |
| } |
| |
| @NotNull |
| @Override |
| public RestrictionProvider getRestrictionProvider() { |
| return rp; |
| } |
| }; |
| } |
| |
| @NotNull |
| private ACL setupPolicy(@Nullable String path, @Nullable Privilege... privileges) throws RepositoryException { |
| Privilege[] privs = (privileges == null || privileges.length == 0) ? testPrivileges : privileges; |
| return TestUtility.setupPolicy(acMgr, path, testPrincipal, privs, true, TestUtility.getGlobRestriction("*", valueFactory), null); |
| } |
| |
| @NotNull |
| private Map<String, Value[]> getMvRestriction(@NotNull String name, @NotNull String... values) throws ValueFormatException { |
| List<Value> list = new ArrayList<>(); |
| for (String v : values) { |
| list.add(valueFactory.createValue(v, PropertyType.NAME)); |
| } |
| return ImmutableMap.of(name, list.toArray(new Value[0])); |
| } |
| |
| @NotNull |
| private List<String> getInvalidPaths() { |
| List<String> invalid = new ArrayList<>(); |
| invalid.add(""); |
| invalid.add("../../jcr:testRoot"); |
| invalid.add("jcr:testRoot"); |
| invalid.add("jcr:test/Root"); |
| invalid.add("./jcr:testRoot"); |
| return invalid; |
| } |
| |
| @NotNull |
| private List<String> getAcContentPaths() throws RepositoryException { |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("*", valueFactory)); |
| acMgr.setPolicy(testPath, policy); |
| |
| String aclPath = testPath + '/' + REP_POLICY; |
| Tree acl = root.getTree(aclPath); |
| assertTrue(acl.exists()); |
| Iterator<Tree> aces = acl.getChildren().iterator(); |
| assertTrue(aces.hasNext()); |
| Tree ace = aces.next(); |
| assertNotNull(ace); |
| |
| List<String> acContentPath = new ArrayList<>(); |
| acContentPath.add(aclPath); |
| acContentPath.add(ace.getPath()); |
| |
| Tree rest = ace.getChild(REP_RESTRICTIONS); |
| if (rest.exists()) { |
| acContentPath.add(rest.getPath()); |
| } |
| return acContentPath; |
| } |
| |
| //---------------------------------------------< getSupportedPrivileges >--- |
| @Test |
| public void testGetSupportedPrivileges() throws Exception { |
| List<String> testPaths = new ArrayList<>(); |
| testPaths.add(null); |
| testPaths.add("/"); |
| testPaths.add("/jcr:system"); |
| testPaths.add(testPath); |
| |
| assertSupportedPrivileges(acMgr, testPaths); |
| } |
| |
| @Test |
| public void testGetSupportedPrivilegesInvalidPath() { |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.getSupportedPrivileges(path); |
| fail("Expects valid node path, found: " + path); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetSupportedPrivilegesPropertyPath() throws Exception { |
| acMgr.getSupportedPrivileges("/jcr:primaryType"); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetSupportedPrivilegesNonExistingPath() throws Exception { |
| acMgr.getSupportedPrivileges("/non/existing/node"); |
| } |
| |
| @Test |
| public void testGetSupportedPrivilegesIncludingPathConversion() throws Exception { |
| List<String> testPaths = new ArrayList<>(); |
| testPaths.add('/' + TEST_LOCAL_PREFIX + ":testRoot"); |
| testPaths.add("/{" + TEST_URI + "}testRoot"); |
| |
| AccessControlManager acMgr = createAccessControlManager(root, getNamePathMapperWithLocalRemapping()); |
| assertSupportedPrivileges(acMgr, testPaths); |
| } |
| |
| @Test |
| public void testGetSupportedForPrivilegesAcContent() throws Exception { |
| assertSupportedPrivileges(acMgr, getAcContentPaths()); |
| } |
| |
| private void assertSupportedPrivileges(@NotNull AccessControlManager acMgr, @NotNull Iterable<String> paths) throws Exception { |
| List<Privilege> allPrivileges = Arrays.asList(getPrivilegeManager(root).getRegisteredPrivileges()); |
| for (String acPath : paths) { |
| Privilege[] supported = acMgr.getSupportedPrivileges(acPath); |
| |
| assertNotNull(supported); |
| assertEquals(allPrivileges.size(), supported.length); |
| assertTrue(allPrivileges.containsAll(Arrays.asList(supported))); |
| } |
| } |
| |
| //--------------------------------------------------< privilegeFromName >--- |
| |
| @Test |
| public void testPrivilegeFromName() throws Exception { |
| for (Privilege privilege : getPrivilegeManager(root).getRegisteredPrivileges()) { |
| Privilege p = acMgr.privilegeFromName(privilege.getName()); |
| assertEquals(privilege, p); |
| } |
| } |
| |
| @Test |
| public void testPrivilegeFromExpandedName() throws Exception { |
| Privilege readPriv = getPrivilegeManager(root).getPrivilege(JCR_READ); |
| assertEquals(readPriv, acMgr.privilegeFromName(Privilege.JCR_READ)); |
| } |
| |
| @Test |
| public void testPrivilegeFromInvalidName() { |
| List<String> invalid = new ArrayList<>(); |
| invalid.add(null); |
| invalid.add(""); |
| invalid.add("test:read"); |
| |
| for (String privilegeName : invalid) { |
| try { |
| acMgr.privilegeFromName(privilegeName); |
| fail("Invalid privilege name " + privilegeName); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test |
| public void testPrivilegeFromUnknownName() throws Exception { |
| List<String> invalid = new ArrayList<>(); |
| invalid.add("unknownPrivilege"); |
| invalid.add('{' + NamespaceRegistry.NAMESPACE_JCR + "}unknown"); |
| |
| for (String privilegeName : invalid) { |
| try { |
| acMgr.privilegeFromName(privilegeName); |
| fail("Invalid privilege name " + privilegeName); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| //------------------------------------------------------< hasPrivileges >--- |
| @Test |
| public void testHasNullPrivileges() throws Exception { |
| assertTrue(acMgr.hasPrivileges(testPath, null)); |
| } |
| |
| @Test |
| public void testHasEmptyPrivileges() throws Exception { |
| assertTrue(acMgr.hasPrivileges(testPath, new Privilege[0])); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testHasPrivilegesForPropertyPath() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| |
| acMgr.hasPrivileges(propertyPath, privs); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testHasPrivilegesForPropertyPathSessionPrincipals() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| |
| acMgr.hasPrivileges(propertyPath, getPrincipals(adminSession), privs); |
| } |
| |
| @Test |
| public void testHasPrivilegesNonExistingNodePath() throws Exception { |
| String nonExistingPath = "/not/existing"; |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| try { |
| acMgr.hasPrivileges(nonExistingPath, privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| try { |
| acMgr.hasPrivileges(nonExistingPath, getPrincipals(adminSession), privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| try { |
| acMgr.hasPrivileges(nonExistingPath, getEveryonePrincipalSet(), privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| try { |
| acMgr.hasPrivileges(nonExistingPath, ImmutableSet.of(), privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testHasPrivilegesInvalidPaths() throws Exception { |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.hasPrivileges(path, privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.hasPrivileges(path, getPrincipals(adminSession), privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.hasPrivileges(path, ImmutableSet.of(EveryonePrincipal.getInstance()), privs); |
| fail("AccessControlManager#hasPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test |
| public void testHasPrivilegesAccessControlledNodePath() throws Exception { |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| for (String path : getAcContentPaths()) { |
| assertTrue(acMgr.hasPrivileges(path, privs)); |
| assertTrue(acMgr.hasPrivileges(path, getPrincipals(adminSession), privs)); |
| assertFalse(acMgr.hasPrivileges(path, ImmutableSet.of(EveryonePrincipal.getInstance()), privs)); |
| } |
| } |
| |
| @Test |
| public void testHasRepoPrivileges() throws Exception { |
| assertTrue(acMgr.hasPrivileges(null, privilegesFromNames(PrivilegeConstants.JCR_ALL))); |
| assertTrue(acMgr.hasPrivileges(null, getPrincipals(adminSession), privilegesFromNames(PrivilegeConstants.JCR_ALL))); |
| } |
| |
| @Test |
| public void testHasRepoPrivilegesEmptyPrincipalSet() throws Exception { |
| assertFalse(acMgr.hasPrivileges(null, Collections.emptySet(), privilegesFromNames(PrivilegeConstants.JCR_ALL))); |
| } |
| |
| //------------------------------------------------------< getPrivileges >--- |
| @Test |
| public void testGetPrivilegesForPropertyPath() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| try { |
| acMgr.getPrivileges(propertyPath); |
| fail("AccessControlManager#getPrivileges for property should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| |
| try { |
| acMgr.getPrivileges(propertyPath, Collections.singleton(testPrincipal)); |
| fail("AccessControlManager#getPrivileges for property should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| |
| try { |
| acMgr.getPrivileges(propertyPath, getPrincipals(adminSession)); |
| fail("AccessControlManager#getPrivileges for property should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testGetPrivilegesNonExistingNodePath() throws Exception { |
| String nonExistingPath = "/not/existing"; |
| try { |
| acMgr.getPrivileges(nonExistingPath); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| |
| try { |
| acMgr.getPrivileges(nonExistingPath, getPrincipals(adminSession)); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| |
| try { |
| acMgr.getPrivileges(nonExistingPath, Collections.singleton(testPrincipal)); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| |
| try { |
| acMgr.getPrivileges(nonExistingPath, Collections.emptySet()); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (PathNotFoundException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testGetPrivilegesInvalidPaths() { |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.getPrivileges(path); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.getPrivileges(path, getPrincipals(adminSession)); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.getPrivileges(path, Collections.singleton(testPrincipal)); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| |
| for (String path : getInvalidPaths()) { |
| try { |
| acMgr.getPrivileges(path, Collections.emptySet()); |
| fail("AccessControlManager#getPrivileges for node that doesn't exist should fail."); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test |
| public void testGetPrivilegesAccessControlledNodePath() throws Exception { |
| Privilege[] expected = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| for (String path : getAcContentPaths()) { |
| assertArrayEquals(expected, acMgr.getPrivileges(path)); |
| assertArrayEquals(expected, acMgr.getPrivileges(path, getPrincipals(adminSession))); |
| } |
| } |
| |
| @Test |
| public void testGetPrivilegesForPrincipalsAccessControlledNodePath() throws Exception { |
| Set<Principal> testPrincipals = ImmutableSet.of(testPrincipal); |
| Privilege[] expected = new Privilege[0]; |
| for (String path : getAcContentPaths()) { |
| assertArrayEquals(expected, acMgr.getPrivileges(path, testPrincipals)); |
| } |
| } |
| |
| @Test |
| public void testGetPrivilegesForNoPrincipalsAccessControlledNodePath() throws Exception { |
| Privilege[] expected = new Privilege[0]; |
| for (String path : getAcContentPaths()) { |
| assertArrayEquals(expected, acMgr.getPrivileges(path, Collections.emptySet())); |
| } |
| } |
| |
| @Test |
| public void testGetRepoPrivileges() throws Exception { |
| assertArrayEquals(privilegesFromNames(PrivilegeConstants.JCR_ALL), acMgr.getPrivileges(null)); |
| assertArrayEquals(privilegesFromNames(PrivilegeConstants.JCR_ALL), acMgr.getPrivileges(null, getPrincipals(adminSession))); |
| } |
| |
| @Test |
| public void testGetRepoPrivilegesEveryonePrincipalSet() throws Exception { |
| assertArrayEquals(new Privilege[0], acMgr.getPrivileges(null, getEveryonePrincipalSet())); |
| } |
| |
| @Test |
| public void testGetRepoPrivilegesEmptyPrincipalSet() throws Exception { |
| assertArrayEquals(new Privilege[0], acMgr.getPrivileges(null, Collections.emptySet())); |
| } |
| |
| @Test |
| public void testGetPrivilegesForPrincipals() throws Exception { |
| Set<Principal> adminPrincipals = getPrincipals(adminSession); |
| Privilege[] expected = privilegesFromNames(PrivilegeConstants.JCR_ALL); |
| assertArrayEquals(expected, acMgr.getPrivileges("/", adminPrincipals)); |
| assertArrayEquals(expected, acMgr.getPrivileges(null, adminPrincipals)); |
| assertArrayEquals(expected, acMgr.getPrivileges(testPath, adminPrincipals)); |
| |
| setupPolicy(testPath); |
| root.commit(); |
| Set<Principal> testPrincipals = Collections.singleton(testPrincipal); |
| assertArrayEquals(new Privilege[0], acMgr.getPrivileges(null, testPrincipals)); |
| assertArrayEquals(new Privilege[0], acMgr.getPrivileges("/", testPrincipals)); |
| assertEquals( |
| ImmutableSet.copyOf(testPrivileges), |
| ImmutableSet.copyOf(acMgr.getPrivileges(testPath, testPrincipals))); |
| } |
| |
| //--------------------------------------< getApplicablePolicies(String) >--- |
| |
| @Test |
| public void testGetApplicablePolicies() throws Exception { |
| AccessControlPolicyIterator itr = acMgr.getApplicablePolicies(testPath); |
| |
| assertNotNull(itr); |
| assertTrue(itr.hasNext()); |
| |
| AccessControlPolicy policy = itr.nextAccessControlPolicy(); |
| assertNotNull(policy); |
| assertTrue(policy instanceof ACL); |
| |
| ACL acl = (ACL) policy; |
| assertTrue(acl.isEmpty()); |
| assertEquals(testPath, acl.getPath()); |
| |
| assertFalse(itr.hasNext()); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesOnAccessControllable() throws Exception { |
| Tree node = root.getTree(testPath); |
| node.setProperty(JcrConstants.JCR_MIXINTYPES, ImmutableList.of(MIX_REP_ACCESS_CONTROLLABLE), Type.NAMES); |
| |
| AccessControlPolicyIterator itr = acMgr.getApplicablePolicies(testPath); |
| |
| assertNotNull(itr); |
| assertTrue(itr.hasNext()); |
| } |
| |
| @Test |
| public void testGetApplicableRepoPolicies() throws Exception { |
| AccessControlPolicyIterator itr = acMgr.getApplicablePolicies((String) null); |
| |
| assertNotNull(itr); |
| assertTrue(itr.hasNext()); |
| |
| AccessControlPolicy policy = itr.nextAccessControlPolicy(); |
| assertNotNull(policy); |
| assertTrue(policy instanceof ACL); |
| |
| ACL acl = (ACL) policy; |
| assertTrue(acl.isEmpty()); |
| assertNull(acl.getPath()); |
| |
| assertFalse(itr.hasNext()); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesWithCollidingNode() throws Exception { |
| Tree testTree = root.getTree(testPath); |
| TreeUtil.addChild(testTree, REP_POLICY, JcrConstants.NT_UNSTRUCTURED); |
| |
| AccessControlPolicyIterator itr = acMgr.getApplicablePolicies(testPath); |
| assertNotNull(itr); |
| assertFalse(itr.hasNext()); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesForAccessControlled() throws Exception { |
| AccessControlPolicy policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acMgr.setPolicy(testPath, policy); |
| |
| AccessControlPolicyIterator itr = acMgr.getApplicablePolicies(testPath); |
| assertNotNull(itr); |
| assertFalse(itr.hasNext()); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesInvalidPath() { |
| for (String invalid : getInvalidPaths()) { |
| try { |
| acMgr.getPolicies(invalid); |
| fail("Getting applicable policies for an invalid path should fail"); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testApplicablePoliciesForPropertyPath() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| acMgr.getApplicablePolicies(propertyPath); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetApplicablePoliciesNonExistingNodePath() throws Exception { |
| String nonExistingPath = "/not/existing"; |
| acMgr.getApplicablePolicies(nonExistingPath); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesForAcContentPaths() throws Exception { |
| for (String path : getAcContentPaths()) { |
| try { |
| acMgr.getApplicablePolicies(path); |
| fail("Getting applicable policies for access control content should fail."); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| //------------------------------------------------< getPolicies(String) >--- |
| @Test |
| public void testGetPolicies() throws Exception { |
| AccessControlPolicy policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acMgr.setPolicy(testPath, policy); |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| |
| assertTrue(policies[0] instanceof ACL); |
| ACL acl = (ACL) policies[0]; |
| assertTrue(acl.isEmpty()); |
| assertEquals(testPath, acl.getOakPath()); |
| } |
| |
| @Test |
| public void testGetPoliciesNodeNotAccessControlled() throws Exception { |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 0); |
| } |
| |
| @Test |
| public void testGetPoliciesAfterSet() throws Exception { |
| setupPolicy(testPath); |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| |
| assertTrue(policies[0] instanceof ACL); |
| ACL acl = (ACL) policies[0]; |
| assertFalse(acl.isEmpty()); |
| } |
| |
| @Test |
| public void testGetPoliciesAfterRemove() throws Exception { |
| setupPolicy(testPath); |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| |
| acMgr.removePolicy(testPath, policies[0]); |
| |
| policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 0); |
| assertTrue(acMgr.getApplicablePolicies(testPath).hasNext()); |
| } |
| |
| @Test |
| public void testGetPolicyWithInvalidPrincipal() throws Exception { |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("*", valueFactory)); |
| acMgr.setPolicy(testPath, policy); |
| |
| Tree aclNode = root.getTree(testPath + '/' + REP_POLICY); |
| Tree aceNode = TreeUtil.addChild(aclNode, "testACE", NT_REP_DENY_ACE); |
| aceNode.setProperty(REP_PRINCIPAL_NAME, "invalidPrincipal"); |
| aceNode.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); |
| |
| // reading policies with unknown principal name should not fail. |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| |
| ACL acl = (ACL) policies[0]; |
| List<String> principalNames = new ArrayList<>(); |
| for (AccessControlEntry ace : acl.getEntries()) { |
| principalNames.add(ace.getPrincipal().getName()); |
| } |
| assertTrue(principalNames.remove("invalidPrincipal")); |
| assertTrue(principalNames.remove(testPrincipal.getName())); |
| assertTrue(principalNames.isEmpty()); |
| } |
| |
| @Test |
| public void testGetRepoPolicies() throws Exception { |
| String path = null; |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(path); |
| assertPolicies(policies, 0); |
| |
| acMgr.setPolicy(null, acMgr.getApplicablePolicies(path).nextAccessControlPolicy()); |
| assertFalse(acMgr.getApplicablePolicies(path).hasNext()); |
| |
| policies = acMgr.getPolicies(path); |
| assertPolicies(policies, 1); |
| |
| assertTrue(policies[0] instanceof ACL); |
| ACL acl = (ACL) policies[0]; |
| assertTrue(acl.isEmpty()); |
| assertNull(acl.getPath()); |
| assertNull(acl.getOakPath()); |
| assertFalse(acMgr.getApplicablePolicies(path).hasNext()); |
| |
| acMgr.removePolicy(path, acl); |
| assertPolicies(acMgr.getPolicies(path), 0); |
| assertTrue(acMgr.getApplicablePolicies(path).hasNext()); |
| } |
| |
| @Test |
| public void testGetPoliciesInvalidPath() { |
| for (String invalid : getInvalidPaths()) { |
| try { |
| acMgr.getPolicies(invalid); |
| fail("Getting policies for an invalid path should fail"); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetPoliciesPropertyPath() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| acMgr.getPolicies(propertyPath); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetPoliciesNonExistingNodePath() throws Exception { |
| String nonExistingPath = "/not/existing"; |
| acMgr.getPolicies(nonExistingPath); |
| } |
| |
| @Test |
| public void testGetPoliciesAcContentPaths() throws Exception { |
| for (String path : getAcContentPaths()) { |
| try { |
| acMgr.getPolicies(path); |
| fail("Getting policies for access control content should fail."); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test |
| public void testGetPoliciesLimitsPrincipalLookup() throws Exception { |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addAccessControlEntry(EveryonePrincipal.getInstance(), privilegesFromNames(JCR_READ)); |
| policy.addEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_ADD_CHILD_NODES, PrivilegeConstants.JCR_REMOVE_CHILD_NODES), true, ImmutableMap.of(REP_GLOB, getValueFactory(root).createValue(""))); |
| policy.addAccessControlEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_REMOVE_NODE)); |
| acMgr.setPolicy(policy.getPath(), policy); |
| |
| // read policy again |
| policy = (ACL) acMgr.getPolicies(policy.getPath())[0]; |
| assertEquals(3, policy.size()); |
| AccessControlEntry[] entries = policy.getAccessControlEntries(); |
| // reading policies attempts to lookup principals (see OAK-xxx) |
| assertTrue(entries[0].getPrincipal() instanceof GroupPrincipal); |
| // reading policies must only lookup a given principal once |
| assertSame(entries[1].getPrincipal(), entries[2].getPrincipal()); |
| } |
| |
| @Test |
| public void testGetPoliciesWithNonAceChild() throws Exception { |
| ACL policy = setupPolicy(testPath, testPrivileges); |
| assertEquals(1, policy.size()); |
| |
| Tree policyTree = root.getTree(testPath).getChild(REP_POLICY); |
| TreeUtil.addChild(policyTree, "child", NT_OAK_UNSTRUCTURED); |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| assertEquals(1, ((ACL) policies[0]).size()); |
| } |
| |
| @Test |
| public void testGetPoliciesWithInvalidatedPrivileges() throws Exception { |
| ACL policy = setupPolicy(testPath, privilegesFromNames(JCR_LOCK_MANAGEMENT)); |
| assertEquals(1, policy.size()); |
| |
| Tree privTree = root.getTree(PrivilegeConstants.PRIVILEGES_PATH).getChild(JCR_LOCK_MANAGEMENT); |
| privTree.remove(); |
| |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPath); |
| assertPolicies(policies, 1); |
| ACL acl = (ACL) policies[0]; |
| assertEquals(1, acl.size()); |
| Privilege[] privs = acl.getAccessControlEntries()[0].getPrivileges(); |
| assertArrayEquals(new Privilege[0], privs); |
| } |
| |
| //---------------------------------------< getEffectivePolicies(String) >--- |
| @Test |
| public void testGetEffectivePoliciesNoPoliciesSet() throws Exception { |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 0); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesEmptyACL() throws Exception { |
| // set empty policy -> no effective ACEs |
| acMgr.setPolicy(testPath, acMgr.getApplicablePolicies(testPath).nextAccessControlPolicy()); |
| root.commit(); |
| |
| // resulting effective policies should be empty array |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 0); |
| } |
| |
| @Test |
| public void testGetEffectivePolicies() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 1); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesRootPath() throws Exception { |
| assertPolicies(acMgr.getEffectivePolicies(PathUtils.ROOT_PATH), 0); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesNullPath() throws Exception { |
| assertPolicies(acMgr.getEffectivePolicies((String) null), 0); |
| ACL acl = null; |
| try { |
| acl = setupPolicy(null, privilegesFromNames(PrivilegeConstants.JCR_WORKSPACE_MANAGEMENT)); |
| root.commit(); |
| assertPolicies(acMgr.getEffectivePolicies((String) null), 1); |
| } finally { |
| if (acl != null) { |
| acMgr.removePolicy(null, acl); |
| root.commit(); |
| } |
| } |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesOnChild() throws Exception { |
| setupPolicy(testPath); |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| root.commit(); |
| |
| String childPath = child.getPath(); |
| assertPolicies(acMgr.getEffectivePolicies(childPath), 1); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesOnNewChild() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(childPath), 1); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesOnChild2() throws Exception { |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| setupPolicy(childPath); |
| setupPolicy(testPath); |
| root.commit(); |
| |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(childPath); |
| assertPolicies(policies, 2); |
| |
| for (AccessControlPolicy policy : policies) { |
| assertTrue(policy instanceof ImmutableACL); |
| } |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesMatchingRestriction() throws Exception { |
| ACL policy = TestUtility.setupPolicy(acMgr, testPath, testPrincipal, privilegesFromNames(JCR_READ), true, null, |
| getMvRestriction(REP_ITEM_NAMES, "child")); |
| policy.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, null, |
| getMvRestriction(REP_ITEM_NAMES, "notMatching")); |
| acMgr.setPolicy(policy.getPath(), policy); |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| Tree grandChild = TreeUtil.addChild(child, "child", JcrConstants.NT_UNSTRUCTURED); |
| root.commit(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 1); |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(child.getPath()); |
| assertPolicies(policies, 1); |
| |
| // only the matching ACE must be included in the effective policy |
| AccessControlPolicy effective = policies[0]; |
| assertTrue(effective instanceof ImmutableACL); |
| assertEquals(2, ((ImmutableACL) effective).getAccessControlEntries().length); |
| |
| assertPolicies(acMgr.getEffectivePolicies(grandChild.getPath()), 1); |
| } |
| |
| /** |
| * An ACE restriction matching only a property (like e.g. jcr:primaryType) would not be included in the effective |
| * policies, becauce AccessControlManager.getEffectivePolicies(String) requires the path to point to an existing |
| * JCR node. |
| */ |
| @Test |
| public void testGetEffectivePoliciesMatchingPropertyRestriction() throws Exception { |
| TestUtility.setupPolicy(acMgr, testPath, testPrincipal, privilegesFromNames(JCR_READ), false, null, |
| getMvRestriction(REP_ITEM_NAMES, JcrConstants.JCR_PRIMARYTYPE)); |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| Tree grandChild = TreeUtil.addChild(child, "child", JcrConstants.NT_UNSTRUCTURED); |
| root.commit(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 1); |
| assertPolicies(acMgr.getEffectivePolicies(child.getPath()), 1); |
| assertPolicies(acMgr.getEffectivePolicies(grandChild.getPath()), 1); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesNotMatchingRestriction() throws Exception { |
| TestUtility.setupPolicy(acMgr, testPath, testPrincipal, privilegesFromNames(JCR_READ), true, null, |
| getMvRestriction(REP_NT_NAMES, NT_OAK_UNSTRUCTURED)); |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", NT_OAK_UNSTRUCTURED); |
| Tree grandChild = TreeUtil.addChild(child, "grandChild", JcrConstants.NT_UNSTRUCTURED); |
| Tree other = TreeUtil.addChild(root.getTree(testPath), "other", JcrConstants.NT_UNSTRUCTURED); |
| |
| root.commit(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 1); |
| assertPolicies(acMgr.getEffectivePolicies(grandChild.getPath()), 1); |
| assertPolicies(acMgr.getEffectivePolicies(other.getPath()), 1); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesNewPolicy() throws Exception { |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 0); |
| |
| setupPolicy(testPath); |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 0); |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath),"child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(childPath), 0); |
| |
| setupPolicy(childPath); |
| assertPolicies(acMgr.getEffectivePolicies(childPath), 0); |
| } |
| |
| @Test |
| public void testGetEffectiveModifiedPolicy() throws Exception { |
| ACL acl = setupPolicy(testPath); |
| AccessControlEntry[] aces = acl.getAccessControlEntries(); |
| root.commit(); |
| |
| acl.addAccessControlEntry(EveryonePrincipal.getInstance(), privilegesFromNames(PrivilegeConstants.JCR_VERSION_MANAGEMENT)); |
| acMgr.setPolicy(testPath, acl); |
| |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(testPath); |
| assertPolicies(acMgr.getEffectivePolicies(testPath), 1); |
| |
| assertTrue(policies[0] instanceof AccessControlList); |
| AccessControlEntry[] effectiveAces = ((AccessControlList) policies[0]).getAccessControlEntries(); |
| assertArrayEquals(aces, effectiveAces); |
| assertFalse(Arrays.equals(effectiveAces, acl.getAccessControlEntries())); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesInvalidPath() { |
| for (String invalid : getInvalidPaths()) { |
| try { |
| acMgr.getEffectivePolicies(invalid); |
| fail("Getting policies for an invalid path should fail"); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetEffectivePoliciesForPropertyPath() throws Exception { |
| String propertyPath = "/jcr:primaryType"; |
| acMgr.getEffectivePolicies(propertyPath); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testGetEffectivePoliciesNonExistingNodePath() throws Exception { |
| String nonExistingPath = "/not/existing"; |
| acMgr.getEffectivePolicies(nonExistingPath); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesForAcContentPaths() throws Exception { |
| for (String path : getAcContentPaths()) { |
| try { |
| acMgr.getEffectivePolicies(path); |
| fail("Getting effective policies for access control content should fail."); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| //-----------------------------< setPolicy(String, AccessControlPolicy) >--- |
| @Test |
| public void testSetPolicy() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acl.addAccessControlEntry(testPrincipal, testPrivileges); |
| acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, TestUtility.getGlobRestriction("*/something", valueFactory)); |
| |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| Root root2 = adminSession.getLatestRoot(); |
| AccessControlPolicy[] policies = getAccessControlManager(root2).getPolicies(testPath); |
| assertPolicies(policies, 1); |
| assertArrayEquals(acl.getAccessControlEntries(), ((ACL) policies[0]).getAccessControlEntries()); |
| } |
| |
| @Test |
| public void testSetRepoPolicy() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, null); |
| acl.addAccessControlEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_NAMESPACE_MANAGEMENT)); |
| |
| acMgr.setPolicy(null, acl); |
| root.commit(); |
| |
| Root root2 = adminSession.getLatestRoot(); |
| AccessControlPolicy[] policies = getAccessControlManager(root2).getPolicies((String) null); |
| assertPolicies(policies, 1); |
| assertArrayEquals(acl.getAccessControlEntries(), ((ACL) policies[0]).getAccessControlEntries()); |
| } |
| |
| @Test |
| public void testSetPolicyWritesAcContent() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acl.addAccessControlEntry(testPrincipal, testPrivileges); |
| acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, TestUtility.getGlobRestriction("*/something", valueFactory)); |
| |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| Root root2 = adminSession.getLatestRoot(); |
| Tree tree = root2.getTree(testPath); |
| assertTrue(tree.hasChild(REP_POLICY)); |
| Tree policyTree = tree.getChild(REP_POLICY); |
| assertEquals(NT_REP_ACL, TreeUtil.getPrimaryTypeName(policyTree)); |
| assertEquals(2, policyTree.getChildrenCount(3)); |
| |
| Iterator<Tree> children = policyTree.getChildren().iterator(); |
| Tree ace = children.next(); |
| assertEquals(NT_REP_GRANT_ACE, TreeUtil.getPrimaryTypeName(ace)); |
| assertEquals(testPrincipal.getName(), TreeUtil.getString(ace, REP_PRINCIPAL_NAME)); |
| assertEquals( |
| newHashSet(testPrivileges), |
| newHashSet(privilegesFromNames(TreeUtil.getStrings(ace, REP_PRIVILEGES)))); |
| assertFalse(ace.hasChild(REP_RESTRICTIONS)); |
| |
| Tree ace2 = children.next(); |
| assertEquals(NT_REP_DENY_ACE, TreeUtil.getPrimaryTypeName(ace2)); |
| assertEquals(EveryonePrincipal.NAME, checkNotNull(ace2.getProperty(REP_PRINCIPAL_NAME)).getValue(Type.STRING)); |
| Privilege[] privs = privilegesFromNames(TreeUtil.getNames(ace2, REP_PRIVILEGES)); |
| assertEquals(newHashSet(testPrivileges), newHashSet(privs)); |
| assertTrue(ace2.hasChild(REP_RESTRICTIONS)); |
| Tree restr = ace2.getChild(REP_RESTRICTIONS); |
| assertEquals("*/something", checkNotNull(restr.getProperty(REP_GLOB)).getValue(Type.STRING)); |
| } |
| |
| @Test |
| public void testModifyExistingPolicy() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| assertTrue(acl.addAccessControlEntry(testPrincipal, testPrivileges)); |
| AccessControlEntry allowTest = acl.getAccessControlEntries()[0]; |
| |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| assertTrue(acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, TestUtility.getGlobRestriction("*/something", valueFactory))); |
| |
| AccessControlEntry[] aces = acl.getAccessControlEntries(); |
| assertEquals(2, aces.length); |
| AccessControlEntry denyEveryone = aces[1]; |
| assertEquals(EveryonePrincipal.getInstance(), denyEveryone.getPrincipal()); |
| |
| acl.orderBefore(denyEveryone, allowTest); |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| aces = acl.getAccessControlEntries(); |
| assertEquals(2, aces.length); |
| assertEquals(denyEveryone, aces[0]); |
| assertEquals(allowTest, aces[1]); |
| |
| Privilege[] readAc = new Privilege[]{acMgr.privilegeFromName(PrivilegeConstants.JCR_READ_ACCESS_CONTROL)}; |
| assertTrue(acl.addEntry(testPrincipal, readAc, false, Collections.emptyMap())); |
| assertEquals(3, acl.size()); |
| AccessControlEntry denyTest = acl.getAccessControlEntries()[2]; |
| |
| acl.orderBefore(denyTest, allowTest); |
| acMgr.setPolicy(testPath, acl); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| aces = acl.getAccessControlEntries(); |
| assertEquals(3, aces.length); |
| |
| assertEquals(denyEveryone, aces[0]); |
| assertEquals(denyTest, aces[1]); |
| assertEquals(allowTest, aces[2]); |
| } |
| |
| @Test |
| public void testSetInvalidPolicy() throws Exception { |
| try { |
| acMgr.setPolicy(testPath, new TestACL(testPath, getRestrictionProvider(), getNamePathMapper())); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| |
| ACL acl = setupPolicy(testPath); |
| try { |
| acMgr.setPolicy(testPath, new TestACL(testPath, getRestrictionProvider(), getNamePathMapper())); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| |
| ACL repoAcl = setupPolicy(null); |
| try { |
| acMgr.setPolicy(testPath, repoAcl); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| |
| try { |
| acMgr.setPolicy(null, acl); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testSetPolicyInvalidPath() { |
| for (String invalid : getInvalidPaths()) { |
| try { |
| AccessControlPolicy acl = createPolicy(invalid); |
| acMgr.setPolicy(invalid, acl); |
| fail("Setting access control policy with invalid path should fail"); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testSetPolicyPropertyPath() throws Exception { |
| String path = "/jcr:primaryType"; |
| AccessControlPolicy acl = createPolicy(path); |
| acMgr.setPolicy(path, acl); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testSetPolicyNonExistingNodePath() throws Exception { |
| String path = "/non/existing"; |
| AccessControlPolicy acl = createPolicy(path); |
| acMgr.setPolicy(path, acl); |
| } |
| |
| @Test |
| public void testSetPolicyAcContent() throws Exception { |
| for (String acPath : getAcContentPaths()) { |
| try { |
| AccessControlPolicy acl = createPolicy(acPath); |
| acMgr.setPolicy(acPath, acl); |
| fail("Setting access control policy to access control content should fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testSetPolicyAtDifferentPath() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acMgr.setPolicy("/", acl); |
| } |
| |
| @Test |
| public void testSetPolicyModifiesRoot() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| assertTrue(acl.addAccessControlEntry(testPrincipal, testPrivileges)); |
| assertFalse(root.hasPendingChanges()); |
| |
| acMgr.setPolicy(testPath, acl); |
| assertTrue(root.hasPendingChanges()); |
| |
| root.commit(); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| assertEquals(1, acl.getAccessControlEntries().length); |
| |
| acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, TestUtility.getGlobRestriction("*/something", valueFactory)); |
| acMgr.setPolicy(testPath, acl); |
| assertTrue(root.hasPendingChanges()); |
| |
| root.commit(); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| assertEquals(2, acl.getAccessControlEntries().length); |
| } |
| |
| @Test |
| public void testSetPolicyWithRestrictions() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| acl.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("/a/b", valueFactory)); |
| acl.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("/c/d", valueFactory)); |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| ACL l = (ACL) acMgr.getPolicies(testPath)[0]; |
| assertEquals(2, l.getAccessControlEntries().length); |
| } |
| |
| @Test |
| public void testSetPolicyCreatesIndexedAceNodeNames() throws Exception { |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| assertTrue(acl.addAccessControlEntry(testPrincipal, testPrivileges)); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("/*/a", valueFactory))); |
| assertTrue(acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false)); |
| assertTrue(acl.addEntry(EveryonePrincipal.getInstance(), testPrivileges, false, TestUtility.getGlobRestriction("/*/a", valueFactory))); |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| acl = (ACL) acMgr.getPolicies(testPath)[0]; |
| assertEquals(4, acl.getAccessControlEntries().length); |
| |
| Iterable<Tree> aceTrees = root.getTree(testPath).getChild(AccessControlConstants.REP_POLICY).getChildren(); |
| String[] aceNodeNames = Iterables.toArray(Iterables.transform(aceTrees, Tree::getName), String.class); |
| assertArrayEquals(new String[]{"allow", "allow1", "deny2", "deny3"}, aceNodeNames); |
| } |
| |
| @Test |
| public void testSetPolicyWithExistingMixins() throws Exception { |
| TreeUtil.addMixin(root.getTree(testPath), JcrConstants.MIX_LOCKABLE, root.getTree(NodeTypeConstants.NODE_TYPES_PATH), null); |
| |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, testPath); |
| assertTrue(acl.addAccessControlEntry(testPrincipal, testPrivileges)); |
| acMgr.setPolicy(testPath, acl); |
| root.commit(); |
| |
| assertEquals(ImmutableSet.of(JcrConstants.MIX_LOCKABLE, MIX_REP_ACCESS_CONTROLLABLE), |
| ImmutableSet.copyOf(TreeUtil.getNames(root.getTree(testPath), JcrConstants.JCR_MIXINTYPES))); |
| } |
| |
| //--------------------------< removePolicy(String, AccessControlPolicy) >--- |
| @Test |
| public void testRemovePolicy() throws Exception { |
| ACL acl = setupPolicy(testPath); |
| |
| acMgr.removePolicy(testPath, acl); |
| |
| assertPolicies(acMgr.getPolicies(testPath), 0); |
| assertTrue(acMgr.getApplicablePolicies(testPath).hasNext()); |
| } |
| |
| @Test |
| public void testRemoveRepoPolicy() throws Exception { |
| ACL acl = setupPolicy(null); |
| |
| acMgr.removePolicy(null, acl); |
| |
| assertPolicies(acMgr.getPolicies((String) null), 0); |
| assertTrue(acMgr.getApplicablePolicies((String) null).hasNext()); |
| } |
| |
| @Test |
| public void testRemoveInvalidPolicy() throws Exception { |
| ACL acl = setupPolicy(testPath); |
| try { |
| acMgr.removePolicy(testPath, new TestACL(testPath, getRestrictionProvider(), getNamePathMapper())); |
| fail("Invalid policy -> removal must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| |
| ACL repoAcl = setupPolicy(null); |
| try { |
| acMgr.removePolicy(testPath, repoAcl); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| |
| try { |
| acMgr.removePolicy(null, acl); |
| fail("Setting invalid policy must fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testRemovePolicyInvalidPath() { |
| for (String invalid : getInvalidPaths()) { |
| try { |
| AccessControlPolicy acl = createPolicy(invalid); |
| acMgr.removePolicy(invalid, acl); |
| fail("Removing access control policy with invalid path should fail"); |
| } catch (RepositoryException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testRemovePolicyPropertyPath() throws Exception { |
| String path = "/jcr:primaryType"; |
| AccessControlPolicy acl = createPolicy(path); |
| acMgr.removePolicy(path, acl); |
| } |
| |
| @Test(expected = PathNotFoundException.class) |
| public void testRemovePolicyNonExistingNodePath() throws Exception { |
| String path = "/non/existing"; |
| AccessControlPolicy acl = createPolicy(path); |
| acMgr.removePolicy(path, acl); |
| } |
| |
| @Test |
| public void testRemovePolicyAcContent() throws Exception { |
| for (String acPath : getAcContentPaths()) { |
| try { |
| AccessControlPolicy acl = createPolicy(acPath); |
| acMgr.removePolicy(acPath, acl); |
| fail("Removing access control policy to access control content should fail"); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testRemovePolicyAtDifferentPath() throws Exception { |
| setupPolicy(testPath); |
| ACL acl = TestUtility.getApplicablePolicy(acMgr, PathUtils.ROOT_PATH); |
| acMgr.removePolicy(testPath, acl); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testRemovePolicyNodeRemoved() throws Exception { |
| setupPolicy(testPath); |
| AccessControlPolicy acl = acMgr.getPolicies(testPath)[0]; |
| root.getTree(testPath + "/" + REP_POLICY).remove(); |
| |
| acMgr.removePolicy(testPath, acl); |
| } |
| |
| //-----------------------------------< getApplicablePolicies(Principal) >--- |
| @Test(expected = AccessControlException.class) |
| public void testGetApplicablePoliciesNullPrincipal() throws Exception { |
| acMgr.getApplicablePolicies((Principal) null); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testGetApplicablePoliciesInvalidPrincipal() throws Exception { |
| Principal unknown = getPrincipalManager(root).getPrincipal("unknown"); |
| int i = 0; |
| while (unknown != null) { |
| unknown = getPrincipalManager(root).getPrincipal("unknown"+i); |
| } |
| unknown = new InvalidTestPrincipal("unknown" + i); |
| |
| acMgr.getApplicablePolicies(unknown); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesInternalPrincipal() throws Exception { |
| Principal unknown = getPrincipalManager(root).getPrincipal("unknown"); |
| int i = 0; |
| while (unknown != null) { |
| unknown = getPrincipalManager(root).getPrincipal("unknown"+i); |
| } |
| unknown = new PrincipalImpl("unknown" + i); |
| |
| assertPolicies(acMgr.getApplicablePolicies(unknown), 1); |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesByPrincipal() throws Exception { |
| List<Principal> principals = ImmutableList.of(testPrincipal, EveryonePrincipal.getInstance()); |
| for (Principal principal : principals) { |
| AccessControlPolicy[] applicable = acMgr.getApplicablePolicies(principal); |
| assertPolicies(applicable, 1); |
| assertTrue(applicable[0] instanceof ACL); |
| } |
| } |
| |
| @Test |
| public void testGetApplicablePoliciesByPrincipal2() throws Exception { |
| setupPolicy(testPath); |
| |
| // changes not yet persisted -> no existing policies found for user |
| AccessControlPolicy[] applicable = acMgr.getApplicablePolicies(testPrincipal); |
| assertPolicies(applicable, 1); |
| assertTrue(applicable[0] instanceof ACL); |
| |
| // after persisting changes -> no applicable policies present any more. |
| root.commit(); |
| assertPolicies(acMgr.getApplicablePolicies(testPrincipal), 0); |
| } |
| |
| //---------------------------------------------< getPolicies(Principal) >--- |
| @Test(expected = AccessControlException.class) |
| public void testGetPoliciesNullPrincipal() throws Exception { |
| acMgr.getPolicies((Principal) null); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testGetPoliciesInvalidPrincipal() throws Exception { |
| Principal unknown = getPrincipalManager(root).getPrincipal("unknown"); |
| int i = 0; |
| while (unknown != null) { |
| unknown = getPrincipalManager(root).getPrincipal("unknown"+i); |
| } |
| unknown = new InvalidTestPrincipal("unknown" + i); |
| |
| acMgr.getPolicies(unknown); |
| } |
| |
| @Test |
| public void testGetPoliciesInternalPrincipal() throws Exception { |
| Principal unknown = getPrincipalManager(root).getPrincipal("unknown"); |
| int i = 0; |
| while (unknown != null) { |
| unknown = getPrincipalManager(root).getPrincipal("unknown"+i); |
| } |
| unknown = new PrincipalImpl("unknown" + i); |
| assertPolicies(acMgr.getPolicies(unknown), 0); |
| } |
| |
| @Test |
| public void testGetPoliciesByPrincipal() throws Exception { |
| List<Principal> principals = ImmutableList.of(testPrincipal, EveryonePrincipal.getInstance()); |
| for (Principal principal : principals) { |
| assertPolicies(acMgr.getPolicies(principal), 0); |
| } |
| } |
| |
| @Test |
| public void testGetPoliciesByPrincipal2() throws Exception { |
| setupPolicy(testPath); |
| |
| // changes not yet persisted -> no existing policies found for user |
| assertPolicies(acMgr.getPolicies(testPrincipal), 0); |
| |
| // after persisting changes -> policies must be found |
| root.commit(); |
| assertPolicies(acMgr.getPolicies(testPrincipal), 1); |
| } |
| |
| @Test |
| public void testGetPoliciesByPrincipalRemapped() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| NamePathMapper mapper = getNamePathMapperWithLocalRemapping(); |
| AccessControlPolicy[] policies = createAccessControlManager(root, mapper).getPolicies(testPrincipal); |
| assertNotNull(policies); |
| assertEquals(1, policies.length); |
| |
| List<ACE> entries = ((ACL) policies[0]).getEntries(); |
| Value rest = entries.get(0).getRestriction(REP_NODE_PATH); |
| assertNotNull(rest); |
| assertEquals(mapper.getJcrPath(testPath), rest.getString()); |
| } |
| |
| @Test |
| public void testGetPoliciesByPrincipalRepositoryLevel() throws Exception { |
| setupPolicy(null, privilegesFromNames(PrivilegeConstants.JCR_NODE_TYPE_DEFINITION_MANAGEMENT)); |
| |
| // changes not yet persisted -> no existing policies found for user |
| AccessControlPolicy[] policies = acMgr.getPolicies(testPrincipal); |
| assertNotNull(policies); |
| assertEquals(0, policies.length); |
| |
| // after persisting changes -> policies must be found |
| root.commit(); |
| policies = acMgr.getPolicies(testPrincipal); |
| assertNotNull(policies); |
| assertEquals(1, policies.length); |
| JackrabbitAccessControlList acl = (JackrabbitAccessControlList) policies[0]; |
| AccessControlEntry[] entries = acl.getAccessControlEntries(); |
| assertEquals(1, entries.length); |
| JackrabbitAccessControlEntry entry = (JackrabbitAccessControlEntry) entries[0]; |
| assertTrue(entry.getRestriction(REP_NODE_PATH).getString().isEmpty()); |
| } |
| |
| //-------------------------------< getEffectivePolicies(Set<Principal>) >--- |
| |
| @Test(expected = AccessControlException.class) |
| public void testGetEffectivePoliciesNullPrincipal() throws Exception { |
| acMgr.getEffectivePolicies((Set) null); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testGetEffectivePoliciesSetContainingNullPrincipal() throws Exception { |
| acMgr.getEffectivePolicies(new HashSet<>(Arrays.asList(EveryonePrincipal.getInstance(), null, testPrincipal))); |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesInvalidPrincipals() throws Exception { |
| Principal unknown = getPrincipalManager(root).getPrincipal("unknown"); |
| int i = 0; |
| while (unknown != null) { |
| unknown = getPrincipalManager(root).getPrincipal("unknown"+i); |
| } |
| unknown = new InvalidTestPrincipal("unknown" + i); |
| try { |
| acMgr.getEffectivePolicies(Collections.singleton(unknown)); |
| fail("Unknown principal should be detected."); |
| } catch (AccessControlException e) { |
| // success |
| } |
| try { |
| acMgr.getEffectivePolicies(ImmutableSet.of(unknown, EveryonePrincipal.getInstance(), testPrincipal)); |
| fail("Unknown principal should be detected."); |
| } catch (AccessControlException e) { |
| // success |
| } |
| } |
| |
| @Test |
| public void testGetEffectivePoliciesByPrincipal() throws Exception { |
| // no ACLs containing entries for the specified principals |
| // -> no effective policies expected |
| Set<Set<Principal>> principalSets = new HashSet<>(); |
| principalSets.add(Collections.singleton(testPrincipal)); |
| principalSets.add(Collections.singleton(EveryonePrincipal.getInstance())); |
| principalSets.add(ImmutableSet.of(testPrincipal, EveryonePrincipal.getInstance())); |
| |
| for (Set<Principal> principals : principalSets) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); |
| assertPolicies(policies, 0); |
| } |
| |
| setupPolicy(testPath); |
| // changes not yet persisted -> no effecitve policies found for testprincipal |
| for (Set<Principal> principals : principalSets) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); |
| assertPolicies(policies, 0); |
| } |
| |
| root.commit(); |
| // after persisting changes -> the policy must be found |
| for (Set<Principal> principals : principalSets) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); |
| if (principals.contains(testPrincipal)) { |
| assertPolicies(policies, 1); |
| } else { |
| assertPolicies(policies, 0); |
| } |
| } |
| |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| setupPolicy(childPath); |
| // changes not yet persisted -> no effecitve policies found for testprincipal |
| for (Set<Principal> principals : principalSets) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); |
| if (principals.contains(testPrincipal)) { |
| assertPolicies(policies, 1); |
| } else { |
| assertPolicies(policies, 0); |
| } |
| } |
| |
| root.commit(); |
| // after persisting changes -> the policy must be found |
| for (Set<Principal> principals : principalSets) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principals); |
| if (principals.contains(testPrincipal)) { |
| assertPolicies(policies, 2); |
| } else { |
| assertPolicies(policies, 0); |
| } |
| } |
| } |
| |
| @Test |
| public void testNoEffectiveDuplicateEntries() throws Exception { |
| Set<Principal> principalSet = ImmutableSet.of(testPrincipal, EveryonePrincipal.getInstance()); |
| |
| // create first policy with multiple ACEs for the test principal set. |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("*", valueFactory)); |
| policy.addEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_VERSION_MANAGEMENT), false); |
| policy.addEntry(EveryonePrincipal.getInstance(), privilegesFromNames(PrivilegeConstants.JCR_LIFECYCLE_MANAGEMENT), false); |
| assertEquals(3, policy.getAccessControlEntries().length); |
| acMgr.setPolicy(testPath, policy); |
| root.commit(); |
| |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(principalSet); |
| assertPolicies(policies, 1); |
| |
| // add another policy |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| setupPolicy(childPath); |
| root.commit(); |
| |
| assertPolicies(acMgr.getEffectivePolicies(principalSet), 2); |
| } |
| |
| @Test |
| public void testEffectiveSorting() throws Exception { |
| Set<Principal> principalSet = ImmutableSet.of(testPrincipal, EveryonePrincipal.getInstance()); |
| |
| ACL nullPathPolicy = null; |
| try { |
| // 1. policy at 'testPath' |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("*", valueFactory)); |
| policy.addEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_VERSION_MANAGEMENT), false); |
| policy.addEntry(EveryonePrincipal.getInstance(), privilegesFromNames(PrivilegeConstants.JCR_LIFECYCLE_MANAGEMENT), false); |
| acMgr.setPolicy(testPath, policy); |
| |
| // 2. policy at child node |
| Tree child = TreeUtil.addChild(root.getTree(testPath), "child", JcrConstants.NT_UNSTRUCTURED); |
| String childPath = child.getPath(); |
| setupPolicy(childPath); |
| |
| // 3. policy for null-path |
| nullPathPolicy = TestUtility.getApplicablePolicy(acMgr, null); |
| assertNotNull(nullPathPolicy); |
| |
| nullPathPolicy.addEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.REP_PRIVILEGE_MANAGEMENT), true); |
| acMgr.setPolicy(null, nullPathPolicy); |
| root.commit(); |
| |
| AccessControlPolicy[] effectivePolicies = acMgr.getEffectivePolicies(principalSet); |
| assertPolicies(effectivePolicies, 3); |
| |
| assertNull(((JackrabbitAccessControlPolicy) effectivePolicies[0]).getPath()); |
| assertEquals(testPath, ((JackrabbitAccessControlPolicy) effectivePolicies[1]).getPath()); |
| assertEquals(childPath, ((JackrabbitAccessControlPolicy) effectivePolicies[2]).getPath()); |
| |
| } finally { |
| if (nullPathPolicy != null) { |
| acMgr.removePolicy(null, nullPathPolicy); |
| root.commit(); |
| } |
| } |
| } |
| |
| @Test |
| public void testEffectivePoliciesFiltering() throws Exception { |
| // create first policy with multiple ACEs for the test principal set. |
| ACL policy = TestUtility.getApplicablePolicy(acMgr, testPath); |
| policy.addEntry(testPrincipal, testPrivileges, true, TestUtility.getGlobRestriction("*", valueFactory)); |
| policy.addEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_VERSION_MANAGEMENT), false); |
| policy.addEntry(EveryonePrincipal.getInstance(), privilegesFromNames(PrivilegeConstants.JCR_LIFECYCLE_MANAGEMENT), false); |
| assertEquals(3, policy.getAccessControlEntries().length); |
| acMgr.setPolicy(testPath, policy); |
| root.commit(); |
| |
| // different ways to create the principal-set to make sure the filtering |
| // doesn't rely on principal equality but rather on the name. |
| List<Principal> principals = ImmutableList.of( |
| testPrincipal, |
| new PrincipalImpl(testPrincipal.getName()), |
| () -> testPrincipal.getName()); |
| |
| for (Principal princ : principals) { |
| AccessControlPolicy[] policies = acMgr.getEffectivePolicies(ImmutableSet.of(princ)); |
| assertPolicies(policies, 1); |
| assertTrue(policies[0] instanceof AccessControlList); |
| |
| AccessControlList acl = (AccessControlList) policies[0]; |
| assertEquals(2, acl.getAccessControlEntries().length); |
| for (AccessControlEntry ace : acl.getAccessControlEntries()) { |
| assertEquals(princ.getName(), ace.getPrincipal().getName()); |
| } |
| } |
| } |
| |
| @Test |
| public void testEffectivePolicyIsolatedAce() throws Exception { |
| Root r = spy(root); |
| ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); |
| when(r.getContentSession()).thenReturn(cs); |
| |
| Tree testTree = r.getTree(testPath); |
| Tree ace = TreeUtil.addChild(testTree, "ace", NT_REP_GRANT_ACE); |
| ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); |
| ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); |
| |
| ResultRow row = when(mock(ResultRow.class).getPath()).thenReturn(ace.getPath()).getMock(); |
| Iterable rows = ImmutableList.of(row); |
| Result res = mock(Result.class); |
| when(res.getRows()).thenReturn(rows).getMock(); |
| QueryEngine qe = mock(QueryEngine.class); |
| when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenReturn(res); |
| when(r.getQueryEngine()).thenReturn(qe); |
| |
| AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); |
| AccessControlPolicy[] policies = mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); |
| assertPolicies(policies, 0); |
| } |
| |
| @Test |
| public void testEffectivePolicyWrongPrimaryType() throws Exception { |
| Root r = spy(root); |
| ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); |
| when(r.getContentSession()).thenReturn(cs); |
| |
| Tree testTree = r.getTree(testPath); |
| Tree aclWithWrongType = TreeUtil.addChild(testTree, REP_POLICY, NT_OAK_UNSTRUCTURED); |
| Tree ace = TreeUtil.addChild(aclWithWrongType, "ace", NT_REP_GRANT_ACE); |
| ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); |
| ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); |
| |
| ResultRow row = when(mock(ResultRow.class).getPath()).thenReturn(ace.getPath()).getMock(); |
| Iterable rows = ImmutableList.of(row); |
| Result res = mock(Result.class); |
| when(res.getRows()).thenReturn(rows).getMock(); |
| QueryEngine qe = mock(QueryEngine.class); |
| when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenReturn(res); |
| when(r.getQueryEngine()).thenReturn(qe); |
| |
| AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); |
| AccessControlPolicy[] policies = mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); |
| assertPolicies(policies, 0); |
| } |
| |
| @Test(expected = RepositoryException.class) |
| public void testEffectivePolicyFailingQuery() throws Exception { |
| Root r = spy(root); |
| ContentSession cs = when(spy(adminSession).getLatestRoot()).thenReturn(r).getMock(); |
| when(r.getContentSession()).thenReturn(cs); |
| |
| Tree testTree = r.getTree(testPath); |
| Tree ace = TreeUtil.addChild(testTree, "ace", NT_REP_GRANT_ACE); |
| ace.setProperty(REP_PRINCIPAL_NAME, testPrincipal.getName()); |
| ace.setProperty(REP_PRIVILEGES, ImmutableList.of(JCR_READ), Type.NAMES); |
| |
| QueryEngine qe = mock(QueryEngine.class); |
| when(qe.executeQuery(anyString(), anyString(), any(Map.class), any(Map.class))).thenThrow(new ParseException("test", 0)); |
| when(r.getQueryEngine()).thenReturn(qe); |
| |
| AccessControlManagerImpl mgr = createAccessControlManager(r, getNamePathMapper()); |
| mgr.getEffectivePolicies(ImmutableSet.of(testPrincipal)); |
| } |
| |
| //-----------------------------------------------< setPrincipalPolicy() >--- |
| @Test |
| public void testSetPrincipalPolicy() throws Exception { |
| JackrabbitAccessControlPolicy[] applicable = acMgr.getApplicablePolicies(testPrincipal); |
| assertPolicies(applicable, 1); |
| assertTrue(applicable[0] instanceof ACL); |
| |
| ACL acl = (ACL) applicable[0]; |
| Value pathValue = getValueFactory().createValue(testPath, PropertyType.PATH); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, Collections.singletonMap(REP_NODE_PATH, pathValue))); |
| acMgr.setPolicy(acl.getPath(), acl); |
| root.commit(); |
| |
| Root root2 = adminSession.getLatestRoot(); |
| AccessControlPolicy[] policies = getAccessControlManager(root2).getPolicies(testPath); |
| assertPolicies(policies, 1); |
| assertEquals(1, ((ACL) policies[0]).getAccessControlEntries().length); |
| |
| policies = getAccessControlManager(root2).getPolicies(testPrincipal); |
| assertPolicies(policies, 1); |
| assertArrayEquals(acl.getAccessControlEntries(), ((ACL) policies[0]).getAccessControlEntries()); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicy2() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| JackrabbitAccessControlPolicy[] policies = acMgr.getPolicies(testPrincipal); |
| ACL acl = (ACL) policies[0]; |
| |
| Value nodePathValue = getValueFactory().createValue(testPath, PropertyType.PATH); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, ImmutableMap.of(REP_NODE_PATH, nodePathValue))); |
| |
| // entry with * glob has already been created in the setup |
| Map<String, Value> restrictions = ImmutableMap.of(REP_NODE_PATH, nodePathValue, REP_GLOB, valueFactory.createValue("*")); |
| assertFalse(acl.addEntry(testPrincipal, testPrivileges, true, restrictions)); |
| |
| // entry with different glob -> should be added |
| restrictions = ImmutableMap.of(REP_NODE_PATH, nodePathValue, REP_GLOB, valueFactory.createValue("*/a/b")); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, false, restrictions)); |
| |
| acMgr.setPolicy(acl.getPath(), acl); |
| assertEquals(3, ((ACL) acMgr.getPolicies(testPath)[0]).getAccessControlEntries().length); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicyRemapped() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| NamePathMapper mapper = getNamePathMapperWithLocalRemapping(); |
| JackrabbitAccessControlManager remappedAcMgr = createAccessControlManager(root, mapper); |
| JackrabbitAccessControlPolicy[] policies = remappedAcMgr.getPolicies(testPrincipal); |
| assertNotNull(policies); |
| assertEquals(1, policies.length); |
| |
| ACL acl = (ACL) policies[0]; |
| Value pathValue = new ValueFactoryImpl(root, mapper).createValue(mapper.getJcrPath(testPath), PropertyType.PATH); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, Collections.singletonMap(REP_NODE_PATH, pathValue))); |
| remappedAcMgr.setPolicy(acl.getPath(), acl); |
| root.commit(); |
| |
| AccessControlPolicy[] acps = remappedAcMgr.getPolicies(mapper.getJcrPath(testPath)); |
| assertEquals(1, acps.length); |
| assertEquals(2, ((ACL) acps[0]).getAccessControlEntries().length); |
| |
| acps = acMgr.getPolicies(testPath); |
| assertEquals(1, acps.length); |
| assertEquals(2, ((ACL) acps[0]).getAccessControlEntries().length); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicyForRepositoryLevel() throws Exception { |
| assertEquals(0, acMgr.getPolicies((String)null).length); |
| |
| JackrabbitAccessControlPolicy[] policies = acMgr.getApplicablePolicies(testPrincipal); |
| ACL acl = (ACL) policies[0]; |
| |
| Map<String, Value> restrictions = new HashMap<>(); |
| restrictions.put(REP_NODE_PATH, getValueFactory().createValue("", PropertyType.STRING)); |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_NAMESPACE_MANAGEMENT); |
| assertTrue(acl.addEntry(testPrincipal, privs, true, restrictions)); |
| |
| acMgr.setPolicy(acl.getPath(), acl); |
| |
| AccessControlPolicy[] repoLevelPolicies = acMgr.getPolicies((String)null); |
| assertEquals(1, repoLevelPolicies.length); |
| |
| AccessControlEntry[] entries = ((JackrabbitAccessControlList) repoLevelPolicies[0]).getAccessControlEntries(); |
| assertEquals(1, entries.length); |
| |
| assertArrayEquals(privs, entries[0].getPrivileges()); |
| assertEquals(testPrincipal, entries[0].getPrincipal()); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicyWithNewMvRestriction() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| JackrabbitAccessControlPolicy[] policies = acMgr.getPolicies(testPrincipal); |
| ACL acl = (ACL) policies[0]; |
| |
| Map<String, Value> restrictions = new HashMap<>(); |
| restrictions.put(REP_NODE_PATH, getValueFactory().createValue(testPath, PropertyType.PATH)); |
| |
| Map<String, Value[]> mvRestrictions = new HashMap<>(); |
| ValueFactory vf = getValueFactory(root); |
| Value[] restrValues = new Value[] {vf.createValue("itemname", PropertyType.NAME), vf.createValue("propName", PropertyType.NAME)}; |
| mvRestrictions.put(REP_ITEM_NAMES, restrValues); |
| |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, restrictions, mvRestrictions)); |
| |
| acMgr.setPolicy(acl.getPath(), acl); |
| AccessControlEntry[] entries = ((ACL) acMgr.getPolicies(testPath)[0]).getAccessControlEntries(); |
| assertEquals(2, entries.length); |
| ACE newEntry = (ACE) entries[1]; |
| assertEquals(1, newEntry.getRestrictions().size()); |
| assertArrayEquals(restrValues, newEntry.getRestrictions(REP_ITEM_NAMES)); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicyRemovesEntries() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| ACL acl = (ACL) acMgr.getPolicies(testPrincipal)[0]; |
| acl.getEntries().clear(); |
| acMgr.setPolicy(acl.getPath(), acl); |
| |
| assertEquals(0, ((ACL) acMgr.getPolicies(testPath)[0]).getAccessControlEntries().length); |
| } |
| |
| @Test |
| public void testSetEmptyPrincipalPolicyRemovedACL() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| ACL acl = (ACL) acMgr.getPolicies(testPrincipal)[0]; |
| acl.getEntries().clear(); |
| |
| // remove policy at test-path before writing back the principal-based policy |
| AccessControlPolicy nodeBased = acMgr.getPolicies(testPath)[0]; |
| acMgr.removePolicy(testPath, nodeBased); |
| |
| // now write back the empty principal-based policy |
| acMgr.setPolicy(acl.getPath(), acl); |
| |
| // ... which must not have an effect and the policy must not be re-added. |
| assertPolicies(acMgr.getPolicies(testPath), 0); |
| } |
| |
| @Test |
| public void testSetPrincipalPolicyRemovedACL() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| ACL acl = (ACL) acMgr.getPolicies(testPrincipal)[0]; |
| |
| // remove policy at test-path before writing back the principal-based policy |
| ACL nodeBased = (ACL) acMgr.getPolicies(testPath)[0]; |
| int expectedSize = nodeBased.size(); |
| acMgr.removePolicy(testPath, nodeBased); |
| |
| // now write it back |
| acMgr.setPolicy(acl.getPath(), acl); |
| |
| // entries needed to be added again |
| assertPolicies(acMgr.getPolicies(testPath), expectedSize); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testSetPrincipalPolicyWithIncompleteEntry() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| ACL acl = (ACL) acMgr.getPolicies(testPrincipal)[0]; |
| Privilege[] privs = privilegesFromNames(PrivilegeConstants.JCR_LIFECYCLE_MANAGEMENT); |
| acl.getEntries().add(new ACE(testPrincipal, PrivilegeBits.BUILT_IN.get(PrivilegeConstants.JCR_LIFECYCLE_MANAGEMENT), false, Collections.emptySet(), getNamePathMapper()) { |
| @Override |
| public Privilege[] getPrivileges() { |
| return privs; |
| } |
| }); |
| |
| acMgr.setPolicy(acl.getPath(), acl); |
| } |
| |
| //--------------------------------------------< removePrincipalPolicy() >--- |
| |
| @Test |
| public void testRemovePrincipalPolicy() throws Exception { |
| JackrabbitAccessControlPolicy[] applicable = acMgr.getApplicablePolicies(testPrincipal); |
| assertPolicies(applicable, 1); |
| assertTrue(applicable[0] instanceof ACL); |
| |
| ACL acl = (ACL) applicable[0]; |
| Value pathValue = getValueFactory().createValue(testPath, PropertyType.PATH); |
| assertTrue(acl.addEntry(testPrincipal, testPrivileges, true, Collections.singletonMap(REP_NODE_PATH, pathValue))); |
| acMgr.setPolicy(acl.getPath(), acl); |
| root.commit(); |
| |
| acMgr.removePolicy(acl.getPath(), acl); |
| root.commit(); |
| |
| assertPolicies(acMgr.getPolicies(testPrincipal), 0); |
| assertPolicies(acMgr.getPolicies(testPath), 0); |
| } |
| |
| @Test |
| public void testRemovePrincipalPolicy2() throws Exception { |
| ACL acl = setupPolicy(testPath); |
| assertTrue(acl.addAccessControlEntry(EveryonePrincipal.getInstance(), privilegesFromNames(PrivilegeConstants.REP_READ_PROPERTIES))); |
| acMgr.setPolicy(acl.getPath(), acl); |
| root.commit(); |
| |
| JackrabbitAccessControlPolicy[] policies = acMgr.getPolicies(testPrincipal); |
| assertPolicies(policies, 1); |
| |
| // removing the 'testPrincipal' policy will not remove the entry for everyone |
| acMgr.removePolicy(policies[0].getPath(), policies[0]); |
| |
| assertPolicies(acMgr.getPolicies(testPath), 1); |
| assertPolicies(acMgr.getPolicies(testPrincipal), 0); |
| assertPolicies(acMgr.getPolicies(EveryonePrincipal.getInstance()), 1); |
| } |
| |
| @Test(expected = AccessControlException.class) |
| public void testRemovePrincipalPolicyRemovedACL() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| AccessControlPolicy nodeBased = acMgr.getPolicies(testPath)[0]; |
| |
| ACL acl = (ACL) acMgr.getPolicies(testPrincipal)[0]; |
| |
| // remove policy at test-path before writing back the principal-based policy |
| acMgr.removePolicy(testPath, nodeBased); |
| |
| // now try to write it back, which is expected to throw AccessControlException |
| acMgr.removePolicy(acl.getPath(), acl); |
| } |
| |
| @Test |
| public void testRemovePoliciesByPrincipalRemapped() throws Exception { |
| setupPolicy(testPath); |
| root.commit(); |
| |
| NamePathMapper mapper = getNamePathMapperWithLocalRemapping(); |
| JackrabbitAccessControlManager remappedAcMgr = createAccessControlManager(root, mapper); |
| JackrabbitAccessControlPolicy[] policies = remappedAcMgr.getPolicies(testPrincipal); |
| assertNotNull(policies); |
| assertEquals(1, policies.length); |
| |
| remappedAcMgr.removePolicy(policies[0].getPath(), policies[0]); |
| root.commit(); |
| |
| assertEquals(0, acMgr.getPolicies(testPath).length); |
| } |
| |
| @Test |
| public void testRemovePrincipalPolicyForRepositoryLevel() throws Exception { |
| setupPolicy(null, privilegesFromNames(PrivilegeConstants.JCR_NAMESPACE_MANAGEMENT)); |
| root.commit(); |
| |
| JackrabbitAccessControlPolicy[] policies = acMgr.getPolicies(testPrincipal); |
| assertEquals(1, policies.length); |
| |
| acMgr.removePolicy(policies[0].getPath(), policies[0]); |
| root.commit(); |
| |
| AccessControlPolicy[] repoLevelPolicies = acMgr.getPolicies((String)null); |
| assertEquals(0, repoLevelPolicies.length); |
| } |
| |
| private final static class TestACL extends AbstractAccessControlList { |
| |
| private final List<JackrabbitAccessControlEntry> entries = new ArrayList<>(); |
| private final RestrictionProvider restrictionProvider; |
| |
| private TestACL(@Nullable String jcrPath, |
| @NotNull RestrictionProvider restrictionProvider, |
| @NotNull NamePathMapper namePathMapper, |
| @NotNull List<JackrabbitAccessControlEntry> entries) { |
| super((jcrPath == null) ? null : namePathMapper.getOakPath(jcrPath), namePathMapper); |
| this.entries.addAll(entries); |
| this.restrictionProvider = restrictionProvider; |
| } |
| |
| private TestACL(@Nullable String jcrPath, |
| @NotNull RestrictionProvider restrictionProvider, |
| @NotNull NamePathMapper namePathMapper, |
| @NotNull JackrabbitAccessControlEntry... entry) { |
| this(jcrPath, restrictionProvider, namePathMapper, Lists.newArrayList(entry)); |
| } |
| |
| @Override |
| public boolean isEmpty() { |
| return entries.isEmpty(); |
| } |
| |
| @Override |
| public int size() { |
| return entries.size(); |
| } |
| |
| @Override |
| public boolean addEntry(@NotNull Principal principal, @NotNull Privilege[] privileges, |
| boolean isAllow, @Nullable Map<String, Value> restrictions) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| @Override |
| public boolean addEntry(@NotNull Principal principal, @NotNull Privilege[] privileges, boolean isAllow, @Nullable Map<String, Value> restrictions, @Nullable Map<String, Value[]> mvRestrictions) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| @Override |
| public void orderBefore(@NotNull AccessControlEntry srcEntry, @Nullable AccessControlEntry destEntry) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| @Override |
| public void removeAccessControlEntry(AccessControlEntry ace) { |
| throw new UnsupportedOperationException(); |
| } |
| |
| @NotNull |
| @Override |
| public List<JackrabbitAccessControlEntry> getEntries() { |
| return entries; |
| } |
| |
| @NotNull |
| @Override |
| public RestrictionProvider getRestrictionProvider() { |
| return restrictionProvider; |
| } |
| } |
| } |
