Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A class that handles checking permssision for a document

 *

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Chad Berkley

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.util.Vector;

import edu.ucsb.nceas.metacat.util.MetaCatUtil;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

{

   private String docId = null;

   private boolean hasSubTreeAccessControl = false; // flag if has a subtree

                                                    // access for this docid

   private Vector subTreeList = new Vector();

                                         //level document

    * Constructor for PermissionController

    * @param myDocid      the docid need to access

    */

     // Get rid of rev number

    * @param myDocid String

    * @param needDeleteRev boolean

    */

   public PermissionController(String myDocid, boolean needDeleteRevFromDocid)

   {

     if (!needDeleteRevFromDocid)

     {

       docId = myDocid;

     }

     else

     {

         docId = MetaCatUtil.getDocIdFromAccessionNumber(myDocid);

     }

   }

   /**

    */

   public boolean hasSubTreeAccessControl()

   {

     return hasSubTreeAccessControl;

   }

    * Check from db connection if at least one of the list of @principals

    * @param user  the user name

    * @param groups  the groups which the use is in

    * @param myPermission  permission type to check for

    */

  {

    boolean hasPermission=false;

    String [] userPackage=null;

    int permission =AccessControlList.intValue(myPermission);

    if ((user==null) && (groups==null || groups.length==0))

    {

      return true;

    }

    userPackage=createUsersPackage(user, groups);

    //is "write", the user should have "all" right

    {

    }//if

    else //in other situation, just check the request permission

    {

      hasPermission = hasPermission(userPackage,docId, permission);

  }

    * Check from db connection if the users in String array @principals has

    * @param docid, document identifier to check on

  private boolean hasPermission(String [] principals, String docId,

                                           int permission)

                         throws SQLException

  {

      //first, if there is a docid owner in user package, return true

      {

      }

      //check perm_order

          //if it is allowfirst and has deny rule(either explicit )

          //deny access

        }//if

          //if it is allowfirst and hasn't deny rule and has allow rule

          //allow access

        }//else if

        else

        {

          //other situation deny access

        }//else

     }//if isAllowFirst

     else //denyFirst

     {

         //if it is denyFirst and has allow rule, allow access

         return true;

       }

       else

       {

         //if it is denyfirst but no allow rule, deny access

         return false;

       }

     }//else denyfirst

    }//try

    catch (Exception e)

    {

                         +e.getMessage());

  }//hasPermission

   * @param user String

   * @param groups String[]

   * @param myPermission String

   * @param inlineDataId String

   * @throws McdbException

   * @return boolean

   */

  private boolean hasPermissionForInlineData(String user, String[] groups,

                                      String myPermission, String inlineDataId)

                                      throws Exception

  {

     // this method can call the public method - hasPermission(...)

     // the only difference is about the ownership, you couldn't find the owner

     // from inlinedataId directly. You should get it from eml document itself

     String []userPackage = createUsersPackage(user, groups);

     if (containDocumentOwner(userPackage, docId))

     {

       return true;

     }

     else

     {

         PermissionController controller =

                               new PermissionController(inlineDataId, false);

         return controller.hasPermission(user, groups, myPermission);

     }

  }

  /**

   * access control

   */

  public boolean hasPermissionForSubTreeNode(String user, String[] groups,

                                             String myPermission, long nodeId)

                                             throws McdbException

  {

    Enumeration en = unaccessableSubTree.elements();

    while (en.hasMoreElements())

    {

      SubTree tree = (SubTree)en.nextElement();

      long start = tree.getStartNodeId();

      long stop  = tree.getEndNodeId();

      {

      }

    }

    return flag;

  }

  /**

   * @param user  the user name

   * @param groups  the groups which the use is in

   * @param myPermission  permission type to check for

   */

  {

    Hashtable resultUnaccessableSubTree = new Hashtable();

    String [] principals=null;

    int permission =AccessControlList.intValue(myPermission);

    if ((user==null) && (groups==null || groups.length==0))

    {

      return resultUnaccessableSubTree;

    }

    principals=createUsersPackage(user, groups);

    //for the document owner return null(no unaccessable subtree)

    try

    {

      if (containDocumentOwner(principals, docId))

      {

       return resultUnaccessableSubTree;

      }

    }

    catch (SQLException ee)

    {

      throw new McdbException(ee);

    }

    for (int i = 0; i< subTreeList.size(); i++)

    {

      SubTree tree = (SubTree)subTreeList.elementAt(i);

        {

              // put the subtree into unaccessable vector

            }//if

              //if it is allowfirst and hasn't deny rule and has allow rule

              //allow access do nothing

            else

            {

              //other situation deny access

          }//if isAllowFirst

          else //denyFirst

          {

              //if it is denyFirst and has allow rule, allow access, do nothing

            else

            {

              //if it is denyfirst but no allow rule, deny access

              // add into vector

            }

          }//else denyfirst

        }//try

        catch( Exception e)

        {

                                   "UnaccessableSubTree "+e.getMessage());

        }

  }//hasUnaccessableSubtree

  /*

   * is a subtree of subtree a. And user doesn't have read permission for both

   * so we only use subtree a is enough.

   */

    Hashtable newSubTreeHash = new Hashtable();

    boolean   needDelete = false;

    // check the parameters

    if (unAccessSubTree == null || unAccessSubTree.isEmpty())

    {

      return newSubTreeHash;

    }

    else

    {

      // look every subtree start point and stop point, to see if it is embedded

      // in another one. If embedded, they are equavelent and we can use bigger

      // one to replace smaller one

      Enumeration en = unAccessSubTree.elements();

      while (en.hasMoreElements())

      {

        SubTree tree    = (SubTree)en.nextElement();

        String  treeId  = tree.getSubTreeId();

        long    startId = tree.getStartNodeId();

        long    endId   = tree.getEndNodeId();

        while (enu.hasMoreElements())

        {

          SubTree subTree = (SubTree)enu.nextElement();

          String subTreeId= subTree.getSubTreeId();

          long   subTreeStartId = subTree.getStartNodeId();

          long   subTreeEndId   = subTree.getEndNodeId();

          //compare and if the first subtree is a subtree of the second

          // one, set neeDelete true

          if (startId > subTreeStartId && endId < subTreeEndId)

          {

            needDelete = true;

                                     " subtree list becuase it is a subtree of"+

          }//if

        }//while

        // if not need to delete, put the subtree into hash

        if (!needDelete)

        {

        //reset needDelete

        needDelete = false;

      }//while

      return newSubTreeHash;

    }//else

  }

	 * has "all" permission to access it.

	 *

	 * @param docId,

	 *            the document id need to be checked

	 */

	private boolean isAccessDocument(String docId) throws SQLException {

		// detele the rev number if docid contains it

		docId = MetaCatUtil.getDocIdFromString(docId);

		PreparedStatement pStmt = null;

		DBConnection conn = null;

		int serialNumber = -1;

		try {

			// check out DBConnection

			conn = DBConnectionPool.getDBConnection("PermissionControl.isAccessDoc");

			serialNumber = conn.getCheckOutSerialNumber();

			pStmt = conn.prepareStatement("select doctype from xml_documents where "

					+ "docid like '" + docId + "'");

			pStmt.execute();

			ResultSet rs = pStmt.getResultSet();

			boolean hasRow = rs.next();

			String doctype = null;

			if (hasRow) {

				doctype = rs.getString(1);

			pStmt.close();

			if (doctype != null

					&& ((MetaCatUtil.getOptionList(PropertyService

			}

			throw new SQLException("PermissionControl.isAccessDocument "

					+ "Error checking" + " on document " + docId + ". " + e.getMessage());

		} catch (PropertyNotFoundException pnfe) {

			throw new SQLException("PermissionControl.isAccessDocument "

					+ "Error checking" + " on document " + docId + ". " + pnfe.getMessage());

		} finally {

			try {

				pStmt.close();

			} finally {

				DBConnectionPool.returnDBConnection(conn, serialNumber);

			}

		}

	}// isAccessDocument

	 *

	 * @param principals,

	 *            a string array storing the username, groups name and public.

	 * @param docid,

	 *            the id of given documents

	 */

  {

    int lengthOfArray=principals.length;

    DBConnection conn = null;

    int serialNumber = -1;

    {

      //check out DBConnection

      pStmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

      //the owner of document

      for (int i=0; i<lengthOfArray; i++)

      {

        pStmt.setString(1, docId);

        pStmt.setString(2, principals[i]);

                                  principals[i]);

        pStmt.execute();

        ResultSet rs = pStmt.getResultSet();

        hasRow = rs.next();

          pStmt.close();

    }//try

        pStmt.close();

        throw new

                     " on document #" + docId + ". " + e.getMessage());

    }//catch

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    * Check if the permission order for user at that documents is allowFirst

    */

  {

    int lengthOfArray=principals.length;

    boolean hasRow;

    PreparedStatement pStmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    boolean topLever =false;

      //top level

      topLever = true;

      sql = "SELECT perm_order FROM xml_access " +

    else

    {

      //sub tree level

      sql = "SELECT perm_order FROM xml_access " +

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.isAllowFirst");

      serialNumber=conn.getCheckOutSerialNumber();

      for (int i=0; i<lengthOfArray;i++)

      {

        //bind value

        pStmt.setString(1, principals[i]);//user name

        pStmt.setString(2, docId);//docid

        // if subtree, we need set subtree id

        {

        ResultSet rs = pStmt.getResultSet();

        hasRow=rs.next();

        if (hasRow)

        {

          //get the permission order from data base

          String permissionOrder=rs.getString(1);

          //if the permission order is "allowFirst

          if (permissionOrder.equalsIgnoreCase(AccessControlInterface.ALLOWFIRST))

          {

            pStmt.close();

            return true;

          }

          else

          {

            pStmt.close();

            return false;

          }

        }//if

      }//for

    }//try

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    //if reach here, means there is no permssion record for given names and

                        "at document "+docId);

    * Check if the permission order for user at that documents is allowFirst

    * @param principals, list of names of principals to check for

    * @param docid, document identifier to check for

    */

  public Vector getAccessControl()

                  throws SQLException, Exception

  {

	  Vector accessControl = new Vector();

    boolean hasRow;

    PreparedStatement pStmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    String sql = null;

    boolean topLever =false;

    sql = "SELECT principal_name, permission, perm_type, perm_order FROM xml_access ";

    //TODO, need this?

    long startId = 0;

    if (startId == TOPLEVELSTARTNODEID)

    {

      //top level

      topLever = true;

      sql += "WHERE docid = ? AND startnodeid is NULL";

    }

    else

    {

      //sub tree level

      sql += "WHERE docid = ? AND startnodeid = ?";

    }

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.getPermissions");

      serialNumber=conn.getCheckOutSerialNumber();

      //select permission order from database

      pStmt = conn.prepareStatement(sql);

        //bind value

        pStmt.setString(1, docId);//docid

        // if subtree, we need set subtree id

        if (!topLever)

        {

          pStmt.setLong(2, startId);

        }

        pStmt.execute();

        ResultSet rs = pStmt.getResultSet();

        while (rs.next())

        {

          //get the permission order from data base

          String principalName=rs.getString(1);

          String permission=rs.getString(2);

          String permType=rs.getString(3);

          String permOrder=rs.getString(4);

          //make it into an object

          AccessControlForSingleFile acfsf =

        	  new AccessControlForSingleFile(docId, principalName, permission, permType, permOrder);

          accessControl.add(acfsf);

        }

        pStmt.close();

    }//try

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    return accessControl;

  }//getPermissions

    * If it has permission rule and ticket count is greater than 0, the ticket

    * number will decrease one for every allow rule

    * @param permission, the permssion need to check

    */

 {

   int lengthOfArray=principals.length;

   boolean allow=false;//initial value is no allow rule

   ResultSet rs;

   PreparedStatement pStmt = null;

   int permissionValue=permission;

   int permissionValueInTable;

   int ticketCount;

   DBConnection conn = null;

   int serialNumber = -1;

   String sql = null;

     // for toplevel

     topLever = true;

   else