1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34 package info.magnolia.cms.security;
35
36 import info.magnolia.cms.core.Content;
37 import info.magnolia.cms.core.HierarchyManager;
38 import info.magnolia.cms.core.Path;
39 import info.magnolia.context.MgnlContext;
40 import info.magnolia.jcr.iterator.SameChildNodeTypeIterator;
41 import info.magnolia.jcr.util.NodeTypes;
42 import info.magnolia.repository.RepositoryConstants;
43
44 import javax.jcr.Node;
45 import javax.jcr.NodeIterator;
46 import javax.jcr.PathNotFoundException;
47 import javax.jcr.RepositoryException;
48 import javax.jcr.Session;
49
50 import org.apache.commons.lang.StringUtils;
51 import org.slf4j.Logger;
52 import org.slf4j.LoggerFactory;
53
54
55
56
57
58 public class MgnlRoleManager extends RepositoryBackedSecurityManager implements RoleManager {
59
60 public static final String NODE_ACLROLES = "acl_userroles";
61
62 private static final Logger log = LoggerFactory.getLogger(MgnlRoleManager.class);
63
64 @Override
65 public Role getRole(final String name) {
66 return MgnlContext.doInSystemContext(new SilentSessionOp<MgnlRole>(getRepositoryName()) {
67
68 @Override
69 public MgnlRole doExec(Session session) throws RepositoryException {
70 Node roleNode = findPrincipalNode(name, MgnlContext.getJCRSession(getRepositoryName()));
71 if (roleNode == null) {
72 log.debug("can't find role [" + name + "]");
73 return null;
74 }
75 return newRoleInstance(roleNode);
76 }
77
78 @Override
79 public String toString() {
80 return "get role " + name;
81 }
82 });
83 }
84
85 @Override
86 public Role createRole(String name) throws AccessDeniedException {
87 return createRole(null, name);
88 }
89
90
91
92
93
94
95
96 @Override
97 public Role createRole(final String path, final String name) throws AccessDeniedException {
98 validateRoleName(name);
99 return MgnlContext.doInSystemContext(new SilentSessionOp<MgnlRole>(getRepositoryName()) {
100
101 @Override
102 public MgnlRole doExec(Session session) throws RepositoryException {
103 String parentPath = StringUtils.defaultString(path, "/");
104 Node roleNode = session.getNode(parentPath).addNode(name, NodeTypes.Role.NAME);
105 final Node acls = roleNode.addNode(NODE_ACLROLES, NodeTypes.ContentNode.NAME);
106
107 Node acl = acls.addNode(Path.getUniqueLabel(session, acls.getPath(), "0"), NodeTypes.ContentNode.NAME);
108 acl.setProperty("path", roleNode.getPath());
109 acl.setProperty("permissions", Permission.READ);
110
111 session.save();
112 return newRoleInstance(roleNode);
113 }
114
115 @Override
116 public String toString() {
117 return "create role " + name;
118 }
119 });
120 }
121
122
123
124
125 @Deprecated
126 protected MgnlRole newRoleInstance(Content node) throws RepositoryException {
127 return newRoleInstance(node.getJCRNode());
128 }
129
130 protected MgnlRole newRoleInstance(Node node) throws RepositoryException {
131 return new MgnlRole(node.getName(), node.getIdentifier(), getACLs(node).values());
132 }
133
134
135
136
137 @Deprecated
138 protected HierarchyManager getHierarchyManager() {
139 return MgnlContext.getHierarchyManager(RepositoryConstants.USER_ROLES);
140 }
141
142 @Override
143 public void removePermission(final Role role, final String workspace, final String path, final long permission) {
144 MgnlContext.doInSystemContext(new SilentSessionOp<Object>(getRepositoryName()) {
145
146 @Override
147 public Object doExec(Session session) throws Throwable {
148 Node roleNode = session.getNodeByIdentifier(role.getId());
149 Node aclNode = getAclNode(roleNode, workspace);
150 NodeIterator children = new SameChildNodeTypeIterator(aclNode);
151 while(children.hasNext()) {
152 Node child = children.nextNode();
153 if (child.getProperty("path").getString().equals(path)) {
154 if (permission == MgnlRole.PERMISSION_ANY || child.getProperty("permissions").getLong() == permission) {
155 child.remove();
156 }
157 }
158 }
159 session.save();
160 return null;
161 }
162
163 @Override
164 public String toString() {
165 return "add permission to role " + role.getName();
166 }
167 });
168 }
169
170
171
172
173 private Node getAclNode(Node roleNode, String repository) throws RepositoryException, PathNotFoundException,
174 AccessDeniedException {
175 Node aclNode;
176 if (!roleNode.hasNode("acl_" + repository)) {
177 aclNode = roleNode.addNode("acl_" + repository, NodeTypes.ContentNode.NAME);
178 }
179 else {
180 aclNode = roleNode.getNode("acl_" + repository);
181 }
182 return aclNode;
183 }
184
185
186
187
188 private boolean existsPermission(Node aclNode, String path, long permission) throws RepositoryException {
189 NodeIterator children = aclNode.getNodes();
190 while(children.hasNext()) {
191 Node child = children.nextNode();
192 if (child.hasProperty("path") && child.getProperty("path").getString().equals(path)) {
193 if (permission == MgnlRole.PERMISSION_ANY
194 || child.getProperty("permissions").getLong() == permission) {
195 return true;
196 }
197 }
198 }
199 return false;
200 }
201
202 @Override
203 public void addPermission(final Role role, final String workspace, final String path, final long permission) {
204 MgnlContext.doInSystemContext(new SilentSessionOp<Object>(getRepositoryName()) {
205
206 @Override
207 public Object doExec(Session session) throws Throwable {
208 Node roleNode = session.getNodeByIdentifier(role.getId());
209 Node aclNode = getAclNode(roleNode, workspace);
210 if (!existsPermission(aclNode, path, permission)) {
211 String nodeName = Path.getUniqueLabel(session, aclNode.getPath(), "0");
212 Node node = aclNode.addNode(nodeName, NodeTypes.ContentNode.NAME);
213 node.setProperty("path", path);
214 node.setProperty("permissions", permission);
215 session.save();
216 }
217 return null;
218 }
219
220 @Override
221 public String toString() {
222 return "remove permission from role " + role.getName();
223 }
224 });
225 }
226
227
228
229
230
231 @Override
232 protected Node findPrincipalNode(String principalName, Session session) throws RepositoryException {
233 return findPrincipalNode(principalName, session, NodeTypes.Role.NAME);
234 }
235
236 @Override
237 protected String getRepositoryName() {
238 return RepositoryConstants.USER_ROLES;
239 }
240
241 @Override
242 public String getRoleNameById(String string) {
243 return getResourceName(string);
244 }
245
246 protected void validateRoleName(String name) throws AccessDeniedException {
247 if (StringUtils.isBlank(name)) {
248 throw new IllegalArgumentException(name + " is not a valid role name.");
249 }
250
251 Role role = Security.getRoleManager().getRole(name);
252
253 if (role != null) {
254 throw new IllegalArgumentException("Role with name " + name + " already exists.");
255 }
256 }
257 }