org.outerj.daisy.repository.acl
Interface AccessManager


public interface AccessManager

Provides functionality for maintaining the ACL (Access Control List) and checking permissions.

See Daisy's documentation for background information on the ACL system.

Basically, instead of associating an ACL with each document in the repository, there is one global ACL. Which ACL entries applies to which documents is based on conditions selecting documents based on eg their document type or collection membership. The structure of the ACL is thus as follows:

 object expression
    acl entry
    acl entry
    ...
 object expression
    acl entry
    acl entry
    ...
 ...
 

wherin the "object expression" is the expression selecting a set of documents. Each "acl entry" specifies for a certain subject (user, role or everyone) the allowed action (deny/grant) for a certain operation (read/write).

Two ACL's are managed: a staging ACL and a live ACL. Only the staging ACL can be directly modified, the live ACL can be updated by replacing it with the staging ACL.

About access to these functions: all users can read the ACL, only the Administrator can save (modify) it. All users can retrieve access information (ie using the getAclInfo* methods) for themselves, the Administrator can retrieve this information for whatever user.


Method Summary
 void copyLiveToStaging()
          Reverts changes to the staging ACL.
 void copyStagingToLive()
          Puts the staging ACL live.
 VariantKey[] filterDocuments(VariantKey[] variantKeys)
          Filters documents based on 'read live' permission.
 VariantKey[] filterDocuments(VariantKey[] variantKeys, AclPermission permission)
          Filters the given list of document variants so that only document variants to which the current user has the given ACL permission remains.
 long[] filterDocumentTypes(long[] documentTypeIds, long collectionId)
          Filters the given list of document type ids to the ones for which the user is potentially able to create new documents.
 AclResultInfo getAclInfo(Document document)
          Gets ACL info for the current user, by evaluating the (live) ACL rules on the given document object.
 AclResultInfo getAclInfoOnLive(long userId, long[] roleIds, Document document)
          Checks the ACL using the supplied document object.
 AclResultInfo getAclInfoOnLive(long userId, long[] roleIds, long documentId)
          Gets the ACL info for the branch "main" and language "default" of the document.
 AclResultInfo getAclInfoOnLive(long userId, long[] roleIds, long documentId, long branchId, long languageId)
          Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the live ACL.
 AclResultInfo getAclInfoOnLive(long userId, long[] roleIds, VariantKey key)
          Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the live ACL.
 AclResultInfo getAclInfoOnStaging(long userId, long[] roleIds, Document document)
          Equivalent of getAclInfoOnLive(long, long[], org.outerj.daisy.repository.Document).
 AclResultInfo getAclInfoOnStaging(long userId, long[] roleIds, long documentId)
          Gets the ACL info for the branch "main" and language "default" of the document.
 AclResultInfo getAclInfoOnStaging(long userId, long[] roleIds, long documentId, long branchId, long languageId)
          Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the staging ACL.
 AclResultInfo getAclInfoOnStaging(long userId, long[] roleIds, VariantKey key)
          Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the staging ACL.
 Acl getLiveAcl()
          Gets the currently active, live ACL.
 Acl getStagingAcl()
          Gets the staging ACL.
 

Method Detail

getLiveAcl

Acl getLiveAcl()
               throws RepositoryException
Gets the currently active, live ACL. This ACL is not modifiable. To make modifications to the ACL, first modify the staging ACL, and then put the staging version live by callling copyLiveToStaging().

Throws:
RepositoryException

getStagingAcl

Acl getStagingAcl()
                  throws RepositoryException
Gets the staging ACL.

Throws:
RepositoryException

copyStagingToLive

void copyStagingToLive()
                       throws RepositoryException
Puts the staging ACL live.

Throws:
RepositoryException

copyLiveToStaging

void copyLiveToStaging()
                       throws RepositoryException
Reverts changes to the staging ACL.

Throws:
RepositoryException

getAclInfo

AclResultInfo getAclInfo(Document document)
                         throws RepositoryException
Gets ACL info for the current user, by evaluating the (live) ACL rules on the given document object.

Throws:
RepositoryException

getAclInfoOnLive

AclResultInfo getAclInfoOnLive(long userId,
                               long[] roleIds,
                               long documentId,
                               long branchId,
                               long languageId)
                               throws RepositoryException
Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the live ACL.

Throws:
RepositoryException

getAclInfoOnLive

AclResultInfo getAclInfoOnLive(long userId,
                               long[] roleIds,
                               VariantKey key)
                               throws RepositoryException
Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the live ACL.

Throws:
RepositoryException

getAclInfoOnLive

AclResultInfo getAclInfoOnLive(long userId,
                               long[] roleIds,
                               long documentId)
                               throws RepositoryException
Gets the ACL info for the branch "main" and language "default" of the document. This method is mainly provided for backwards compatibility.

Throws:
RepositoryException

getAclInfoOnStaging

AclResultInfo getAclInfoOnStaging(long userId,
                                  long[] roleIds,
                                  long documentId,
                                  long branchId,
                                  long languageId)
                                  throws RepositoryException
Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the staging ACL.

Throws:
RepositoryException

getAclInfoOnStaging

AclResultInfo getAclInfoOnStaging(long userId,
                                  long[] roleIds,
                                  VariantKey key)
                                  throws RepositoryException
Gets ACL info for the specified user acting in the specified role, for the specified document variant, by evaluating the staging ACL.

Throws:
RepositoryException

getAclInfoOnStaging

AclResultInfo getAclInfoOnStaging(long userId,
                                  long[] roleIds,
                                  long documentId)
                                  throws RepositoryException
Gets the ACL info for the branch "main" and language "default" of the document. This method is mainly provided for backwards compatibility.

Throws:
RepositoryException

getAclInfoOnLive

AclResultInfo getAclInfoOnLive(long userId,
                               long[] roleIds,
                               Document document)
                               throws RepositoryException
Checks the ACL using the supplied document object. The current content of the document is used during ACL evaluation, even if it includes unsaved changes. This allows to check the ACL result before saving the document.

This method does not work in the remote API implementation.

Throws:
RepositoryException

getAclInfoOnStaging

AclResultInfo getAclInfoOnStaging(long userId,
                                  long[] roleIds,
                                  Document document)
                                  throws RepositoryException
Equivalent of getAclInfoOnLive(long, long[], org.outerj.daisy.repository.Document).

Throws:
RepositoryException

filterDocumentTypes

long[] filterDocumentTypes(long[] documentTypeIds,
                           long collectionId)
                           throws RepositoryException
Filters the given list of document type ids to the ones for which the user is potentially able to create new documents. This does not guarantee that the user will be able to save a newly created document, as this could depend on the values of document fields or the collections to which the document belongs.

The collectionId parameter is optional (specify -1 to ignore) and allows to specify the collection to which the document will be added, which allows for a better filtered result.

Throws:
RepositoryException

filterDocuments

VariantKey[] filterDocuments(VariantKey[] variantKeys,
                             AclPermission permission)
                             throws RepositoryException
Filters the given list of document variants so that only document variants to which the current user has the given ACL permission remains. Non-existing documents/variants will also be excluded.

Especially in the remote API implementation, this is more efficient then retrieving this information for individual documents, since it only requires one backend HTTP call.

Throws:
RepositoryException

filterDocuments

VariantKey[] filterDocuments(VariantKey[] variantKeys)
                             throws RepositoryException
Filters documents based on 'read live' permission. See also filterDocuments(org.outerj.daisy.repository.VariantKey[], AclPermission).

Throws:
RepositoryException


Copyright © -2012 . All Rights Reserved.