Metacat

import org.dataone.client.CNode;

import org.dataone.client.D1Client;

import org.dataone.service.types.v1.Node;

import org.dataone.service.types.v1.NodeType;

   * Test if the user identified by the provided token has administrative authorization 

   * for the operation on the specified object.

   * 

   * @param session - the Session object containing the credentials for the Subject

   * @param pid - The identifer of the resource for which access is being checked

   * @param operation - The type of operation which is being requested for the given pid

   * 

   * @return true if the operation is allowed

   * 

   * @throws ServiceFailure

   * @throws InvalidToken

   * @throws NotFound

   * @throws NotAuthorized

   * @throws NotImplemented

   */

  protected boolean isAdminAuthorized(Session session, Identifier pid,

      Permission permission) 

      throws ServiceFailure, InvalidToken, NotFound, NotAuthorized,

      NotImplemented {

      boolean allowed = false;

      // are we allowed to do this? only CNs and target MNs are allowed

      CNode cn = D1Client.getCN();

      List<Node> nodes = cn.listNodes().getNodeList();

      if ( nodes == null ) {

          throw new ServiceFailure("4852", "Couldn't get node list.");

      }

      // find the node in the node list

      for ( Node node : nodes ) {

          NodeReference nodeReference = node.getIdentifier();

          logMetacat.debug("In isAdminAuthorized(), Node reference is: " + nodeReference.getValue());

          Subject subject = session.getSubject();

          if (node.getType() == NodeType.CN) {

              List<Subject> nodeSubjects = node.getSubjectList();

              // check if the session subject is in the node subject list

              for (Subject nodeSubject : nodeSubjects) {

                  if ( nodeSubject.equals(subject) ) {

                      allowed = true; // subject of session == target node subject

                      break;

                  } else {

                      throw new NotAuthorized("4851", permission + 

                          " not allowed on " + pid.getValue());

                  }

              }                 

          }

      }

      return allowed;

  }

  /**

   * for the operation on the specified object.