| 24 |
24 |
package edu.ucsb.nceas.metacat.dataone;
|
| 25 |
25 |
|
| 26 |
26 |
import java.io.InputStream;
|
|
27 |
import java.util.ArrayList;
|
| 27 |
28 |
import java.util.Calendar;
|
| 28 |
29 |
import java.util.Date;
|
| 29 |
30 |
import java.util.List;
|
| ... | ... | |
| 40 |
41 |
import org.dataone.service.types.AccessRule;
|
| 41 |
42 |
import org.dataone.service.types.Event;
|
| 42 |
43 |
import org.dataone.service.types.Identifier;
|
|
44 |
import org.dataone.service.types.Group;
|
| 43 |
45 |
import org.dataone.service.types.Log;
|
| 44 |
46 |
import org.dataone.service.types.LogEntry;
|
| 45 |
47 |
import org.dataone.service.types.NodeReference;
|
| 46 |
48 |
import org.dataone.service.types.Permission;
|
|
49 |
import org.dataone.service.types.Person;
|
| 47 |
50 |
import org.dataone.service.types.Session;
|
| 48 |
51 |
import org.dataone.service.types.Subject;
|
| 49 |
52 |
import org.dataone.service.types.SystemMetadata;
|
| ... | ... | |
| 281 |
284 |
String guid = pid.getValue();
|
| 282 |
285 |
|
| 283 |
286 |
// are we allowed to do this?
|
| 284 |
|
if (!hasPermission(session, pid, Permission.CHANGE_PERMISSION)) {
|
|
287 |
if (!isAuthorized(session, pid, Permission.CHANGE_PERMISSION)) {
|
| 285 |
288 |
throw new NotAuthorized("4420", "not allowed by " + subject.getValue() + " on " + guid);
|
| 286 |
289 |
}
|
| 287 |
290 |
|
| ... | ... | |
| 329 |
332 |
|
| 330 |
333 |
boolean allowed = false;
|
| 331 |
334 |
|
| 332 |
|
// get the subject
|
| 333 |
|
Subject subject = session.getSubject();
|
|
335 |
// get the subjects from the session
|
|
336 |
List<Subject> subjects = new ArrayList<Subject>();
|
|
337 |
subjects.add(session.getSubject());
|
|
338 |
for (Person p: session.getSubjectList().getPersonList()) {
|
|
339 |
subjects.add(p.getSubject());
|
|
340 |
}
|
|
341 |
for (Group g: session.getSubjectList().getGroupList()) {
|
|
342 |
subjects.add(g.getSubject());
|
|
343 |
}
|
| 334 |
344 |
|
| 335 |
345 |
// get the system metadata
|
| 336 |
346 |
String guid = pid.getValue();
|
| ... | ... | |
| 342 |
352 |
}
|
| 343 |
353 |
List<AccessRule> allows = systemMetadata.getAccessPolicy().getAllowList();
|
| 344 |
354 |
for (AccessRule accessRule: allows) {
|
| 345 |
|
if (accessRule.getSubjectList().contains(subject)) {
|
| 346 |
|
allowed = accessRule.getPermissionList().contains(permission);
|
| 347 |
|
if (allowed) {
|
| 348 |
|
break;
|
|
355 |
for (Subject subject: subjects) {
|
|
356 |
if (accessRule.getSubjectList().contains(subject)) {
|
|
357 |
allowed = accessRule.getPermissionList().contains(permission);
|
|
358 |
if (allowed) {
|
|
359 |
break;
|
|
360 |
}
|
| 349 |
361 |
}
|
| 350 |
362 |
}
|
| 351 |
363 |
}
|
| 352 |
364 |
|
| 353 |
365 |
// TODO: throw or return?
|
| 354 |
366 |
if (!allowed) {
|
| 355 |
|
throw new NotAuthorized("1820", permission + "not allowed by " + subject.getValue() + " on " + guid);
|
|
367 |
throw new NotAuthorized("1820", permission + "not allowed on " + guid);
|
| 356 |
368 |
}
|
| 357 |
369 |
return allowed;
|
| 358 |
370 |
}
|
| 359 |
|
|
| 360 |
|
protected boolean hasPermission(Session session, Identifier pid, Permission permission)
|
| 361 |
|
throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,
|
| 362 |
|
NotImplemented, InvalidRequest {
|
| 363 |
371 |
|
| 364 |
|
boolean allowed = false;
|
| 365 |
|
|
| 366 |
|
// get the subject
|
| 367 |
|
Subject subject = session.getSubject();
|
| 368 |
|
|
| 369 |
|
// get the system metadata
|
| 370 |
|
String guid = pid.getValue();
|
| 371 |
|
SystemMetadata systemMetadata = null;
|
| 372 |
|
try {
|
| 373 |
|
systemMetadata = IdentifierManager.getInstance().getSystemMetadata(guid);
|
| 374 |
|
} catch (McdbDocNotFoundException e) {
|
| 375 |
|
throw new NotFound("1800", "No record found for: " + guid);
|
| 376 |
|
}
|
| 377 |
|
List<AccessRule> allows = systemMetadata.getAccessPolicy().getAllowList();
|
| 378 |
|
for (AccessRule accessRule: allows) {
|
| 379 |
|
if (accessRule.getSubjectList().contains(subject)) {
|
| 380 |
|
allowed = accessRule.getPermissionList().contains(permission);
|
| 381 |
|
if (allowed) {
|
| 382 |
|
break;
|
| 383 |
|
}
|
| 384 |
|
}
|
| 385 |
|
}
|
| 386 |
|
|
| 387 |
|
return allowed;
|
| 388 |
|
}
|
| 389 |
|
|
| 390 |
372 |
/* End methods common to CNAuthorization and MNAuthorization APIs */
|
| 391 |
373 |
|
| 392 |
374 |
/**
|
-use every Subject in the session (alt Ids and Group membership)
-consolidate to single isAuthorized method