Index: src/edu/ucsb/nceas/metacat/DBQuery.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DBQuery.java	(revision 569)
+++ src/edu/ucsb/nceas/metacat/DBQuery.java	(revision 570)
@@ -168,7 +168,7 @@
         boolean tableHasRows = rs.next();
         while (tableHasRows) {
           docid = rs.getString(1);
-          if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
+          if ( !hasPermission(conn, user, group, docid) ) {continue;}
           docname = rs.getString(2);
           doctype = rs.getString(3);
           doctitle = rs.getString(4);
@@ -274,7 +274,7 @@
           while(tableHasRows) 
           {
             docid = rs.getString(1);
-            if ( !hasReadPermission(conn, docid, user, group) ) {continue;}
+            if ( !hasPermission(conn, user, group, docid) ) {continue;}
             fieldname = rs.getString(2);
             fielddata = rs.getString(3);
             
@@ -635,110 +635,27 @@
      return createQuery(value, "any");
    }
    
-  /** Check for "read" permissions from DB connection */
-  private boolean hasReadPermission(Connection conn, String docid, 
-                                     String user, String group) 
-                                     throws SQLException {
+  /** 
+    * Check for "READ" permission on @docid for @user and/or @group 
+    * from DB connection 
+    */
+  private boolean hasPermission ( Connection conn, String user,
+                                  String group, String docid ) 
+                  throws SQLException 
+  {
     // b' of the command line invocation
     if ( (user == null) && (group == null) ) {
       return true;
     }
     
-    PreparedStatement pstmt;
-    // checking if user is owner of docid or if docid has public access
-    try {
-      pstmt = conn.prepareStatement(
-                   "SELECT 'x' FROM xml_documents " +
-                   "WHERE docid LIKE ? AND user_owner LIKE ? " + 
-                   "UNION " +
-                   "SELECT 'x' FROM xml_documents " +
-                   "WHERE docid LIKE ? AND public_access = 1");
-      // Bind the values to the query
-      pstmt.setString(1, docid);
-      pstmt.setString(2, user);
-      pstmt.setString(3, docid);
-
-      pstmt.execute();
-      ResultSet rs = pstmt.getResultSet();
-      boolean hasRow = rs.next();
-      pstmt.close();
-      if (hasRow) {
-        return true;
-      }
-      
-    } catch (SQLException e) {
-      throw new 
-        SQLException("Error checking document's owner or public access: "
-                      + e.getMessage());
+    // Check for READ permission on @docid for @user and/or @group
+    AccessControlList aclobj = new AccessControlList(conn);
+    boolean hasPermission = aclobj.hasPermission("READ",user,docid);
+    if ( !hasPermission && group != null ) {
+      hasPermission = aclobj.hasPermission("READ",group,docid);
     }
-
-    // checking if docid has public access at this time
-    try {
-      pstmt = conn.prepareStatement(
-                   "SELECT 'x' FROM xml_access " +
-                   "WHERE docid LIKE ? " +
-                   "AND principal_name = 'public' " +
-                   "AND principal_type = 'user' " +
-                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
-                                   "AND nvl(end_time,sysdate)");
-      // Bind the values to the query
-      pstmt.setString(1, docid);
-
-      pstmt.execute();
-      ResultSet rs = pstmt.getResultSet();
-      boolean hasRow = rs.next();
-      pstmt.close();
-      if (hasRow) {
-        return true;
-      }
-      
-    } catch (SQLException e) {
-      throw new 
-        SQLException("Error checking doc's public access: " + e.getMessage());
-    }
-
-    // checking access type from xml_access table
-    int accesstype = 0;
-    try {
-      pstmt = conn.prepareStatement(
-                   "SELECT access_type FROM xml_access " +
-                   "WHERE docid LIKE ? " + 
-                   "AND principal_name LIKE ? " +
-                   "AND principal_type = 'user' " +
-                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
-                                   "AND nvl(end_time,sysdate) " +
-                   "UNION " +
-                   "SELECT access_type FROM xml_access " +
-                   "WHERE docid LIKE ? " + 
-                   "AND principal_name LIKE ? " +
-                   "AND principal_type = 'group' " +
-                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
-                                   "AND nvl(end_time,sysdate)");
-      // Bind the values to the query
-      pstmt.setString(1, docid);
-      pstmt.setString(2, user);
-      pstmt.setString(3, docid);
-      pstmt.setString(4, group);
-
-      pstmt.execute();
-      ResultSet rs = pstmt.getResultSet();
-      boolean hasRows = rs.next();
-      while ( hasRows ) {
-        accesstype = rs.getInt(1);
-        if ( (accesstype & READ) == READ ) {
-          pstmt.close();
-          return true;
-        }
-        hasRows = rs.next();
-      }
-
-      pstmt.close();
-      return false;
-      
-    } catch (SQLException e) {
-      throw new 
-      SQLException("Error getting document's permissions: " + e.getMessage());
-    }
+    
+    return hasPermission;
   }
    
 }
Index: src/edu/ucsb/nceas/metacat/DocumentImpl.java
===================================================================
--- src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 569)
+++ src/edu/ucsb/nceas/metacat/DocumentImpl.java	(revision 570)
@@ -771,7 +771,7 @@
 
     if ( action.equals("UPDATE") ) {
       // check for 'write' permission for 'user' to update this document
-      if ( !hasWritePermission(conn, docid, user, group) ) {
+      if ( !hasPermission(conn, user, group, docid) ) {
         throw new Exception("User " + user + 
               " does not have permission to update XML Document #" + docid);
       }          
@@ -828,7 +828,7 @@
     String newdocid = ac.generate(docid, "DELETE");
 
     // check for 'write' permission for 'user' to delete this document
-    if ( !hasWritePermission(conn, docid, user, group) ) {
+    if ( !hasPermission(conn, user, group, docid) ) {
       throw new Exception("User " + user + 
               " does not have permission to delete XML Document #" + docid);
     }
@@ -846,80 +846,27 @@
     conn.setAutoCommit(true);
   }
   
-  /** Check for "write" permissions from DB connection */
-  private static boolean hasWritePermission(Connection conn, String docid, 
-                                     String user, String group) 
-                                     throws SQLException {
+  /** 
+    * Check for "WRITE" permission on @docid for @user and/or @group 
+    * from DB connection 
+    */
+  private static boolean hasPermission( Connection conn, String user,
+                                        String group, String docid) 
+                         throws SQLException 
+  {
     // b' of the command line invocation
     if ( (user == null) && (group == null) ) {
       return true;
     }
 
-    PreparedStatement pstmt;
-    // checking if user is owner of docid
-    try {
-      pstmt = conn.prepareStatement(
-                   "SELECT 'x' FROM xml_documents " +
-                   "WHERE docid LIKE ? AND user_owner LIKE ?");
-      // Bind the values to the query
-      pstmt.setString(1, docid);
-      pstmt.setString(2, user);
-
-      pstmt.execute();
-      ResultSet rs = pstmt.getResultSet();
-      boolean hasRow = rs.next();
-      pstmt.close();
-      if (hasRow) {
-        return true;
-      }
-      
-    } catch (SQLException e) {
-      throw new 
-        SQLException("Error checking document's owner: " + e.getMessage());
+    // Check for WRITE permission on @docid for @user and/or @group
+    AccessControlList aclobj = new AccessControlList(conn);
+    boolean hasPermission = aclobj.hasPermission("WRITE",user,docid);
+    if ( !hasPermission && group != null ) {
+      hasPermission = aclobj.hasPermission("WRITE",group,docid);
     }
-
-    // checking access type from xml_access table
-    int accesstype = 0;
-    try {
-      pstmt = conn.prepareStatement(
-                   "SELECT access_type FROM xml_access " +
-                   "WHERE docid LIKE ? " + 
-                   "AND principal_name LIKE ? " +
-                   "AND principal_type = 'user' " +
-                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
-                                   "AND nvl(end_time,sysdate) " +
-                   "UNION " +
-                   "SELECT access_type FROM xml_access " +
-                   "WHERE docid LIKE ? " + 
-                   "AND principal_name LIKE ? " +
-                   "AND principal_type = 'group' " +
-                   "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
-                                   "AND nvl(end_time,sysdate)");
-      // Bind the values to the query
-      pstmt.setString(1, docid);
-      pstmt.setString(2, user);
-      pstmt.setString(3, docid);
-      pstmt.setString(4, group);
-
-      pstmt.execute();
-      ResultSet rs = pstmt.getResultSet();
-      boolean hasRows = rs.next();
-      while ( hasRows ) {
-        accesstype = rs.getInt(1);
-        if ( (accesstype & WRITE) == WRITE ) {
-          pstmt.close();
-          return true;
-        }
-        hasRows = rs.next();
-      }
-
-      pstmt.close();
-      return false;
-      
-    } catch (SQLException e) {
-      throw new 
-      SQLException("Error getting document's permissions: " + e.getMessage());
-    }
+    
+    return hasPermission;
   }
 
   /**
Index: src/edu/ucsb/nceas/metacat/AccessControlList.java
===================================================================
--- src/edu/ucsb/nceas/metacat/AccessControlList.java	(revision 569)
+++ src/edu/ucsb/nceas/metacat/AccessControlList.java	(revision 570)
@@ -38,36 +38,37 @@
   static final int WRITE = 2;
   static final int READ = 4;
 
-  private Connection  conn;
-  private String docid;
+  private Connection conn;
   private String parserName;
   private Stack elementStack;
 
-  private Vector allow  = new Vector();
-  private Vector begin1 = new Vector();
-  private Vector end1   = new Vector();
-  private Vector count1 = new Vector();
-
-  private Vector denyv  = new Vector();
-  private Vector begin2 = new Vector();
-  private Vector end2   = new Vector();
-  private Vector count2 = new Vector();
+  private String resourceId;
+  private Vector principalName;
+  private int    permission;
+  private String permType;
+  private String permOrder;
+  private String beginTime;
+  private String endTime;
+  private int    ticketCount;
   
-  private String principal_name = "";
-  private String principal_type;
-  private int permission = 0;
-  private String begin_time;
-  private String end_time;
-  private int count;
-  private int deny;
-  
   /**
    * Construct an instance of the AccessControlList class.
+   * It is used by the permission check up from DBQuery and DocumentImpl
+   *
+   * @param conn the JDBC connection where acl data are loaded
+   */
+  public AccessControlList ( Connection conn )
+  {
+    this.conn = conn;
+  }
+
+  /**
+   * Construct an instance of the AccessControlList class.
    * It parse acl file and loads acl data into db connection.
    *
    * @param conn the JDBC connection where acl data are loaded
    * @param docid the Accession# of the document with the acl data
-   * @param acl the acl file containing acl data for the document
+   * @param acl the acl file containing acl data
    */
   public AccessControlList ( Connection conn, String docid, Reader acl )
                   throws SAXException, IOException, ClassNotFoundException 
@@ -77,9 +78,12 @@
     String parserName = util.getOption("saxparser");
 
     this.conn = conn;
-    this.docid = docid;
     this.parserName = parserName;
-    elementStack = new Stack();
+    this.elementStack = new Stack();
+    
+    this.principalName = new Vector();
+    this.permission = 0;
+    this.ticketCount = 0;
 
     // Initialize the parser and read the queryspec
     XMLReader parser = initializeParser();
@@ -87,6 +91,14 @@
 
   }
 
+  /**
+   * Construct an instance of the AccessControlList class.
+   * It parse acl file and loads acl data into db connection.
+   *
+   * @param conn the JDBC connection where acl data are loaded
+   * @param docid the Accession# of the document with the acl data
+   * @param aclfilename the name of acl file containing acl data
+   */
   public AccessControlList( Connection conn, String docid, String aclfilename )
                   throws SAXException, IOException, ClassNotFoundException 
   {
@@ -128,6 +140,9 @@
         currentNode.setAttribute(atts.getLocalName(i), atts.getValue(i));
       }
     }
+    if ( currentNode.getTagName().equals("resource") ) {
+      permOrder = currentNode.getAttribute("order");
+    }
     elementStack.push(currentNode); 
   }
 
@@ -143,12 +158,10 @@
     BasicNode currentNode = (BasicNode)elementStack.peek(); 
     String currentTag = currentNode.getTagName();
 
-    if (currentTag.equals("groupName")) {
-      principal_name = inputString;
-      principal_type = "group";
-    } else if (currentTag.equals("userName")) {
-      principal_name = inputString;
-      principal_type = "user";
+    if (currentTag.equals("resourceIdentifier")) {
+      resourceId = inputString;
+    } else if (currentTag.equals("principalName")) {
+      principalName.addElement(new String(inputString));
     } else if (currentTag.equals("permission")) {
       if ( inputString.trim().toUpperCase().equals("READ") ) {
         permission = permission | READ;
@@ -158,15 +171,15 @@
         permission = permission | ALL;
       }
     } else if (currentTag.equals("duration") && 
-               begin_time == null && end_time == null ) {
+               beginTime == null && endTime == null ) {
       try {
-        begin_time = inputString.substring(0, inputString.indexOf(" "));
-        end_time = inputString.substring(inputString.indexOf(" ")+1);
+        beginTime = inputString.substring(0, inputString.indexOf(" "));
+        endTime = inputString.substring(inputString.indexOf(" ")+1);
       } catch (StringIndexOutOfBoundsException se) {
-        begin_time = inputString;
+        beginTime = inputString;
       }
-    } else if (currentTag.equals("count") && count == 0 ) {
-      count = (new Integer(inputString.trim())).intValue();
+    } else if (currentTag.equals("ticketCount") && ticketCount == 0 ) {
+      ticketCount = (new Integer(inputString.trim())).intValue();
     }
   }
 
@@ -179,78 +192,54 @@
          throws SAXException 
   {
     BasicNode leaving = (BasicNode)elementStack.pop(); 
-    if ( leaving.getTagName().equals("allow") && permission > 0 ) {
-      // collect allowed permissions in a Vector variable allow
-      allow.add(new Integer(permission));
-      begin1.add(begin_time);
-      end1.add(end_time);
-      count1.add(new Integer(count));
+    if ( leaving.getTagName().equals("allow") ) {
+      
+      if ( permission > 0 ) {
 
+        // insert into db calculated permission for the list of principals
+        try {
+          insertPermissions("allowed");
+        } catch (SQLException sqle) {
+          throw new SAXException(sqle);
+        }
+      }
+
       // reset the allowed permission
+      principalName = new Vector();
       permission = 0;
-      begin_time = null;
-      end_time = null;
-      count = 0;
+      beginTime = null;
+      endTime = null;
+      ticketCount = 0;
     
-    } else if ( leaving.getTagName().equals("deny") && permission > 0 ) {
-      // collect denied permissions in a Vector variable denyv
-      denyv.add(new Integer(permission));
-      begin2.add(begin_time);
-      end2.add(end_time);
-      count2.add(new Integer(count));
+    } else if ( leaving.getTagName().equals("deny") ) {
+      
+      if ( permission > 0 ) {
 
-      // reset the denied permission
-      permission = 0;
-      begin_time = null;
-      end_time = null;
-      count = 0;
-
-    } else if ( leaving.getTagName().equals("accessControl") ) {
-      // when order attribute for <accessControl> is specified to "denyFirst"
-      // exclude the allowed permissions from the list of denied ones
-      if ( leaving.getAttribute("order").equals("denyFirst") ) {
-        for ( int i = 0; i < allow.size(); i++ ) {
-          for ( int j = 0; j < denyv.size(); j++ ) {
-            denyv.setElementAt( 
-            new Integer(((Integer)denyv.elementAt(j)).intValue() & 
-                        ~((Integer)allow.elementAt(i)).intValue()), j);
-          }
+        // insert into db calculated permission for the list of principals
+        try {
+          insertPermissions("denied");
+        } catch (SQLException sqle) {
+          throw new SAXException(sqle);
         }
       }
 
-      // insert into db connection collected permissions for the principal
-      try {
-        insertPermissions();
-      } catch (SQLException sqle) {
-        throw new SAXException(sqle);
-      }
+      // reset the denied permission
+      principalName = new Vector();
+      permission = 0;
+      beginTime = null;
+      endTime = null;
+      ticketCount = 0;
 
-      // reset the list of allowed and denied permissions 
-      // for use for the next principal
-      allow  = new Vector();
-      begin1 = new Vector();
-      end1   = new Vector();
-      count1 = new Vector();
+    } else if ( leaving.getTagName().equals("resource") ) {
+      // reset the resource identifier
+      resourceId = null;
+      permOrder = null;
+    }
 
-      denyv  = new Vector();
-      begin2 = new Vector();
-      end2   = new Vector();
-      count2 = new Vector();
-
-    } else if ( leaving.getTagName().equals("user") || 
-                leaving.getTagName().equals("group") ) {
-//      try {                  
-//        principal_name = 
-//        principal_name.substring(0, principal_name.lastIndexOf("."));
-//      } catch (StringIndexOutOfBoundsException se) {
-        // reset the name of the current principal for next use
-        principal_name = "";
-//      }
-    }
   }
                           
-  /** Insert into db connection collected permissions for a principal */
-  private void insertPermissions() 
+  /** Insert into db calculated permission for the list of principals */
+  private void insertPermissions( String permType ) 
           throws SQLException 
   {
     PreparedStatement pstmt;
@@ -258,51 +247,205 @@
     try {
       pstmt = conn.prepareStatement(
               "INSERT INTO xml_access " + 
-              "(docid, principal_name, principal_type, " +
-              "permission, begin_time, end_time, ticket_counter, deny)" +
-              "VALUES (?, ?, ?, ?, to_date(?,'mm/dd/yy'), " +
-              " to_date(?,'mm/dd/yy'), ?, ?)");
+              "(docid,principal_name,permission,perm_type,perm_order," +
+              "begin_time,end_time,ticket_count) VALUES " +
+              "(?,?,?,?,?,to_date(?,'mm/dd/yy'),to_date(?,'mm/dd/yy'),?)");
       // Bind the values to the query
-      pstmt.setString(1, docid);
-      pstmt.setString(2, principal_name);
-      pstmt.setString(3, principal_type);
-      // insert the allowed permissions first
-      for ( int i = 0; i < allow.size(); i++ ) {
-        pstmt.setInt(4, ((Integer)allow.elementAt(i)).intValue());
-        pstmt.setString(5, (String)begin1.elementAt(i));
-        pstmt.setString(6, (String)end1.elementAt(i));
-        if ( ((Integer)count1.elementAt(i)).intValue() > 0 ) {
-          pstmt.setString(7, "" + ((Integer)count1.elementAt(i)).intValue());
-        } else {
-          pstmt.setString(7, "");
-        }
+      pstmt.setString(1, resourceId);
+      pstmt.setInt(3, permission);
+      pstmt.setString(4, permType);
+      pstmt.setString(5, permOrder);
+      pstmt.setString(6, beginTime);
+      pstmt.setString(7, endTime);
+      if ( ticketCount > 0 ) {
+        pstmt.setString(8, "" + ticketCount);
+      } else {
         pstmt.setString(8, "");
+      }
+      for ( int i = 0; i < principalName.size(); i++ ) {
+        pstmt.setString(2, (String)principalName.elementAt(i));
+        pstmt.execute();
+      }
 
+    } catch (SQLException e) {
+      throw new 
+      SQLException("AccessControlList.insertPermissions(): " + e.getMessage());
+    }
+  }
+
+  /** Check for @permission for @principal on @resourceId from db connection */
+  public boolean hasPermission ( String permission, String principal,
+                                 String resourceId )
+                 throws SQLException
+  {
+    PreparedStatement pstmt;
+    // check public access to @resourceId from xml_documents table
+    if ( permission.equals("READ") ) {
+      try {
+        pstmt = conn.prepareStatement(
+                "SELECT 'x' FROM xml_documents " +
+                "WHERE docid LIKE ? AND public_access = 1");
+        // Bind the values to the query
+        pstmt.setString(1, principal);
+
         pstmt.execute();
+        ResultSet rs = pstmt.getResultSet();
+        boolean hasRow = rs.next();
+        pstmt.close();
+        if (hasRow) {
+          return true;
+        }
+//System.out.println("Passed the check for public access");      
+
+      } catch (SQLException e) {
+        throw new 
+        SQLException("Error checking document's public access: "
+                      + e.getMessage());
       }
+    }
+    
+    // since owner of resource has all permission on it,
+    // check if @principal is owner of @resourceId in xml_documents table
+    if ( principal != null ) {
+      try {
+        pstmt = conn.prepareStatement(
+                "SELECT 'x' FROM xml_documents " +
+                "WHERE docid LIKE ? AND user_owner LIKE ?");
+        // Bind the values to the query
+        pstmt.setString(1, resourceId);
+        pstmt.setString(2, principal);
 
-      // insert the denied permissions
-      for ( int i = 0; i < denyv.size(); i++ ) {
-        if ( ((Integer)denyv.elementAt(i)).intValue() <= 0 ) {
-          continue;
+        pstmt.execute();
+        ResultSet rs = pstmt.getResultSet();
+        boolean hasRow = rs.next();
+        pstmt.close();
+        if (hasRow) {
+          return true;
         }
-        pstmt.setInt(4, ((Integer)denyv.elementAt(i)).intValue());
-        pstmt.setString(5, (String)begin2.elementAt(i));
-        pstmt.setString(6, (String)end2.elementAt(i));
-        if ( ((Integer)count2.elementAt(i)).intValue() > 0 ) {
-          pstmt.setString(7, "" + ((Integer)count2.elementAt(i)).intValue());
-        } else {
-          pstmt.setString(7, "");
+//System.out.println("Passed the check for ownership");      
+     
+      } catch (SQLException e) {
+        throw new 
+        SQLException("AccessControlList.hasPermission(): " +
+                     "Error checking document's ownership. " + e.getMessage());
+      }
+
+      // check @principal's @permission on @resourceId from xml_access table
+      int accessValue = 0;
+      int ticketCount = 0;
+      String permOrder = "";
+      try {
+        pstmt = conn.prepareStatement(
+                "SELECT permission, perm_order, ticket_count " +
+                "FROM xml_access " +
+                "WHERE docid LIKE ? " + 
+                "AND principal_name LIKE ? " +
+                "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                                "AND nvl(end_time,sysdate) " +
+                "AND perm_type LIKE ?");
+        // check if it is "denied" first
+        // Bind the values to the query
+        pstmt.setString(1, resourceId);
+        pstmt.setString(2, principal);
+        pstmt.setString(3, "denied");
+
+        pstmt.execute();
+        ResultSet rs = pstmt.getResultSet();
+        boolean hasRows = rs.next();
+        while ( hasRows ) {
+          accessValue = rs.getInt(1);
+          permOrder = rs.getString(2);
+          ticketCount = rs.getInt(3);
+          if ( ( accessValue & intValue(permission) ) == intValue(permission) &&
+               ( permOrder.equals("allow first") ) &&
+               ( rs.wasNull() || ticketCount > 0 ) ) {
+            if ( !rs.wasNull() && ticketCount > 0 ) {
+              decreaseNumberOfAccess(accessValue,principal,resourceId,"denied");
+            }
+            pstmt.close();
+            return false;
+          }
+          hasRows = rs.next();
         }
-        pstmt.setString(8, "" + 1);
+//System.out.println("Passed the check for denied access");      
 
+        // it is not denied then check if it is "allowed"
+        // Bind the values to the query
+        pstmt.setString(1, resourceId);
+        pstmt.setString(2, principal);
+        pstmt.setString(3, "allowed");
+
         pstmt.execute();
+        rs = pstmt.getResultSet();
+        hasRows = rs.next();
+        while ( hasRows ) {
+          accessValue = rs.getInt(1);
+          ticketCount = rs.getInt(3);
+          if ( ( accessValue & intValue(permission) )==intValue(permission) &&
+               ( rs.wasNull() || ticketCount > 0 ) ) {
+            if ( !rs.wasNull() && ticketCount > 0 ) {
+              decreaseNumberOfAccess(accessValue,principal,resourceId,"allowed");
+            }
+            pstmt.close();
+            return true;
+          }
+          hasRows = rs.next();
+        }
+//System.out.println("Passed the check for allowed access");      
+
+        // ???
+        // here there could be a check for the group's permission like 
+        // selfrecursive call to hasPermission(conn,permission,group,recourceId)
+        //
+      
+        pstmt.close();
+        return false;
+  
+      } catch (SQLException e) {
+        throw new 
+        SQLException("AccessControlList.hasPermission(): " +
+                     "Error checking document's permission. " + e.getMessage());
       }
+    }
+    
+    return false;
+  }
 
-    } catch (SQLException e) {
-      throw new 
-      SQLException("AccessControlList.insertPermissions(): " + e.getMessage());
+  /** decrease the number of access to @resourceId for @principal */
+  private void decreaseNumberOfAccess(int permission, String principal,
+                                      String resourceId, String permType)
+               throws SQLException
+  {
+    PreparedStatement pstmt;
+    pstmt = conn.prepareStatement(
+            "UPDATE xml_access SET ticket_count = ticket_count - 1 " +
+            "WHERE docid LIKE ? " +
+            "AND principal_name LIKE ? " +
+            "AND permission LIKE ? " +
+            "AND sysdate BETWEEN nvl(begin_time,sysdate) " +
+                            "AND nvl(end_time,sysdate) " +
+            "AND perm_type LIKE ?");
+    // Bind the values to the query
+    pstmt.setString(1, resourceId);
+    pstmt.setString(2, principal);
+    pstmt.setInt(3, permission);
+    pstmt.setString(4, permType);
+
+    pstmt.execute();
+    pstmt.close();
+  }
+ 
+  // get the int value of READ, WRITE or ALL
+  private int intValue ( String permission )
+  {
+    if ( permission.equals("READ") ) {
+      return READ;
+    } else if ( permission.equals("WRITE") ) {
+      return WRITE;
+    } else if ( permission.equals("ALL") ) {
+      return ALL;
     }
+    
+    return -1;
   }
-   
 }
