Metacat

  private String userName = null;

  private static final String PUBLIC = "public";

  private String [] group = null;

  /**

   * Method to set user name

   *

   * @param myName  the user name

   */

  public void setUserName(String myName)

  {

    this.userName = myName;

  }

  /**

   * Method to set user group

   *

   * @param myGroup  the user group

   */

  public void setGroup(String [] myGroup)

  {

    this.group = myGroup;

  }

  /*

   * Method to get owner query. If it is owner it has all permission

   */

  private String createOwerQuery()

  {

    String ownerQuery = null;

    ownerQuery = "SELECT docid FROM xml_documents WHERE user_owner ='" +

                  PUBLIC + "'";

    if (userName != null && !userName.equals(""))

    {

      ownerQuery = ownerQuery + " OR user_owner ='"+ userName +"'";

    }

    if (group != null)

    {

      for (int i = 0; i< group.length; i++)

      {

        String groupUint = group[i];

        if (groupUint != null && !groupUint.equals(""))

        {

          ownerQuery = ownerQuery +" OR user_owner = '" + groupUint + "'";

        }//if

      }//for

    }

    MetaCatUtil.debugMessage("OwnerQuery: "+ownerQuery, 30);

    return ownerQuery;

  }

  /*

   * Method to create query for xml_access, this part is to get docid list which

   * have a allow rule for a given user

   */

  private String createAllowRuleQuery()

  {

    String allowQuery = null;

    allowQuery ="SELECT docid from xml_access WHERE ";

    // add allow rule for user name

    if (userName != null && !userName.equals(""))

    {

      allowQuery = allowQuery +"(principal_name = '" + userName 

                              +"' AND perm_type = 'allow')";

    }

    // add allow rule for public

    allowQuery = allowQuery +"OR (principal_name = '" + PUBLIC 

                              +"' AND perm_type = 'allow')";

    // add allow rule for group

    if (group != null)

    {

      for (int i = 0; i< group.length; i++)

      {

        String groupUint = group[i];

        if (groupUint != null && !groupUint.equals(""))

        {

          allowQuery = allowQuery +" OR (principal_name = '" + groupUint 

                              +"' AND perm_type = 'allow')";

        }//if

      }//for

    }//if

    MetaCatUtil.debugMessage("allow query is: "+ allowQuery, 30);

    return allowQuery;

  }

   /*

   * Method to create query for xml_access, this part is to get docid list which

   * have a deny rule and perm_order is allowFirst for a given user. This means

   * the user will be denied to read

   */

  private String createDenyRuleQuery()

  {

    String denyQuery = null;

    denyQuery ="SELECT docid from xml_access WHERE ";

    // add deny rule for user name

    if (userName != null && !userName.equals(""))

    {

      denyQuery = denyQuery +"(principal_name = '" + userName 

                              +"' AND perm_type = 'deny' "

                              +"AND perm_order ='allowFirst')";

    }

    // add deny rule for public

    denyQuery = denyQuery +"OR (principal_name = '" + PUBLIC 

                               +"' AND perm_type = 'deny' "

                               +"AND perm_order ='allowFirst')";

    // add allow rule for group

    if (group != null)

    {

      for (int i = 0; i< group.length; i++)

      {

        String groupUint = group[i];

        if (groupUint != null && !groupUint.equals(""))

        {

          denyQuery = denyQuery +" OR (principal_name = '" + groupUint 

                                +"' AND perm_type = 'deny' "

                                +"AND perm_order ='allowFirst')";

        }//if

      }//for

    }//if

    MetaCatUtil.debugMessage("denyquery is: "+ denyQuery, 30);

    return denyQuery;

  }

  /**

   * Method to append a access control query to SQL. So in DBQuery class, we can

   * get docid from both user specified query and access control query. We don't

   * need to checking permission after we get the doclist. It will be good to 

   * performance

   *

   */

  public String getAccessQuery()

  {

    String accessQuery = null;

    String onwer = createOwerQuery();

    String allow = createAllowRuleQuery();

    String deny = createDenyRuleQuery();

    accessQuery = " AND (docid IN("+ onwer + ")";

    accessQuery = accessQuery + " OR (docid IN (" + allow + ")" 

                 + " AND docid NOT IN ("+ deny + ")))";

    MetaCatUtil.debugMessage("accessquery is: "+ accessQuery, 30);

    return accessQuery;

  }