]> git.argeo.org Git - lgpl/argeo-commons.git/blobdiff - server/runtime/org.argeo.server.jackrabbit/src/main/java/org/argeo/jackrabbit/JackrabbitContainer.java
Big cleanup of the security layers
[lgpl/argeo-commons.git] / server / runtime / org.argeo.server.jackrabbit / src / main / java / org / argeo / jackrabbit / JackrabbitContainer.java
index 3dab19312dd57dd3ba8fe1d58055976400b9623b..10c7af1d05e002359ce4abf758b3ebb7d9c08fa0 100644 (file)
 
 package org.argeo.jackrabbit;
 
-import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.Reader;
+import java.net.URL;
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Properties;
+import java.util.Set;
+import java.util.TreeSet;
+import java.util.UUID;
 import java.util.concurrent.Executor;
 
 import javax.jcr.Credentials;
 import javax.jcr.LoginException;
 import javax.jcr.NoSuchWorkspaceException;
+import javax.jcr.Node;
 import javax.jcr.Repository;
 import javax.jcr.RepositoryException;
 import javax.jcr.Session;
+import javax.jcr.SimpleCredentials;
 import javax.jcr.Value;
 
 import org.apache.commons.io.FileUtils;
@@ -45,17 +51,17 @@ import org.apache.jackrabbit.api.JackrabbitRepository;
 import org.apache.jackrabbit.commons.NamespaceHelper;
 import org.apache.jackrabbit.commons.cnd.CndImporter;
 import org.apache.jackrabbit.core.RepositoryImpl;
-import org.apache.jackrabbit.core.TransientRepository;
 import org.apache.jackrabbit.core.config.RepositoryConfig;
 import org.apache.jackrabbit.core.config.RepositoryConfigurationParser;
 import org.apache.jackrabbit.jcr2dav.Jcr2davRepositoryFactory;
 import org.argeo.ArgeoException;
+import org.argeo.jcr.ArgeoNames;
 import org.argeo.jcr.JcrUtils;
-import org.springframework.beans.factory.DisposableBean;
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.context.ResourceLoaderAware;
+import org.argeo.security.SystemAuthentication;
 import org.springframework.core.io.Resource;
-import org.springframework.core.io.ResourceLoader;
+import org.springframework.security.Authentication;
+import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
 import org.springframework.util.SystemPropertyUtils;
 import org.xml.sax.InputSource;
 
@@ -63,144 +69,250 @@ import org.xml.sax.InputSource;
  * Wrapper around a Jackrabbit repository which allows to configure it in Spring
  * and expose it as a {@link Repository}.
  */
-public class JackrabbitContainer implements InitializingBean, DisposableBean,
-               Repository, ResourceLoaderAware {
+public class JackrabbitContainer implements Repository {
        private Log log = LogFactory.getLog(JackrabbitContainer.class);
 
+       // remote
+       private String uri = null;
+       private Credentials remoteSystemCredentials = null;
+
+       // local
        private Resource configuration;
+       private RepositoryConfig repositoryConfig;
        private File homeDirectory;
        private Resource variables;
-
        private Boolean inMemory = false;
-       private String uri = null;
 
+       // wrapped repository
        private Repository repository;
 
-       private ResourceLoader resourceLoader;
-
+       // data model
        /** Node type definitions in CND format */
        private List<String> cndFiles = new ArrayList<String>();
 
+       /** Migrations to execute (if not already done) */
+       private Set<JackrabbitDataModelMigration> dataModelMigrations = new HashSet<JackrabbitDataModelMigration>();
+
        /** Namespaces to register: key is prefix, value namespace */
        private Map<String, String> namespaces = new HashMap<String, String>();
 
        private Boolean autocreateWorkspaces = false;
 
        private Executor systemExecutor;
-       private Credentials adminCredentials;
-
-       // transition from legacy spring approach
-       private Boolean alreadyInitialized = false;
-       private Boolean alreadyDisposed = false;
 
-       /** @deprecated explicitly declare {@link #init()} as init-method instead. */
-       public void afterPropertiesSet() throws Exception {
-               log.warn("## This initialization approach is deprecated and will be removed,"
-                               + " declare init-method=\"init\" instead.");
-               if (!alreadyInitialized)
-                       initImpl();
+       /**
+        * Empty constructor, {@link #init()} should be called after properties have
+        * been set
+        */
+       public JackrabbitContainer() {
        }
 
-       public void init() throws Exception {
-               initImpl();
-               alreadyInitialized = true;
+       /**
+        * Convenience constructor for remote, {@link #init()} is called in the
+        * constructor.
+        */
+       public JackrabbitContainer(String uri, Credentials remoteSystemCredentials) {
+               setUri(uri);
+               setRemoteSystemCredentials(remoteSystemCredentials);
+               init();
        }
 
-       protected void initImpl() throws Exception {
+       /** Initializes */
+       public void init() {
                if (repository != null) {
                        // we are just wrapping another repository
-                       importNodeTypeDefinitions(repository);
+                       prepareDataModel();
                        return;
                }
 
-               // remote repository
-               if (uri != null && !uri.trim().equals("")) {
-                       Map<String, String> params = new HashMap<String, String>();
-                       params.put(org.apache.jackrabbit.commons.JcrUtils.REPOSITORY_URI,
-                                       uri);
-                       repository = new Jcr2davRepositoryFactory().getRepository(params);
-                       if (repository == null)
-                               throw new ArgeoException("Remote Davex repository " + uri
-                                               + " not found");
-                       log.info("Initialized Jackrabbit repository " + repository
-                                       + " from URI " + uri);
-                       // do not perform further initialization since we assume that the
-                       // remote repository has been properly configured
-                       return;
-               }
+               createJackrabbitRepository();
+               // migrate if needed
+               migrate();
+
+               // apply new CND files after migration
+               if (cndFiles != null && cndFiles.size() > 0)
+                       prepareDataModel();
+       }
 
-               // local repository
-               if (inMemory && homeDirectory.exists()) {
-                       FileUtils.deleteDirectory(homeDirectory);
-                       log.warn("Deleted Jackrabbit home directory " + homeDirectory);
+       /** Actually creates the new repository. */
+       protected void createJackrabbitRepository() {
+               long begin = System.currentTimeMillis();
+               InputStream configurationIn = null;
+               try {
+                       if (uri != null && !uri.trim().equals("")) {// remote
+                               Map<String, String> params = new HashMap<String, String>();
+                               params.put(
+                                               org.apache.jackrabbit.commons.JcrUtils.REPOSITORY_URI,
+                                               uri);
+                               repository = new Jcr2davRepositoryFactory()
+                                               .getRepository(params);
+                               if (repository == null)
+                                       throw new ArgeoException("Remote Davex repository " + uri
+                                                       + " not found");
+                               log.info("Initialized Jackrabbit repository " + repository
+                                               + " from URI " + uri);
+                               // we assume that the remote repository has been properly
+                               // configured
+                       } else {// local
+                               // reset uri to null in order to optimize isRemote()
+                               uri = null;
+
+                               // temporary
+                               if (inMemory && getHomeDirectory().exists()) {
+                                       FileUtils.deleteDirectory(getHomeDirectory());
+                                       log.warn("Deleted Jackrabbit home directory "
+                                                       + getHomeDirectory());
+                               }
+
+                               // process configuration file
+                               Properties vars = getConfigurationProperties();
+                               configurationIn = configuration.getInputStream();
+                               vars.put(
+                                               RepositoryConfigurationParser.REPOSITORY_HOME_VARIABLE,
+                                               getHomeDirectory().getCanonicalPath());
+                               repositoryConfig = RepositoryConfig.create(new InputSource(
+                                               configurationIn), vars);
+
+                               //
+                               // Actual repository creation
+                               //
+                               repository = RepositoryImpl.create(repositoryConfig);
+
+                               double duration = ((double) (System.currentTimeMillis() - begin)) / 1000;
+                               log.info("Initialized Jackrabbit repository in " + duration
+                                               + " s, home: " + getHomeDirectory() + ", config: "
+                                               + configuration);
+                       }
+               } catch (Exception e) {
+                       throw new ArgeoException("Cannot create Jackrabbit repository "
+                                       + getHomeDirectory(), e);
+               } finally {
+                       IOUtils.closeQuietly(configurationIn);
                }
+       }
+
+       /** Executes migrations, if needed. */
+       protected void migrate() {
+               // Remote migration not supported
+               if (isRemote())
+                       return;
+
+               // No migration to perform
+               if (dataModelMigrations.size() == 0)
+                       return;
+
+               Boolean restartAndClearCaches = false;
 
-               RepositoryConfig config;
-               Properties vars = getConfigurationProperties();
-               InputStream in = configuration.getInputStream();
+               // migrate data
+               Session session = null;
                try {
-                       vars.put(RepositoryConfigurationParser.REPOSITORY_HOME_VARIABLE,
-                                       homeDirectory.getCanonicalPath());
-                       config = RepositoryConfig.create(new InputSource(in), vars);
+                       session = login();
+                       for (JackrabbitDataModelMigration dataModelMigration : new TreeSet<JackrabbitDataModelMigration>(
+                                       dataModelMigrations)) {
+                               if (dataModelMigration.migrate(session)) {
+                                       restartAndClearCaches = true;
+                               }
+                       }
+               } catch (ArgeoException e) {
+                       throw e;
                } catch (Exception e) {
-                       throw new RuntimeException("Cannot read configuration", e);
+                       throw new ArgeoException("Cannot migrate", e);
                } finally {
-                       IOUtils.closeQuietly(in);
+                       JcrUtils.logoutQuietly(session);
                }
 
-               if (inMemory)
-                       repository = new TransientRepository(config);
-               else
-                       repository = RepositoryImpl.create(config);
+               // restart repository
+               if (restartAndClearCaches) {
+                       JackrabbitDataModelMigration
+                                       .clearRepositoryCaches(repositoryConfig);
+                       ((JackrabbitRepository) repository).shutdown();
+                       createJackrabbitRepository();
+               }
 
-               if (cndFiles != null && cndFiles.size() > 0)
-                       importNodeTypeDefinitions(repository);
+               // set data model version
+               try {
+                       session = login();
+               } catch (RepositoryException e) {
+                       throw new ArgeoException("Cannot login to migrated repository", e);
+               }
 
-               log.info("Initialized Jackrabbit repository " + repository + " in "
-                               + homeDirectory + " with config " + configuration);
-       }
+               for (JackrabbitDataModelMigration dataModelMigration : new TreeSet<JackrabbitDataModelMigration>(
+                               dataModelMigrations)) {
+                       try {
+                               if (session.itemExists(dataModelMigration
+                                               .getDataModelNodePath())) {
+                                       Node dataModelNode = session.getNode(dataModelMigration
+                                                       .getDataModelNodePath());
+                                       dataModelNode.setProperty(
+                                                       ArgeoNames.ARGEO_DATA_MODEL_VERSION,
+                                                       dataModelMigration.getTargetVersion());
+                                       session.save();
+                               }
+                       } catch (Exception e) {
+                               log.error("Cannot set model version", e);
+                       }
+               }
+               JcrUtils.logoutQuietly(session);
 
-       /**
-        * @deprecated explicitly declare {@link #dispose()} as destroy-method
-        *             instead.
-        */
-       public void destroy() throws Exception {
-               log.warn("## This dispose approach is deprecated and will be removed,"
-                               + " declare destroy-method=\"dispose\" instead.");
-               if (!alreadyDisposed)
-                       disposeImpl();
        }
 
-       public void dispose() throws Exception {
-               disposeImpl();
-               alreadyDisposed = true;
-       }
+       /** Lazy init. */
+       protected File getHomeDirectory() {
+               try {
+                       if (homeDirectory == null) {
+                               if (inMemory) {
+                                       homeDirectory = new File(
+                                                       System.getProperty("java.io.tmpdir")
+                                                                       + File.separator
+                                                                       + System.getProperty("user.name")
+                                                                       + File.separator + "jackrabbit-"
+                                                                       + UUID.randomUUID());
+                                       homeDirectory.mkdirs();
+                                       // will it work if directory is not empty??
+                                       homeDirectory.deleteOnExit();
+                               }
+                       }
 
-       protected void disposeImpl() throws Exception {
-               if (repository != null) {
-                       if (repository instanceof JackrabbitRepository)
-                               ((JackrabbitRepository) repository).shutdown();
-                       else if (repository instanceof RepositoryImpl)
-                               ((RepositoryImpl) repository).shutdown();
-                       else if (repository instanceof TransientRepository)
-                               ((TransientRepository) repository).shutdown();
+                       return homeDirectory.getCanonicalFile();
+               } catch (IOException e) {
+                       throw new ArgeoException("Cannot get canonical file for "
+                                       + homeDirectory, e);
                }
+       }
 
-               if (inMemory)
-                       if (homeDirectory.exists()) {
-                               FileUtils.deleteDirectory(homeDirectory);
-                               if (log.isDebugEnabled())
-                                       log.debug("Deleted Jackrabbit home directory "
-                                                       + homeDirectory);
-                       }
+       /** Shutdown the repository */
+       public void destroy() throws Exception {
+               if (repository != null && repository instanceof RepositoryImpl) {
+                       long begin = System.currentTimeMillis();
+                       ((RepositoryImpl) repository).shutdown();
+                       if (inMemory)
+                               if (getHomeDirectory().exists()) {
+                                       FileUtils.deleteDirectory(getHomeDirectory());
+                                       if (log.isDebugEnabled())
+                                               log.debug("Deleted Jackrabbit home directory "
+                                                               + getHomeDirectory());
+                               }
+                       double duration = ((double) (System.currentTimeMillis() - begin)) / 1000;
+                       log.info("Destroyed Jackrabbit repository in " + duration
+                                       + " s, home: " + getHomeDirectory() + ", config "
+                                       + configuration);
+               }
+       }
 
-               if (uri != null && !uri.trim().equals(""))
-                       log.info("Destroyed Jackrabbit repository with uri " + uri);
-               else
-                       log.info("Destroyed Jackrabbit repository " + repository + " in "
-                                       + homeDirectory + " with config " + configuration);
+       /**
+        * @deprecated explicitly declare {@link #destroy()} as destroy-method
+        *             instead.
+        */
+       public void dispose() throws Exception {
+               log.error("## Declare destroy-method=\"destroy\". in the Jackrabbit container bean");
+               destroy();
        }
 
+       /*
+        * UTILITIES
+        */
+
+       /** Generates the properties to use in the configuration. */
        protected Properties getConfigurationProperties() {
                InputStream propsIn = null;
                Properties vars;
@@ -219,6 +331,13 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
                        }
                        // override with system properties
                        vars.putAll(System.getProperties());
+
+                       if (log.isTraceEnabled()) {
+                               log.trace("Jackrabbit config variables:");
+                               for (Object key : new TreeSet<Object>(vars.keySet()))
+                                       log.trace(key + "=" + vars.getProperty(key.toString()));
+                       }
+
                } catch (IOException e) {
                        throw new ArgeoException("Cannot read configuration properties", e);
                } finally {
@@ -228,46 +347,56 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
        }
 
        /**
-        * Import declared node type definitions, trying to update them if they have
-        * changed. In case of failures an error will be logged but no exception
-        * will be thrown.
+        * Import declared node type definitions and register namespaces. Tries to
+        * update the node definitions if they have changed. In case of failures an
+        * error will be logged but no exception will be thrown.
         */
-       protected void importNodeTypeDefinitions(final Repository repository) {
-               final Credentials credentialsToUse;
-               if (systemExecutor == null) {
-                       if (adminCredentials == null) {
-                               log.error("No system executor or admin credentials found,"
-                                               + " cannot import node types");
-                               return;
-                       }
-                       credentialsToUse = adminCredentials;
-               } else {
-                       credentialsToUse = null;
-               }
+       protected void prepareDataModel() {
+               // importing node def on remote si currently not supported
+               if (isRemote())
+                       return;
 
                Runnable action = new Runnable() {
                        public void run() {
-                               Reader reader = null;
                                Session session = null;
                                try {
-                                       session = repository.login(credentialsToUse);
-                                       processNewSession(session);
-                                       // Load cnds as resources
+                                       session = login();
+                                       // register namespaces
+                                       if (namespaces.size() > 0) {
+                                               NamespaceHelper namespaceHelper = new NamespaceHelper(
+                                                               session);
+                                               namespaceHelper.registerNamespaces(namespaces);
+                                       }
+                                       // load CND files from classpath or as URL
                                        for (String resUrl : cndFiles) {
-                                               Resource res = resourceLoader.getResource(resUrl);
-                                               byte[] arr = IOUtils.toByteArray(res.getInputStream());
-                                               reader = new InputStreamReader(
-                                                               new ByteArrayInputStream(arr));
-                                               CndImporter.registerNodeTypes(reader, session, true);
+                                               boolean classpath;
+                                               if (resUrl.startsWith("classpath:")) {
+                                                       resUrl = resUrl.substring("classpath:".length());
+                                                       classpath = true;
+                                               } else if (resUrl.indexOf(':') < 0) {
+                                                       classpath = true;
+                                               } else {
+                                                       classpath = false;
+                                               }
+
+                                               URL url = classpath ? getClass().getClassLoader()
+                                                               .getResource(resUrl) : new URL(resUrl);
+
+                                               Reader reader = null;
+                                               try {
+                                                       reader = new InputStreamReader(url.openStream());
+                                                       CndImporter
+                                                                       .registerNodeTypes(reader, session, true);
+                                               } finally {
+                                                       IOUtils.closeQuietly(reader);
+                                               }
                                        }
-                                       session.save();
                                } catch (Exception e) {
                                        log.error(
                                                        "Cannot import node type definitions " + cndFiles,
                                                        e);
                                        JcrUtils.discardQuietly(session);
                                } finally {
-                                       IOUtils.closeQuietly(reader);
                                        JcrUtils.logoutQuietly(session);
                                }
                        }
@@ -279,29 +408,44 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
                        action.run();
        }
 
-       // JCR REPOSITORY (delegated)
+       /*
+        * DELEGATED JCR REPOSITORY METHODS
+        */
+
        public String getDescriptor(String key) {
-               return repository.getDescriptor(key);
+               return getRepository().getDescriptor(key);
        }
 
        public String[] getDescriptorKeys() {
-               return repository.getDescriptorKeys();
-       }
-
-       public Session login() throws LoginException, RepositoryException {
-               Session session = repository.login();
-               processNewSession(session);
-               return session;
+               return getRepository().getDescriptorKeys();
        }
 
+       /** Central login method */
        public Session login(Credentials credentials, String workspaceName)
                        throws LoginException, NoSuchWorkspaceException,
                        RepositoryException {
+
+               // retrieve credentials for remote
+               if (credentials == null && isRemote()) {
+                       Authentication authentication = SecurityContextHolder.getContext()
+                                       .getAuthentication();
+                       if (authentication != null) {
+                               if (authentication instanceof UsernamePasswordAuthenticationToken) {
+                                       UsernamePasswordAuthenticationToken upat = (UsernamePasswordAuthenticationToken) authentication;
+                                       credentials = new SimpleCredentials(upat.getName(), upat
+                                                       .getCredentials().toString().toCharArray());
+                               } else if ((authentication instanceof SystemAuthentication)
+                                               && remoteSystemCredentials != null) {
+                                       credentials = remoteSystemCredentials;
+                               }
+                       }
+               }
+
                Session session;
                try {
-                       session = repository.login(credentials, workspaceName);
+                       session = getRepository().login(credentials, workspaceName);
                } catch (NoSuchWorkspaceException e) {
-                       if (autocreateWorkspaces)
+                       if (autocreateWorkspaces && workspaceName != null)
                                session = createWorkspaceAndLogsIn(credentials, workspaceName);
                        else
                                throw e;
@@ -310,35 +454,37 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
                return session;
        }
 
+       public Session login() throws LoginException, RepositoryException {
+               return login(null, null);
+       }
+
        public Session login(Credentials credentials) throws LoginException,
                        RepositoryException {
-               Session session = repository.login(credentials);
-               processNewSession(session);
-               return session;
+               return login(credentials, null);
        }
 
        public Session login(String workspaceName) throws LoginException,
                        NoSuchWorkspaceException, RepositoryException {
-               Session session;
-               try {
-                       session = repository.login(workspaceName);
-               } catch (NoSuchWorkspaceException e) {
-                       if (autocreateWorkspaces)
-                               session = createWorkspaceAndLogsIn(null, workspaceName);
-                       else
-                               throw e;
-               }
-               processNewSession(session);
-               return session;
+               return login(null, workspaceName);
        }
 
-       protected synchronized void processNewSession(Session session) {
-               try {
-                       NamespaceHelper namespaceHelper = new NamespaceHelper(session);
-                       namespaceHelper.registerNamespaces(namespaces);
-               } catch (Exception e) {
-                       throw new ArgeoException("Cannot process new session", e);
+       /** Called after a session has been created, does nothing by default. */
+       protected void processNewSession(Session session) {
+       }
+
+       public Boolean isRemote() {
+               return uri != null;
+       }
+
+       /** Wraps access to the repository, making sure it is available. */
+       protected Repository getRepository() {
+               if (repository == null) {
+                       throw new ArgeoException(
+                                       "No repository initialized."
+                                                       + " Was the init() method called?"
+                                                       + " The dispose() method should also be called on shutdown.");
                }
+               return repository;
        }
 
        /**
@@ -349,33 +495,32 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
                        String workspaceName) throws RepositoryException {
                if (workspaceName == null)
                        throw new ArgeoException("No workspace specified.");
-               Session session = repository.login(credentials);
+               Session session = getRepository().login(credentials);
                session.getWorkspace().createWorkspace(workspaceName);
                session.logout();
-               return repository.login(credentials, workspaceName);
-       }
-
-       public void setResourceLoader(ResourceLoader resourceLoader) {
-               this.resourceLoader = resourceLoader;
+               return getRepository().login(credentials, workspaceName);
        }
 
        public boolean isStandardDescriptor(String key) {
-               return repository.isStandardDescriptor(key);
+               return getRepository().isStandardDescriptor(key);
        }
 
        public boolean isSingleValueDescriptor(String key) {
-               return repository.isSingleValueDescriptor(key);
+               return getRepository().isSingleValueDescriptor(key);
        }
 
        public Value getDescriptorValue(String key) {
-               return repository.getDescriptorValue(key);
+               return getRepository().getDescriptorValue(key);
        }
 
        public Value[] getDescriptorValues(String key) {
-               return repository.getDescriptorValues(key);
+               return getRepository().getDescriptorValues(key);
        }
 
-       // BEANS METHODS
+       /*
+        * FIELDS ACCESS
+        */
+
        public void setHomeDirectory(File homeDirectory) {
                this.homeDirectory = homeDirectory;
        }
@@ -404,16 +549,20 @@ public class JackrabbitContainer implements InitializingBean, DisposableBean,
                this.uri = uri;
        }
 
-       public void setSystemExecutor(Executor systemExecutor) {
-               this.systemExecutor = systemExecutor;
+       public void setRemoteSystemCredentials(Credentials remoteSystemCredentials) {
+               this.remoteSystemCredentials = remoteSystemCredentials;
        }
 
-       public void setAdminCredentials(Credentials adminCredentials) {
-               this.adminCredentials = adminCredentials;
+       public void setSystemExecutor(Executor systemExecutor) {
+               this.systemExecutor = systemExecutor;
        }
 
        public void setRepository(Repository repository) {
                this.repository = repository;
        }
 
+       public void setDataModelMigrations(
+                       Set<JackrabbitDataModelMigration> dataModelMigrations) {
+               this.dataModelMigrations = dataModelMigrations;
+       }
 }