Package org.ametys.odf.rights

Class AbstractODFRoleForContextualizedContentAccessController

java.lang.Object

org.ametys.odf.rights.AbstractODFRoleForContextualizedContentAccessController

All Implemented Interfaces:

AccessController, PluginAware, Supporter<Object>, Serviceable

Direct Known Subclasses:

ODFContributorForContextualizedContentAccessController, ODFManagerForContextualizedContentAccessController, ODFMCCManagerForContextualizedContentAccessController

public abstract class AbstractODFRoleForContextualizedContentAccessController
extends Object
implements AccessController, Serviceable, PluginAware

AccessController for a ODF ODFRightHelper.ContextualizedContent based on ODF role

Nested Class Summary

Nested classes/interfaces inherited from interface org.ametys.core.right.AccessController

AccessController.AccessResult, AccessController.ExplanationObject, AccessController.Permission

Field Summary

Fields

Modifier and Type	Field	Description
protected ODFContentsTreeHelper	_odfContentsTreeHelper	The ODF contents tree helper
protected ODFRightHelper	_odfRightHelper	The ODF right helper
protected AmetysObjectResolver	_resolver	The ametys resolver
protected RightProfilesDAO	_rightProfileDAO	The rights profile DAO

Constructor Summary

Constructors

Constructor	Description
AbstractODFRoleForContextualizedContentAccessController()

Method Summary

Modifier and Type	Method	Description
Map<AccessController.ExplanationObject,Map<AccessController.Permission,AccessExplanation>>	explainAllPermissions(UserIdentity identity, Set<GroupIdentity> groups)	Get AccessExplanation for each permission given to the user by this access controller.
Map<GroupIdentity,Map<AccessController.Permission,AccessExplanation>>	explainAllPermissionsByGroup(Object object)	Get all the permissions granted to groups on the object.
Map<UserIdentity,Map<AccessController.Permission,AccessExplanation>>	explainAllPermissionsByUser(Object object)	Get all the permissions granted to users on the object.
Map<AccessController.Permission,AccessExplanation>	explainAllPermissionsForAnonymous(Object object)	Get all the permissions granted to an anonymous user on the object.
Map<AccessController.Permission,AccessExplanation>	explainAllPermissionsForAnyConnected(Object object)	Get all the permissions granted to any connected user on the object.
AccessExplanation	explainPermission(UserIdentity user, Set<GroupIdentity> groups, String rightId, Object object)	Explain the permission for a user on the given object.
protected Set<UserIdentity>	getAllowedUsers(Content content, ODFRightHelper.ContextualizedPermissionContext permissionCtx)	Get the allowed users for this content taking into account the content itself and its parents
String	getId()	Get the id of this controller
protected abstract Set<UserIdentity>	getLocalAllowedUsers(Content content)	Get the local allowed users for this content
I18nizableText	getObjectCategory(Object object)	Get a label classifying the object handled by this access controller
I18nizableText	getObjectLabel(Object object)	Get a label describing the object handled by this access controller
protected Set<Content>	getParents(Content content, ODFRightHelper.ContextualizedPermissionContext permissionCtx)	Get the parents of the content for rights purpose
AccessController.AccessResult	getPermission(UserIdentity user, Set<GroupIdentity> userGroups, String rightId, Object object)	Gets the kind of access a user has on an object for a given right
Map<GroupIdentity,AccessController.AccessResult>	getPermissionByGroup(String rightId, Object object)	Gets the permission by group only on an object for the given right.
Map<String,AccessController.AccessResult>	getPermissionByRight(UserIdentity user, Set<GroupIdentity> userGroups, Object object)	Gets the kind of access a user has on an object for all rights
Map<UserIdentity,AccessController.AccessResult>	getPermissionByUser(String rightId, Object object)	Gets the permission by user only on an object for the given right.
protected ODFRightHelper.ContextualizedPermissionContext	getPermissionContext(ODFRightHelper.ContextualizedContent contextualizedContent)	Get the permission context
AccessController.AccessResult	getPermissionForAnonymous(String rightId, Object object)	Gets the permission for Anonymous only on an object for a given right
AccessController.AccessResult	getPermissionForAnyConnectedUser(String rightId, Object object)	Gets the permission for any connected user only on an object for a given right
AccessController.AccessResult	getReadAccessPermission(UserIdentity user, Set<GroupIdentity> userGroups, Object object)	Gets the kind of access a user has on an object for thye read access
Map<GroupIdentity,AccessController.AccessResult>	getReadAccessPermissionByGroup(Object object)	Gets the read access permission by group only on an object.
Map<UserIdentity,AccessController.AccessResult>	getReadAccessPermissionByUser(Object object)	Gets the read access permission by user only on an object.
AccessController.AccessResult	getReadAccessPermissionForAnonymous(Object object)	Gets the read access permission for Anonymous only on an object
AccessController.AccessResult	getReadAccessPermissionForAnyConnectedUser(Object object)	Gets the read access permission for any connected user only on an object
protected List<String>	getRightsInTargetProfile()	Get the rights hold by target profile
protected abstract String	getRoleAttributePath()	Get the attribute path for role
protected abstract String	getTargetProfileId()	Get the id of target profile
boolean	hasAnonymousAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)	Returns true if anonymous has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
boolean	hasAnonymousAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)	Returns true if anonymous has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
boolean	hasAnyConnectedUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, String rightId)	Returns true if any connected user has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
boolean	hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)	Returns true if any connected user has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
boolean	hasUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups, String rightId)	Returns true if the user has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
boolean	hasUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts, UserIdentity user, Set<GroupIdentity> userGroups)	Returns true if the user has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.
void	service(ServiceManager smanager)
void	setPluginInfo(String pluginName, String featureName, String id)	Sets the plugin info relative to the current component. Note : The feature name may be null if the targeted component in declared at plugin level.
boolean	supports(Object object)	Check if an element is supported

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.ametys.core.right.AccessController

explainPermissionForAnonymous, explainPermissionForAnyConnectedUser, explainReadAccessPermission, explainReadAccessPermissionForAnonymous, explainReadAccessPermissionForAnyConnectedUser, getExplanationObject, getObjectPriority

Field Details

_rightProfileDAO

protected RightProfilesDAO _rightProfileDAO

The rights profile DAO

_odfContentsTreeHelper

protected ODFContentsTreeHelper _odfContentsTreeHelper

The ODF contents tree helper

_resolver

protected AmetysObjectResolver _resolver

The ametys resolver

_odfRightHelper

protected ODFRightHelper _odfRightHelper

The ODF right helper

Constructor Details

AbstractODFRoleForContextualizedContentAccessController

public AbstractODFRoleForContextualizedContentAccessController()

Method Details

service

public void service(ServiceManager smanager)
             throws ServiceException

Specified by:

service in interface Serviceable

Throws:

ServiceException

setPluginInfo

public void setPluginInfo(String pluginName,
 String featureName,
 String id)

Description copied from interface: PluginAware

Sets the plugin info relative to the current component.
Note : The feature name may be null if the targeted component in declared at plugin level.

Specified by:

setPluginInfo in interface PluginAware

Parameters:

pluginName - Unique identifier for the plugin hosting the extension

featureName - Unique feature identifier (unique for a given pluginName)

id - Unique identifier of this component

getId

public String getId()

Description copied from interface: AccessController

Get the id of this controller

Specified by:

getId in interface AccessController

Returns:

the id of this controller

supports

public boolean supports(Object object)

Description copied from interface: Supporter

Check if an element is supported

Specified by:

supports in interface Supporter<Object>

Parameters:

object - The element

Returns:

true if the element is supported, false otherwise

getParents

protected Set<Content> getParents(Content content,
 ODFRightHelper.ContextualizedPermissionContext permissionCtx)

Get the parents of the content for rights purpose

Parameters:

content - the content

permissionCtx - the permission context

Returns:

the parents of content

getPermissionContext

protected ODFRightHelper.ContextualizedPermissionContext getPermissionContext(ODFRightHelper.ContextualizedContent contextualizedContent)

Get the permission context

Parameters:

contextualizedContent - the initial contextualized content

Returns:

the permission context.

getPermission

public AccessController.AccessResult getPermission(UserIdentity user,
 Set<GroupIdentity> userGroups,
 String rightId,
 Object object)

Description copied from interface: AccessController

Gets the kind of access a user has on an object for a given right

Specified by:

getPermission in interface AccessController

Parameters:

user - The user. Cannot be null.

userGroups - The groups the user belongs to

rightId - The id of the right of the user

object - The context object to check the access

Returns:

the kind of access a user has on an object for a right

getRightsInTargetProfile

protected List<String> getRightsInTargetProfile()

Get the rights hold by target profile

Returns:

the rights hold by target profile

getTargetProfileId

protected abstract String getTargetProfileId()

Get the id of target profile

Returns:

the id of target profile

getAllowedUsers

protected Set<UserIdentity> getAllowedUsers(Content content,
 ODFRightHelper.ContextualizedPermissionContext permissionCtx)

Get the allowed users for this content taking into account the content itself and its parents

Parameters:

content - the ODF content (program item or orgunit)

permissionCtx - the permission context

Returns:

the allowed users. Empty if no user is allowed on this content

getLocalAllowedUsers

protected abstract Set<UserIdentity> getLocalAllowedUsers(Content content)

Get the local allowed users for this content

Parameters:

content - the ODF content (program item or orgunit)

Returns:

the allowed users. Empty if no user is allowed on this content

getReadAccessPermission

public AccessController.AccessResult getReadAccessPermission(UserIdentity user,
 Set<GroupIdentity> userGroups,
 Object object)

Description copied from interface: AccessController

Gets the kind of access a user has on an object for thye read access

Specified by:

getReadAccessPermission in interface AccessController

Parameters:

user - The user. Cannot be null.

userGroups - The groups the user belongs to

object - The context object to check the access

Returns:

the kind of access a user has on an object for the read access

getPermissionByRight

public Map<String,AccessController.AccessResult> getPermissionByRight(UserIdentity user,
 Set<GroupIdentity> userGroups,
 Object object)

Description copied from interface: AccessController

Gets the kind of access a user has on an object for all rights

Specified by:

getPermissionByRight in interface AccessController

Parameters:

user - The user. Cannot be null.

userGroups - The groups the user belongs to

object - The context object to check the access

Returns:

the kind of access a user has on an object for all rights

getRoleAttributePath

protected abstract String getRoleAttributePath()

Get the attribute path for role

Returns:

the attribute path for role

getPermissionForAnonymous

public AccessController.AccessResult getPermissionForAnonymous(String rightId,
 Object object)

Description copied from interface: AccessController

Gets the permission for Anonymous only on an object for a given right

Specified by:

getPermissionForAnonymous in interface AccessController

Parameters:

rightId - The id of the right to check

object - The object

Returns:

the permission for Anonymous only on an object for a given right

getReadAccessPermissionForAnonymous

public AccessController.AccessResult getReadAccessPermissionForAnonymous(Object object)

Description copied from interface: AccessController

Gets the read access permission for Anonymous only on an object

Specified by:

getReadAccessPermissionForAnonymous in interface AccessController

Parameters:

object - The object

Returns:

the read access permission for Anonymous only on an object

getPermissionForAnyConnectedUser

public AccessController.AccessResult getPermissionForAnyConnectedUser(String rightId,
 Object object)

Description copied from interface: AccessController

Gets the permission for any connected user only on an object for a given right

Specified by:

getPermissionForAnyConnectedUser in interface AccessController

Parameters:

rightId - The id of the right to check

object - The object

Returns:

the permission for any connected user only on an object for a given right

getReadAccessPermissionForAnyConnectedUser

public AccessController.AccessResult getReadAccessPermissionForAnyConnectedUser(Object object)

Description copied from interface: AccessController

Gets the read access permission for any connected user only on an object

Specified by:

getReadAccessPermissionForAnyConnectedUser in interface AccessController

Parameters:

object - The object

Returns:

the read access permission for any connected user only on an object

getPermissionByUser

public Map<UserIdentity,AccessController.AccessResult> getPermissionByUser(String rightId,
 Object object)

Description copied from interface: AccessController

Gets the permission by user only on an object for the given right. It does not take account of the groups of the user, etc.

Specified by:

getPermissionByUser in interface AccessController

Parameters:

rightId - The id of the right to check

object - The object

Returns:

the permission by user only on an object for the given right

getReadAccessPermissionByUser

public Map<UserIdentity,AccessController.AccessResult> getReadAccessPermissionByUser(Object object)

Description copied from interface: AccessController

Gets the read access permission by user only on an object. It does not take account of the groups of the user, etc.

Specified by:

getReadAccessPermissionByUser in interface AccessController

Parameters:

object - The object

Returns:

the read access permission by user only on an object

getPermissionByGroup

public Map<GroupIdentity,AccessController.AccessResult> getPermissionByGroup(String rightId,
 Object object)

Description copied from interface: AccessController

Gets the permission by group only on an object for the given right.

Specified by:

getPermissionByGroup in interface AccessController

Parameters:

rightId - The id of the right to check

object - The object

Returns:

the permission by group only on an object for the given right

getReadAccessPermissionByGroup

public Map<GroupIdentity,AccessController.AccessResult> getReadAccessPermissionByGroup(Object object)

Description copied from interface: AccessController

Gets the read access permission by group only on an object.

Specified by:

getReadAccessPermissionByGroup in interface AccessController

Parameters:

object - The object

Returns:

the read access permission by group only on an object

hasUserAnyPermissionOnWorkspace

public boolean hasUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts,
 UserIdentity user,
 Set<GroupIdentity> userGroups,
 String rightId)

Description copied from interface: AccessController

Returns true if the user has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasUserAnyPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

user - The user

userGroups - The groups

rightId - The id of the right to check

Returns:

true if the user has a permission on at least one object, directly or though groups, for a given right

hasUserAnyReadAccessPermissionOnWorkspace

public boolean hasUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts,
 UserIdentity user,
 Set<GroupIdentity> userGroups)

Description copied from interface: AccessController

Returns true if the user has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasUserAnyReadAccessPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

user - The user

userGroups - The groups

Returns:

true if the user has a permission on at least one object, directly or though groups, for a given right

hasAnonymousAnyPermissionOnWorkspace

public boolean hasAnonymousAnyPermissionOnWorkspace(Set<Object> workspacesContexts,
 String rightId)

Description copied from interface: AccessController

Returns true if anonymous has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasAnonymousAnyPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

rightId - The id of the right to check

Returns:

true if anonymous has a permission on at least one object, directly or though groups, for a given right

hasAnonymousAnyReadAccessPermissionOnWorkspace

public boolean hasAnonymousAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)

Description copied from interface: AccessController

Returns true if anonymous has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasAnonymousAnyReadAccessPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

Returns:

true if anonymous has a permission on at least one object, directly or though groups, for a given right

hasAnyConnectedUserAnyPermissionOnWorkspace

public boolean hasAnyConnectedUserAnyPermissionOnWorkspace(Set<Object> workspacesContexts,
 String rightId)

Description copied from interface: AccessController

Returns true if any connected user has a permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasAnyConnectedUserAnyPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

rightId - The id of the right to check

Returns:

true if any connected user has a permission on at least one object, directly or though groups, for a given right

hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace

public boolean hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace(Set<Object> workspacesContexts)

Description copied from interface: AccessController

Returns true if any connected user has a read access permission on at least one object, directly or though groups, for a given rights and if the object is attached to the given context that is /${WorkspaceName} and its conversions.

Specified by:

hasAnyConnectedUserAnyReadAccessPermissionOnWorkspace in interface AccessController

Parameters:

workspacesContexts - The contexts to tests such as {"/${WorkspaceName}", "/repository", "/admin"}

Returns:

true if any connected user has a permission on at least one object, directly or though groups, for a given right

explainPermission

public AccessExplanation explainPermission(UserIdentity user,
 Set<GroupIdentity> groups,
 String rightId,
 Object object)

Description copied from interface: AccessController

Explain the permission for a user on the given object. The access result in the explanation MUST be the same value as the one returned by AccessController.getPermission(UserIdentity, Set, String, Object). And the explanation should described the actual object that granted the right to allow final user to see if any context conversion happened

Specified by:

explainPermission in interface AccessController

Parameters:

user - the user to test

groups - the groups of the user

rightId - the right to test

object - the object to test

Returns:

an explanation of the access

explainAllPermissions

public Map<AccessController.ExplanationObject,Map<AccessController.Permission,AccessExplanation>> explainAllPermissions(UserIdentity identity,
 Set<GroupIdentity> groups)

Description copied from interface: AccessController

Get AccessExplanation for each permission given to the user by this access controller. Returns a pair of permission/access explanation for each object with a granted or denied permission to this user by this access controller. Each explanation should be equivalent to calling the AccessController.explainPermission(UserIdentity, Set, String, Object) or AccessController.explainReadAccessPermission(UserIdentity, Set, Object) for the user, on the object with the corresponding right

Specified by:

explainAllPermissions in interface AccessController

Parameters:

identity - the user identity

groups - the groups the user belongs to.

Returns:

all the user's permissions handled by this controller

getObjectLabel

public I18nizableText getObjectLabel(Object object)

Description copied from interface: AccessController

Get a label describing the object handled by this access controller

Specified by:

getObjectLabel in interface AccessController

Parameters:

object - the object

Returns:

the label

getObjectCategory

public I18nizableText getObjectCategory(Object object)

Description copied from interface: AccessController

Get a label classifying the object handled by this access controller

Specified by:

getObjectCategory in interface AccessController

Parameters:

object - the object

Returns:

the label

explainAllPermissionsForAnonymous

public Map<AccessController.Permission,AccessExplanation> explainAllPermissionsForAnonymous(Object object)

Description copied from interface: AccessController

Get all the permissions granted to an anonymous user on the object.

Specified by:

explainAllPermissionsForAnonymous in interface AccessController

Parameters:

object - the right context to check. it must be supported by the controller (see Supporter.supports(T)

Returns:

the permissions with their associated explanation

explainAllPermissionsForAnyConnected

public Map<AccessController.Permission,AccessExplanation> explainAllPermissionsForAnyConnected(Object object)

Description copied from interface: AccessController

Get all the permissions granted to any connected user on the object. The result must only include permissions specific to any connected user

Specified by:

explainAllPermissionsForAnyConnected in interface AccessController

Parameters:

object - the right context to check. it must be supported by the controller (see Supporter.supports(T)

Returns:

the permissions with their associated explanation

explainAllPermissionsByUser

public Map<UserIdentity,Map<AccessController.Permission,AccessExplanation>> explainAllPermissionsByUser(Object object)

Description copied from interface: AccessController

Get all the permissions granted to users on the object. The result must only include permissions specific to a user

Specified by:

explainAllPermissionsByUser in interface AccessController

Parameters:

object - the right context to check. it must be supported by the controller (see Supporter.supports(T)

Returns:

the permissions with their associated explanation for each user

explainAllPermissionsByGroup

public Map<GroupIdentity,Map<AccessController.Permission,AccessExplanation>> explainAllPermissionsByGroup(Object object)

Description copied from interface: AccessController

Get all the permissions granted to groups on the object. The result must only include permissions specific to a group

Specified by:

explainAllPermissionsByGroup in interface AccessController

Parameters:

object - the right context to check. it must be supported by the controller (see Supporter.supports(T)

Returns:

the permissions with their associated explanation for each group