/src/edu/ucsb/nceas/metacat/PermissionController.java - Diff - Metacat - Ecoinformatics Redmine

« Previous | Next »

Revision 6744

Added by ben leinfelder over 12 years ago

refactor Metacat access handling to be on a per-revision basis so that it more closely aligns with the DataONE approach
http://bugzilla.ecoinformatics.org/show_bug.cgi?id=5560

     public class PermissionController
+    {
        private String docId = null;
     //   private String docId = null;
     //   private int rev = -1;
        private String guid = null;
        private boolean hasSubTreeAccessControl = false; // flag if has a subtree
                                                         // access for this docid
        private Vector subTreeList = new Vector();
-...
        private static Logger logMetacat = Logger.getLogger(PermissionController.class);
        /**
         * Constructor for PermissionController
         * @param myDocid      the docid need to access
         */
        public PermissionController(String myDocid) throws McdbException
+       {
          // Get rid of rev number
          docId = DocumentUtil.getSmartDocId(myDocid);
          //hasSubTreeAccessControl = checkSubTreeAccessControl();
+       }
     	 * Constructor for PermissionController
+    	 *
     	 * @param myDocid the docid need to access
     	 */
     	public PermissionController(String myDocid) throws McdbException {
        /**
         * Constructor for PermssionController
         * @param myDocid String
         * @param needDeleteRev boolean
         */
        public PermissionController(String myDocid, boolean needDeleteRevFromDocid)
+       {
          if (!needDeleteRevFromDocid)
+         {
            docId = myDocid;
+         }
          else
+         {
              docId = DocumentUtil.getDocIdFromAccessionNumber(myDocid);
+         }
+       }
     		// find the guid if we can
     		String docId = null;
     		int rev = -1;
     		// get the parts
     		docId = DocumentUtil.getSmartDocId(myDocid);
     		rev = DocumentUtil.getRevisionFromAccessionNumber(myDocid);
     		// this is what we really want
     		guid = IdentifierManager.getInstance().getGUID(docId, rev);
+    	}
        /**
         * Return if a document has subtree access control
         */
-...
         //if the requested document is access documents and requested permission
         //is "write", the user should have "all" right
         if (isAccessDocument(docId) && (permission == AccessControlInterface.WRITE))
         if (isAccessDocument() && (permission == AccessControlInterface.WRITE))
+        {
           hasPermission = hasPermission(userPackage,docId, 7);// 7 is all permission
           hasPermission = hasPermission(userPackage, 7);// 7 is all permission
         }//if
         else //in other situation, just check the request permission
+        {
           // Check for @permission on @docid for @user and/or @groups
           hasPermission = hasPermission(userPackage,docId, permission);
           hasPermission = hasPermission(userPackage, permission);
         }//else
         return hasPermission;
-...
         * @param docid, document identifier to check on
         * @param permission, permission (write or all...) to check for
         */
       private boolean hasPermission(String [] principals, String docId,
                                                int permission)
       private boolean hasPermission(String [] principals, int permission)
                              throws SQLException
+      {
         long startId = TOPLEVELSTARTNODEID;// this is for top level, so startid is 0
-...
+        {
           //first, if there is a docid owner in user package, return true
           //because doc owner has all permssion
           if (containDocumentOwner(principals, docId))
           if (containDocumentOwner(principals))
+          {
               return true;
-...
           //If there is no owner in user package, checking the table
           //check perm_order
           if (isAllowFirst(principals, docId, startId))
           if (isAllowFirst(principals, startId))
+          {
             if (hasExplicitDenyRule(principals, docId, permission, startId))
             if (hasExplicitDenyRule(principals, permission, startId))
+            {
               //if it is allowfirst and has deny rule(either explicit )
               //deny access
               return false;
             }//if
             else if ( hasAllowRule(principals, docId, permission, startId))
             else if ( hasAllowRule(principals, permission, startId))
+            {
               //if it is allowfirst and hasn't deny rule and has allow rule
               //allow access
-...
          }//if isAllowFirst
          else //denyFirst
+         {
            if (hasAllowRule(principals, docId, permission, startId))
            if (hasAllowRule(principals, permission, startId))
+           {
              //if it is denyFirst and has allow rule, allow access
              return true;
-...
          // from inlinedataId directly. You should get it from eml document itself
          String []userPackage = createUsersPackage(user, groups);
          try {
             if (containDocumentOwner(userPackage, docId))
             if (containDocumentOwner(userPackage))
+             {
                return true;
+             }
              else
+             {
                  PermissionController controller =
                                        new PermissionController(inlineDataId, false);
             	 // is a funky inline data id with the extra part, so we set it manually
                  PermissionController controller = new PermissionController(guid);
                  controller.guid = inlineDataId;
                  return controller.hasPermission(user, groups, myPermission);
+             }
         } catch (SQLException e) {
-...
         //for the document owner return null(no unaccessable subtree)
         try
+        {
           if (containDocumentOwner(principals, docId))
           if (containDocumentOwner(principals))
+          {
            return resultUnaccessableSubTree;
+          }
-...
             try
+            {
               if (isAllowFirst(principals, docId, startId))
               if (isAllowFirst(principals, startId))
+              {
                 if (hasExplicitDenyRule(principals, docId, permission, startId ))
                 if (hasExplicitDenyRule(principals, permission, startId ))
+                {
                  //if it is allowfirst and has deny rule
-...
                     resultUnaccessableSubTree.put(new Long(startId), tree);
+                  }
                 }//if
                 else if ( hasAllowRule(principals, docId, permission, startId))
                 else if ( hasAllowRule(principals, permission, startId))
+                {
                   //if it is allowfirst and hasn't deny rule and has allow rule
                   //allow access do nothing
-...
               }//if isAllowFirst
               else //denyFirst
+              {
                 if (hasAllowRule(principals, docId, permission,startId))
                 if (hasAllowRule(principals, permission,startId))
+                {
                   //if it is denyFirst and has allow rule, allow access, do nothing
-...
     	 * @param docId,
     	 *            the document id need to be checked
     	 */
     	private boolean isAccessDocument(String docId) throws SQLException {
     		// detele the rev number if docid contains it
     	private boolean isAccessDocument() throws SQLException {
     		// get the docid from the guid
     		String docId = null;
     		try {
     			docId = IdentifierManager.getInstance().getLocalId(guid);
     		} catch (McdbDocNotFoundException e) {
     			return false;
     			//throw new SQLException(e);
+    		}
     		docId = DocumentUtil.getDocIdFromString(docId);
     		PreparedStatement pStmt = null;
     		DBConnection conn = null;
-...
     	 * @param docid,
     	 *            the id of given documents
     	 */
       private boolean containDocumentOwner( String[] principals, String docId)
       private boolean containDocumentOwner(String[] principals)
                         throws SQLException
+      {
     	// get the docid
     	String docId = null;
     	try {
     		docId = IdentifierManager.getInstance().getLocalId(guid);
     		docId = DocumentUtil.getDocIdFromString(docId);
     	} catch (McdbDocNotFoundException e) {
     		// should be true if we own the parent doc, but likely won't be checked in that case
     		return false;
+    	}
         int lengthOfArray=principals.length;
         boolean hasRow;
         PreparedStatement pStmt=null;
-...
         * @param principals, list of names of principals to check for
         * @param docid, document identifier to check for
         */
       private boolean isAllowFirst(String [] principals, String docId,
                                    long startId)
       private boolean isAllowFirst(String [] principals, long startId)
                       throws SQLException, Exception
+      {
         int lengthOfArray=principals.length;
-...
+        {
           //top level
           topLever = true;
           sql = "SELECT perm_order FROM xml_access " +
         "WHERE lower(principal_name) = ? AND docid = ? AND startnodeid is NULL";
           sql =
         	  "SELECT perm_order FROM xml_access " +
     		    "WHERE lower(principal_name) = ? " +
     		    "AND guid = ? " +
     		    "AND startnodeid is NULL";
+        }
         else
+        {
           //sub tree level
           sql = "SELECT perm_order FROM xml_access " +
             "WHERE lower(principal_name)= ? AND docid = ? AND startnodeid = ?";
             "WHERE lower(principal_name) = ? " +
             "AND guid = ? " +
             "AND startnodeid = ?";
+        }
         try
-...
+          {
             //bind value
             pStmt.setString(1, principals[i]);//user name
             pStmt.setString(2, docId);//docid
             pStmt.setString(2, guid);//guid
             // if subtree, we need set subtree id
             if (!topLever)
+            {
-...
         //docid. So throw a exception.
         throw new Exception("PermissionController.isAllowFirst - There is no permission record for user "+ principals[0] +
                             " at document " + docId);
                             " at document " + guid);
       }//isAllowFirst
-...
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasAllowRule(String [] principals, String docId,
                                       int permission, long startId)
       private boolean hasAllowRule(String [] principals, int permission, long startId)
                       throws SQLException, Exception
+     {
        int lengthOfArray=principals.length;
-...
        PreparedStatement pStmt = null;
        int permissionValue=permission;
        int permissionValueInTable;
        int ticketCount;
        DBConnection conn = null;
        int serialNumber = -1;
        boolean topLever = false;
-...
+       {
          // for toplevel
          topLever = true;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
        "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
          sql = "SELECT permission " +
     		"FROM xml_access " +
      		"WHERE guid = ? " +
      		"AND lower(principal_name) = ? " +
      		"AND perm_type = ? " +
      		"AND startnodeid is NULL";
+       }
        else
+       {
          topLever =false;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
           "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
          sql = "SELECT permission " +
          		"FROM xml_access " +
          		"WHERE guid = ? " +
          		"AND lower(principal_name) = ? " +
          		"AND perm_type = ? " +
          		"AND startnodeid = ?";
+       }
        try
+       {
-...
         //function will assign begin_time=sysdate
         pStmt = conn.prepareStatement(sql);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(1, guid);
         pStmt.setString(3, AccessControlInterface.ALLOW);
         // if subtree lever, need to set subTreeId
-...
         * @param docid, document identifier to check for
         * @param permission, the permssion need to check
         */
       private boolean hasExplicitDenyRule(String [] principals, String docId,
       private boolean hasExplicitDenyRule(String [] principals,
                                           int permission, long startId)
                       throws SQLException
+     {
-...
        if (startId == TOPLEVELSTARTNODEID)
+       {
          topLevel = true;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
         "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid is NULL";
          sql = "SELECT permission " +
          		"FROM xml_access " +
          		"WHERE guid = ? " +
     	     	"AND lower(principal_name) = ? " +
     	     	"AND perm_type = ? " +
     	     	"AND startnodeid is NULL";
+       }
        else
+       {
          topLevel = false;
          sql = "SELECT permission FROM xml_access WHERE docid = ? " +
          "AND lower(principal_name) = ? AND perm_type = ? AND startnodeid = ?";
          sql = "SELECT permission " +
     		"FROM xml_access " +
     		"WHERE guid = ? " +
     	  	"AND lower(principal_name) = ? " +
     	  	"AND perm_type = ? " +
     	  	"AND startnodeid = ?";
+       }
        try
-...
          pStmt = conn.prepareStatement(sql);
         //bind docid, perm_type
         pStmt.setString(1, docId);
         pStmt.setString(1, guid);
         pStmt.setString(3, AccessControlInterface.DENY);
         // subtree level need to set up subtreeid
-...
        * user can't read it. The key is subtree id of inlinedata, the data is
        * internal file name for the inline data which is stored as docid
        * in xml_access table or data object doc id.
        * @param docidWithoutRev, metadata docid which should be the accessfileid
        * @param docid (With Rev), metadata docid which should be the accessfileid
        *                         in the table
        * @param user , the name of user
        * @param groups, the group which the user belong to
        */
        public static Hashtable<String, String> getUnReadableInlineDataIdList(String docidWithoutRev,
                                                        String user, String[] groups,
                                                        boolean withRevision)
        public static Hashtable<String, String> getUnReadableInlineDataIdList(String docid,
                                                        String user, String[] groups)
                                                     throws McdbException
+       {
          Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
                                   user, groups, AccessControlInterface.READSTRING,
                                   withRevision);
          Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docid,
                                   user, groups, AccessControlInterface.READSTRING);
          return inlineDataList;
+       }
-...
                                                    throws Exception
+      {
         Hashtable<String, String> inlineDataList = getUnAccessableInlineDataIdList(docidWithoutRev,
                                 user, groups, AccessControlInterface.WRITESTRING,
                                 withRevision);
                                 user, groups, AccessControlInterface.WRITESTRING);
         return inlineDataList;
+      }
        /*
        /**
         * This method will get hashtable which contains a unaccessable distribution
         * inlinedata object list
+        *
         * withRevision is used to get inline id list with or without revision number
         * e.g. when withRevision is true, temp.1.1.1, temp.1.1.2 would be returned
         * otherwise temp.1.1 and temp.1.2 would be returned.
         */
        private static Hashtable<String, String> getUnAccessableInlineDataIdList(String docid,
                                    String user, String[] groups, String permission,
                                    boolean withRevision)
                                    String user, String[] groups, String permission)
                                  throws McdbException
+       {
            Hashtable<String, String> unAccessibleIdList = new Hashtable();
-...
+          {
             String subTreeId = (String) en.nextElement();
             String fileId = (String) allIdList.get(subTreeId);
             //Here fileid is internal file id for line data. It stored in docid
             // field in xml_access table. so we don't need to delete rev
             PermissionController controller = new PermissionController(docid, false);
             //Here fileid is internal file id for line data. It stored in guid
             // field in xml_access table.
             PermissionController controller = new PermissionController(docid);
             if (!controller.hasPermissionForInlineData(user, groups, permission, fileId))
+            {
                 if(withRevision)
+                {
                     logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
                                              " and " + "inline data file name " +
                                              fileId + " into " + "un" + permission +
                                              " hash");
                     unAccessibleIdList.put(subTreeId, fileId);
                 logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
                                          " and " + "inline data file name " +
                                          fileId + " into " + "un" + permission +
                                          " hash");
                 unAccessibleIdList.put(subTreeId, fileId);
+                }
                 else
+                {
                     logMetacat.info("PermissionController.getUnAccessableInlineDataIdList - Put subtree id " + subTreeId +
                                              " and " + "inline data file name " +
                                              DocumentUtil.getInlineDataIdWithoutRev(fileId) +
                                              " into " + "un" + permission +
                                              " hash");
                     unAccessibleIdList.put(subTreeId,
                     		DocumentUtil.getInlineDataIdWithoutRev(fileId));
+                }
+            }
+          }
           return unAccessibleIdList;
-...
        private static Hashtable getAllInlineDataIdList(String docid) throws SQLException
+       {
          Hashtable inlineDataList = new Hashtable();
          String sql = "SELECT subtreeid, docid FROM xml_access WHERE " +
                        "accessfileid = ? AND subtreeid  IS NOT NULL";
          String sql =
         	 "SELECT subtreeid, guid " +
         	 "FROM xml_access " +
         	 "WHERE accessfileid = ? " +
         	 "AND subtreeid IS NOT NULL";
          PreparedStatement pStmt=null;
          ResultSet rs=null;
          DBConnection conn=null;

Also available in: Unified diff

Project

General

Profile

Metacat

Revision 6744

Added by ben leinfelder over 12 years ago