| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| package org.apache.sling.jcr.jackrabbit.accessmanager.post; |
| |
| import java.security.Principal; |
| import java.util.Collection; |
| import java.util.List; |
| import java.util.Map; |
| import java.util.Set; |
| |
| import javax.jcr.RepositoryException; |
| import javax.jcr.Session; |
| import javax.jcr.Value; |
| import javax.jcr.security.AccessControlEntry; |
| import javax.jcr.security.AccessControlManager; |
| import javax.jcr.security.AccessControlPolicy; |
| import javax.servlet.Servlet; |
| |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlList; |
| import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager; |
| import org.apache.jackrabbit.api.security.authorization.PrincipalAccessControlList; |
| import org.apache.jackrabbit.oak.spi.security.authorization.restriction.RestrictionProvider; |
| import org.apache.sling.jcr.jackrabbit.accessmanager.LocalPrivilege; |
| import org.apache.sling.jcr.jackrabbit.accessmanager.LocalRestriction; |
| import org.apache.sling.jcr.jackrabbit.accessmanager.ModifyPrincipalAce; |
| import org.apache.sling.jcr.jackrabbit.accessmanager.impl.PrincipalAceHelper; |
| import org.apache.sling.servlets.post.PostResponseCreator; |
| import org.jetbrains.annotations.NotNull; |
| import org.jetbrains.annotations.Nullable; |
| import org.osgi.service.component.annotations.Component; |
| import org.osgi.service.component.annotations.Reference; |
| import org.osgi.service.component.annotations.ReferenceCardinality; |
| import org.osgi.service.component.annotations.ReferencePolicyOption; |
| |
| /** |
| * <p> |
| * Sling Post Servlet implementation for modifying the principalbased ACE for a principal on a JCR |
| * resource. |
| * </p> |
| * <h2>Rest Service Description</h2> |
| * <p> |
| * Modify a principal's ACEs for the node identified as a resource by the request |
| * URL >resource<.modifyPAce.html |
| * </p> |
| * <h3>Transport Details:</h3> |
| * <h4>Methods</h4> |
| * <ul> |
| * <li>POST</li> |
| * </ul> |
| * <h4>Post Parameters</h4> |
| * <dl> |
| * <dt>principalId</dt> |
| * <dd>The principal of the ACEs to modify in the ACL specified by the path.</dd> |
| * <dt>privilege@[privilege_name]</dt> |
| * <dd>One or more privileges which will be applied to the ACE. Any permissions that are present in an |
| * existing ACE for the principal but not in the request are left untouched. The parameter value must be either 'allow' or 'all'. |
| * For backward compatibility, 'granted' may also be used for the parameter value as an alias for 'allow'.</dd> |
| * <dt>restriction@[restriction_name]</dt> |
| * <dd>One or more restrictions which will be applied to the ACE. The value is the target value of the restriction to be set.</dd> |
| * <dt>restriction@[restriction_name]@Delete</dt> |
| * <dd>One or more restrictions which will be removed from the ACE</dd> |
| * <dt>privilege@[privilege_name]@Delete</dt> |
| * <dd>One param for each privilege to delete. The parameter value must be either 'allow' or 'all' to specify which state to delete from</dd> |
| * <dt>restriction@[privilege_name]@[restriction_name]@Allow</dt> |
| * <dt>restriction@[privilege_name]@[restriction_name]@Deny</dt> |
| * <dd>One param for each restriction value. The same parameter name may be used again for multi-value restrictions. The @Allow suffix |
| * specifies whether to apply the restriction to the 'allow' privilege. The value is the target value of the restriction to be set.</dd> |
| * <dt>restriction@[privilege_name]@[restriction_name]@Delete</dt> |
| * <dd>One param for each restriction to delete. The parameter value must be either 'allow' or 'all' to specify which state to delete from.</dd> |
| * </dl> |
| * |
| * <h4>Response</h4> |
| * <dl> |
| * <dt>200</dt> |
| * <dd>Success.</dd> |
| * <dt>404</dt> |
| * <dd>The resource was not found.</dd> |
| * <dt>500</dt> |
| * <dd>Failure. HTML explains the failure.</dd> |
| * </dl> |
| * |
| * <h4>Notes</h4> |
| * <p> |
| * The principalId is assumed to refer directly to an Authorizable, that comes direct from |
| * the UserManager. This can be a group or a user, but if its a group, denied permissions |
| * will not be added to the group. The group will only contain granted privileges. |
| * </p> |
| */ |
| @Component(service = {Servlet.class, ModifyPrincipalAce.class}, |
| property= { |
| "sling.servlet.resourceTypes=sling/servlet/default", |
| "sling.servlet.methods=POST", |
| "sling.servlet.selectors=modifyPAce", |
| "sling.servlet.prefix:Integer=-1" |
| }, |
| reference = { |
| @Reference(name="RestrictionProvider", |
| bind = "bindRestrictionProvider", |
| service = RestrictionProvider.class), |
| @Reference(name = "PostResponseCreator", |
| bind = "bindPostResponseCreator", |
| cardinality = ReferenceCardinality.MULTIPLE, |
| policyOption = ReferencePolicyOption.GREEDY, |
| service = PostResponseCreator.class) |
| }) |
| @SuppressWarnings("java:S110") |
| public class ModifyPrincipalAceServlet extends ModifyAceServlet implements ModifyPrincipalAce { |
| |
| private static final long serialVersionUID = -4152308935573740745L; |
| |
| @Override |
| protected boolean allowNonExistingPaths() { |
| return true; |
| } |
| |
| @Override |
| public void modifyPrincipalAce(Session jcrSession, String resourcePath, String principalId, |
| Map<String, String> privileges, boolean autoSave) throws RepositoryException { |
| modifyPrincipalAce(jcrSession, resourcePath, principalId, privileges, |
| null, null, null, autoSave); |
| } |
| |
| @Override |
| public void modifyPrincipalAce(Session jcrSession, String resourcePath, String principalId, |
| Map<String, String> privileges, Map<String, Value> restrictions, |
| Map<String, Value[]> mvRestrictions, Set<String> removeRestrictionNames, boolean autoSave) |
| throws RepositoryException { |
| modifyAce(jcrSession, resourcePath, principalId, privileges, null, |
| restrictions, mvRestrictions, removeRestrictionNames, autoSave, null); |
| } |
| |
| @Override |
| public void modifyPrincipalAce(Session jcrSession, String resourcePath, String principalId, |
| Collection<LocalPrivilege> localPrivileges, boolean autoSave) throws RepositoryException { |
| modifyAce(jcrSession, resourcePath, principalId, |
| localPrivileges, null, |
| autoSave, null); |
| } |
| |
| /** |
| * Override to ensure that we get the policy that implements {@link PrincipalAccessControlList} |
| */ |
| @Override |
| protected JackrabbitAccessControlList getAcl(@NotNull AccessControlManager acm, String resourcePath, Principal principal) |
| throws RepositoryException { |
| JackrabbitAccessControlList acl = null; |
| if (acm instanceof JackrabbitAccessControlManager) { |
| JackrabbitAccessControlManager jacm = (JackrabbitAccessControlManager)acm; |
| AccessControlPolicy[] policies = jacm.getPolicies(principal); |
| for (AccessControlPolicy policy : policies) { |
| if (policy instanceof PrincipalAccessControlList) { |
| acl = (PrincipalAccessControlList) policy; |
| break; |
| } |
| } |
| if (acl == null) { |
| AccessControlPolicy[] applicablePolicies = jacm.getApplicablePolicies(principal); |
| for (AccessControlPolicy policy : applicablePolicies) { |
| if (policy instanceof PrincipalAccessControlList) { |
| acl = (PrincipalAccessControlList) policy; |
| break; |
| } |
| } |
| } |
| } |
| return acl; |
| } |
| |
| /** |
| * Override to ensure that we only remove the entries that have an effectivePath that matches |
| * the current resourcePath |
| */ |
| @Override |
| protected String removeAces(@NotNull String resourcePath, @Nullable String order, @NotNull Principal principal, |
| @NotNull JackrabbitAccessControlList acl) throws RepositoryException { |
| AccessControlEntry[] existingAccessControlEntries = acl.getAccessControlEntries(); |
| for (int j = 0; j < existingAccessControlEntries.length; j++) { |
| AccessControlEntry ace = existingAccessControlEntries[j]; |
| @Nullable |
| JackrabbitAccessControlEntry jrEntry = getJackrabbitAccessControlEntry(ace, resourcePath, principal); |
| if (jrEntry != null) { |
| if (order == null || order.length() == 0) { |
| //order not specified, so keep track of the original ACE position. |
| order = String.valueOf(j); |
| } |
| |
| acl.removeAccessControlEntry(ace); |
| } |
| } |
| return order; |
| } |
| |
| /** |
| * Override to ensure we do not add enty that denies privileges which is not allowed in a principal ACE |
| */ |
| @Override |
| protected void addAces(@NotNull String resourcePath, @NotNull Principal principal, |
| @NotNull Map<Set<LocalRestriction>, List<LocalPrivilege>> restrictionsToLocalPrivilegesMap, boolean isAllow, |
| @NotNull JackrabbitAccessControlList acl) throws RepositoryException { |
| if (!isAllow && !restrictionsToLocalPrivilegesMap.isEmpty()) { |
| // deny privileges not allowed in a principal ACE |
| throw new IllegalArgumentException("Deny privileges are not allowed in a principal ACE"); |
| } |
| super.addAces(resourcePath, principal, restrictionsToLocalPrivilegesMap, isAllow, acl); |
| } |
| |
| /** |
| * Override to ensure that we only return the entries that have an effectivePath that matches |
| * the current resourcePath |
| */ |
| @Override |
| protected @Nullable JackrabbitAccessControlEntry getJackrabbitAccessControlEntry(@NotNull AccessControlEntry entry, @NotNull String resourcePath, |
| @NotNull Principal forPrincipal) { |
| JackrabbitAccessControlEntry jrEntry = null; |
| if (entry instanceof PrincipalAccessControlList.Entry && |
| entry.getPrincipal().equals(forPrincipal) && |
| PrincipalAceHelper.matchesResourcePath(resourcePath, entry)) { |
| jrEntry = (JackrabbitAccessControlEntry)entry; |
| } |
| return jrEntry; |
| } |
| |
| } |
