Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A class that handles checking permssision for a document

               and subtree in a document

 *

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Chad Berkley

 *    Release: @release@

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.sql.*;

import java.util.Vector;

public class PermissionController

{

   private String docId = null;

   private boolean hasSubTreeAccessControl = false; // flag if has a subtree

                                                    // access for this docid

   private Vector subTreeList = new Vector();

                                         //level document

    * Constructor for PermissionController

    * @param myDocid      the docid need to access

    */

     // Get rid of rev number

   }

    * Return if a document has subtree access control

    */

   public boolean hasSubTreeAccessControl()

   {

     return hasSubTreeAccessControl;

   }

    * Go through the access table and find if has subtree access control

    * if has, store the subtree into list and return true. Otherwise,

    * return false

    */

    boolean flag = false;

    PreparedStatement pStmt=null;

    ResultSet rs=null;

    DBConnection conn=null;

    int serialNumber=-1;

    String query="SELECT subtreeid, startnodeid, endnodeid from xml_access " +

                 "where docid =? ";

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("PermissionController.hasSubTreeA");

      serialNumber=conn.getCheckOutSerialNumber();

      pStmt=conn.prepareStatement(query);

      //bind the value to query

      pStmt.setString(1, docId);

      //execute the query

      pStmt.execute();

      rs=pStmt.getResultSet();

      //process the result

      while (rs.next()) //

      {

        String subTreeId = rs.getString(1);

        if (subTreeId != null && startNodeId != 0 && startNodeId != 0)

        {

          flag = true;// has subtree control

          SubTree tree = new SubTree();

          tree.setSubTreeId(subTreeId);

          tree.setStartNodeId(startNodeId);

          tree.setEndNodeId(endNodeId);

          subTreeList.add(tree);

         }

      }

    }//try

    {

      throw new McdbException(e);

    }

    {

      try

      {

        pStmt.close();

      }

      {

        throw new McdbException(ee);

      }

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    return flag;

  }

  /**

    * Check from db connection if at least one of the list of @principals

    * @param user  the user name

    * @param groups  the groups which the use is in

    * @param myPermission  permission type to check for

    */

  public boolean hasPermission(String user, String[]groups, String myPermission)

                              throws SQLException, Exception

  {

    boolean hasPermission=false;

    String [] userPackage=null;

    int permission =AccessControlList.intValue(myPermission);

    if ((user==null) && (groups==null || groups.length==0))

    {

      return true;

    }

    //create a userpackage including user, public and group member

    userPackage=createUsersPackage(user, groups);

    //if the requested document is access documents and requested permission

    //is "write", the user should have "all" right

    {

    }//if

    else //in other situation, just check the request permission

    {

      hasPermission = hasPermission(userPackage,docId, permission);

    }//else

    return hasPermission;

  }

  /**

    * Check from db connection if the users in String array @principals has

    * @permission on @docid*

    * @param principals, names in userPakcage need to check for @permission

    * @param docid, document identifier to check on

    * @param permission, permission (write or all...) to check for

    */

  private boolean hasPermission(String [] principals, String docId,

                                           int permission)

                         throws SQLException

  {

    {

      //first, if there is a docid owner in user package, return true

      //because doc owner has all permssion

      if (containDocumentOwner(principals, docId))

      {

          return true;

      }

      //If there is no owner in user package, checking the table

      //check perm_order

          //if it is allowfirst and has deny rule(either explicit )

          //deny access

        }//if

          //if it is allowfirst and hasn't deny rule and has allow rule

          //allow access

        }//else if

        else

        {

          //other situation deny access

        }//else

     }//if isAllowFirst

     else //denyFirst

     {

         //if it is denyFirst and has allow rule, allow access

         return true;

       }

       else

       {

         //if it is denyfirst but no allow rule, deny access

         return false;

       }

     }//else denyfirst

    }//try

    catch (Exception e)

    {

      MetaCatUtil.debugMessage("There is a exception in hasPermission method: "

                         +e.getMessage(), 50);

    }

    return false;

  }//hasPermission

  /**

   * access control

   */

  public boolean hasPermissionForSubTreeNode(String user, String[] groups,

                                             String myPermission, long nodeId)

                                             throws McdbException

  {

    Hashtable unaccessableSubTree = hasUnaccessableSubTree(user, groups,

                                                           myPermission);

    Enumeration en = unaccessableSubTree.elements();

    while (en.hasMoreElements())

    {

      SubTree tree = (SubTree)en.nextElement();

      long start = tree.getStartNodeId();

      long stop  = tree.getEndNodeId();

      {

      }

    }

    return flag;

  }

  /**

   * permssion to access

   * @param user  the user name

   * @param groups  the groups which the use is in

   * @param myPermission  permission type to check for

   */

  public Hashtable hasUnaccessableSubTree(String user, String[] groups,

                                       String myPermission) throws McdbException

  {

    Hashtable resultUnaccessableSubTree = new Hashtable();

    String [] principals=null;

    int permission =AccessControlList.intValue(myPermission);

    //for the commnad line invocation return null(no unaccessable subtree)

    if ((user==null) && (groups==null || groups.length==0))

    {

      return resultUnaccessableSubTree;

    }

    //create a userpackage including user, public and group member

    principals=createUsersPackage(user, groups);

    //for the document owner return null(no unaccessable subtree)

    try

    {

      if (containDocumentOwner(principals, docId))

      {

       return resultUnaccessableSubTree;

      }

    }

    catch (SQLException ee)

    {

      throw new McdbException(ee);

    }

    // go through every subtree which has access control

    for (int i = 0; i< subTreeList.size(); i++)

    {

      SubTree tree = (SubTree)subTreeList.elementAt(i);

        {

             //if it is allowfirst and has deny rule

              // put the subtree into unaccessable vector

            }//if

              //if it is allowfirst and hasn't deny rule and has allow rule

              //allow access do nothing

            }//else if

            else

            {

              //other situation deny access

            }//else

          }//if isAllowFirst

          else //denyFirst

          {

              //if it is denyFirst and has allow rule, allow access, do nothing

            }

            else

            {

              //if it is denyfirst but no allow rule, deny access

              // add into vector

            }

          }//else denyfirst

        }//try

        catch( Exception e)

        {

          MetaCatUtil.debugMessage("error in PermissionControl.has" +

                                   "UnaccessableSubTree "+e.getMessage(), 30);

          throw new McdbException(e);

        }

  }//hasUnaccessableSubtree

  /*

   * A method to merge nested subtree into bigger one. For example subtree b

   * is a subtree of subtree a. And user doesn't have read permission for both

   * so we only use subtree a is enough.

   */

    Hashtable newSubTreeHash = new Hashtable();

    boolean   needDelete = false;

    // check the parameters

    if (unAccessSubTree == null || unAccessSubTree.isEmpty())

    {

      return newSubTreeHash;

    }

    else

    {

      // look every subtree start point and stop point, to see if it is embedded

      // in another one. If embedded, they are equavelent and we can use bigger

      // one to replace smaller one

      Enumeration en = unAccessSubTree.elements();

      while (en.hasMoreElements())

      {

        SubTree tree    = (SubTree)en.nextElement();

        String  treeId  = tree.getSubTreeId();

        long    startId = tree.getStartNodeId();

        long    endId   = tree.getEndNodeId();

        Enumeration enu = unAccessSubTree.elements();

        while (enu.hasMoreElements())

        {

          SubTree subTree = (SubTree)enu.nextElement();

          String subTreeId= subTree.getSubTreeId();

          long   subTreeStartId = subTree.getStartNodeId();

          long   subTreeEndId   = subTree.getEndNodeId();

          //compare and if the first subtree is a subtree of the second

          // one, set neeDelete true

          if (startId > subTreeStartId && endId < subTreeEndId)

          {

            needDelete = true;

            MetaCatUtil.debugMessage("the subtree: "+ treeId +

                                     " need to be get rid of from unaccessable"+

                                     " subtree list becuase it is a subtree of"+

                                     " another subtree in the list", 45);

            break;

          }//if

        }//while

        // if not need to delete, put the subtree into hash

        if (!needDelete)

        {

        //reset needDelete

        needDelete = false;

      }//while

      return newSubTreeHash;

    }//else

  }

    * has "all" permission to access it.

    * @param docId, the document id need to be checked

    */

    private boolean isAccessDocument(String docId) throws SQLException

    {

      //detele the rev number if docid contains it

      docId=MetaCatUtil.getDocIdFromString(docId);

      PreparedStatement pStmt=null;

      DBConnection conn = null;

      int serialNumber = -1;

      try

      {

        //check out DBConnection

                                      "docid like '" + docId +  "'");

        ResultSet rs = pStmt.getResultSet();

        boolean hasRow = rs.next();

        if (hasRow)

        {

          doctype = rs.getString(1);

        }

        // if it is an access document

        if (doctype != null && ((MetaCatUtil.getOptionList(MetaCatUtil.

           getOption("accessdoctype")).contains(doctype))))

        }

      catch(SQLException e)

      {

                     " on document " + docId + ". " + e.getMessage());

      }

      finally

      {

        try

        {

           pStmt.close();

        }

        finally

        {

          DBConnectionPool.returnDBConnection(conn, serialNumber);

        }

      }

    }//isAccessDocument

  /**

    * Check if a stirng array contains a given documents' owner

    * @param principals, a string array storing the username, groups name and

    * public.

    * @param docid, the id of given documents

    */

  {

    int lengthOfArray=principals.length;

    boolean hasRow;

    PreparedStatement pStmt=null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      pStmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

      //the owner of document

      for (int i=0; i<lengthOfArray; i++)

      {

        // Bind the values to the query

        pStmt.setString(1, docId);

        pStmt.setString(2, principals[i]);

                                  principals[i], 40);

        pStmt.execute();

        ResultSet rs = pStmt.getResultSet();

        hasRow = rs.next();

        if (hasRow)

        {

          pStmt.close();

        }//if

      }//for

    }//try

    catch (SQLException e)

    {

        pStmt.close();

        throw new

                     " on document #" + docId + ". " + e.getMessage());

    }//catch

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    return false;

  }//containDocumentOwner

  /**

    * Check if the permission order for user at that documents is allowFirst

    * @param principals, list of names of principals to check for

    * @param docid, document identifier to check for

    */

  {

    int lengthOfArray=principals.length;

    boolean hasRow;

    PreparedStatement pStmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    boolean topLever =false;

      //top level

      topLever = true;

      sql = "SELECT perm_order FROM xml_access " +

    else

    {

      //sub tree level

      sql = "SELECT perm_order FROM xml_access " +

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.isAllowFirst");

      serialNumber=conn.getCheckOutSerialNumber();

      //select permission order from database

      //check every name in the array

      for (int i=0; i<lengthOfArray;i++)

      {

        //bind value

        pStmt.setString(1, principals[i]);//user name

        pStmt.setString(2, docId);//docid

        // if subtree, we need set subtree id

        if (!topLever)

        {

        pStmt.execute();

        ResultSet rs = pStmt.getResultSet();

        hasRow=rs.next();

        if (hasRow)

        {

          //get the permission order from data base

          String permissionOrder=rs.getString(1);

          //if the permission order is "allowFirst

          if (permissionOrder.equalsIgnoreCase(AccessControlInterface.ALLOWFIRST))

          {

            pStmt.close();

            return true;

          }

          else

          {

            pStmt.close();

            return false;

          }

        }//if

      }//for

    }//try

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    //if reach here, means there is no permssion record for given names and

    //docid. So throw a exception.

    throw new Exception("There is no permission record for user"+principals[0]+

                        "at document "+docId);

  }//isAllowFirst

  /**

    * Check if the users array has allow rules for given users, docid and

    * permission.

    * If it has permission rule and ticket count is greater than 0, the ticket

    * number will decrease one for every allow rule

    * @param principals, list of names of principals to check for

    * @param docid, document identifier to check for

    * @param permission, the permssion need to check

    */

  private boolean hasAllowRule(String [] principals, String docId,

 {

   int lengthOfArray=principals.length;

   boolean allow=false;//initial value is no allow rule

   ResultSet rs;

   PreparedStatement pStmt = null;

   int permissionValue=permission;

   int permissionValueInTable;

   int ticketCount;

   DBConnection conn = null;

   int serialNumber = -1;

   String sql = null;

     // for toplevel

     topLever = true;

     sql = "SELECT permission FROM xml_access WHERE docid = ? " +

   else

   {

     topLever =false;

     sql = "SELECT permission FROM xml_access WHERE docid = ? " +

   {

     //check out DBConnection

     conn=DBConnectionPool.getDBConnection("AccessControlList.hasAllowRule");

     serialNumber=conn.getCheckOutSerialNumber();

    //This sql statement will select entry with

    //begin_time<=currentTime<=end_time in xml_access table

    //If begin_time or end_time is null in table, isnull(begin_time, sysdate)

    //function will assign begin_time=sysdate

    pStmt.setString(1, docId);

    pStmt.setString(3, AccessControlInterface.ALLOW);

    // if subtree lever, need to set subTreeId

    if (!topLever)

    {

    //bind every elenment in user name array

    for (int i=0;i<lengthOfArray; i++)

    {

      pStmt.setString(2, principals[i]);

      pStmt.execute();

      rs=pStmt.getResultSet();

      while (rs.next())//check every entry for one user

      {

        permissionValueInTable=rs.getInt(1);

        //the user have a permission to access the file

        if (( permissionValueInTable & permissionValue )== permissionValue )

        {

        }//if

      }//while

    }//for

   }//try

   catch (SQLException sqlE)

   {

     throw sqlE;

   }

   catch (Exception e)

   {

     throw e;

   }

   finally

   {

     try

     {

       pStmt.close();

     }

     finally

     {

       DBConnectionPool.returnDBConnection(conn, serialNumber);

     }

   }

    return allow;

 }//hasAllowRule

   /**

    * Check if the users array has explicit deny rules for given users, docid