/ - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 6744

Added by ben leinfelder over 12 years ago

refactor Metacat access handling to be on a per-revision basis so that it more closely aligns with the DataONE approach
http://bugzilla.ecoinformatics.org/show_bug.cgi?id=5560

     					true);
     			accessDAOList = new Vector<XMLAccessDAO>();
     			accessDAO = new XMLAccessDAO();
     			accessDAO.setDocId(docId);
     			accessDAO.setGuid(docId);
     			accessDAO.setPrincipalName(principal);
     			accessDAO.setPermission(new Long(AccessControlInterface.READ));
     			accessDAO.setPermType(AccessControlInterface.ALLOW);
-...
                     System.out.println("subAccessDAO.perm: '" + subAccessDAO.getPermission() + "'");
                     System.out.println("mainAccessDAO.perm: '" + mainAccessDAO.getPermission() + "'");*/
     				if (subAccessDAO.getDocId().equals(mainAccessDAO.getDocId()) &&
     				if (subAccessDAO.getGuid().equals(mainAccessDAO.getGuid()) &&
     						subAccessDAO.getPermOrder().equals(mainAccessDAO.getPermOrder()) &&
     						subAccessDAO.getPermType().equals(mainAccessDAO.getPermType()) &&
     						subAccessDAO.getPrincipalName().equals(mainAccessDAO.getPrincipalName()) &&
-...
     	 */
     	private void debugAccessDAOList(Vector<XMLAccessDAO> accessDAOList) {
     		for (XMLAccessDAO xmlAccessDAO : accessDAOList) {
     			debug("Doc ID:      " + xmlAccessDAO.getDocId());
     			debug("Guid:      " + xmlAccessDAO.getGuid());
     			debug("Perm Order:  " + xmlAccessDAO.getPermOrder());
     			debug("Perm Type:   " + xmlAccessDAO.getPermType());
     			debug("Principal    " + xmlAccessDAO.getPrincipalName());

      * Replication changes to support DataONE System Metadata replication
      */
     ALTER TABLE xml_replication ADD COLUMN systemmetadatareplicate INT8;
     /*
      *  Allow guid in xml_access table (for system metadata)
     */
     ALTER TABLE xml_access ADD COLUMN guid text;
     /**
      * track the user-agent for the request
-...
      */
     INSERT INTO xml_catalog (entry_type, public_id, system_id)
       VALUES ('Schema', '@eml2_1_1namespace@', '/schema/eml-2.1.1/eml.xsd');
     /**
      * Generate GUIDs for docid.rev
      */
     INSERT INTO identifier (docid, rev, guid)
     	SELECT docid, rev, docid || '.' || rev FROM xml_documents;
     INSERT INTO identifier (docid, rev, guid)
     	SELECT docid, revisionid, docid || '.' || revisionid FROM xml_revisions;
     /**
      *  Allow guid in xml_access table (for system metadata)
      */
     ALTER TABLE xml_access ADD COLUMN guid text;
     /**
      * Upgrade xml_access records to use GUID from identifier table
      */
     INSERT INTO xml_access (
     	guid, principal_name, permission, perm_type, perm_order,
     	docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
+    )
     	SELECT
     		id.guid, xa.principal_name, xa.permission, xa.perm_type, xa.perm_order,
     		xa.docid, xa.accessfileid, xa.begin_time, xa.end_time, xa.ticket_count, xa.subtreeid, xa.startnodeid, xa.endnodeid
     	FROM identifier id, xml_access xa
     	WHERE id.docid = xa.docid;
     /**
      * Include inline access rows -- they have a special guid: 'scope.docid.rev.index'
      */
     INSERT INTO xml_access (
     	guid, principal_name, permission, perm_type, perm_order,
     	docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
+    )
     	SELECT
     		docid, principal_name, permission, perm_type, perm_order,
     		docid, accessfileid, begin_time, end_time, ticket_count, subtreeid, startnodeid, endnodeid
     	FROM xml_access
     	WHERE docid like '%.%.%.%';
     /**
      * Update the accessfileid to use guid
      * TODO: specific revision should be used
      */
     UPDATE xml_access
     SET accessfileid = id.guid
     FROM identifier id, xml_access xa
     WHERE xa.accessfileid = id.docid
     /**
      * Remove old access rules
      */
     DELETE FROM xml_access WHERE guid is null;
     /**
      * clean up the xml_access table
      */
     ALTER TABLE xml_access DROP COLUMN docid;
     /*
      * update the database version
      */

src/xmltables-postgres.sql
209	209	* ACL -- table to store ACL for XML documents by principals
210	210	*/
211	211	CREATE TABLE xml_access (
212		docid VARCHAR(250), -- the document id #
213	212	guid text, -- foreign key to system metadata
214	213	accessfileid VARCHAR(250), -- the document id # for the access file
215	214	principal_name VARCHAR(100), -- name of user, group, etc.

+        {
             String allowQuery = null;
             String allowString = constructAllowString();
             allowQuery = "SELECT docid from xml_access WHERE( " + allowString;
             allowQuery = "SELECT id.docid from xml_access xa, identifier id WHERE id.guid = xa.guid AND ( " + allowString;
             allowQuery = allowQuery + ")";
             logMetacat.info("QuerySpecification.createAllowRuleQuery - allow query is: " + allowQuery);
             return allowQuery;
-...
+        {
             String denyQuery = null;
             String denyString = constructDenyString();
             denyQuery = "SELECT docid from xml_access WHERE( " + denyString;
             denyQuery = "SELECT id.docid from xml_access xa, identifier id WHERE id.guid = xa.guid AND ( " + denyString;
             denyQuery = denyQuery + ") ";
             logMetacat.info("QuerySpecification.createDenyRuleQuery - denyquery is: " + denyQuery);
             return denyQuery;

+      }
       /**
        * Returns a Vector of all the docids in the xml_path_index tables
        * Returns a Vector of all the current versions of public docids
        */
       protected Vector<String> queryAllDocids() {
         Vector<String> _docs = new Vector<String>();
-...
          * to be considered for the spatial cache
          */
         //String query = "select distinct docid from xml_path_index";
         String query = "select distinct docid from xml_access where principal_name = 'public' and perm_type = 'allow'";
         String query = "select distinct id.docid " +
         		"from xml_access xa, identifier id, xml_documents xd " +
         		"where xa.guid = id.guid " +
         		"and id.docid = xd.docid " +
         		"and id.rev = xd.rev " +
         		"and xa.principal_name = 'public' " +
         		"and xa.perm_type = 'allow'";
         try {
           pstmt = dbconn.prepareStatement(query);

     		if (isSpatialDocument) {
     			/*
     			 * Get the bounding coordinates
     			 * Get the bounding coordinates for current public revision
     			 */
     			query = "SELECT path, nodedatanumerical, parentnodeid FROM xml_path_index"
     					+ " WHERE docid = ?"
     					+ " AND docid IN (SELECT distinct docid FROM xml_access WHERE docid = ?"
     					+ " AND principal_name = 'public' AND perm_type = 'allow')"
     					+ " AND docid IN " +
     							"(SELECT distinct id.docid " +
     							"FROM identifier id, xml_access xa, xml_documents xd "
     							+ " WHERE id.docid = ?"
     							+ " AND id.docid = xd.docid "
     							+ " AND id.rev = xd.rev "
     							+ " AND id.guid = xa.guid "
     							+ " AND xa.principal_name = 'public' AND xa.perm_type = 'allow')"
     					+ " AND (path = '" + westPath + "'" + "  OR path = '" + southPath
     					+ "'" + "  OR path = '" + eastPath + "'" + "  OR path = '"
     					+ northPath + "'" + " ) ORDER BY parentnodeid;";

         ResultSet rs=null;
         //the query stirng
         String query="SELECT docid from xml_access";
         String query="SELECT id.docid from xml_access xa, identifier id where xa.guid = id.guid";
         try
+        {
           pStmt=conn.prepareStatement(query);
-...
                 docId=(String)docList.nextElement();
                 dataSetId=(String)docIdMapDataSetId.get(docId);
                 query="select accessfileid, principal_name,permission,perm_type,"
                     +"perm_order,begin_time,end_time,ticket_count from xml_access "
                     +"where docid =?";
                     +"perm_order,begin_time,end_time,ticket_count from xml_access xa, identifier id "
                     +"where id.docid = ? and id.guid = xa.guid";
                 pStmt=conn.prepareStatement(query);
                 //bind the value to query
                 pStmt.setString(1, dataSetId);

     import org.apache.log4j.Logger;
     import edu.ucsb.nceas.metacat.AccessionNumber;
     import edu.ucsb.nceas.metacat.AccessionNumberException;
     import edu.ucsb.nceas.metacat.DBUtil;
     import edu.ucsb.nceas.metacat.IdentifierManager;
     import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
     import edu.ucsb.nceas.metacat.database.DBConnection;
     import edu.ucsb.nceas.metacat.database.DBConnectionPool;
     import edu.ucsb.nceas.metacat.shared.AccessException;
-...
     public class XMLAccessAccess extends BaseAccess {
     	private Logger logMetacat = Logger.getLogger(XMLAccessAccess.class);
     	private static String DOCID = "docid";
     	private static String GUID = "guid";
     	private String idAttribute = DOCID;
     	// Constructor
     	public XMLAccessAccess() throws AccessException {}
     	public XMLAccessAccess(boolean useGuid) {
     		if (useGuid) {
     			idAttribute = GUID;
+    		}
+    	}
     	/**
     	 * Get all xml access for a document
-...
     	 *            the id of the document
     	 * @return an xml access DAO list
     	 */
     	public Vector<XMLAccessDAO> getXMLAccessForDoc(String id) throws AccessException {
     	public Vector<XMLAccessDAO> getXMLAccessForDoc(String guid) throws AccessException {
     		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
     		if (id == null) {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForDoc - doc id " +
     					"must be specified when selecting xml_access record");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForDoc");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ?";
     			String sql = "SELECT * FROM xml_access WHERE guid = ?";
     			pstmt = conn.prepareStatement(sql);
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			String sqlReport = "XMLAccessAccess.getXMLAccessForDoc - SQL: " + sql;
     			sqlReport += " [" + id + "]";
     			sqlReport += " [" + guid + "]";
     			logMetacat.info(sqlReport);
-...
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForDoc - SQL error when getting access " +
     					" for id: " + id  + " : "  + sqle.getMessage());
     					" for id: " + guid  + " : "  + sqle.getMessage());
     		} catch (PermOrderException poe) {
     			String errorStr = "XMLAccessAccess.getXMLAccessForDoc - Permission order error when getting " +
     				"access record for doc id: " + id + " : "  + poe.getMessage();
     				"access record for doc id: " + guid + " : "  + poe.getMessage();
     			logMetacat.error(errorStr);
     			throw new AccessException(errorStr);
     		} finally {
-...
     	 *            the credentials of the principal in the database
     	 * @return an xml access DAO list
     	 */
     	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String id, String principalName)
     	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String guid, String principalName)
     			throws AccessException {
     		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
     		if (id == null) {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - doc id " +
     					"must be specified when selecting xml_access record");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForPrincipal");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ?";
     			String sql = "SELECT * FROM xml_access WHERE guid = ? AND principal_name = ?";
     			pstmt = conn.prepareStatement(sql);
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, principalName);
     			String sqlReport = "XMLAccessAccess.getXMLAccessForPrincipal - SQL: " + sql;
     			sqlReport += " [" + id + "," + principalName + "]";
     			sqlReport += " [" + guid + "," + principalName + "]";
     			logMetacat.info(sqlReport);
-...
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - SQL error when getting access " +
     					" for id: " + id + ", principal: " + principalName  + " : "  + sqle.getMessage());
     					" for id: " + guid + ", principal: " + principalName  + " : "  + sqle.getMessage());
     		} catch (PermOrderException poe) {
     			String errorStr = "XMLAccessAccess.getXMLAccessForPrincipal - Permission order error when getting " +
     				"access record for id: " + id + ", principal: " + principalName + " : "  + poe.getMessage();
     				"access record for id: " + guid + ", principal: " + principalName + " : "  + poe.getMessage();
     			logMetacat.error(errorStr);
     			throw new AccessException(errorStr);
     		} finally {
-...
     	/**
     	 * Get all xml access for a principal/permType/permOrder for a certain document
+    	 *
     	 * @param id
     	 * @param guid
     	 *            the id of the document
     	 * @param principalName
     	 *            the credentials of the principal in the database
     	 * @return an xml access DAO list
     	 */
     	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String id, String principalName, String permType, String permOrder)
     	public Vector<XMLAccessDAO> getXMLAccessForPrincipal(String guid, String principalName, String permType, String permOrder)
     			throws AccessException {
     		Vector<XMLAccessDAO> xmlAccessList = new Vector<XMLAccessDAO>();
     		if (id == null) {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - doc id " +
     					"must be specified when selecting xml_access record");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.getXMLAccessForPrincipal");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ? " +
     			String sql = "SELECT * FROM xml_access WHERE guid = ? AND principal_name = ? " +
     				"AND perm_type = ? AND perm_order = ?";
     			pstmt = conn.prepareStatement(sql);
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, principalName);
     			pstmt.setString(3, permType);
     			pstmt.setString(4, permOrder);
     			String sqlReport = "XMLAccessAccess.getXMLAccessForPrincipal - SQL: " + sql;
     			sqlReport += " [" + id + "," + principalName + "," +  permType + "," + permOrder + "]";
     			sqlReport += " [" + guid + "," + principalName + "," +  permType + "," + permOrder + "]";
     			logMetacat.info(sqlReport);
-...
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.getXMLAccessForPrincipal - SQL error when getting access " +
     					" for id: " + id + ", principal: " + principalName  + " : "  + sqle.getMessage());
     					" for id: " + guid + ", principal: " + principalName  + " : "  + sqle.getMessage());
     		} catch (PermOrderException poe) {
     			String errorStr = "XMLAccessAccess.getXMLAccessForPrincipal - Permission order error when getting " +
     				"access record for id: " + id + ", principal: " + principalName + " : "  + poe.getMessage();
     				"access record for id: " + guid + ", principal: " + principalName + " : "  + poe.getMessage();
     			logMetacat.error(errorStr);
     			throw new AccessException(errorStr);
     		} finally {
-...
     	 * principal already exists, bitwise OR the permission to the existing
     	 * permission and update.
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principalName
     	 *            principal credentials
-...
     	 * @param permOrder
     	 *            permission order
     	 */
     	public void addXMLAccess(String id, String principalName, Long permission, String permType,
     	public void addXMLAccess(String guid, String principalName, Long permission, String permType,
     			String permOrder, String accessFileId, String subTreeId) throws AccessException, PermOrderException {
     		permOrderConflict(id, permOrder);
     		permOrderConflict(guid, permOrder);
     		Vector<XMLAccessDAO> xmlAccessList =
     			getXMLAccessForPrincipal(id, principalName, permType, permOrder);
     			getXMLAccessForPrincipal(guid, principalName, permType, permOrder);
     		// if more than one record exists for this principal on this document with the same
     		// access type / access order combination, call cleanup to combine common access and then
     		// re-retrieve the access list.
     		if (xmlAccessList.size() == 0) {
     			insertXMLAccess(id, principalName, permission, permType, permOrder, accessFileId, subTreeId);
     			insertXMLAccess(guid, principalName, permission, permType, permOrder, accessFileId, subTreeId);
     			return;
+    		}
     		if (xmlAccessList.size() > 1) {
     			cleanupXMLAccessForPrincipal(xmlAccessList);
     			xmlAccessList = getXMLAccessForPrincipal(id, principalName, permType, permOrder);
     			xmlAccessList = getXMLAccessForPrincipal(guid, principalName, permType, permOrder);
+    		}
     		if (xmlAccessList.size() == 0) {
     			throw new AccessException("XMLAccessAccess.addXMLAccess - xml access list is empty when " +
     				"it shouldn't be for id: " + id + ", prinicpal name: " + principalName + ", perm type " +
     				"it shouldn't be for id: " + guid + ", prinicpal name: " + principalName + ", perm type " +
     				permType + ", perm order: " + permOrder);
+    		}
-...
     		//trying to add, update the access record with the existing permission bitwis OR-ed with our
     		// new permission
     		if ((xmlAccessDAO.getPermission() & permission) != permission) {
     			updateXMLAccessPermission(id, principalName, xmlAccessDAO.getPermission() | permission);
     			updateXMLAccessPermission(guid, principalName, xmlAccessDAO.getPermission() | permission);
+    		}
+    	}
-...
     	 * @param xmlAccessList
     	 *            list of xml access dao objects that hold new access for the document
     	 */
     	public void replaceAccess(String id, List<XMLAccessDAO> xmlAccessList) throws AccessException {
     		deleteXMLAccessForDoc(id);
     	public void replaceAccess(String guid, List<XMLAccessDAO> xmlAccessList) throws AccessException {
     		deleteXMLAccessForDoc(guid);
     		insertAccess(guid, xmlAccessList);
+    	}
     	/**
     	 * Set permissions for a given document. This means first removing all access control for the
     	 * document and then adding the given rules.
+    	 *
     	 * @param id
     	 *            document id
     	 * @param xmlAccessList
     	 *            list of xml access dao objects that hold new access for the document
     	 */
     	public void insertAccess(String guid, List<XMLAccessDAO> xmlAccessList) throws AccessException {
     		// if more than one record exists for this principal on this document with the same
     		// access type / access order combination, call cleanup to combine common access and then
     		// re-retrieve the access list.
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			insertXMLAccess(id, xmlAccessDAO.getPrincipalName(), xmlAccessDAO.getPermission(),
     			insertXMLAccess(guid, xmlAccessDAO.getPrincipalName(), xmlAccessDAO.getPermission(),
     					xmlAccessDAO.getPermType(), xmlAccessDAO.getPermOrder(), xmlAccessDAO.getAccessFileId(), xmlAccessDAO.getSubTreeId());
+    		}
+    	}
-...
     	 * @param permOrder
     	 *            permission order
     	 */
     	private void insertXMLAccess(String id, String principalName, Long permission, String permType,
     	private void insertXMLAccess(String guid, String principalName, Long permission, String permType,
     			String permOrder, String accessFileId, String subTreeId) throws AccessException {
     	    //System.out.println("permission in insertXMLAccess: " + permission);
     	    try
-...
     	        logMetacat.warn(e.getMessage());
+    	    }
     		if (id == null) {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.insertXMLAccess - id is required when " +
     					"inserting XML access record");
+    		}
-...
     			serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "INSERT INTO xml_access " +
     				"(docid, guid, principal_name, permission, perm_type, perm_order, accessfileid, subtreeid ) " +
     				"VALUES (?,?,?,?,?,?,?,?)";
     				"(guid, principal_name, permission, perm_type, perm_order, accessfileid, subtreeid ) " +
     				"VALUES (?,?,?,?,?,?,?)";
     			pstmt = conn.prepareStatement(sql);
     			String guid = null;
     			String docid = null;
     			if (idAttribute.equals(GUID)) {
     				guid = id;
     				try {
     					String localId = IdentifierManager.getInstance().getLocalId(id);
     					// Parse the localId into scope and rev parts, strip off the rev
     		            AccessionNumber acc = new AccessionNumber(localId, "NOACTION");
     		            docid = acc.getDocid();
     				} catch (McdbDocNotFoundException e) {
     					//ignore
     					logMetacat.warn("No local id mapping found for guid: " + id);
     				} catch (NumberFormatException e) {
                         logMetacat.warn("LocalId could not be parsed for guid: " + id);
                     } catch (AccessionNumberException e) {
                         logMetacat.warn("LocalId could not be parsed for guid: " + id);
+                    }
     			} else {
     				int rev = DBUtil.getLatestRevisionInDocumentTable(id);
     				try {
     					guid = IdentifierManager.getInstance().getGUID(id, rev);
     				} catch (McdbDocNotFoundException e) {
     					//ignore
     					logMetacat.warn("No guid mapping found for docid: " + id + "." + rev);
+    				}
     				docid = id;
+    			}
     			// Bind the values to the query
     			pstmt.setString(1, docid);
     			pstmt.setString(2, guid);
     			pstmt.setString(3, principalName);
     			pstmt.setLong(4, permission);
     			pstmt.setString(5, permType);
     			pstmt.setString(6, permOrder);
     			pstmt.setString(7, accessFileId);
     			pstmt.setString(8, subTreeId);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, principalName);
     			pstmt.setLong(3, permission);
     			pstmt.setString(4, permType);
     			pstmt.setString(5, permOrder);
     			pstmt.setString(6, accessFileId);
     			pstmt.setString(7, subTreeId);
     			String sqlReport = "XMLAccessAccess.insertXMLAccess - SQL: " + sql;
     			sqlReport += " [" + docid + "," + guid + "," + principalName + "," +  permission + "," +  permType + "," + permOrder + "]";
     			sqlReport += " [" + guid + "," + principalName + "," +  permission + "," +  permType + "," + permOrder + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.insertXMLAccess - SQL error when inserting"
     					+ "xml access permissions for id: " + id + ", principal: " +
     					+ "xml access permissions for id: " + guid + ", principal: " +
     					principalName + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
-...
     	 * Update existing xml access permissions in the db.  The permission value should be the combined
     	 * value of pre-existing permissions plus new permissions.
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principalName
     	 *            principal credentials
     	 * @param permission
     	 *            permission bitmap
     	 */
     	private void updateXMLAccessPermission(String id, String principalName, Long permission)
     	private void updateXMLAccessPermission(String guid, String principalName, Long permission)
     			throws AccessException {
     		if (id == null) {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.updateXMLAccessPermission - id is required when " +
     					"updating XML access record");
+    		}
-...
     			serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "UPDATE xml_access SET permission = ?" +
     				"WHERE " + idAttribute + " = ? AND principal_name = ?";
     				"WHERE guid = ? AND principal_name = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setLong(1, permission);
     			pstmt.setString(2, id);
     			pstmt.setString(2, guid);
     			pstmt.setString(3, principalName);
     			String sqlReport = "XMLAccessAccess.updateXMLAccessPermission - SQL: " + sql;
     			sqlReport += " [" + permission + "," + id + "," + principalName + "]";
     			sqlReport += " [" + permission + "," + guid + "," + principalName + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.updateXMLAccessPermission - SQL error when updating"
     					+ "xml access permissions for id: " + id + ", principal: " +
     					+ "xml access permissions for id: " + guid + ", principal: " +
     					principalName + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
-...
     	 * for a given document.  If the provided permission is exactly the same as what
     	 * the principal has, the record is deleted from the database.
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principalName
     	 *            principal credentials
     	 */
     	public void removeXMLAccessForPrincipal(String id, String principalName, Long permission) throws AccessException {
     		if (id == null) {
     	public void removeXMLAccessForPrincipal(String guid, String principalName, Long permission) throws AccessException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.removeXMLAccessForPrincipal - id is required when " +
     					"removing XML access");
+    		}
-...
     					"updating XML access");
+    		}
     		Vector<XMLAccessDAO> xmlAccessList = getXMLAccessForPrincipal(id, principalName);
     		Vector<XMLAccessDAO> xmlAccessList = getXMLAccessForPrincipal(guid, principalName);
     		if (xmlAccessList.size() == 0) {
     			logMetacat.warn("XMLAccessAccess.removeXMLAccessForPrincipal - attempting to remove access when no " +
     				"access record exists for id: " + id + ", principal: " + principalName);
     				"access record exists for id: " + guid + ", principal: " + principalName);
     		} else {
     			long permissionMask = 0;
     			for (XMLAccessDAO xmlAccessDAO : xmlAccessList) {
-...
     			// in this case, the only existing permissions are the ones we want to remove, so
     			// delete the record(s) for this principal on this document
     			if ((permissionMask & permission) == permission) {
     				deleteXMLAccessForPrincipal(id, principalName);
     				deleteXMLAccessForPrincipal(guid, principalName);
+    			}
     			if (xmlAccessList.size() > 1) {
     			} else {
     				updateXMLAccessPermission(id, principalName, permission);
     				updateXMLAccessPermission(guid, principalName, permission);
+    			}
+    		}
-...
     	 * @param id
     	 *            document id
     	 */
     	public void deleteXMLAccessForDoc(String id) throws AccessException {
     		if (id == null) {
     	public void deleteXMLAccessForDoc(String guid) throws AccessException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " +
     					"deleting XML access record");
+    		}
-...
     		int serialNumber = -1;
     		try {
     			String guid = null;
     			String docid = null;
     			if (idAttribute.equals(GUID)) {
     				guid = id;
     				try {
     					String localId = IdentifierManager.getInstance().getLocalId(id);
     					// Parse the localId into scope and rev parts, strip off the rev
     		            AccessionNumber acc = new AccessionNumber(localId, "NOACTION");
     		            docid = acc.getDocid();
     				} catch (McdbDocNotFoundException e) {
     					//ignore
     					logMetacat.warn("No local id mapping found for guid: " + id);
     				} catch (NumberFormatException e) {
                         logMetacat.warn("LocalId could not be parsed for guid: " + id);
                     } catch (AccessionNumberException e) {
                         logMetacat.warn("LocalId could not be parsed for guid: " + id);
+                    }
     			} else {
     				int rev = DBUtil.getLatestRevisionInDocumentTable(id);
     				try {
     					guid = IdentifierManager.getInstance().getGUID(id, rev);
     				} catch (McdbDocNotFoundException e) {
     					//ignore
     					logMetacat.warn("No guid mapping found for docid: " + id + "." + rev);
+    				}
     				docid = id;
+    			}
     			// check out DBConnection
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForDoc");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "DELETE FROM xml_access WHERE docid = ? OR guid = ?";
     			String sql = "DELETE FROM xml_access WHERE guid = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, docid);
     			pstmt.setString(2, guid);
     			pstmt.setString(1, guid);
     			String sqlReport = "XMLAccessAccess.deleteXMLAccessForDoc - SQL: " + sql;
     			sqlReport += " [" + id + "]";
     			sqlReport += " [" + guid + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when deleting"
     					+ "xml access permissions for id: " + id + ":" + sqle.getMessage());
     					+ "xml access permissions for id: " + guid + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
+    		}
-...
     	 * Delete xml access.  This removes all access records from the database for a principal
     	 * for a given document
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principal
     	 *            principal credentials
     	 */
     	private void deleteXMLAccessForPrincipal(String id, String principalName) throws AccessException {
     		if (id == null) {
     	private void deleteXMLAccessForPrincipal(String guid, String principalName) throws AccessException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " +
     					"deleting XML access record");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForPrincipal");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "DELETE FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ?";
     			String sql = "DELETE FROM xml_access WHERE guid = ? AND principal_name = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, principalName);
     			String sqlReport = "XMLAccessAccess.deleteXMLAccessForPrincipal - SQL: " + sql;
     			sqlReport += " [" + id + "," + principalName + "]";
     			sqlReport += " [" + guid + "," + principalName + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - SQL error when deleting"
     					+ "xml access permissions for id: " + id + ", principal: " +
     					+ "xml access permissions for id: " + guid + ", principal: " +
     					principalName + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
-...
+    	}
     	/**
     	 * Delete xml access.  This removes all access records from the database for a principal
     	 * for a given document
+    	 *
     	 * @param guid
     	 *            document id
     	 * @param principal
     	 *            principal credentials
     	 */
     	public void deleteXMLAccessForDoc(String guid, String permType) throws AccessException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - id is required when " +
     					"deleting XML access record");
+    		}
     		if (permType == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - permType is required when " +
     					"deleting XML access record");
+    		}
     	    PreparedStatement pstmt = null;
     		DBConnection conn = null;
     		int serialNumber = -1;
     		try {
     			// check out DBConnection
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForDoc");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "DELETE FROM xml_access WHERE guid = ? AND perm_type = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, guid);
     			pstmt.setString(2, permType);
     			String sqlReport = "XMLAccessAccess.deleteXMLAccessForDoc - SQL: " + sql;
     			sqlReport += " [" + guid + "," + permType + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForDoc - SQL error when deleting"
     					+ "xml access permissions for id: " + guid + ", permType: " +
     					permType + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
+    		}
+    	}
     	/**
     	 * Checks to see if there is a permission order conflict for a given document.  Each
     	 * document is only allowed to have a single permission order
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principal
     	 *            principal credentials
     	 */
     	private void permOrderConflict(String id, String permOrder) throws AccessException, PermOrderException {
     		if (id == null) {
     	private void permOrderConflict(String guid, String permOrder) throws AccessException, PermOrderException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.permOrderConflict - id is required when " +
     					"determining perm order conflict");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.permOrderConflict");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "SELECT * FROM xml_access WHERE " + idAttribute + " = ? AND perm_order != ?";
     			String sql = "SELECT * FROM xml_access WHERE guid = ? AND perm_order != ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, permOrder);
     			String sqlReport = "XMLAccessAccess.permOrderConflict - SQL: " + sql;
     			sqlReport += " [" + id + "," + permOrder + "]";
     			sqlReport += " [" + guid + "," + permOrder + "]";
     			logMetacat.info(sqlReport);
-...
     			ResultSet resultSet = pstmt.getResultSet();
     			if (resultSet.next()) {
     				throw new PermOrderException("XMLAccessAccess.addXMLAccess - cannot add permission " +
     					"record for id: " + id + "with permOrder: " + permOrder + " due to permOrder conflict");
     					"record for id: " + guid + "with permOrder: " + permOrder + " due to permOrder conflict");
+    			}
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.permOrderConflict - SQL error when checking"
     					+ "for perm order conflict on: " + id + ":" + sqle.getMessage());
     					+ "for perm order conflict on: " + guid + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
+    		}
-...
     	 * Delete xml access.  This removes all access records from the database for a principal
     	 * for a given document, perm type and perm order
+    	 *
     	 * @param id
     	 * @param guid
     	 *            document id
     	 * @param principal
     	 *            principal credentials
     	 */
     	private void deleteXMLAccessForPrincipal(String id, String principalName, String permType, String permOrder) throws AccessException {
     		if (id == null) {
     	private void deleteXMLAccessForPrincipal(String guid, String principalName, String permType, String permOrder) throws AccessException {
     		if (guid == null) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - id is required when " +
     					"deleting XML access record");
+    		}
-...
     			conn = DBConnectionPool.getDBConnection("XMLAccessAccess.deleteXMLAccessForPrincipal");
         		serialNumber = conn.getCheckOutSerialNumber();
     			String sql = "DELETE FROM xml_access WHERE " + idAttribute + " = ? AND principal_name = ? " +
     			String sql = "DELETE FROM xml_access WHERE guid = ? AND principal_name = ? " +
     				"AND perm_type = ? AND perm_order = ?";
     			pstmt = conn.prepareStatement(sql);
     			// Bind the values to the query
     			pstmt.setString(1, id);
     			pstmt.setString(1, guid);
     			pstmt.setString(2, principalName);
     			pstmt.setString(3, permType);
     			pstmt.setString(4, permOrder);
     			String sqlReport = "XMLAccessAccess.deleteXMLAccessForPrincipal - SQL: " + sql;
     			sqlReport += " [" + id + "," + principalName + "," + permType + "," + permOrder + "]";
     			sqlReport += " [" + guid + "," + principalName + "," + permType + "," + permOrder + "]";
     			logMetacat.info(sqlReport);
     			pstmt.execute();
     		} catch (SQLException sqle) {
     			throw new AccessException("XMLAccessAccess.deleteXMLAccessForPrincipal - SQL error when deleting"
     					+ "xml access permissions for id: " + id + ", principal: " +
     					+ "xml access permissions for id: " + guid + ", principal: " +
     					principalName + ":" + sqle.getMessage());
     		} finally {
     			closeDBObjects(pstmt, conn, serialNumber, logMetacat);
-...
     		int numDenyRecords = 0;
     		long allowPermissionMask = 0;
     		long denyPermissionMask = 0;
     		String id = null;
     		String guid = null;
     		String principalName = null;
     		String permType = null;
     		String permOrder = null;
-...
     		// iterate through the list of access dao objects and bttwise or the permissions.  Most
     		// of this is just doing some error checking to make sure each record is valid.
     		for (XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			String daoId = xmlAccessDAO.getDocId();
     			if (idAttribute.equals(GUID)) {
     				daoId = xmlAccessDAO.getGuid();
+    			}
     			if (id == null) {
     				id = daoId;
     			String daoId = xmlAccessDAO.getGuid();
     			if (guid == null) {
     				guid = daoId;
     			} else {
     				if (!id.equals(daoId)) {
     				if (!guid.equals(daoId)) {
     					throw new AccessException("XMLAccessAccess.cleanupXMLAccessForPrincipal - " +
     							" Conflicting ids " + daoId + " and " + id);
     							" Conflicting ids " + daoId + " and " + guid);
+    				}
+    			}
     			if (principalName == null) {
-...
     		// if there was more than one allow record, remove all allow records for this user on this doc
     		// with this perm type and perm order then insert a single record
     		if (numAllowRecords > 1) {
     			deleteXMLAccessForPrincipal(id, principalName, AccessControlInterface.ALLOW, permOrder);
     			insertXMLAccess(id, principalName, allowPermissionMask, AccessControlInterface.ALLOW, permOrder, accessFileId, subTreeId);
     			deleteXMLAccessForPrincipal(guid, principalName, AccessControlInterface.ALLOW, permOrder);
     			insertXMLAccess(guid, principalName, allowPermissionMask, AccessControlInterface.ALLOW, permOrder, accessFileId, subTreeId);
+    		}
     		// if there was more than one deny record, remove all deny records for this user on this doc
     		// with this perm type and perm order then insert a single record
     		if (numDenyRecords > 1) {
     			deleteXMLAccessForPrincipal(id, principalName, AccessControlInterface.DENY, permOrder);
     			insertXMLAccess(id, principalName, denyPermissionMask, AccessControlInterface.DENY, permOrder, accessFileId, subTreeId);
     			deleteXMLAccessForPrincipal(guid, principalName, AccessControlInterface.DENY, permOrder);
     			insertXMLAccess(guid, principalName, denyPermissionMask, AccessControlInterface.DENY, permOrder, accessFileId, subTreeId);
+    		}
+    	}
-...
     	private void validateDocXMLAccessList(Vector<XMLAccessDAO> xmlAccessList) throws PermOrderException {
     		String permOrder = null;
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			String daoId = xmlAccessDAO.getDocId();
     			if (idAttribute.equals(GUID)) {
     				daoId = xmlAccessDAO.getGuid();
+    			}
     			String daoId = xmlAccessDAO.getGuid();
     			if (permOrder == null) {
     				permOrder = xmlAccessDAO.getPermOrder();
     			} else {
-...
     		boolean allowFirst = false;
     		boolean denyFirst = false;
     		String id = null;
     		String guid = null;
     		// These vectors will hold all combinations of access DAOs with different permission
     		// orders and permission types.
-...
     		// sort the access dao records into the appropriate vector
     		for(XMLAccessDAO xmlAccessDAO : xmlAccessList) {
     			String daoId = xmlAccessDAO.getDocId();
     			if (idAttribute.equals(GUID)) {
     				daoId = xmlAccessDAO.getGuid();
     			String daoId = xmlAccessDAO.getGuid();
     			if (guid == null) {
     				guid = daoId;
+    			}
     			if (id == null) {
     				id = daoId;
+    			}
     			if (xmlAccessDAO.getPermOrder().equals(AccessControlInterface.ALLOWFIRST)) {
     				allowFirst = true;
     				if (xmlAccessDAO.getPermType().equals(AccessControlInterface.ALLOW)) {
-...
     		// document
     		if(allowFirst && denyFirst) {
     			throw new PermOrderException("XMLAccessAccess.validatePrincipalXMLAccessList - " +
     					" Conflicting permission orders for document " + id +
     					" Conflicting permission orders for document " + guid +
     					". Database intervention required ");
+    		}
+    	}
-...
     	protected XMLAccessDAO populateDAO(ResultSet resultSet) throws SQLException {
     		XMLAccessDAO xmlAccessDAO = new XMLAccessDAO();
     		xmlAccessDAO.setDocId(resultSet.getString(idAttribute));
     		xmlAccessDAO.setGuid(resultSet.getString("guid"));
     		xmlAccessDAO.setAccessFileId(resultSet.getString("accessfileid"));
     		xmlAccessDAO.setPrincipalName(resultSet.getString("principal_name"));
     		xmlAccessDAO.setPermission(resultSet.getLong("permission"));

      */
     public class XMLAccessDAO extends BaseDAO {
     	private String _docId = null;
     	private String _guid = null;
     	private String _accessFileId = null;
     	private String _principalName = null;
-...
     	private String _subTreeId = null;
     	private String _startNodeId = null;
     	private String _endNodeId = null;
     	public String getDocId() {
     		return _docId;
+    	}
     	public void setDocId(String docId) {
     		if (docId != null && docId.equals("")) {
     			docId = null;
     		} else {
     			_docId = docId;
+    		}
+    	}
     	public String getGuid() {
     		return _guid;
+    	}

     import org.xml.sax.XMLReader;
     import org.xml.sax.helpers.XMLReaderFactory;
     import edu.ucsb.nceas.metacat.DBUtil;
     import edu.ucsb.nceas.metacat.DocInfoHandler;
     import edu.ucsb.nceas.metacat.IdentifierManager;
     import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
     import edu.ucsb.nceas.metacat.McdbException;
     import edu.ucsb.nceas.metacat.PermissionController;
     import edu.ucsb.nceas.metacat.database.DBConnection;
-...
     public class AccessControlForSingleFile implements AccessControlInterface
+    {
       private String _docId;
       private String _guid;
       private Logger logMetacat = Logger.getLogger(AccessControlForSingleFile.class);
         /**
     	 * Construct an instance of the AccessControlForSingleFile class.  This
-...
     	public AccessControlForSingleFile(String accessionNumber)
     			throws AccessControlException {
     		// Get rid of dev if myaccessNumber has one;
     		_docId = DocumentUtil.getDocIdFromString(accessionNumber);
     		if (_docId == null || _docId.equals("")) {
     			throw new AccessControlException("AccessControlForSingleFile() - Accession number "
     							+ "can't be null in constructor");
     		// this is a local metacat id
     		String docid = DocumentUtil.getDocIdFromString(accessionNumber);
     		// get the revision
     		String revision = DocumentUtil.getRevisionStringFromString(accessionNumber);
     		int rev = -1;
     		if (revision != null) {
     			// we were given it
     			rev = Integer.valueOf(revision);
     		} else {
     			// look up the latest
     			try {
     				rev = DBUtil.getLatestRevisionInDocumentTable(docid);
     			} catch (SQLException e) {
     				AccessControlException ace = new AccessControlException(e.getMessage());
     				ace.initCause(e);
     				throw ace;
+    			}
     			if (rev <= 0) {
     				// look in the revisions table
     				try {
     					rev = DBUtil.getMaxRevFromRevisionTable(docid);
     				} catch (SQLException e) {
     					AccessControlException ace = new AccessControlException(e.getMessage());
     					ace.initCause(e);
     					throw ace;
+    				}
+    			}
+    		}
     		// find the guid for this docid.rev
     		try {
     			_guid = IdentifierManager.getInstance().getGUID(docid, rev);
     		} catch (McdbDocNotFoundException e) {
     			AccessControlException ace = new AccessControlException(e.getMessage());
     			ace.initCause(e);
     			throw ace;
+    		}
     		// couldn't find it?
     		if (_guid == null || _guid.equals("")) {
     			throw new AccessControlException("Guid cannot be null");
+    		}
     		logMetacat.debug("AccessControlForSingleFile() - docid: " + _docId);
     		logMetacat.debug("AccessControlForSingleFile() - docid: " + _guid);
+    	}
       	/**
-...
     			// doc id.
     			XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
     			//System.out.println("permission in accessControlForSingleFile.insertPermissions: " + permission);
     			xmlAccessAccess.addXMLAccess(_docId, principalName, new Long(permission), permType, permOrder, accessFileId, subTreeId);
     			xmlAccessAccess.addXMLAccess(_guid, principalName, new Long(permission), permType, permOrder, accessFileId, subTreeId);
     		} catch (AccessException ae) {
     			throw new AccessControlException("AccessControlForSingleFile.insertPermissions - "
     					+ "DB access error when inserting permissions: " + ae.getMessage());
-...
     		try {
     			// use DocInfoHandler to parse the access section into DAO objects
     			XMLReader parser = null;
     			DocInfoHandler docInfoHandler = new DocInfoHandler(_docId);
     			DocInfoHandler docInfoHandler = new DocInfoHandler(_guid);
     			ContentHandler chandler = docInfoHandler;
     			// Get an instance of the parser
-...
     			// replace all access on the document
     	        Vector<XMLAccessDAO> accessControlList = docInfoHandler.getAccessControlList();
     	        xmlAccessAccess.replaceAccess(_docId, accessControlList);
     	        xmlAccessAccess.replaceAccess(_guid, accessControlList);
     		} catch (PropertyNotFoundException pnfe) {
     			throw new AccessControlException("AccessControlForSingleFile.insertPermissions - "
-...
     				"AND perm_order = ? ");
     			// Bind the values to the query
     			pstmt.setString(1, _docId);
     			pstmt.setString(1, _guid);
     			pstmt.setString(2, xmlAccessDAO.getPrincipalName());
     			pstmt.setLong(3, xmlAccessDAO.getPermission());
     			pstmt.setString(4, xmlAccessDAO.getPermType());
-...
     		try {
     			hasPermission = isOwned(user);
     			if (!hasPermission) {
     				PermissionController controller = new PermissionController(_docId);
     				PermissionController controller = new PermissionController(_guid);
     				hasPermission =
     					controller.hasPermission(user, groups, READSTRING);
+    			}
-...
     			if (hasPermission) {
     				// Get a list of all access dao objects for this docid
     				XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
     				Vector<XMLAccessDAO> xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_docId);
     				Vector<XMLAccessDAO> xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_guid);
     				output.append(getAccessString(xmlAccessDAOList));
     			} else {
     				output.append(getAccessString(new Vector<XMLAccessDAO>()));
-...
     		try {
     			// Get a list of all access dao objects for this docid
     			XMLAccessAccess xmlAccessAccess = new XMLAccessAccess();
     			xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_docId);
     			xmlAccessDAOList = xmlAccessAccess.getXMLAccessForDoc(_guid);
     		} catch (AccessException ae) {
     				throw new AccessControlException("AccessControlForSingleFile.getAccessString() - DB access error when " +
     						"getting access string: " + ae.getMessage());
-...
     			subtreeid = xmlAccessDAOList.get(0).getSubTreeId();
+    		}
     		output.append("<access authSystem=\"knb\" order=\"" + permOrder + "\" id=\"" + _docId + "\" scope=\"document\"");
     		output.append("<access authSystem=\"knb\" order=\"" + permOrder + "\" id=\"" + _guid + "\" scope=\"document\"");
     		if (accessfileid != null) {
     			output.append(" accessfileid=\"" + accessfileid + "\"");
+    		}
-...
     			serialNumber = conn.getCheckOutSerialNumber();
     			pstmt = conn.prepareStatement("SELECT 'x' FROM xml_documents "
     					+ "WHERE docid = ? " + "AND user_owner = ?");
     			pstmt.setString(1, _docId);
     			pstmt.setString(1, _guid);
     			pstmt.setString(2, user);
     			pstmt.execute();
     			ResultSet rs = pstmt.getResultSet();

     import com.oreilly.servlet.multipart.Part;
     import edu.ucsb.nceas.metacat.DocInfoHandler;
     import edu.ucsb.nceas.metacat.IdentifierManager;
     import edu.ucsb.nceas.metacat.McdbDocNotFoundException;
     import edu.ucsb.nceas.metacat.accesscontrol.AccessControlException;
     import edu.ucsb.nceas.metacat.accesscontrol.AccessControlForSingleFile;
     import edu.ucsb.nceas.metacat.accesscontrol.AccessControlInterface;
-...
+        }
         private String setPublicAccess(String permissionType, String metaDocId, Stack docIdStack)
         throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException{
         throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException, McdbDocNotFoundException{
             String                      result = " for Documents ";
             String                      docId, lst = metaDocId, permOrder;
-...
          * Second, remove all access rules of the user public, then add the new rules.
          */
         private void setPublicReadAccess(String permissionType, String docid)
             throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException{
             throws InsufficientKarmaException, MetacatException, MetacatInaccessibleException, AccessControlException, McdbDocNotFoundException{
           String originalAccessBlock = getMetacatClient().getAccessControl(docid);
           Vector<XMLAccessDAO> accessList = parseAccessXMLBlock(docid, originalAccessBlock);
           if(accessList != null  && !accessList.isEmpty()) {
-...
          * Populate xmlAccessDAO object with the some parameters.
          */
         private XMLAccessDAO generateXMLAccessDAO(String docid, String principalName,
             String permission, String permType, String permOrder) {
           String identifier = DocumentUtil.getDocIdFromString(docid);
             String permission, String permType, String permOrder) throws McdbDocNotFoundException {
           String localId = DocumentUtil.getDocIdFromString(docid);
           int rev = DocumentUtil.getRevisionFromAccessionNumber(docid);
           String identifier = IdentifierManager.getInstance().getGUID(localId, rev);
           XMLAccessDAO xmlAccessDAO = new XMLAccessDAO();
           xmlAccessDAO.setDocId(identifier);
           xmlAccessDAO.setGuid(identifier);
           xmlAccessDAO.setPrincipalName(principalName);
           xmlAccessDAO.setPermission(Integer.valueOf(AccessControlList.intValue(permission)).longValue());
           xmlAccessDAO.setPermType(permType);

     public class PermissionController
+    {
        private String docId = null;
     //   private String docId = null;
     //   private int rev = -1;
        private String guid = null;
        private boolean hasSubTreeAccessControl = false; // flag if has a subtree
                                                         // access for this docid
        private Vector subTreeList = new Vector();
-...
        private static Logger logMetacat = Logger.getLogger(PermissionController.class);
        /**
         * Constructor for PermissionController
         * @param myDocid      the docid need to access
         */
        public PermissionController(String myDocid) throws McdbException
+       {
          // Get rid of rev number
          docId = DocumentUtil.getSmartDocId(myDocid);
          //hasSubTreeAccessControl = checkSubTreeAccessControl();
+       }
     	 * Constructor for PermissionController
+    	 *
     	 * @param myDocid the docid need to access
     	 */
     	public PermissionController(String myDocid) throws McdbException {
        /**
         * Constructor for PermssionController
         * @param myDocid String
         * @param needDeleteRev boolean
         */
        public PermissionController(String myDocid, boolean needDeleteRevFromDocid)
+       {
          if (!needDeleteRevFromDocid)
+         {
            docId = myDocid;
+         }
          else
+         {
              docId = DocumentUtil.getDocIdFromAccessionNumber(myDocid);
+         }
+       }
     		// find the guid if we can
     		String docId = null;
     		int rev = -1;
     		// get the parts
     		docId = DocumentUtil.getSmartDocId(myDocid);
     		rev = DocumentUtil.getRevisionFromAccessionNumber(myDocid);
     		// this is what we really want
     		guid = IdentifierManager.getInstance().getGUID(docId, rev);
+    	}
        /**
         * Return if a document has subtree access control
         */
-...
         //if the requested document is access documents and requested permission
         //is "write", the user should have "all" right
         if (isAccessDocument(docId) && (permission == AccessControlInterface.WRITE))
         if (isAccessDocument() && (permission == AccessControlInterface.WRITE))
+        {
           hasPermission = hasPermission(userPackage,docId, 7);// 7 is all permission
           hasPermission = hasPermission(userPackage, 7);// 7 is all permission
         }//if
         else //in other situation, just check the request permission
+        {
           // Check for @permission on @docid for @user and/or @groups
           hasPermission = hasPermission(userPackage,docId, permission);
           hasPermission = hasPermission(userPackage, permission);
         }//else
         return hasPermission;
-...
         * @param docid, document identifier to check on
         * @param permission, permission (write or all...) to check for
         */
       private boolean hasPermission(String [] principals, String docId,
                                                int permission)
       private boolean hasPermission(String [] principals, int permission)
                              throws SQLException
+      {
         long startId = TOPLEVELSTARTNODEID;// this is for top level, so startid is 0
-...
+        {
           //first, if there is a docid owner in user package, return true
           //because doc owner has all permssion
           if (containDocumentOwner(principals, docId))
           if (containDocumentOwner(principals))
+          {
               return true;
-...
           //If there is no owner in user package, checking the table
           //check perm_order
           if (isAllowFirst(principals, docId, startId))
           if (isAllowFirst(principals, startId))
+          {
             if (hasExplicitDenyRule(principals, docId, permission, startId))
             if (hasExplicitDenyRule(principals, permission, startId))
+            {
               //if it is allowfirst and has deny rule(either explicit )
               //deny access
               return false;
             }//if
             else if ( hasAllowRule(principals, docId, permission, startId))
             else if ( hasAllowRule(principals, permission, startId))
+            {
               //if it is allowfirst and hasn't deny rule and has allow rule
               //allow access
-...
          }//if isAllowFirst
          else //denyFirst
+         {
            if (hasAllowRule(principals, docId, permission, startId))
            if (hasAllowRule(principals, permission, startId))
+           {
              //if it is denyFirst and has allow rule, allow access
              return true;
-...
          // from inlinedataId directly. You should get it from eml document itself
          String []userPackage = createUsersPackage(user, groups);
          try {
             if (containDocumentOwner(userPackage, docId))
             if (containDocumentOwner(userPackage))
+             {
                return true;
+             }
              else
+             {
                  PermissionController controller =
                                        new PermissionController(inlineDataId, false);
             	 // is a funky inline data id with the extra part, so we set it manually
                  PermissionController controller = new PermissionController(guid);
                  controller.guid = inlineDataId;
                  return controller.hasPermission(user, groups, myPermission);
+             }
         } catch (SQLException e) {
-...
         //for the document owner return null(no unaccessable subtree)
         try
+        {
           if (containDocumentOwner(principals, docId))
           if (containDocumentOwner(principals))
+          {
            return resultUnaccessableSubTree;
+          }
-...
             try
+            {
               if (isAllowFirst(principals, docId, startId))
               if (isAllowFirst(principals, startId))
+              {
                 if (hasExplicitDenyRule(principals, docId, permission, startId ))
                 if (hasExplicitDenyRule(principals, permission, startId ))
+                {
                  //if it is allowfirst and has deny rule
-...
                     resultUnaccessableSubTree.put(new Long(startId), tree);
+                  }
                 }//if
                 else if ( hasAllowRule(principals, docId, permission, startId))
                 else if ( hasAllowRule(principals, permission, startId))
+                {
                   //if it is allowfirst and hasn't deny rule and has allow rule
                   //allow access do nothing
-...
               }//if isAllowFirst
               else //denyFirst
+              {
                 if (hasAllowRule(principals, docId, permission,startId))
                 if (hasAllowRule(principals, permission,startId))
+                {
                   //if it is denyFirst and has allow rule, allow access, do nothing
-...
     	 * @param docId,
     	 *            the document id need to be checked
     	 */
     	private boolean isAccessDocument(String docId) throws SQLException {
     		// detele the rev number if docid contains it
     	private boolean isAccessDocument() throws SQLException {

... This diff was truncated because it exceeds the maximum size that can be displayed.

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 6744

Added by ben leinfelder over 12 years ago