Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that loads eml-access.xml file containing ACL 

 *             for a metadata document into relational DB

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Jivka Bojilova

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.io.*;

import java.sql.*;

import java.util.Stack;

import java.util.Vector;

import org.apache.log4j.Logger;

import org.xml.sax.Attributes;

import org.xml.sax.InputSource;

import org.xml.sax.ContentHandler;

import org.xml.sax.EntityResolver;

import org.xml.sax.ErrorHandler;

import org.xml.sax.SAXException;

import org.xml.sax.XMLReader;

import org.xml.sax.helpers.XMLReaderFactory;

import org.xml.sax.helpers.DefaultHandler;

import edu.ucsb.nceas.metacat.database.DBConnection;

import edu.ucsb.nceas.metacat.database.DBConnectionPool;

import edu.ucsb.nceas.metacat.properties.PropertyService;

import edu.ucsb.nceas.metacat.util.MetacatUtil;

import edu.ucsb.nceas.metacat.util.SystemUtil;

import edu.ucsb.nceas.utilities.PropertyNotFoundException;

/** 

 * A Class that loads eml-access.xml file containing ACL for a metadata

 * document into relational DB. It extends DefaultHandler class to handle

 * SAX parsing events when processing the XML stream.

 */

public class AccessControlList extends DefaultHandler 

                               implements AccessControlInterface 

{

//  private static String sysdate = DatabaseService.getDBAdapter().getDateTimeFunction();

//  private static String isnull = DatabaseService.getDBAdapter().getIsNULLFunction();

  private DBConnection connection;

  private String parserName;

  private Stack elementStack;

  private String server;

  private String sep;

  private boolean	processingDTD;

  private String  user;

  private String[] groups;

  private String  aclid;

  private int     rev;

  private String 	docname;

  private String 	doctype;

  private String 	systemid;

  private String docurl;

  private Vector resourceURL;

  private Vector resourceID;

  private Vector principal;

  private int    permission;

  private String permType;

  private String permOrder;

//  private String publicAcc;

  private String beginTime;

  private String endTime;

  private int    ticketCount;

  private int    serverCode = 1;

  private Vector aclObjects = new Vector();

  private boolean instarttag = true;

  private String tagName = "";

  private static Logger logMetacat = Logger.getLogger(AccessControlList.class);

  /**

   * Construct an instance of the AccessControlList class.

   * It is used by the permission check up from DBQuery or DocumentImpl

   * and from "getaccesscontrol" action

   *

   * @param conn the JDBC connection where acl info is get

   */

  public AccessControlList(DBConnection conn) throws SQLException

  {

    this.connection = conn;

  }

  /**

   * Construct an instance of the AccessControlList class.

   * It parse acl file and loads acl data into db connection.

   *

   * @param conn the JDBC connection where acl data are loaded

   * @param aclid the Accession# of the document with the acl data

   * @param acl the acl file containing acl data

   * @param user the user connected to MetaCat servlet and owns the document

   * @param groups the groups to which user belongs

   * @param serverCode the serverid from xml_replication on which this document

   *        resides.

   */

  public AccessControlList(DBConnection conn, String aclid, int rev,

                           String user, String[] groups, int serverCode)

                  throws SAXException, IOException, McdbException, PropertyNotFoundException

  {

		String parserName = PropertyService.getProperty("xml.saxparser");

		this.server = SystemUtil.getSecureServerURL();

		this.sep = PropertyService.getProperty("document.accNumSeparator");

		this.connection = conn;

		this.parserName = parserName;

		this.processingDTD = false;

		this.elementStack = new Stack();

		this.user = user;

		this.groups = groups;

		this.aclid = aclid;

		this.resourceURL = new Vector();

		this.resourceID = new Vector();

		this.principal = new Vector();

		this.permission = 0;

		this.ticketCount = 0;

		// this.publicAcc = null;

		this.serverCode = serverCode;

		// read the access file from db connection

		DocumentImpl acldoc = new DocumentImpl(aclid + sep + rev);

		String acl = acldoc.toString();

		this.rev = acldoc.getRev();

		// Initialize the parse

		XMLReader parser = initializeParser();

		// parse the access file and write the info to xml_access

		if (acl != null) {

			parser.parse(new InputSource(new StringReader(acl)));

		} else {

			throw new McdbException("Could not retrieve access control list for:  " + aclid + sep + rev);

		}

	}

// NOT USED

// /**

// * Construct an instance of the AccessControlList class.

//   * It parses eml-access file and loads acl data into db connection.

//   * It is used from command line execution.

//   *

//   * @param conn the JDBC connection where acl data are loaded

//   * @param docid the Accession# of the document with the acl data

//   * @param aclfilename the name of acl file containing acl data

//   * @param user the user connected to MetaCat servlet and owns the document

//   * @param groups the groups to which user belongs

//   */

//  public AccessControlList( Connection conn, String aclid, String aclfilename,

//                           String user, String[] groups )

//                  throws SAXException, IOException, McdbException

//  {

//    this(conn, aclid, new FileReader(new File(aclfilename).toString()), 

//         user, groups, 1);

//  }

  /* Set up the SAX parser for reading the XML serialized ACL */

  private XMLReader initializeParser() throws SAXException 

  {

    XMLReader parser = null;

    // Get an instance of the parser

    parser = XMLReaderFactory.createXMLReader(parserName);

    // Turn off validation

    parser.setFeature("http://xml.org/sax/features/validation", true);

    // Set Handlers in the parser

    // Set the ContentHandler to this instance

    parser.setContentHandler((ContentHandler)this);

    // make a DBEntityResolver instance

    // Set the EntityReslover to DBEntityResolver instance

    EntityResolver eresolver = new DBEntityResolver(connection,this,null);

    parser.setEntityResolver((EntityResolver)eresolver);

    // Set the ErrorHandler to this instance

    parser.setErrorHandler((ErrorHandler)this);

    return parser; 

  }

  /**

   * Callback method used by the SAX Parser when beginning of the document

   */

  public void startDocument() throws SAXException 

  {

    //delete all previously submitted permissions @ relations

    //this happens only on UPDATE of the access file

    try {

      this.aclObjects = getACLObjects(aclid);

      //delete all permissions for resources related to @aclid if any

      if ( aclid != null ) {

        deletePermissionsForRelatedResources(aclid);

      }

    } catch (SQLException sqle) {

      throw new SAXException(sqle);

    }

  }

  /**

   * Callback method used by the SAX Parser when the start tag of an 

   * element is detected. Used in this context to parse and store

   * the acl information in class variables.

   */

  public void startElement (String uri, String localName, 

                            String qName, Attributes atts) 

         throws SAXException 

  {

    instarttag = true;

    if(localName.equals("allow"))

    {

      tagName = "allow";

    }

    else if(localName.equals("deny"))

    {

      tagName = "deny";

    }

    BasicNode currentNode = new BasicNode(localName);

    if (atts != null) {

      int len = atts.getLength();

      for (int i = 0; i < len; i++) {

        currentNode.setAttribute(atts.getLocalName(i), atts.getValue(i));

      }

    }

    if ( currentNode.getTagName().equals("acl") ) {

      permOrder = currentNode.getAttribute("order");

    //  publicAcc = currentNode.getAttribute("public");

    }

    elementStack.push(currentNode); 

  }

  /**

   * Callback method used by the SAX Parser when the text sequences of an 

   * xml stream are detected. Used in this context to parse and store

   * the acl information in class variables.

   */ 

  public void characters(char ch[], int start, int length)

         throws SAXException 

  {

    if(!instarttag)

    {

      return;

    }

    String inputString = new String(ch, start, length);

    inputString = inputString.trim(); 

    //System.out.println("==============inputString: " + inputString);

    BasicNode currentNode = (BasicNode)elementStack.peek(); 

    String currentTag = currentNode.getTagName();

      if (currentTag.equals("principal")) {

        principal.addElement(inputString);

      } else if (currentTag.equals("permission")) {

        if ( inputString.trim().toUpperCase().equals("READ") ) {

          permission = permission | READ;

        } else if ( inputString.trim().toUpperCase().equals("WRITE") ) {

          permission = permission | WRITE;

        } else if ( inputString.trim().toUpperCase().equals("CHANGEPERMISSION")) 

        {

          permission = permission | CHMOD;

        } else if ( inputString.trim().toUpperCase().equals("ALL") ) {

          permission = permission | ALL;

        }/*else{

          throw new SAXException("Unknown permission type: " + inputString);

        }*/

      } else if ( currentTag.equals("startDate") && beginTime == null ) {

        beginTime = inputString.trim();

      } else if ( currentTag.equals("stopDate") && endTime == null) {

        endTime = inputString.trim();

      } else if (currentTag.equals("ticketCount") && ticketCount == 0 ) {

        try {

          ticketCount = (new Integer(inputString.trim())).intValue();

        } catch (NumberFormatException nfe) {

          throw new SAXException("Wrong integer format for:" + inputString);

        }

      }

  }

  /**

   * Callback method used by the SAX Parser when the end tag of an 

   * element is detected. Used in this context to parse and store

   * the acl information in class variables.

   */

  public void endElement (String uri, String localName, String qName)

         throws SAXException 

  {

    instarttag = false;

    BasicNode leaving = (BasicNode)elementStack.pop();

    String leavingTagName = leaving.getTagName();

    if ( leavingTagName.equals("allow") ||

         leavingTagName.equals("deny")    ) {

      if ( permission > 0 ) {

        // insert into db calculated permission for the list of principals

        try {

          // go through the objects in xml_relation about this acl doc

          for (int i=0; i < aclObjects.size(); i++) {

            // docid of the current object

            String docid = (String)aclObjects.elementAt(i); 

            //DocumentIdentifier docID = new DocumentIdentifier(docid);

            //docid = docID.getIdentifier();

            // the docid get here has revision number, so we need to 

            // remove it.

            //docid = MetacatUtil.getDocIdFromAccessionNumber(docid);

            //System.out.println("The docid insert is!!!!!!!!!! "+ docid);

            insertPermissions(docid,leavingTagName);

          }

          // if acl is not in object list

          //should insert permission for aclid itself into database

          /*if (!aclObjects.contains(aclid))

          {

            DocumentIdentifier aclIdItself = new DocumentIdentifier(aclid);

            String aclIdString = aclIdItself.getIdentifier();

            insertPermissions(aclIdString,leavingTagName);

          }*/

        } catch (SQLException sqle) {

          throw new SAXException(sqle);

        } catch (Exception e) {

          throw new SAXException(e);

        }

      }

      // reset the allow/deny permission

      principal = new Vector();

      permission = 0;

      beginTime = null;

      endTime = null;

      ticketCount = 0;

    }

  }

  /** 

    * SAX Handler that receives notification of DOCTYPE. Sets the DTD.

    * @param name name of the DTD

    * @param publicId Public Identifier of the DTD

    * @param systemId System Identifier of the DTD

    */

  public void startDTD(String name, String publicId, String systemId) 

              throws SAXException {

    docname = name;

    doctype = publicId;

    systemid = systemId;

  }

  /** 

   * SAX Handler that receives notification of the start of entities.

   * @param name name of the entity

   */

  public void startEntity(String name) throws SAXException {

    if (name.equals("[dtd]")) {

      processingDTD = true;

    }

  }

  /** 

   * SAX Handler that receives notification of the end of entities.

   * @param name name of the entity

   */

  public void endEntity(String name) throws SAXException {

    if (name.equals("[dtd]")) {

      processingDTD = false;

    }

  }

  /**

   * Get the document name.

   */

  public String getDocname() {

    return docname;

  }

  /**

   * Get the document processing state.

   */

  public boolean processingDTD() {

    return processingDTD;

  }

  /* Get all objects associated with @aclid from db.*/

  private Vector getACLObjects(String aclid) 

          throws SQLException 

  {

    Vector aclObjects = new Vector();

    DBConnection conn = null;

    int serialNumber = -1;

    PreparedStatement pstmt = null;

    try

    {

      //get connection from DBConnectionPool

      conn=DBConnectionPool.getDBConnection("AccessControlList.getACLObject");

      serialNumber=conn.getCheckOutSerialNumber();

      // delete all acl records for resources related to @aclid if any

      pstmt = conn.prepareStatement(

                             "SELECT object FROM xml_relation " +

                             "WHERE subject = ? ");

      pstmt.setString(1,aclid);

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      boolean hasRows = rs.next();

      while (hasRows) {

        String object = rs.getString(1);

        //System.out.println("add acl object into vector !!!!!!!!!!!!!!!!!"+object);

        aclObjects.addElement(object);

        hasRows = rs.next();

      }//whil

    }

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        //retrun DBConnection

        DBConnectionPool.returnDBConnection(conn,serialNumber);

      }

    }

    return aclObjects;

  }

  /* Delete from db all permission for resources related to @aclid if any.*/

  private void deletePermissionsForRelatedResources(String aclid) 

          throws SQLException 

  {

    //DBConnection conn = null;

    //int serialNumber = -1;

    Statement stmt = null;

    try

    {

      //check out DBConenction

      //conn=DBConnectionPool.getDBConnection("AccessControlList.deltePerm");

      //serialNumber=conn.getCheckOutSerialNumber();

      // delete all acl records for resources related to @aclid if any

      stmt = connection.createStatement();

      // Increase DBConnection usage count

      connection.increaseUsageCount(1);

      logMetacat.debug("running sql: " + stmt.toString());

      stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid 

                                                                      + "'");

      //increase usageCount!!!!!!

      //conn.increaseUsageCount(1);

    }

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      stmt.close();

      //retrun DBConnection

      //DBConnectionPool.returnDBConnection(conn,serialNumber);

    }

  }

  /* Insert into db calculated permission for the list of principals 

   * The DBConnection it is use is class field. Because we want to keep rollback

   * features and it need use same connection

  */

  private void insertPermissions(String docid, String permType ) 

                                            throws SQLException 

  {

    PreparedStatement pstmt = null;

    //DBConnection conn = null;

    //int serialNumber = -1;

    try {

      //Check out DBConnection

      //conn=DBConnectionPool.getDBConnection("AccessControlList.insertPerm");

      //serialNumber=conn.getCheckOutSerialNumber();

      pstmt = connection.prepareStatement(

              "INSERT INTO xml_access " + 

              "(docid, principal_name, permission, perm_type, perm_order," +

              "ticket_count, accessfileid) VALUES " +

              "(?,?,?,?,?,?,?)");

      // Increase DBConnection usage count

      connection.increaseUsageCount(1);

      // Bind the values to the query

      pstmt.setString(1, docid);

      pstmt.setInt(3, permission);

      pstmt.setString(4, permType);

      pstmt.setString(5, permOrder);

      pstmt.setString(7, aclid);

      if ( ticketCount > 0 ) {

        pstmt.setInt(6, ticketCount);

      } else {

        pstmt.setInt(6, 0);

      }

      //incrase usagecount for DBConnection

      //conn.increaseUsageCount(1);

      String prName;

      for ( int j = 0; j < principal.size(); j++ ) {

        prName = (String)principal.elementAt(j);

        pstmt.setString(2, prName);

        logMetacat.debug("running sql: " + pstmt.toString());

        pstmt.execute();

      /*    

        // check if there are conflict with permission's order

        String permOrderOpos = permOrder;

        int perm = getPermissions(permission, prName, docid, permOrder);

        if (  perm != 0 ) {

          if ( permOrder.equals("allowFirst") ) {

            permOrderOpos = "denyFirst";

          } else if ( permOrder.equals("denyFirst") ) {

            permOrderOpos = "allowFirst";

          }

          throw new SQLException("Permission(s) " + txtValue(perm) + 

                    " for \"" + prName + "\" on document #" + docid +

                    " has/have been used with \"" + permOrderOpos + "\"");

        }

      */

      }

      pstmt.close();

    } catch (SQLException e) {

      throw new 

      SQLException("AccessControlList.insertPermissions(): " + e.getMessage());

    }

    finally

    {

      pstmt.close();

      //return the DBConnection

      //DBConnectionPool.returnDBConnection(conn, serialNumber);

    }

  }

  /* Get permissions with permission order different than @permOrder. */

  private int getPermissions(int permission, String principal,

                             String docid, String permOrder)

          throws SQLException 

  {

    PreparedStatement pstmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.getPermissions");

      serialNumber=conn.getCheckOutSerialNumber();

      pstmt = conn.prepareStatement(

            "SELECT permission FROM xml_access " +

            "WHERE docid = ? " +

            "AND principal_name = ? " +

            "AND perm_order NOT = ?");

      pstmt.setString(1, docid);

      pstmt.setString(2, principal);

      pstmt.setString(3, permOrder);

      logMetacat.debug("running sql: " + pstmt.toString());

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      boolean hasRow = rs.next();

      int perm = 0;

      while ( hasRow ) {

        perm = rs.getInt(1);

        perm = permission & perm;

        if ( perm != 0 ) {

          pstmt.close();

          return perm;

        }

        hasRow = rs.next();

      }

    }//try

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    return 0;

  }

    /* Get the int value of READ, WRITE, CHMOD or ALL. */

	public static int intValue(String permission) {

		int thisPermission = 0;

		if (permission.toUpperCase().contains(CHMODSTRING)) {

			thisPermission |= CHMOD;

		} 

		if (permission.toUpperCase().contains(READSTRING)) {

			thisPermission |= READ;

		} 

		if (permission.toUpperCase().contains(WRITESTRING)) {

			thisPermission |= WRITE;

		} 

		if (permission.toUpperCase().contains(ALLSTRING)) {

			thisPermission |= ALL;

		}

		if (thisPermission == 0) {

			return -1;

		} else {

			return thisPermission;

		}

	}

  /* Get the text value of READ, WRITE, CHMOD or ALL. */

	public static String txtValue(int permission) {

		StringBuffer txtPerm = new StringBuffer();

		if ((permission & ALL) == ALL) {

			return ALLSTRING;

		}		

		if ((permission & CHMOD) == CHMOD) {

			txtPerm.append(CHMODSTRING);

		}

		if ((permission & READ) == READ) {

			if (txtPerm.length() > 0)

				txtPerm.append(",");

			txtPerm.append(READSTRING);

		}

		if ((permission & WRITE) == WRITE) {

			if (txtPerm.length() > 0)

				txtPerm.append(",");

			txtPerm.append(WRITESTRING);

		}

		return txtPerm.toString();

	}

// /* Get the text value of READ, WRITE or ALL. */

//  public static String txtValue ( int permission )

//  {

//    StringBuffer txtPerm = new StringBuffer();

//    if (permission == READ) {

//      txtPerm.append("READ");

//    } 

//    if (permission == WRITE) {

//      txtPerm.append("WRITE");

//    }

//    if (permission == ALL) {

//      txtPerm.append("ALL");

//    }

//

//    return txtPerm.toString();

//  }

  /**

    * Get Access Control List information for document from db connetion.

    * User or Group should have permissions for reading

    * access control information for a document specified by @docid.

    * @param docid document identifier which acl info to get

    * @param user name of user connected to Metacat system

    * @param groups names of user's groups to which user belongs

    */

  public String getACL(String docid, String user, String[] groups) 

          throws SQLException, Exception

  {

    StringBuffer output = new StringBuffer();

    StringBuffer outTemp = new StringBuffer();

    String accDoctype = PropertyService.getProperty("xml.accessdoctype");

    String server = PropertyService.getProperty("server.name");

    String docurl = "metacat://" + server + "/?docid=" + docid;

    String systemID;

    boolean isOwned = false;

    boolean hasPermission = false;

    String publicAcc;

    String acfid = "";

    String acfid_prev = "";

    String principal;

    Vector principalArr = new Vector();

    int permission;

    int perm_prev = -1;

    String permType;

    String permOrder = "";

    String permOrder_prev = "";

    String beginTime = "";

    String begin_prev = "";

    String endTime = "";

    String end_prev = "";

    int ticketCount = -1;

    int ticket_prev = -1;

    DBConnection conn = null;

    int serialNumber = -1;

    PreparedStatement pstmt = null;

    try {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.getACL");

      serialNumber=conn.getCheckOutSerialNumber();

      isOwned = isOwned(docid, user);

      systemID = getSystemID((String)MetacatUtil.

                                      getOptionList(accDoctype).elementAt(0));

      publicAcc = getPublicAccess(docid);

      output.append("<?xml version=\"1.0\"?>\n");

      output.append("<!DOCTYPE acl PUBLIC \"" + accDoctype + "\" \"" +

                    systemID + "\">\n");

      output.append("<acl authSystem=\"\">\n");

      pstmt = conn.prepareStatement(

              "SELECT distinct accessfileid, principal_name, permission, " +

              "perm_type, perm_order, to_char(begin_time,'mm/dd/yyyy'), " +

              "to_char(end_time,'mm/dd/yyyy'), ticket_count " +

              "FROM xml_access WHERE docid = ? " +

              "ORDER BY accessfileid, perm_order, perm_type, permission");

      // Bind the values to the query

      pstmt.setString(1, docid);

      logMetacat.debug("running sql: " + pstmt.toString());

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      boolean hasRows = rs.next();

      while (hasRows) {

        acfid = rs.getString(1);

        principal = rs.getString(2);

        permission = rs.getInt(3);

        permType = rs.getString(4);

        permOrder = rs.getString(5);

        beginTime = rs.getString(6);

        endTime = rs.getString(7);

        ticketCount = rs.getInt(8);

        // if @docid is not owned by @user, only ACL info from that

        // access files to which @user/@groups has "read" permission

        // is extracted

        if ( !isOwned ) {

          if ( !acfid.equals(acfid_prev) ) {

            acfid_prev = acfid;

            //hasPermission = this.hasPermission("READ",user,groups,acfid);

             PermissionController controller = new PermissionController(acfid);

             hasPermission = controller.hasPermission(user,groups,

                                            AccessControlInterface.READSTRING);

          }

          if ( !hasPermission ) {

            rs.next();

            continue;

          }

        }

        // open <resource> tag

        if ( !permOrder.equals(permOrder_prev) ) {

          // close </resource> tag if any was opened 

          output.append(outTemp.toString());

          outTemp = new StringBuffer();

          if ( !permOrder_prev.equals("") ) {

            output.append("  </resource>\n");

          }

          output.append("  <resource order=\"" + permOrder + "\" public=\"" +

                        publicAcc + "\">\n");

          output.append("    <resourceIdentifier>" + docurl + 

                        "</resourceIdentifier>\n");

          permOrder_prev = permOrder;

        }

        // close </allow> or </deny> tag then open new one

        if ( permission != perm_prev ||

             (endTime == null) && (end_prev != null) ||

             (beginTime == null) && (begin_prev != null) ||

             endTime != null && !endTime.equals(end_prev)  ||

             beginTime != null && !beginTime.equals(begin_prev) ||

             ticketCount != ticket_prev )  {

          output.append(outTemp.toString());

          outTemp = new StringBuffer();

          principalArr.removeAllElements();

          output.append("    <" + permType + ">\n");

        }

        // put all principals here for the same 

        // permission, duration and ticket_count

        if ( !principalArr.contains(principal) ) {

          principalArr.addElement(principal);

          output.append("      <principal>" + principal + "</principal>\n");

        } 

        // prepare <permission> tags, <duration> and <ticketCount>

        // if any to put within <allow> (<deny>) by next cicle

        if ( permission != perm_prev || 

             (endTime == null) && (end_prev != null) ||

             (beginTime == null) && (begin_prev != null) ||

             endTime != null && !endTime.equals(end_prev)  ||

             beginTime != null && !beginTime.equals(begin_prev) ||

             ticketCount != ticket_prev )  {

          if ( (permission & READ) == READ ) {

            outTemp.append("      <permission>read</permission>\n");

          }

          if ( (permission & WRITE) == WRITE ) {

            outTemp.append("      <permission>write</permission>\n");

          }

          if ( (permission & ALL) == ALL ) {

            outTemp.append("      <permission>all</permission>\n");

          }

          if ( (beginTime != null) || (endTime != null) ) {

            outTemp.append("      <duration>" + beginTime + " " + endTime +

                          "</duration>\n");

          }

          if ( ticketCount > 0 ) {

            outTemp.append("      <ticketCount>" + ticketCount + 

                          "</ticketCount>\n");

          }

          outTemp.append("    </" + permType + ">\n");

          perm_prev = permission;

          ticket_prev = ticketCount;

          begin_prev = beginTime;

          end_prev = endTime;

        }

        hasRows = rs.next();

      }

      // close <allow> or <deny> if anything left in outTemp var

      output.append(outTemp.toString());

      // If there are no any acl info for @docid accessible by @user/@group,

      // extract only the following information

      if ( permOrder.equals("") ) {

        output.append("  <resource public=\"" + publicAcc + "\">\n");

        output.append("    <resourceIdentifier>" + docurl + 

                      "</resourceIdentifier>\n");

      }

      // always close them

      output.append("  </resource>\n");

      output.append("</acl>\n");

      pstmt.close();

      return output.toString();

    } catch (SQLException e) {

      throw new 

      SQLException("AccessControlList.getACL(). " + e.getMessage());

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

  }

  /* Check if @user is owner of @docid from db conn. */

  private boolean isOwned(String docid, String user) throws SQLException {

    PreparedStatement pstmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.isOwned");

      serialNumber=conn.getCheckOutSerialNumber();

      pstmt = conn.prepareStatement("SELECT 'x' FROM xml_documents " +

                                  "WHERE docid = ? " + 

                                  "AND user_owner = ?");

      pstmt.setString(1, docid);

      pstmt.setString(2, user);

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      boolean hasRow = rs.next();

      return hasRow;

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

  }

  /* Get the flag for public "read" access for @docid from db conn. */

  private String getPublicAccess(String docid) throws SQLException {

    int publicAcc = 0;

    PreparedStatement pstmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.getPublicAcces");

      serialNumber=conn.getCheckOutSerialNumber();

      pstmt = conn.prepareStatement("SELECT public_access FROM xml_documents " +

                                  "WHERE docid = ?");

      pstmt.setString(1, docid);

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      boolean hasRow = rs.next();

      if ( hasRow ) {

        publicAcc = rs.getInt(1);

      }

      return (publicAcc == 1) ? "yes" : "no";

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

  }

  /* Get SystemID for @publicID from Metacat DB Catalog. */

  private String getSystemID(String publicID) throws SQLException, PropertyNotFoundException {

		String systemID = "";

		PreparedStatement pstmt = null;

		DBConnection conn = null;

		int serialNumber = -1;

		try {

			//check out DBConnection

			conn = DBConnectionPool.getDBConnection("AccessControlList.getSystemID");

			serialNumber = conn.getCheckOutSerialNumber();

			pstmt = conn.prepareStatement("SELECT system_id FROM xml_catalog "

					+ "WHERE entry_type = 'DTD' " + "AND public_id = ?");

			pstmt.setString(1, publicID);

			pstmt.execute();

			ResultSet rs = pstmt.getResultSet();

			boolean hasRow = rs.next();

			if (hasRow) {

				systemID = rs.getString(1);

				// system id may not have server url on front.  Add it if not.

				if (!systemID.startsWith("http://")) {

					systemID = SystemUtil.getContextURL() + systemID;

				}

			}

			return systemID;

		}//try

		finally {

			try {

				pstmt.close();

			} finally {

				DBConnectionPool.returnDBConnection(conn, serialNumber);

			}

		}//finally

	}

  public static void main(String[] args) {

	  System.out.println("text value for CHMOD (" + CHMOD + "): " + txtValue(CHMOD));

	  System.out.println("text value for READ: (" + READ + "): " + txtValue(READ));

	  System.out.println("text value for WRITE: (" + WRITE + "): " + txtValue(WRITE));

	  System.out.println("text value for ALL: (" + ALL + "): " + txtValue(ALL));

	  int chmod_read = CHMOD|READ;

	  System.out.println("text value for CHMOD|READ: (" + chmod_read + "): " + txtValue(CHMOD|READ));

	  int chmod_write = CHMOD|WRITE;

	  System.out.println("text value for CHMOD|WRITE: (" + chmod_write + "): " + txtValue(CHMOD|WRITE));

	  int chmod_all = CHMOD|ALL;

	  System.out.println("text value for CHMOD|ALL: (" + chmod_all + "): " + txtValue(CHMOD|ALL));

	  int read_write = READ|WRITE;

	  System.out.println("text value for READ|WRITE: (" + read_write + "): " + txtValue(READ|WRITE));

	  int read_all = READ|ALL;

	  System.out.println("text value for READ|ALL: (" + read_all + "): " + txtValue(READ|ALL));

	  int write_all = WRITE|ALL;

	  System.out.println("text value for WRITE|ALL: (" + write_all + "): " + txtValue(WRITE|ALL));

	  int chmod_read_write = CHMOD|READ|WRITE;

	  System.out.println("text value for CHMOD|READ|WRITE: (" + chmod_read_write + "): " + txtValue(CHMOD|READ|WRITE));

	  int chmod_read_all = CHMOD|READ|ALL;

	  System.out.println("text value for CHMOD|READ|ALL: (" + chmod_read_all + "): " + txtValue(CHMOD|READ|ALL));

	  int chmod_write_all = CHMOD|WRITE|ALL;

	  System.out.println("text value for CHMOD|WRITE|ALL: (" + chmod_write_all + "): " + txtValue(CHMOD|WRITE|ALL));

	  int read_write_all = READ|WRITE|ALL;

	  System.out.println("text value for READ|WRITE|ALL: (" + read_write_all + "): " + txtValue(READ|WRITE|ALL));

	  int chmod_read_write_all = CHMOD|READ|WRITE|ALL;

	  System.out.println("text value for CHMOD|READ|WRITE|ALL: (" + chmod_read_write_all + "): " + txtValue(CHMOD|READ|WRITE|ALL));

	  System.out.println();

	  System.out.println("int value for GOOBER: " + intValue("GOOBER"));

	  System.out.println("int value for CHANGEPERMISSION: " + intValue("CHANGEPERMISSION"));

	  System.out.println("int value for READ: " + intValue("READ"));

	  System.out.println("int value for WRITE: " + intValue("WRITE"));

	  System.out.println("int value for ALL: " + intValue("ALL"));

	  System.out.println("int value for CHANGEPERMISSION,READ: " + intValue("CHANGEPERMISSION,READ"));

	  System.out.println("int value for CHANGEPERMISSION,WRITE: " + intValue("CHANGEPERMISSION,WRITE"));

	  System.out.println("int value for CHANGEPERMISSION,ALL: " + intValue("CHANGEPERMISSION,ALL"));

	  System.out.println("int value for READ,WRITE: " + intValue("READ,WRITE"));

	  System.out.println("int value for READ,ALL: " + intValue("READ,ALL"));

	  System.out.println("int value for WRITE,ALL: " + intValue("WRITE,ALL"));

	  System.out.println("int value for CHANGEPERMISSION,READ,WRITE: " + intValue("CHANGEPERMISSION,READ,WRITE"));

	  System.out.println("int value for CHANGEPERMISSION,READ,ALL: " + intValue("CHANGEPERMISSION,READ,ALL"));

	  System.out.println("int value for CHANGEPERMISSION,READ,ALL: " + intValue("CHANGEPERMISSION,WRITE,ALL"));

	  System.out.println("int value for READ,WRITE,ALL: " + intValue("READ,WRITE,ALL"));

	  System.out.println("int value for CHANGEPERMISSION,READ,WRITE,ALL: " + intValue("CHANGEPERMISSION,READ,WRITE,ALL"));

  }

}

/**

 *  '$RCSfile$'

 *    Purpose: A Class that loads eml-access.xml file containing ACL 

 *             for a metadata document into relational DB

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Jivka Bojilova

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.io.*;

import java.sql.*;

import java.util.Stack;

import java.util.Vector;

import java.util.Hashtable;

import java.net.URL;

import java.net.MalformedURLException;

import org.apache.log4j.Logger;

import edu.ucsb.nceas.metacat.database.DBConnection;

import edu.ucsb.nceas.metacat.database.DBConnectionPool;

import edu.ucsb.nceas.metacat.util.DocumentUtil;

/** 

 * A Class that loads eml-access.xml file containing ACL for a metadata

 * document into relational DB. It extends DefaultHandler class to handle

 * SAX parsing events when processing the XML stream.

 */

public class AccessControlForSingleFile implements AccessControlInterface 

{

  private String docId;

  private String principal;

  private int    permission;

  private String permType;

  private String permOrder;

  private Logger logMetacat = Logger.getLogger(AccessControlForSingleFile.class);

  /**

   * Construct an instance of the AccessControlForSingleFile class.

   * @param myAccessNumber  the docid or docid with dev will be controlled

   * @param myprincipal  the principal will have permission

   * @param myPermission the permission will be given

   * @param myPermType  the permsission type, allow or deny

   * @param myPermOrder  the permission order, allowFirst or denyFirst

   */

  public AccessControlForSingleFile(String myAccessionNumber,

                                    String myPrincipalName,

                                    String myPermission,

                                    String myPermType,

                                    String myPermOrder) 

                                   throws Exception

  {

    try

    {

      //Get rid of dev if myaccessNumber has one;

      docId = DocumentUtil.getDocIdFromString(myAccessionNumber);

      if (docId == null || docId.equals(""))

      {

        throw new Exception("Docid couldn't be null");

      }

      // Check principal

      principal = myPrincipalName;

      if (principal == null || principal.equals(""))

      {

        throw new Exception("principal couldn't be null");

      }

      // get permission value

      permission = AccessControlList.intValue(myPermission);

      if (permission == -1)

      {

        throw new Exception("permission "+ myPermission + " is not valid");

      }

      // check permission type

      permType = myPermType;

      // if permtype is not allow or deny, throw a exception

      if (permType == null

          || (!permType.equals(AccessControlInterface.ALLOW)

          && !permType.equals(AccessControlInterface.DENY)))

      {

        throw new Exception("permtype should be "+AccessControlInterface.ALLOW+

                            " or " +AccessControlInterface.DENY);

      }

      // check permission order

      permOrder = myPermOrder;

      // If permission order is not allowFirst or denyFirst, default to denyFirst.

      if (permOrder == null || !permOrder.equals(AccessControlInterface.DENYFIRST)) {

        permOrder = AccessControlInterface.ALLOWFIRST;

      }

      //debugMessage

      logMetacat.info("docid in AccessControlForSingleFiel: " +

                                docId);

      logMetacat.info("principal in AccessControlForSingleFiel: " +

                                principal);

      logMetacat.info("permission in AccessControlForSingleFiel: " +

                                permission);

      logMetacat.info("permType in AccessControlForSingleFiel: " +

                                permType);

      logMetacat.info("permOrder in AccessControlForSingleFiel: " +

                                permOrder);

    }

    catch (Exception e)

    {

      logMetacat.error("Error in construct of AccessControlForSingle" +

                               "File for docid: " + docId + " : " + e.getMessage());

      throw e;

    }

  }

  /**

   * Method to insert records into xml_access table

   */

  public void insertPermissions() throws SQLException 

  {

    PreparedStatement pstmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection

                               ("AccessControlForSingleFiel.insertPermissions");

      serialNumber=conn.getCheckOutSerialNumber();

      pstmt = conn.prepareStatement(

              "INSERT INTO xml_access " + 

              "(docid, principal_name, permission, perm_type, perm_order " +

              ") VALUES (?,?,?,?,?)");

      // Bind the values to the query

      pstmt.setString(1, docId);

      pstmt.setString(2, principal);

      pstmt.setInt(3, permission);

      pstmt.setString(4, permType);

      pstmt.setString(5, permOrder);

      //pstmt.setString(6, AccessControlInterface.ACLID);

      pstmt.execute();

    }//try

    catch (SQLException e)

    {

      logMetacat.error("Error in AccessControlForSingleFile.insert" +

                               "Permissions: " + e.getMessage());

      throw e;

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

  }

  /**

   * 

   * @return true if the Access Control for this file already exists in the DB

   * @throws SQLException

   */

  public boolean accessControlExists() throws SQLException 

  {

	  boolean exists = false;

    PreparedStatement pstmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    try

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection

                               ("AccessControlForSingleFiel.accessControlExists");

      serialNumber=conn.getCheckOutSerialNumber();

      pstmt = conn.prepareStatement(

              "SELECT * FROM xml_access " + 

              "WHERE docid = ? " +

              "AND principal_name = ? " +

              "AND permission = ? " +

              "AND perm_type = ? " +

              "AND perm_order =? ");

      // Bind the values to the query

      pstmt.setString(1, docId);

      pstmt.setString(2, principal);

      pstmt.setInt(3, permission);

      pstmt.setString(4, permType);

      pstmt.setString(5, permOrder);

      pstmt.execute();

      ResultSet rs = pstmt.getResultSet();

      exists = rs.next();

    }//try

    catch (SQLException e)

    {

      logMetacat.error("Error in AccessControlForSingleFile.accessControlExists: "

                               + e.getMessage());

      throw e;

    }

    finally

    {

      try

      {

        pstmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    return exists;

  }

  public String getAccessString() {

	  StringBuffer sb = new StringBuffer();

	  sb.append("<access>");

		  sb.append("<permOrder>");

		  sb.append(this.permOrder);

		  sb.append("</permOrder>");

		  sb.append("<permType>");

		  sb.append(this.permType);

		  sb.append("</permType>");

		  sb.append("<permission>");

		  sb.append(AccessControlList.txtValue(this.permission));

		  sb.append("</permission>");

		  sb.append("<principal>");

		  sb.append(this.principal);

		  sb.append("</principal>");

	  sb.append("</access>");

	  return sb.toString();

  }

}

/**

 *  '$RCSfile$'

 *    Purpose: A Class that represents an XML Text node and its contents,

 *             and can build itself from a database connection

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Matt Jones

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.util.Vector;

import org.apache.log4j.Logger;

/**

 * A Class that represents an XML access rule. It include principal and 

 * permission

 */

public class AccessRule

{

  private String permissionType = null;

  private Vector<String> principal = new Vector<String>();

  private int permission = 0;

  private Logger logMetacat = Logger.getLogger(AccessRule.class);

  /** Set the permssionType */

  public void setPermissionType(String type)

  {

    permissionType = type;

  }

  public String getPermissionType()

  {

     return permissionType;

  }

  /** Set the a principle */

  public void addPrincipal(String newPrincipal) 

  {

    this.principal.addElement(newPrincipal);

  }

  /** Get the principle vector */

  public Vector<String> getPrincipal() 

  {

    return principal;

  }

  /** 

   * Set a permission. 

   */

  public void setPermission(int myPermission) 

  {

    permission = myPermission;

  }

  /**

   * Get permission

   */

  public int getPermission()

  {

    return permission;

  }

  /**

   * Copy a AccessRule to another accessrule object

   */

  public Object clone()

  {

    // create a new object

    AccessRule newRule = new AccessRule();

    // set permissiontype

    logMetacat.info("copy permission type: "+

                              this.getPermissionType());

    newRule.setPermissionType(this.getPermissionType());

    // set permission

    logMetacat.info("copy permission: "+

                              this.getPermission());

    newRule.setPermission(this.getPermission());

    // walk through all the principals

    Vector principalVector = this.getPrincipal();

    for (int i=0; i<principalVector.size(); i++)

    {

      String name = (String)principalVector.elementAt(i);

      logMetacat.info("copy principle: "+ name);

      // Add this name to newrules

      newRule.addPrincipal(name);

    }

    return newRule;

  }

}//AccessRule