Metacat

/**

 *  '$RCSfile$'

 *    Purpose: A class that handles checking permssision for a document

 *

 *             National Center for Ecological Analysis and Synthesis

 *    Authors: Chad Berkley

 *

 *   '$Author$'

 *     '$Date$'

 * '$Revision$'

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License as published by

 * the Free Software Foundation; either version 2 of the License, or

 * (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 * GNU General Public License for more details.

 *

 * You should have received a copy of the GNU General Public License

 * along with this program; if not, write to the Free Software

 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 */

package edu.ucsb.nceas.metacat;

import java.sql.ResultSet;

import java.sql.SQLException;

import org.dataone.service.types.v1.Permission;

import org.dataone.service.types.v1.Session;

import org.dataone.service.types.v1.Subject;

import edu.ucsb.nceas.metacat.database.DBConnectionPool;

{

//   private int rev = -1;

   private String guid = null;

                                                    // access for this docid

	 *

	 * @param myDocid the docid need to access

	 */

	public PermissionController(String myDocid) throws McdbException {

		String docId = null;

		int rev = -1;

		docId = DocumentUtil.getSmartDocId(myDocid);

		rev = DocumentUtil.getRevisionFromAccessionNumber(myDocid);

		// this is what we really want

		guid = IdentifierManager.getInstance().getGUID(docId, rev);

	}

    */

   public boolean hasSubTreeAccessControl()

   {

     return hasSubTreeAccessControl;

   }

       sessionData = SessionService.getInstance().getRegisteredSession(sessionId);

       if (sessionData == null) {

           return false;

       }

	   return hasPermission(sessionData.getUserName(), sessionData.getGroupNames(), myPermission);

   }

    * Check from db connection if at least one of the list of @principals

    * @param groups  the groups which the use is in

    * @param myPermission  permission type to check for

    */

    boolean hasPermission=false;

    String [] userPackage=null;

    {

      return true;

    }

    // for administrators

    //see http://bugzilla.ecoinformatics.org/show_bug.cgi?id=4728

    try {

		if (AuthUtil.isAdministrator(user, groups)) {

			return true;

		}

	} catch (MetacatUtilException e) {

		// not much we can do here, except treat them as normal

		logMetacat.warn("Error checking for administrator: " + e.getMessage(), e);

	}

    // for DataONE rightsHolder permission

    boolean isOwner = false;

    try {

		Session userSession = new Session();

		Subject subject = new Subject();

		subject.setValue(user);

		userSession.setSubject(subject);

		Identifier pid = new Identifier();

		pid.setValue(guid);

		SystemMetadata sysMeta = HazelcastService.getInstance().getSystemMetadataMap().get(pid);

		isOwner = (sysMeta.getRightsHolder().equals(subject));

		logMetacat.warn("Error checking for DataONE permissions: " + e.getMessage(), e);

		isOwner = false;

    }

    if (isOwner) {

    	return true;

    }

    userPackage=createUsersPackage(user, groups);

    //is "write", the user should have "all" right

    else //in other situation, just check the request permission

    {

      // Check for @permission on @docid for @user and/or @groups

  }

    * Check from db connection if the users in String array @principals has

    * @param docid, document identifier to check on

  {

      //first, if there is a docid owner in user package, return true

      }

      //check perm_order

          //if it is allowfirst and has deny rule(either explicit )

          //deny access

        }//if

          //if it is allowfirst and hasn't deny rule and has allow rule

          //allow access

        }//else if

        else

        {

          //other situation deny access

        }//else

     }//if isAllowFirst

     else //denyFirst

     {

         //if it is denyFirst and has allow rule, allow access

         return true;

       }

       else

       {

         //if it is denyfirst but no allow rule, deny access

         return false;

       }

     }//else denyfirst

    }//try

    catch (Exception e)

    {

  }//hasPermission

   * @param user String

   * @param groups String[]

   * @param myPermission String

   * @param inlineDataId String

   * @throws McdbException

   * @return boolean

   */

  private boolean hasPermissionForInlineData(String user, String[] groups,

                                      String myPermission, String inlineDataId)

     // this method can call the public method - hasPermission(...)

     // the only difference is about the ownership, you couldn't find the owner

     // from inlinedataId directly. You should get it from eml document itself

     String []userPackage = createUsersPackage(user, groups);

           return true;

         }

         else

         {

             PermissionController controller = new PermissionController(guid);

             controller.guid = inlineDataId;

         }

    } catch (SQLException e) {

        throw new McdbException(e.getMessage());

    }

  /**

   * access control

   */

  public boolean hasPermissionForSubTreeNode(String user, String[] groups,

                                             String myPermission, long nodeId)

                                             throws McdbException

  {

    {

      SubTree tree = (SubTree)en.nextElement();

      long start = tree.getStartNodeId();

      long stop  = tree.getEndNodeId();

      {

      }

    }

    return flag;

  }

  /**

   * @param user  the user name

   * @param groups  the groups which the use is in

   * @param myPermission  permission type to check for

   */

  {

    int permission =AccessControlList.intValue(myPermission);

    if ((user==null) && (groups==null || groups.length==0))

    {

      return resultUnaccessableSubTree;

    }

    principals=createUsersPackage(user, groups);

    //for the document owner return null(no unaccessable subtree)

    try

    {

       return resultUnaccessableSubTree;

      }

    }

    catch (SQLException ee)

    {

      throw new McdbException(ee);

    }

    for (int i = 0; i< subTreeList.size(); i++)

    {

      SubTree tree = (SubTree)subTreeList.elementAt(i);

        {

              // put the subtree into unaccessable vector

            }//if

              //if it is allowfirst and hasn't deny rule and has allow rule

              //allow access do nothing

            else

            {

              //other situation deny access

          }//if isAllowFirst

          else //denyFirst

          {

              //if it is denyFirst and has allow rule, allow access, do nothing

            else

            {

              //if it is denyfirst but no allow rule, deny access

              // add into vector

            }

          }//else denyfirst

        }//try

        catch( Exception e)

        {

        }

  }//hasUnaccessableSubtree

  /*

   * is a subtree of subtree a. And user doesn't have read permission for both

   * so we only use subtree a is enough.

   */

    // check the parameters

    if (unAccessSubTree == null || unAccessSubTree.isEmpty())

    {

      return newSubTreeHash;

    }

    else

    {

      // look every subtree start point and stop point, to see if it is embedded

      // in another one. If embedded, they are equavelent and we can use bigger

      // one to replace smaller one

      {

        SubTree tree    = (SubTree)en.nextElement();

        String  treeId  = tree.getSubTreeId();

        long    startId = tree.getStartNodeId();

        long    endId   = tree.getEndNodeId();

        {

          SubTree subTree = (SubTree)enu.nextElement();

          long   subTreeEndId   = subTree.getEndNodeId();

          //compare and if the first subtree is a subtree of the second

          // one, set neeDelete true

          if (startId > subTreeStartId && endId < subTreeEndId)

          {

            needDelete = true;

                                     " subtree list becuase it is a subtree of"+

          }//if

        }//while

        // if not need to delete, put the subtree into hash

        if (!needDelete)

        {

        //reset needDelete

        needDelete = false;

      }//while

      return newSubTreeHash;

    }//else

  }

	 * has "all" permission to access it.

	 *

	 * @param docId,

	 *            the document id need to be checked

	 */

		// get the docid from the guid

		String docId = null;

		try {

			docId = IdentifierManager.getInstance().getLocalId(guid);

		} catch (McdbDocNotFoundException e) {

			return false;

			//throw new SQLException(e);

		}

		DBConnection conn = null;

		int serialNumber = -1;

		try {

			// check out DBConnection

			conn = DBConnectionPool.getDBConnection("PermissionControl.isAccessDoc");

			serialNumber = conn.getCheckOutSerialNumber();

			pStmt.setString(1, docId);

			ResultSet rs = pStmt.getResultSet();

			boolean hasRow = rs.next();

			String doctype = null;

			if (hasRow) {

				doctype = rs.getString(1);

			pStmt.close();

			if (doctype != null

			}

			throw new SQLException("PermissionControl.isAccessDocument "

					+ "Error checking" + " on document " + docId + ". " + e.getMessage());

		} catch (PropertyNotFoundException pnfe) {

			throw new SQLException("PermissionControl.isAccessDocument "

					+ "Error checking" + " on document " + docId + ". " + pnfe.getMessage());

		} finally {

			try {

				pStmt.close();

			} finally {

				DBConnectionPool.returnDBConnection(conn, serialNumber);

			}

		}

	}// isAccessDocument

	 *

	 * @param principals,

	 *            a string array storing the username, groups name and public.

	 * @param docid,

	 *            the id of given documents

	 */

  {

	// get the docid

	String docId = null;

	try {

		docId = IdentifierManager.getInstance().getLocalId(guid);

		docId = DocumentUtil.getDocIdFromString(docId);

	} catch (McdbDocNotFoundException e) {

		// should be true if we own the parent doc, but likely won't be checked in that case

		return false;

	}

    DBConnection conn = null;

    int serialNumber = -1;

    {

      //check out DBConnection

      pStmt = conn.prepareStatement(

                "SELECT 'x' FROM xml_documents " +

                "UNION ALL " +

                "SELECT 'x' FROM xml_revisions " +

                "WHERE docid = ? AND lower(user_owner) = ? ");

      //the owner of document

      for (int i=0; i<lengthOfArray; i++)

      {

        pStmt.setString(1, docId);

        pStmt.setString(2, principals[i]);

        pStmt.setString(4, principals[i]);

        pStmt.execute();

        ResultSet rs = pStmt.getResultSet();

        hasRow = rs.next();

          pStmt.close();

    }//try

        pStmt.close();

        throw new

                     " on document #" + docId + ". " + e.getMessage());

    }//catch

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    * Check if the permission order for user at that documents is allowFirst

    */

  {

    int lengthOfArray=principals.length;

    boolean hasRow;

    PreparedStatement pStmt = null;

    DBConnection conn = null;

    int serialNumber = -1;

    boolean topLever =false;

      //top level

      topLever = true;

    	  "SELECT perm_order FROM xml_access " +

		    "WHERE lower(principal_name) = ? " +

		    "AND guid = ? " +

		    "AND startnodeid is NULL";

    else

    {

      //sub tree level

      sql = "SELECT perm_order FROM xml_access " +

        "AND guid = ? " +

        "AND startnodeid = ?";

    {

      //check out DBConnection

      conn=DBConnectionPool.getDBConnection("AccessControlList.isAllowFirst");

      serialNumber=conn.getCheckOutSerialNumber();

      for (int i=0; i<lengthOfArray;i++)

      {

        //bind value

        pStmt.setString(1, principals[i]);//user name

        {

        ResultSet rs = pStmt.getResultSet();

        hasRow=rs.next();

        if (hasRow)

        {

          //get the permission order from data base

          String permissionOrder=rs.getString(1);

          //if the permission order is "allowFirst

          if (permissionOrder.equalsIgnoreCase(AccessControlInterface.ALLOWFIRST))

          {

            pStmt.close();

            return true;

          }

          else

          {

            pStmt.close();

            return false;

          }

        }//if

      }//for

    }//try

    catch (SQLException e)

    {

      throw e;

    }

    finally

    {

      try

      {

        pStmt.close();

      }

      finally

      {

        DBConnectionPool.returnDBConnection(conn, serialNumber);

      }

    }

    //if reach here, means there is no permssion record for given names and

    * If it has permission rule and ticket count is greater than 0, the ticket

    * number will decrease one for every allow rule

    * @param permission, the permssion need to check

    */

 {

   int lengthOfArray=principals.length;

   boolean allow=false;//initial value is no allow rule

   ResultSet rs;

   PreparedStatement pStmt = null;

   int permissionValue=permission;