/src/edu/ucsb/nceas/metacat/accesscontrol/XMLAccessAccess.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 5098

Added by daigle over 14 years ago

change AccessControlForSingleFile to only be instantiated for one file. move ACL methods to AccessControlForSingleFile. Change format of access sections returned to EML 2.1.0.

     /**
      *  '$RCSfile$'
      *    Purpose: A Class that manages database access of scheduled task
      *    Purpose: A Class that manages database access of xml access
      *             information.
      *  Copyright: 2009 Regents of the University of California and the
      *             National Center for Ecological Analysis and Synthesis
-...
+    	}
     	/**
     	 * Add permissions for a given prinicpal on a given document. If the
     	 * prinicpal already exists, bitwise OR the permission to the existing
     	 * Add permissions for a given principal on a given document. If the
     	 * principal already exists, bitwise OR the permission to the existing
     	 * permission and update.
+    	 *
     	 * @param docId
-...
+    	}
     	/**
     	 * Insert an xml access record
     	 * Set permissions for a given document. This means first removing all access control for the
     	 * document and then adding the given rules.
+    	 *
     	 * @param docId
     	 *            document id
     	 * @param xmlAccessList
     	 *            list of xml access dao objects that hold new access for the document
     	 */
     	public void setXMLAccess(String docId, Vector<XMLAccessDAO> xmlAccessList) throws AccessException {
     		deleteXMLAccessForDoc(docId);
     		// if more than one record exists for this principal on this document with the same
     		// access type / access order combination, call cleanup to combine common access and then
     		// re-retrieve the access list.
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			insertXMLAccess(docId, xmlAccessDAO.getPrincipalName(), xmlAccessDAO.getPermission(),
     					xmlAccessDAO.getPermType(), xmlAccessDAO.getPermOrder());
+    		}
+    	}
     	/**
     	 * Insert an xml access record.  It is assumed that the checks have already been made to
     	 * make sure the principal does not already have an access record for this document.  If
     	 * one does already exist, that record should be updated and this insert not called.
+    	 *
     	 * @param docId
     	 *            document id
     	 * @param principal
     	 *            principal credentials
     	 * @param permission
-...
+    	}
     	/**
     	 * Update existing xml access permissions in the db
     	 * Update existing xml access permissions in the db.  The permission value should be the combined
     	 * value of pre-existing permissions plus new permissions.
+    	 *
     	 * @param docId
     	 *            document id
     	 * @param principalName
-...
+    	}
     	/**
     	 * Delete xml access.  This modifies the access in the database for a principal
     	 * Remove xml access.  This modifies the access in the database for a principal
     	 * for a given document.  If the provided permission is exactly the same as what
     	 * the principal has, the record is removed from the database.
     	 * the principal has, the record is deleted from the database.
+    	 *
     	 * @param docId
     	 *            document id
     	 * @param principalName
     	 *            principal credentials
     	 */
     	private void removeXMLAccessForPrincipal(String docId, String principalName, Long permission) throws AccessException {
     	public void removeXMLAccessForPrincipal(String docId, String principalName, Long permission) throws AccessException {
     		if (docId == null) {
     			throw new AccessException("XMLAccessAccess.removeXMLAccessForPrincipal - docid is required when " +
     					"removing XML access");
-...
+    	}
     	/**
     	 * Delete xml access.  This removes all access records from the database for a given document
+    	 *
     	 * @param docId
     	 *            document id
     	 */
     	private void deleteXMLAccessForDoc(String docId) throws AccessException {
     		if (docId == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - docid is required when " +
     					"deleting XML access record");
+    		}
     	    PreparedStatement pstmt = null;
     		DBConnection conn = null;
     		int serialNumber = -1;
     		try {
     			// check out DBConnection
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForDoc");
     			String sql = "DELETE FROM xml_access WHERE docid = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, docId);
     			String sqlReport = "XMLAccessAccess.deleteXMLAccessForDoc - SQL: " + sql;
     			sqlReport += " [" + docId + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when deleting"
     					+ "xml access permissions for doc id: " + docId + ":" + sqle.getMessage());
     		} finally {
     			try {
     				if (pstmt != null) {
     					pstmt.close();
+    				}
     			} catch (SQLException sqle) {
     				logMetacat.error("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when closing prepared " +
     						"statement after deleting xml access permissions for doc id: " + ":" + sqle.getMessage());
     			} finally {
     				DBConnectionPool.returnDBConnection(conn, serialNumber);
+    			}
+    		}
+    	}
     	/**
     	 * Delete xml access.  This removes all access records from the database for a principal
     	 * for a given document
+    	 *
     	 * @param docId
     	 *            document id
     	 * @param principal
-...
+    		}
+    	}
     	/**
     	 * Make sure that only one record exists per principal/permType/document. If
     	 * more than one record exists, delete the existing records, consolidate the
     	 * permissions insert the new record.
+    	 *
     	 * @param xmlAccessList
     	 * @throws AccessException
     	 */
     	private void cleanupXMLAccessForPrincipal(Vector<XMLAccessDAO> xmlAccessList) throws AccessException{
     		long permissionMask = 0;
     		int numAllowRecords = 0;
     		int numDenyRecords = 0;
     		long allowPermissionMask = 0;
     		long denyPermissionMask = 0;
     		String docId = null;
     		String principalName = null;
     		String permType = null;
     		String permOrder = null;
     		if (xmlAccessList.size() == 1) {
     			return;
+    		}
     		// iterate through the list of access dao objects and bttwise or the permissions.  Most
     		// of this is just doing some error checking to make sure each record is valid.
-...
     							"principalName " + principalName + ". Database intervention required ");
+    				}
+    			}
     			permissionMask |= xmlAccessDAO.getPermission();
     			if (permType.equals(AccessControlInterface.ALLOW)) {
     				numAllowRecords++;
     				allowPermissionMask |= xmlAccessDAO.getPermission();
     			} else if (permType.equals(AccessControlInterface.DENY)) {
     				numDenyRecords++;
     				denyPermissionMask |= xmlAccessDAO.getPermission();
+    			}
+    		}
     		// remove all records for this user on this doc with this perm type and perm order
     		// then insert a single record
     		deleteXMLAccessForPrincipal(docId, principalName, permType, permOrder);
     		insertXMLAccess(docId, principalName, permissionMask, permType, permOrder);
     		// if there was more than one allow record, remove all allow records for this user on this doc
     		// with this perm type and perm order then insert a single record
     		if (numAllowRecords > 1) {
     			deleteXMLAccessForPrincipal(docId, principalName, AccessControlInterface.ALLOW, permOrder);
     			insertXMLAccess(docId, principalName, allowPermissionMask, AccessControlInterface.ALLOW, permOrder);
+    		}
     		// if there was more than one deny record, remove all deny records for this user on this doc
     		// with this perm type and perm order then insert a single record
     		if (numDenyRecords > 1) {
     			deleteXMLAccessForPrincipal(docId, principalName, AccessControlInterface.DENY, permOrder);
     			insertXMLAccess(docId, principalName, denyPermissionMask, AccessControlInterface.DENY, permOrder);
+    		}
+    	}
     	/**
+    	 *
     	 * @param xmlAccessList
     	 * @throws PermOrderException
     	 */
     	private void validateDocXMLAccessList(Vector<XMLAccessDAO> xmlAccessList) throws PermOrderException {
     		String permOrder = null;
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-...
     					". Database intervention required ");
+    		}
+    	}
     	/**
     	 * Check if the given list of XML access DAOs has redundant access.  This occurs if there is
     	 * more than one instance of any combination of access type and access order.  Note that we
     	 * assume that the list contains access records for one principal on one document.
     	 * @param xmlAccessList
     	 * @return
     	 * @throws AccessException
     	 */
     	private boolean hasRedundantPrincipalAccess(Vector<XMLAccessDAO> xmlAccessList) throws AccessException {
     		// These will hold counts of all combinations of access DAOs with different permission
     		// orders and permission types.
     		int allowFirstAllows = 0;
     		int allowFirstDenys = 0;
     		int denyFirstAllows = 0;
     		int denyFirstDenys = 0;
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			if (xmlAccessDAO.getPermOrder().equals(AccessControlInterface.ALLOWFIRST)) {
     				if (xmlAccessDAO.getPermType().equals(AccessControlInterface.ALLOW)) {
     					allowFirstAllows++;
     				} else if (xmlAccessDAO.getPermType().equals(AccessControlInterface.DENY)) {
     					allowFirstDenys++;
     				} else {
     					throw new AccessException("XMLAccessAccess.validatePrincipalXMLAccessList - " +
     						"Invalid permission type: "+ xmlAccessDAO.getPermType() + " for document " +
     						xmlAccessDAO.getDocId() + ". Database intervention required ");
+    				}
     			} else if (xmlAccessDAO.getPermOrder().equals(AccessControlInterface.DENYFIRST)) {
     				if (xmlAccessDAO.getPermType().equals(AccessControlInterface.ALLOW)) {
     					denyFirstAllows++;
     				} else if (xmlAccessDAO.getPermType().equals(AccessControlInterface.DENY)) {
     					denyFirstDenys++;
     				} else {
     					throw new AccessException("XMLAccessAccess.validatePrincipalXMLAccessList - " +
     						"Invalid permission type: " + xmlAccessDAO.getPermType() + " for document "+
     						xmlAccessDAO.getDocId() + ". Database intervention required ");
+    				}
+    			}
+    		}
     		return (allowFirstAllows > 1) || (allowFirstDenys > 1) || (denyFirstAllows > 1)
     				|| (denyFirstDenys > 1);
+    	}
     	/**
     	 * Populate a job data object with the current row in a resultset

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 5098

Added by daigle over 14 years ago