Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A Class that loads eml-access.xml file containing ACL 

 *             for a metadata document into relational DB

 *  Copyright: 2000 Regents of the University of California and the

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Jivka Bojilova

 *    Release: @release@

 *

 *   '$Author: bojilova $'

 *     '$Date: 2001-01-09 17:37:56 -0800 (Tue, 09 Jan 2001) $'

 * '$Revision: 652 $'

 */

package edu.ucsb.nceas.metacat;

import java.io.*;

import java.sql.*;

import java.util.Stack;

import java.util.Vector;

import java.util.Hashtable;

import java.net.URL;

import java.net.MalformedURLException;

import org.xml.sax.Attributes;

import org.xml.sax.InputSource;

import org.xml.sax.ContentHandler;

import org.xml.sax.EntityResolver;

import org.xml.sax.ErrorHandler;

import org.xml.sax.SAXException;

import org.xml.sax.SAXParseException;

import org.xml.sax.XMLReader;

import org.xml.sax.helpers.XMLReaderFactory;

import org.xml.sax.helpers.DefaultHandler;

/** 

 * A Class that loads eml-access.xml file containing ACL for a metadata

 * document into relational DB. It extends DefaultHandler class to handle

 * SAX parsing events when processing the XML stream.

 */

public class AccessControlList extends DefaultHandler {

  static final int ALL = 1;

  static final int WRITE = 2;

  static final int READ = 4;

  private Connection conn;

  private String parserName;

  private Stack elementStack;

  private String server;

  private boolean	processingDTD;

  private String  user;

  private String  group;

  private String  aclid;

  private String 	docname;

  private String 	doctype;

  private String 	systemid;

  private String resourceURL;

  private String resourceId;

  private Vector principalName;

  private int    permission;

  private String permType;

  private String permOrder;

  private String beginTime;

  private String endTime;

  private int    ticketCount;

  /**

   * Construct an instance of the AccessControlList class.

   * It is used by the permission check up from DBQuery and DocumentImpl

   *

   * @param conn the JDBC connection where acl data are loaded

   */

  public AccessControlList ( Connection conn ) throws SQLException

  {

    this.conn = conn;

  }

  /**

   * Construct an instance of the AccessControlList class.

   * It parse acl file and loads acl data into db connection.

   *

   * @param conn the JDBC connection where acl data are loaded

   * @param docid the Accession# of the document with the acl data

   * @param acl the acl file containing acl data

   */

  public AccessControlList(Connection conn, String aclid, Reader acl,

                           String user, String group)

                  throws SAXException, IOException, ClassNotFoundException 

  {

    // Get an instance of the parser

    MetaCatUtil util = new MetaCatUtil();

    String parserName = util.getOption("saxparser");

    this.server = util.getOption("server");

    this.conn = conn;

    this.parserName = parserName;

    this.processingDTD = false;

    this.elementStack = new Stack();

    this.user = user;

    this.group = group;

    this.aclid = aclid;

    this.principalName = new Vector();

    this.permission = 0;

    this.ticketCount = 0;

    // Initialize the parser and read the queryspec

    XMLReader parser = initializeParser();

    parser.parse(new InputSource(acl));

  }

  /**

   * Construct an instance of the AccessControlList class.

   * It parse acl file and loads acl data into db connection.

   *

   * @param conn the JDBC connection where acl data are loaded

   * @param docid the Accession# of the document with the acl data

   * @param aclfilename the name of acl file containing acl data

   */

  public AccessControlList( Connection conn, String aclid, String aclfilename,

                           String user, String group )

                  throws SAXException, IOException, ClassNotFoundException 

  {

    this(conn, aclid, new FileReader(new File(aclfilename).toString()), 

         user, group);

  }

  /**

   * Set up the SAX parser for reading the XML serialized ACL

   */

  private XMLReader initializeParser() throws SAXException 

  {

    XMLReader parser = null;

    // Get an instance of the parser

    parser = XMLReaderFactory.createXMLReader(parserName);

    // Turn off validation

    parser.setFeature("http://xml.org/sax/features/validation", true);

    // Set Handlers in the parser

    // Set the ContentHandler to this instance

    parser.setContentHandler((ContentHandler)this);

    // make a DBEntityResolver instance

    // Set the EntityReslover to DBEntityResolver instance

    EntityResolver eresolver = new DBEntityResolver(conn,this,null);

    parser.setEntityResolver((EntityResolver)eresolver);

    // Set the ErrorHandler to this instance

    parser.setErrorHandler((ErrorHandler)this);

    return parser;

  }

  /**

   * callback method used by the SAX Parser when beginning of the document

   */

  public void startDocument() throws SAXException 

  {

    //delete all previously submitted permissions @ relations

    //this happens only on UPDATE of the access file

    try {

      if ( aclid != null ) {

        //first delete all permissions for resources related to @aclid if any

        deletePermissionsForRelatedResources(aclid);

        //then delete all relations with docid of @aclid if any

        deleteRelations(aclid);

      }

    } catch (SQLException sqle) {

      throw new SAXException(sqle);

    }

  }

  /**

   * callback method used by the SAX Parser when the start tag of an 

   * element is detected. Used in this context to parse and store

   * the acl information in class variables.

   */

  public void startElement (String uri, String localName, 

                            String qName, Attributes atts) 

         throws SAXException 

  {

    BasicNode currentNode = new BasicNode(localName);

    if (atts != null) {

      int len = atts.getLength();

      for (int i = 0; i < len; i++) {

        currentNode.setAttribute(atts.getLocalName(i), atts.getValue(i));

      }

    }

    if ( currentNode.getTagName().equals("resource") ) {

      permOrder = currentNode.getAttribute("order");

    }

    elementStack.push(currentNode); 

  }

  /**

   * callback method used by the SAX Parser when the text sequences of an 

   * xml stream are detected. Used in this context to parse and store

   * the acl information in class variables.

   */

  public void characters(char ch[], int start, int length)

         throws SAXException 

  {

    String inputString = new String(ch, start, length);

    BasicNode currentNode = (BasicNode)elementStack.peek(); 

    String currentTag = currentNode.getTagName();

    if (currentTag.equals("resourceIdentifier")) {

      resourceURL = inputString;

      resourceId = getDocid(inputString);

      // check permissions for @user on resourceId first

      // @user must have permission "all" on resourceId

      boolean hasPermission = false;

      try {

        hasPermission = hasPermission("ALL",user,resourceId);

        if ( !hasPermission && group != null ) {

          hasPermission = hasPermission("ALL",group,resourceId);

        }

      } catch (SQLException e) {

        throw new SAXException(e.getMessage());

      }

      if ( !hasPermission ) {

        throw new SAXException(

         "Permission denied for setting access control on " + resourceId);

      }

      // end of check for "all" perm on resourceId

    } else if (currentTag.equals("principalName")) {

      principalName.addElement(new String(inputString));

    } else if (currentTag.equals("permission")) {

      if ( inputString.trim().toUpperCase().equals("READ") ) {

        permission = permission | READ;

      } else if ( inputString.trim().toUpperCase().equals("WRITE") ) {

        permission = permission | WRITE;

      } else if ( inputString.trim().toUpperCase().equals("ALL") ) {

        permission = permission | ALL;

      }

    } else if (currentTag.equals("duration") && 

               beginTime == null && endTime == null ) {

      try {

        beginTime = inputString.substring(0, inputString.indexOf(" "));

        endTime = inputString.substring(inputString.indexOf(" ")+1);

      } catch (StringIndexOutOfBoundsException se) {

        beginTime = inputString;

      }

    } else if (currentTag.equals("ticketCount") && ticketCount == 0 ) {

      ticketCount = (new Integer(inputString.trim())).intValue();

    }

  }

  /**

   * callback method used by the SAX Parser when the end tag of an 

   * element is detected. Used in this context to parse and store

   * the acl information in class variables.

   */

  public void endElement (String uri, String localName, String qName)

         throws SAXException 

  {

    BasicNode leaving = (BasicNode)elementStack.pop(); 

    if ( leaving.getTagName().equals("resourceIdentifier") ) {

      try {

        // make a relationship for @aclid on @resourceId

        if ( aclid != null ) {

          insertRelation(aclid, resourceURL);

        }

      } catch (SQLException sqle) {

        throw new SAXException(sqle);

      }

    } else if ( leaving.getTagName().equals("allow") ) {

      if ( permission > 0 ) {

        // insert into db calculated permission for the list of principals

        try {

          insertPermissions("allowed");

        } catch (SQLException sqle) {

          throw new SAXException(sqle);

        }

      }

      // reset the allowed permission

      principalName = new Vector();

      permission = 0;

      beginTime = null;

      endTime = null;

      ticketCount = 0;

    } else if ( leaving.getTagName().equals("deny") ) {

      if ( permission > 0 ) {

        // insert into db calculated permission for the list of principals

        try {

          insertPermissions("denied");

        } catch (SQLException sqle) {

          throw new SAXException(sqle);

        }

      }

      // reset the denied permission

      principalName = new Vector();

      permission = 0;

      beginTime = null;

      endTime = null;

      ticketCount = 0;

    } else if ( leaving.getTagName().equals("resource") ) {

      // reset the resource identifier

      resourceId = null;

      permOrder = null;

    }

  }

  /** SAX Handler that receives notification of DOCTYPE. Sets the DTD */

  public void startDTD(String name, String publicId, String systemId) 

              throws SAXException {

    docname = name;

    doctype = publicId;

    systemid = systemId;

//    processingDTD = true;

  }

  /** 

   * SAX Handler that receives notification of the start of entities

   */

  public void startEntity(String name) throws SAXException {

    if (name.equals("[dtd]")) {

      processingDTD = true;

    }

  }

  /** 

   * SAX Handler that receives notification of the end of entities

   */

  public void endEntity(String name) throws SAXException {

    if (name.equals("[dtd]")) {

      processingDTD = false;

    }

  }

  /**

   * get the document name

   */

  public String getDocname() {

    return docname;

  }

  /**

   * get the document processing state

   */

  public boolean processingDTD() {

    return processingDTD;

  }

  /** Delete from db all permission for resources related to @aclid if any */

  private void deletePermissionsForRelatedResources(String aclid) 

          throws SQLException 

  {

    // delete all acl records for resources related to @aclid if any

    Statement stmt = conn.createStatement();

    stmt.execute("DELETE FROM xml_access WHERE accessfileid = '" + aclid + "'");

    stmt.close();

  }

  /**

   * Deletes all of the relations with a docid of @docid.

   * @param docid the docid to delete.

   */

  public void deleteRelations(String docid)

          throws SQLException 

  {

    Statement stmt = conn.createStatement();

    stmt.execute("DELETE FROM xml_relation WHERE docid='" + docid + "'");

    stmt.close();

  }

  /** Insert relationship into db for @aclid on @resourceURL  */

  private void insertRelation(String aclid, String resourceURL) 

          throws SQLException 

  {

    String aclURL = "metacat://" + server + "/?docid=" + aclid;

    // insert relationship 

    PreparedStatement pstmt;

    pstmt = conn.prepareStatement(

            "INSERT INTO xml_relation (docid,subject,relationship,object) " +

            "VALUES (?, ?, ?, ?)");

    pstmt.setString(1, aclid);

    pstmt.setString(2, aclURL);

    pstmt.setString(3, "isaclfor");

    pstmt.setString(4, resourceURL);

    pstmt.execute();

    pstmt.close();

  }

  /** Insert into db calculated permission for the list of principals */

  private void insertPermissions( String permType ) 

          throws SQLException 

  {

    PreparedStatement pstmt;

    try {

      pstmt = conn.prepareStatement(

              "INSERT INTO xml_access " + 

              "(docid, principal_name, permission, perm_type, perm_order," +

              "begin_time,end_time,ticket_count, accessfileid) VALUES " +

              "(?,?,?,?,?,to_date(?,'mm/dd/yy'),to_date(?,'mm/dd/yy'),?,?)");

      // Bind the values to the query

      pstmt.setString(1, resourceId);

      pstmt.setInt(3, permission);

      pstmt.setString(4, permType);

      pstmt.setString(5, permOrder);

      pstmt.setString(6, beginTime);

      pstmt.setString(7, endTime);

      pstmt.setString(9, aclid);

      if ( ticketCount > 0 ) {

        pstmt.setString(8, "" + ticketCount);

      } else {

        pstmt.setString(8, "");

      }

      for ( int i = 0; i < principalName.size(); i++ ) {

        pstmt.setString(2, (String)principalName.elementAt(i));

        pstmt.execute();

      }

    } catch (SQLException e) {

      throw new 

      SQLException("AccessControlList.insertPermissions(): " + e.getMessage());

    }

  }

  /** Check for @permission for @principal on @resourceId from db connection */

  public boolean hasPermission ( String permission,

                                 String principal, String resourceId )

                 throws SQLException

  {

    PreparedStatement pstmt;

    // check public access to @resourceId from xml_documents table

    if ( permission.equals("READ") ) {

      try {

        pstmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

                "WHERE docid LIKE ? AND public_access = 1");

        // Bind the values to the query

        pstmt.setString(1, resourceId);

        pstmt.execute();

        ResultSet rs = pstmt.getResultSet();

        boolean hasRow = rs.next();

        pstmt.close();

        if (hasRow) {

          return true;

        }

//System.out.println("Passed the check for public access");      

      } catch (SQLException e) {

        throw new 

        SQLException("Error checking document's public access: "

                      + e.getMessage());

      }

    }

    // since owner of resource has all permission on it,

    // check if @principal is owner of @resourceId in xml_documents table

    if ( principal != null ) {

      try {

        pstmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

                "WHERE docid LIKE ? AND user_owner LIKE ?");

        // Bind the values to the query

        pstmt.setString(1, resourceId);

        pstmt.setString(2, principal);

        pstmt.execute();

        ResultSet rs = pstmt.getResultSet();

        boolean hasRow = rs.next();

        pstmt.close();

        if (hasRow) {

          return true;

        }

//System.out.println("Passed the check for ownership");      

      } catch (SQLException e) {

        throw new 

        SQLException("AccessControlList.hasPermission(): " +

                     "Error checking document's ownership. " + e.getMessage());

      }

      // check @principal's @permission on @resourceId from xml_access table

      int accessValue = 0;

      int ticketCount = 0;

      String permOrder = "";

      try {

        pstmt = conn.prepareStatement(

                "SELECT permission, perm_order, ticket_count " +

                "FROM xml_access " +

                "WHERE docid LIKE ? " + 

                "AND principal_name LIKE ? " +

                "AND sysdate BETWEEN nvl(begin_time,sysdate) " +

                                "AND nvl(end_time,sysdate) " +

                "AND perm_type LIKE ?");

        // check if it is "denied" first

        // Bind the values to the query

        pstmt.setString(1, resourceId);

        pstmt.setString(2, principal);

        pstmt.setString(3, "denied");

        pstmt.execute();

        ResultSet rs = pstmt.getResultSet();

        boolean hasRows = rs.next();

        while ( hasRows ) {

          accessValue = rs.getInt(1);

          permOrder = rs.getString(2);

          ticketCount = rs.getInt(3);

          if ( ( accessValue & intValue(permission) ) == intValue(permission) &&

               ( permOrder.equals("allowFirst") ) &&

               ( rs.wasNull() || ticketCount > 0 ) ) {

            if ( !rs.wasNull() && ticketCount > 0 ) {

              decreaseNumberOfAccess(accessValue,principal,resourceId,"denied");

            }

            pstmt.close();

            return false;

          }

          hasRows = rs.next();

        }

//System.out.println("Passed the check for denied access");      

        // it is not denied then check if it is "allowed"

        // Bind the values to the query

        pstmt.setString(1, resourceId);

        pstmt.setString(2, principal);

        pstmt.setString(3, "allowed");

        pstmt.execute();

        rs = pstmt.getResultSet();

        hasRows = rs.next();

        while ( hasRows ) {

          accessValue = rs.getInt(1);

          ticketCount = rs.getInt(3);

          if ( ( accessValue & intValue(permission) )==intValue(permission) &&

               ( rs.wasNull() || ticketCount > 0 ) ) {

            if ( !rs.wasNull() && ticketCount > 0 ) {

              decreaseNumberOfAccess(accessValue,principal,resourceId,"allowed");

            }

            pstmt.close();

            return true;

          }

          hasRows = rs.next();

        }

//System.out.println("Passed the check for allowed access");      

        // ???

        // here there could be a check for the group's permission like 

        // selfrecursive call to hasPermission(conn,permission,group,recourceId)

        //

        pstmt.close();

        return false;

      } catch (SQLException e) {

        throw new 

        SQLException("AccessControlList.hasPermission(): " +

                     "Error checking document's permission. " + e.getMessage());

      }

    }

    return false;

  }

  /** decrease the number of access to @resourceId for @principal */

  private void decreaseNumberOfAccess(int permission, String principal,

                                      String resourceId, String permType)

               throws SQLException

  {

    PreparedStatement pstmt;

    pstmt = conn.prepareStatement(

            "UPDATE xml_access SET ticket_count = ticket_count - 1 " +

            "WHERE docid LIKE ? " +

            "AND principal_name LIKE ? " +

            "AND permission LIKE ? " +

            "AND sysdate BETWEEN nvl(begin_time,sysdate) " +

                            "AND nvl(end_time,sysdate) " +

            "AND perm_type LIKE ?");

    // Bind the values to the query

    pstmt.setString(1, resourceId);

    pstmt.setString(2, principal);

    pstmt.setInt(3, permission);

    pstmt.setString(4, permType);

    pstmt.execute();

    pstmt.close();

  }

  // get the int value of READ, WRITE or ALL

  private int intValue ( String permission )

  {

    if ( permission.equals("READ") ) {

      return READ;

    } else if ( permission.equals("WRITE") ) {

      return WRITE;

    } else if ( permission.equals("ALL") ) {

      return ALL;

    }

    return -1;

  }

  // get docid from @url

  private String getDocid ( String url ) throws SAXException

  {

    MetaCatUtil util = new MetaCatUtil();

    try {

      URL urlobj = new URL(url);

      Hashtable urlParams = util.parseQuery(urlobj.getQuery());

      if ( urlParams.containsKey("docid") ) {

        return (String)urlParams.get("docid"); // return the docid value

      } else {

        throw new 

        SAXException("\"docid\" not specified within " + url);

      }

    } catch (MalformedURLException e) {

      throw new SAXException(e.getMessage());

    }

  }  

}