Package org.alfresco.repo.security.permissions.impl

Class PermissionServiceImpl

  • All Implemented Interfaces:
    EventListener, PermissionServiceSPI, org.alfresco.service.cmr.security.PermissionService, Extensible, org.springframework.beans.factory.Aware, org.springframework.context.ApplicationContextAware, org.springframework.context.ApplicationListener
    Direct Known Subclasses:
    AllowPermissionServiceImpl
    public class PermissionServiceImpl
extends org.springframework.extensions.surf.util.AbstractLifecycleBean
implements PermissionServiceSPI, Extensible
    The Alfresco implementation of a permissions service against our APIs for the permissions model and permissions persistence.
    Author:
    andyh

    • Field Detail

      • accessCache

        protected org.alfresco.repo.cache.SimpleCache<Serializable,​org.alfresco.service.cmr.security.AccessStatus> accessCache
        a transactionally-safe cache to be injected

      • readersDeniedCache

        protected org.alfresco.repo.cache.SimpleCache<Serializable,​Set<String>> readersDeniedCache

      • nodeService

        protected org.alfresco.service.cmr.repository.NodeService nodeService

      • tenantService

        protected org.alfresco.repo.tenant.TenantService tenantService

      • dictionaryService

        protected org.alfresco.service.cmr.dictionary.DictionaryService dictionaryService

      • aclDaoComponent

        protected AclDAO aclDaoComponent

      • anyDenyDenies

        protected boolean anyDenyDenies

    • Constructor Detail

      • PermissionServiceImpl

        public PermissionServiceImpl()
        Standard spring construction.

    • Method Detail

      • setDictionaryService

        public void setDictionaryService​(org.alfresco.service.cmr.dictionary.DictionaryService dictionaryService)
        Set the dictionary service
        Parameters:
        dictionaryService - DictionaryService

      • setAnyDenyDenies

        public void setAnyDenyDenies​(boolean anyDenyDenies)
        Parameters:
        anyDenyDenies - the anyDenyDenies to set

      • getAnyDenyDenies

        public boolean getAnyDenyDenies()

      • setModelDAO

        public void setModelDAO​(ModelDAO modelDAO)
        Set the permissions model dao
        Parameters:
        modelDAO - ModelDAO

      • setNodeService

        public void setNodeService​(org.alfresco.service.cmr.repository.NodeService nodeService)
        Set the node service.
        Parameters:
        nodeService - NodeService

      • setOwnableService

        public void setOwnableService​(OwnableService ownableService)
        Set the ownable service.
        Parameters:
        ownableService - OwnableService

      • setTenantService

        public void setTenantService​(org.alfresco.repo.tenant.TenantService tenantService)
        Set the tenant service.
        Parameters:
        tenantService - TenantService

      • setPermissionsDaoComponent

        public void setPermissionsDaoComponent​(PermissionsDaoComponent permissionsDaoComponent)
        Set the permissions dao component
        Parameters:
        permissionsDaoComponent - PermissionsDaoComponent

      • setAuthorityService

        public void setAuthorityService​(AuthorityService authorityService)
        Set the authority service.
        Parameters:
        authorityService - AuthorityService

      • setDynamicAuthorities

        public void setDynamicAuthorities​(List<DynamicAuthority> dynamicAuthorities)
        Set the dynamic authorities

      • setAclDAO

        public void setAclDAO​(AclDAO aclDaoComponent)
        Set the ACL DAO component.
        Parameters:
        aclDaoComponent - AclDAO

      • setFixedAclUpdater

        public void setFixedAclUpdater​(FixedAclUpdater fixedAclUpdater)

      • setAccessCache

        public void setAccessCache​(org.alfresco.repo.cache.SimpleCache<Serializable,​org.alfresco.service.cmr.security.AccessStatus> accessCache)
        Set the permissions access cache.
        Parameters:
        accessCache - a transactionally safe cache

      • setReadersCache

        public void setReadersCache​(org.alfresco.repo.cache.SimpleCache<Serializable,​Set<String>> readersCache)
        Parameters:
        readersCache - the readersCache to set

      • setReadersDeniedCache

        public void setReadersDeniedCache​(org.alfresco.repo.cache.SimpleCache<Serializable,​Set<String>> readersDeniedCache)
        Parameters:
        readersDeniedCache - the readersDeniedCache to set

      • setPolicyComponent

        public void setPolicyComponent​(PolicyComponent policyComponent)
        Set the policy component
        Parameters:
        policyComponent - PolicyComponent

      • setPolicyIgnoreUtil

        public void setPolicyIgnoreUtil​(PolicyIgnoreUtil policyIgnoreUtil)

      • onMoveNode

        public void onMoveNode​(org.alfresco.service.cmr.repository.ChildAssociationRef oldChildAssocRef,
                       org.alfresco.service.cmr.repository.ChildAssociationRef newChildAssocRef)
        Cache clear on move node
        Parameters:
        oldChildAssocRef - ChildAssociationRef
        newChildAssocRef - ChildAssociationRef

      • onCreateChildAssociation

        public void onCreateChildAssociation​(org.alfresco.service.cmr.repository.ChildAssociationRef childAssocRef)
        Cache clear on create of a child association from an authority container.
        Parameters:
        childAssocRef - ChildAssociationRef

      • beforeDeleteChildAssociation

        public void beforeDeleteChildAssociation​(org.alfresco.service.cmr.repository.ChildAssociationRef childAssocRef)
        Cache clear on delete of a child association from an authority container.
        Parameters:
        childAssocRef - ChildAssociationRef

      • onBootstrap

        protected void onBootstrap​(org.springframework.context.ApplicationEvent event)
        Specified by:
        onBootstrap in class org.springframework.extensions.surf.util.AbstractLifecycleBean

      • onShutdown

        protected void onShutdown​(org.springframework.context.ApplicationEvent event)
        No-op
        Specified by:
        onShutdown in class org.springframework.extensions.surf.util.AbstractLifecycleBean

      • init

        public void init()

      • getOwnerAuthority

        public String getOwnerAuthority()
        Specified by:
        getOwnerAuthority in interface org.alfresco.service.cmr.security.PermissionService

      • getAllAuthorities

        public String getAllAuthorities()
        Specified by:
        getAllAuthorities in interface org.alfresco.service.cmr.security.PermissionService

      • getAllPermission

        public String getAllPermission()
        Specified by:
        getAllPermission in interface org.alfresco.service.cmr.security.PermissionService

      • getPermissions

        public Set<org.alfresco.service.cmr.security.AccessPermission> getPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Specified by:
        getPermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getAllSetPermissions

        public Set<org.alfresco.service.cmr.security.AccessPermission> getAllSetPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Specified by:
        getAllSetPermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getAllSetPermissions

        public Set<org.alfresco.service.cmr.security.AccessPermission> getAllSetPermissions​(org.alfresco.service.cmr.repository.StoreRef storeRef)
        Specified by:
        getAllSetPermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getAllPermissionsImpl

        protected Set<org.alfresco.service.cmr.security.AccessPermission> getAllPermissionsImpl​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                                                                        boolean includeTrue,
                                                                                        boolean includeFalse)

      • getSettablePermissions

        public Set<String> getSettablePermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Specified by:
        getSettablePermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getSettablePermissions

        public Set<String> getSettablePermissions​(org.alfresco.service.namespace.QName type)
        Specified by:
        getSettablePermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getSetPermissions

        public NodePermissionEntry getSetPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Description copied from interface: PermissionServiceSPI
        Get the permissions that have been set on the given node (it knows nothing of the parent permissions)
        Specified by:
        getSetPermissions in interface PermissionServiceSPI
        Parameters:
        nodeRef - NodeRef
        Returns:
        the node permission entry

      • hasPermission

        public org.alfresco.service.cmr.security.AccessStatus hasPermission​(org.alfresco.service.cmr.repository.NodeRef passedNodeRef,
                                                                    PermissionReference permIn)
        Description copied from interface: PermissionServiceSPI
        Check that the given authentication has a particular permission for the given node. (The default behaviour is to inherit permissions)
        Specified by:
        hasPermission in interface PermissionServiceSPI
        Parameters:
        passedNodeRef - NodeRef
        permIn - PermissionReference
        Returns:
        the access status

      • hasPermission

        public org.alfresco.service.cmr.security.AccessStatus hasPermission​(Long aclID,
                                                                    org.alfresco.service.cmr.security.PermissionContext context,
                                                                    String permission)
        Specified by:
        hasPermission in interface org.alfresco.service.cmr.security.PermissionService

      • hasPermission

        protected org.alfresco.service.cmr.security.AccessStatus hasPermission​(Long aclId,
                                                                       org.alfresco.service.cmr.security.PermissionContext context,
                                                                       PermissionReference permission)

      • getCoreAuthorisations

        protected Set<String> getCoreAuthorisations​(net.sf.acegisecurity.Authentication auth)
        Get the core authorisations for this auth. If null this will be an empty set. Otherwise it will be a Lazy loaded Set of authorities from the authority node structure PLUS any granted authorities.

      • getAuthorisations

        protected Set<String> getAuthorisations​(net.sf.acegisecurity.Authentication auth,
                                        org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                        PermissionReference required)
        Get the authorisations for the currently authenticated user
        Parameters:
        auth - Authentication
        nodeRef - NodeRef
        required - PermissionReference
        Returns:
        the set of authorisations

      • getDynamicAuthorities

        protected Set<String> getDynamicAuthorities​(net.sf.acegisecurity.Authentication auth,
                                            org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                            PermissionReference required)

      • getAuthorisations

        protected Set<String> getAuthorisations​(net.sf.acegisecurity.Authentication auth,
                                        org.alfresco.service.cmr.security.PermissionContext context)

      • getDynamicAuthorities

        protected Set<String> getDynamicAuthorities​(net.sf.acegisecurity.Authentication auth,
                                            org.alfresco.service.cmr.security.PermissionContext context,
                                            Set<String> auths)

      • explainPermission

        public NodePermissionEntry explainPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                             PermissionReference perm)
        Description copied from interface: PermissionServiceSPI
        Where is the permission set that controls the behaviour for the given permission for the given authentication to access the specified name.
        Specified by:
        explainPermission in interface PermissionServiceSPI
        Parameters:
        nodeRef - NodeRef
        perm - PermissionReference
        Returns:
        the node permission entry

      • clearPermission

        public void clearPermission​(org.alfresco.service.cmr.repository.StoreRef storeRef,
                            String authority)
        Specified by:
        clearPermission in interface org.alfresco.service.cmr.security.PermissionService

      • deletePermission

        public void deletePermission​(org.alfresco.service.cmr.repository.StoreRef storeRef,
                             String authority,
                             String perm)
        Specified by:
        deletePermission in interface org.alfresco.service.cmr.security.PermissionService

      • deletePermission

        protected void deletePermission​(org.alfresco.service.cmr.repository.StoreRef storeRef,
                                String authority,
                                PermissionReference perm)

      • deletePermissions

        public void deletePermissions​(org.alfresco.service.cmr.repository.StoreRef storeRef)
        Specified by:
        deletePermissions in interface org.alfresco.service.cmr.security.PermissionService

      • setPermission

        public void setPermission​(org.alfresco.service.cmr.repository.StoreRef storeRef,
                          String authority,
                          String perm,
                          boolean allow)
        Specified by:
        setPermission in interface org.alfresco.service.cmr.security.PermissionService

      • setPermission

        protected void setPermission​(org.alfresco.service.cmr.repository.StoreRef storeRef,
                             String authority,
                             PermissionReference permission,
                             boolean allow)

      • deletePermissions

        public void deletePermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Specified by:
        deletePermissions in interface org.alfresco.service.cmr.security.PermissionService

      • deletePermission

        protected void deletePermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                String authority,
                                PermissionReference perm)

      • clearPermission

        public void clearPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                            String authority)
        Specified by:
        clearPermission in interface org.alfresco.service.cmr.security.PermissionService

      • setPermission

        protected void setPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                             String authority,
                             PermissionReference perm,
                             boolean allow)

      • setInheritParentPermissions

        public void setInheritParentPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                        boolean inheritParentPermissions)
        Specified by:
        setInheritParentPermissions in interface org.alfresco.service.cmr.security.PermissionService

      • setInheritParentPermissions

        public void setInheritParentPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                        boolean inheritParentPermissions,
                                        boolean asyncCall)
        Specified by:
        setInheritParentPermissions in interface org.alfresco.service.cmr.security.PermissionService

      • getInheritParentPermissions

        public boolean getInheritParentPermissions​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Specified by:
        getInheritParentPermissions in interface org.alfresco.service.cmr.security.PermissionService
        See Also:
        PermissionService.getInheritParentPermissions(org.alfresco.service.cmr.repository.NodeRef)

      • getPermissionReference

        public PermissionReference getPermissionReference​(org.alfresco.service.namespace.QName qname,
                                                  String permissionName)
        Description copied from interface: PermissionServiceSPI
        Get the permission reference for the given data type and permission name.
        Specified by:
        getPermissionReference in interface PermissionServiceSPI
        Parameters:
        qname - - may be null if the permission name is unique
        permissionName - String
        Returns:
        the permission reference

      • deletePermission

        public void deletePermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                             String authority,
                             String perm)
        Specified by:
        deletePermission in interface org.alfresco.service.cmr.security.PermissionService

      • hasPermission

        public org.alfresco.service.cmr.security.AccessStatus hasPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                                                                    String perm)
        Specified by:
        hasPermission in interface org.alfresco.service.cmr.security.PermissionService

      • setPermission

        public void setPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef,
                          String authority,
                          String perm,
                          boolean allow)
        Specified by:
        setPermission in interface org.alfresco.service.cmr.security.PermissionService

      • hasReadPermission

        public org.alfresco.service.cmr.security.AccessStatus hasReadPermission​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        Optimised read permission evaluation caveats: doesn't take into account dynamic authorities/groups doesn't take into account node types/aspects for permissions
        Specified by:
        hasReadPermission in interface org.alfresco.service.cmr.security.PermissionService

      • adminRead

        protected org.alfresco.service.cmr.security.AccessStatus adminRead()

      • ownerRead

        protected org.alfresco.service.cmr.security.AccessStatus ownerRead​(String username,
                                                                   org.alfresco.service.cmr.repository.NodeRef nodeRef)

      • getReaders

        public Set<String> getReaders​(Long aclId)
        Specified by:
        getReaders in interface org.alfresco.service.cmr.security.PermissionService

      • getReadersDenied

        public Set<String> getReadersDenied​(Long aclId)
        Specified by:
        getReadersDenied in interface org.alfresco.service.cmr.security.PermissionService
        Parameters:
        aclId - Long
        Returns:
        set of authorities denied permission on the ACL

      • canRead

        protected org.alfresco.service.cmr.security.AccessStatus canRead​(Long aclId)

      • isVersionNodeRef

        protected boolean isVersionNodeRef​(org.alfresco.service.cmr.repository.NodeRef nodeRef)
        This methods checks whether the specified nodeRef instance is a version nodeRef (ie. in the 'version' store)
        Parameters:
        nodeRef - - version nodeRef
        Returns:
        true if version nodeRef false otherwise

      • convertVersionNodeRefToVersionedNodeRef

        protected org.alfresco.service.cmr.repository.NodeRef convertVersionNodeRefToVersionedNodeRef​(org.alfresco.service.cmr.repository.NodeRef versionNodeRef)
        Converts specified version nodeRef (eg. versionStore://...) to versioned nodeRef (eg. workspace://SpacesStore/...)
        Parameters:
        versionNodeRef - - always version nodeRef (ie. in the 'version' store)
        Returns:
        versioned nodeRef (ie.in the 'live' store)

      • getAuthorisations

        public Set<String> getAuthorisations()
        Specified by:
        getAuthorisations in interface org.alfresco.service.cmr.security.PermissionService