Changeset 29904

Show
Ignore:
Timestamp:
02/05/08 18:36:37 (10 months ago)
Author:
ogrisel
Message:

NXP-2010: Make ACP editing events embed the before / after states as event options to make it easier to audit security related

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/event/CoreEventConstants.java

    r29682 r29904  
    3838    public static final String DOCUMENT = "document"; 
    3939 
    40     public static final String ACP = "acp"; 
    41  
    4240    /** 
    4341     * Path the of the container of the empty document model that is being 
    …… 
    5250    public static final String SESSION_ID = "sessionId"; 
    5351 
     52    public static final String OLD_ACP = "oldACP"; 
     53 
     54    public static final String NEW_ACP = "newACP"; 
     55 
    5456    // Constant utility class 
    5557    private CoreEventConstants() { 

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/security/ACE.java

    r28462 r29904  
    2626 * 
    2727 */ 
    28 public final class ACE implements Serializable { 
     28public final class ACE implements Serializable, Cloneable { 
    2929 
    3030    private static final long serialVersionUID = -2466595648453932006L; 
    …… 
    9999    } 
    100100 
     101    @Override 
     102    public Object clone() { 
     103        return new ACE(username, permission, isGranted); 
     104    } 
     105 
    101106} 

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/security/ACL.java

    r19492 r29904  
    4545 * @author <a href="mailto:bs@nuxeo.com">Bogdan Stefanescu</a> 
    4646 */ 
    47 public interface ACL extends List<ACE>, Serializable { 
     47public interface ACL extends List<ACE>, Serializable, Cloneable { 
    4848 
    4949    String LOCAL_ACL = "local"; 
    …… 
    7272    void setACEs(ACE[] aces); 
    7373 
     74    /** 
     75     * Return a recursive copy of the ACL sharing no mutable substructure with 
     76     * the original 
     77     * 
     78     * @return a copy 
     79     */ 
     80    public Object clone(); 
     81 
    7482} 

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/security/ACP.java

    r28475 r29904  
    4545 * 
    4646 */ 
    47 public interface ACP extends Serializable { 
     47public interface ACP extends Serializable, Cloneable { 
    4848 
    4949    /** 
    …… 
    5454     * checked. 
    5555     * 
    56      * @param principal 
    57      *            the pricipal to check 
    58      * @param permission 
    59      *            the permission to check 
     56     * @param principal the pricipal to check 
     57     * @param permission the permission to check 
    6058     * @return Access.GRANT if granted, Access.DENY if denied or Access.UNKNOWN 
    6159     *         if no rule for that permission exists. Never returns null. 
    …… 
    6664 
    6765    /** 
    68      * Check the access on the ACLs for each set of the given permissions and principals. 
    69      * This differs for an iterative check using getAccess(String principal, String pemission) 
    70      * in the order of checks - so that in this case each ACE is fully checked against the given users and permissions 
     66     * Check the access on the ACLs for each set of the given permissions and 
     67     * principals. This differs for an iterative check using getAccess(String 
     68     * principal, String pemission) in the order of checks - so that in this 
     69     * case each ACE is fully checked against the given users and permissions 
    7170     * before passing to the next ACE. 
    7271     * 
    …… 
    102101    /** 
    103102     * Replaces the modifiable user entries (associated with the 
    104      * currentDocument) related to the ACP. Considers that all the 
    105      * passed entries are modifiable and attempts to set them as entries 
    106      * related to the current document. 
     103     * currentDocument) related to the ACP. Considers that all the passed 
     104     * entries are modifiable and attempts to set them as entries related to the 
     105     * current document. 
    107106     * 
    108107     * @param aclName 
    …… 
    113112    /** 
    114113     * Replaces the modifiable user entries (associated with the 
    115      * currentDocument) related to the ACP. Considers that all the 
    116      * passed entries are modifiable and attempts to set them as entries 
    117      * related to the current document. 
     114     * currentDocument) related to the ACP. Considers that all the passed 
     115     * entries are modifiable and attempts to set them as entries related to the 
     116     * current document. 
    118117     * 
    119118     * @param aclName 
    …… 
    121120     * @param overwrite overwrite the whole ACL 
    122121     */ 
    123     void setRules(String aclName, UserEntry[] userEntries, 
    124             boolean overwrite); 
     122    void setRules(String aclName, UserEntry[] userEntries, boolean overwrite); 
    125123 
    126124    String[] getOwners(); 
    …… 
    169167    String[] listUsernamesForAnyPermission(Set<String> perms); 
    170168 
     169    /** 
     170     * Return a recursive copy of the ACP sharing no mutable substructure with 
     171     * the original 
     172     * 
     173     * @return a copy 
     174     */ 
     175    public Object clone(); 
    171176 
    172177} 

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/security/impl/ACLImpl.java

    r28342 r29904  
    7171    } 
    7272 
     73    @Override 
     74    public Object clone() { 
     75        ACLImpl copy = new ACLImpl(name, isReadOnly); 
     76        ACE[] aces = new ACE[size()]; 
     77        for (int i=0; i<size(); i++) { 
     78            aces[i] = (ACE) get(i).clone(); 
     79        } 
     80        copy.setACEs(aces); 
     81        return copy; 
     82    } 
     83 
    7384} 

  • org.nuxeo.ecm.core/trunk/nuxeo-core-api/src/main/java/org/nuxeo/ecm/core/api/security/impl/ACPImpl.java

    r29107 r29904  
    4646    private static final long serialVersionUID = -2640696060701197284L; 
    4747 
    48     private final List<String> owners; 
     48    private final ArrayList<String> owners; 
    4949 
    5050    private final List<ACL> acls; 
    …… 
    363363    } 
    364364 
     365    @SuppressWarnings("unchecked") 
     366    @Override 
     367    public Object clone() { 
     368        ACPImpl copy = new ACPImpl(); 
     369        for (ACL acl: acls) { 
     370            copy.acls.add((ACL) acl.clone()); 
     371        } 
     372        copy.owners.addAll((ArrayList<String>) owners.clone()); 
     373        return copy; 
     374    } 
    365375 
    366376} 

  • org.nuxeo.ecm.core/trunk/nuxeo-core/src/main/java/org/nuxeo/ecm/core/api/AbstractSession.java

    r29684 r29904  
    521521    } 
    522522 
    523     public void setACP(DocumentRef docRef, ACP acp, boolean overwrite) 
     523    public void setACP(DocumentRef docRef, ACP newAcp, boolean overwrite) 
    524524            throws ClientException { 
    525525        try { 
    526526            Document doc = resolveReference(docRef); 
    527527            checkPermission(doc, WRITE_SECURITY); 
    528             // TODO feed some options in events 
    529528            DocumentModel docModel = readModel(doc, null); 
     529 
    530530            Map<String, Object> options = new HashMap<String, Object>(); 
    531531            options.put(CoreEventConstants.DOCUMENT, doc); 
    532             options.put(CoreEventConstants.ACP, docModel.getACP()); 
     532            options.put(CoreEventConstants.OLD_ACP, docModel.getACP().clone()); 
     533            options.put(CoreEventConstants.NEW_ACP, newAcp.clone()); 
     534 
    533535            notifyEvent(DocumentEventTypes.BEFORE_DOC_SECU_UPDATE, docModel, 
    534536                    options, null, null, true); 
    535             getSession().getSecurityManager().setACP(doc, acp, overwrite); 
     537            getSession().getSecurityManager().setACP(doc, newAcp, overwrite); 
    536538            docModel = readModel(doc, null); 
    537             options.put(CoreEventConstants.ACP, acp); 
    538539            notifyEvent(DocumentEventTypes.DOCUMENT_SECURITY_UPDATED, docModel, 
    539540                    options, null, null, true);