| <!DOCTYPE HTML> |
| <html lang="en"> |
| <head> |
| <title>Source code</title> |
| <link rel="stylesheet" type="text/css" href="../../../../../stylesheet.css" title="Style"> |
| </head> |
| <body> |
| <main role="main"> |
| <div class="sourceContainer"> |
| <pre><span class="sourceLineNo">001</span><a id="line.1">/*</a> |
| <span class="sourceLineNo">002</span><a id="line.2"> * Licensed to the Apache Software Foundation (ASF) under one</a> |
| <span class="sourceLineNo">003</span><a id="line.3"> * or more contributor license agreements. See the NOTICE file</a> |
| <span class="sourceLineNo">004</span><a id="line.4"> * distributed with this work for additional information</a> |
| <span class="sourceLineNo">005</span><a id="line.5"> * regarding copyright ownership. The ASF licenses this file</a> |
| <span class="sourceLineNo">006</span><a id="line.6"> * to you under the Apache License, Version 2.0 (the</a> |
| <span class="sourceLineNo">007</span><a id="line.7"> * "License"); you may not use this file except in compliance</a> |
| <span class="sourceLineNo">008</span><a id="line.8"> * with the License. You may obtain a copy of the License at</a> |
| <span class="sourceLineNo">009</span><a id="line.9"> *</a> |
| <span class="sourceLineNo">010</span><a id="line.10"> * http://www.apache.org/licenses/LICENSE-2.0</a> |
| <span class="sourceLineNo">011</span><a id="line.11"> *</a> |
| <span class="sourceLineNo">012</span><a id="line.12"> * Unless required by applicable law or agreed to in writing,</a> |
| <span class="sourceLineNo">013</span><a id="line.13"> * software distributed under the License is distributed on an</a> |
| <span class="sourceLineNo">014</span><a id="line.14"> * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY</a> |
| <span class="sourceLineNo">015</span><a id="line.15"> * KIND, either express or implied. See the License for the</a> |
| <span class="sourceLineNo">016</span><a id="line.16"> * specific language governing permissions and limitations</a> |
| <span class="sourceLineNo">017</span><a id="line.17"> * under the License.</a> |
| <span class="sourceLineNo">018</span><a id="line.18"> */</a> |
| <span class="sourceLineNo">019</span><a id="line.19">package org.apache.shiro.authz;</a> |
| <span class="sourceLineNo">020</span><a id="line.20"></a> |
| <span class="sourceLineNo">021</span><a id="line.21">/**</a> |
| <span class="sourceLineNo">022</span><a id="line.22"> * A Permission represents the ability to perform an action or access a resource. A Permission is the most</a> |
| <span class="sourceLineNo">023</span><a id="line.23"> * granular, or atomic, unit in a system's security policy and is the cornerstone upon which fine-grained security</a> |
| <span class="sourceLineNo">024</span><a id="line.24"> * models are built.</a> |
| <span class="sourceLineNo">025</span><a id="line.25"> * <p/></a> |
| <span class="sourceLineNo">026</span><a id="line.26"> * It is important to understand a Permission instance only represents functionality or access - it does not grant it.</a> |
| <span class="sourceLineNo">027</span><a id="line.27"> * Granting access to an application functionality or a particular resource is done by the application's security</a> |
| <span class="sourceLineNo">028</span><a id="line.28"> * configuration, typically by assigning Permissions to users, roles and/or groups.</a> |
| <span class="sourceLineNo">029</span><a id="line.29"> * <p/></a> |
| <span class="sourceLineNo">030</span><a id="line.30"> * Most typical systems are what the Shiro team calls <em>role-based</em> in nature, where a role represents</a> |
| <span class="sourceLineNo">031</span><a id="line.31"> * common behavior for certain user types. For example, a system might have an <em>Administrator</em> role, a</a> |
| <span class="sourceLineNo">032</span><a id="line.32"> * <em>User</em> or <em>Guest</em> roles, etc.</a> |
| <span class="sourceLineNo">033</span><a id="line.33"> * <p/></a> |
| <span class="sourceLineNo">034</span><a id="line.34"> * But if you have a dynamic security model, where roles can be created and deleted at runtime, you can't hard-code</a> |
| <span class="sourceLineNo">035</span><a id="line.35"> * role names in your code. In this environment, roles themselves aren't very useful. What matters is what</a> |
| <span class="sourceLineNo">036</span><a id="line.36"> * <em>permissions</em> are assigned to these roles.</a> |
| <span class="sourceLineNo">037</span><a id="line.37"> * <p/></a> |
| <span class="sourceLineNo">038</span><a id="line.38"> * Under this paradigm, permissions are immutable and reflect an application's raw functionality</a> |
| <span class="sourceLineNo">039</span><a id="line.39"> * (opening files, accessing a web URL, creating users, etc). This is what allows a system's security policy</a> |
| <span class="sourceLineNo">040</span><a id="line.40"> * to be dynamic: because Permissions represent raw functionality and only change when the application's</a> |
| <span class="sourceLineNo">041</span><a id="line.41"> * source code changes, they are immutable at runtime - they represent 'what' the system can do. Roles, users, and</a> |
| <span class="sourceLineNo">042</span><a id="line.42"> * groups are the 'who' of the application. Determining 'who' can do 'what' then becomes a simple exercise of</a> |
| <span class="sourceLineNo">043</span><a id="line.43"> * associating Permissions to roles, users, and groups in some way.</a> |
| <span class="sourceLineNo">044</span><a id="line.44"> * <p/></a> |
| <span class="sourceLineNo">045</span><a id="line.45"> * Most applications do this by associating a named role with permissions (i.e. a role 'has a' collection of</a> |
| <span class="sourceLineNo">046</span><a id="line.46"> * Permissions) and then associate users with roles (i.e. a user 'has a' collection of roles) so that by transitive</a> |
| <span class="sourceLineNo">047</span><a id="line.47"> * association, the user 'has' the permissions in their roles. There are numerous variations on this theme</a> |
| <span class="sourceLineNo">048</span><a id="line.48"> * (permissions assigned directly to users, or assigned to groups, and users added to groups and these groups in turn</a> |
| <span class="sourceLineNo">049</span><a id="line.49"> * have roles, etc, etc). When employing a permission-based security model instead of a role-based one, users, roles,</a> |
| <span class="sourceLineNo">050</span><a id="line.50"> * and groups can all be created, configured and/or deleted at runtime. This enables an extremely powerful security</a> |
| <span class="sourceLineNo">051</span><a id="line.51"> * model.</a> |
| <span class="sourceLineNo">052</span><a id="line.52"> * <p/></a> |
| <span class="sourceLineNo">053</span><a id="line.53"> * A benefit to Shiro is that, although it assumes most systems are based on these types of static role or</a> |
| <span class="sourceLineNo">054</span><a id="line.54"> * dynamic role w/ permission schemes, it does not require a system to model their security data this way - all</a> |
| <span class="sourceLineNo">055</span><a id="line.55"> * Permission checks are relegated to {@link org.apache.shiro.realm.Realm} implementations, and only those</a> |
| <span class="sourceLineNo">056</span><a id="line.56"> * implementations really determine how a user 'has' a permission or not. The Realm could use the semantics described</a> |
| <span class="sourceLineNo">057</span><a id="line.57"> * here, or it could utilize some other mechanism entirely - it is always up to the application developer.</a> |
| <span class="sourceLineNo">058</span><a id="line.58"> * <p/></a> |
| <span class="sourceLineNo">059</span><a id="line.59"> * Shiro provides a very powerful default implementation of this interface in the form of the</a> |
| <span class="sourceLineNo">060</span><a id="line.60"> * {@link org.apache.shiro.authz.permission.WildcardPermission WildcardPermission}. We highly recommend that you</a> |
| <span class="sourceLineNo">061</span><a id="line.61"> * investigate this class before trying to implement your own <code>Permission</code>s.</a> |
| <span class="sourceLineNo">062</span><a id="line.62"> *</a> |
| <span class="sourceLineNo">063</span><a id="line.63"> * @see org.apache.shiro.authz.permission.WildcardPermission WildcardPermission</a> |
| <span class="sourceLineNo">064</span><a id="line.64"> * @since 0.2</a> |
| <span class="sourceLineNo">065</span><a id="line.65"> */</a> |
| <span class="sourceLineNo">066</span><a id="line.66">public interface Permission {</a> |
| <span class="sourceLineNo">067</span><a id="line.67"></a> |
| <span class="sourceLineNo">068</span><a id="line.68"> /**</a> |
| <span class="sourceLineNo">069</span><a id="line.69"> * Returns {@code true} if this current instance <em>implies</em> all the functionality and/or resource access</a> |
| <span class="sourceLineNo">070</span><a id="line.70"> * described by the specified {@code Permission} argument, {@code false} otherwise.</a> |
| <span class="sourceLineNo">071</span><a id="line.71"> * <p/></a> |
| <span class="sourceLineNo">072</span><a id="line.72"> * <p>That is, this current instance must be exactly equal to or a <em>superset</em> of the functionality</a> |
| <span class="sourceLineNo">073</span><a id="line.73"> * and/or resource access described by the given {@code Permission} argument. Yet another way of saying this</a> |
| <span class="sourceLineNo">074</span><a id="line.74"> * would be:</a> |
| <span class="sourceLineNo">075</span><a id="line.75"> * <p/></a> |
| <span class="sourceLineNo">076</span><a id="line.76"> * <p>If &quot;permission1 implies permission2&quot;, i.e. <code>permission1.implies(permission2)</code> ,</a> |
| <span class="sourceLineNo">077</span><a id="line.77"> * then any Subject granted {@code permission1} would have ability greater than or equal to that defined by</a> |
| <span class="sourceLineNo">078</span><a id="line.78"> * {@code permission2}.</a> |
| <span class="sourceLineNo">079</span><a id="line.79"> *</a> |
| <span class="sourceLineNo">080</span><a id="line.80"> * @param p the permission to check for behavior/functionality comparison.</a> |
| <span class="sourceLineNo">081</span><a id="line.81"> * @return {@code true} if this current instance <em>implies</em> all the functionality and/or resource access</a> |
| <span class="sourceLineNo">082</span><a id="line.82"> * described by the specified {@code Permission} argument, {@code false} otherwise.</a> |
| <span class="sourceLineNo">083</span><a id="line.83"> */</a> |
| <span class="sourceLineNo">084</span><a id="line.84"> boolean implies(Permission p);</a> |
| <span class="sourceLineNo">085</span><a id="line.85">}</a> |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| </pre> |
| </div> |
| </main> |
| </body> |
| </html> |
