X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.core%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fjcr%2FJcrSecurityModel.java;h=e9ab89c2ae8eb4e70786975d0e6e20f4d3ce5f7d;hb=3ea877ebf1b76ffd20319f45b535da45b38e2439;hp=1ec6d280fe2f6733abdcfb09097b026c4f770175;hpb=a39a9b0e7ad6a44b4fab9db2d2a2224badd4062d;p=lgpl%2Fargeo-commons.git

diff --git a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrSecurityModel.java b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrSecurityModel.java
index 1ec6d280f..e9ab89c2a 100644
--- a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrSecurityModel.java
+++ b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrSecurityModel.java
@@ -1,114 +1,36 @@
+/*
+ * Copyright (C) 2007-2012 Argeo GmbH
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *         http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
 package org.argeo.security.jcr;
 
+import java.util.List;
+
 import javax.jcr.Node;
-import javax.jcr.RepositoryException;
 import javax.jcr.Session;
-import javax.jcr.security.Privilege;
-import javax.jcr.version.VersionManager;
-
-import org.argeo.ArgeoException;
-import org.argeo.jcr.ArgeoJcrConstants;
-import org.argeo.jcr.ArgeoNames;
-import org.argeo.jcr.ArgeoTypes;
-import org.argeo.jcr.JcrUtils;
-import org.argeo.jcr.UserJcrUtils;
 
 /**
  * Manages data expected by the Argeo security model, such as user home and
  * profile.
  */
-public class JcrSecurityModel {
-	// ArgeoNames not implemented as interface in order to ease derivation by
-	// Jackrabbit bundles
-
-	/** The home base path. */
-	private String homeBasePath = "/home";
-
+public interface JcrSecurityModel {
 	/**
 	 * To be called before user details are loaded. Make sure than any logged in
 	 * user has a home directory with full access and a profile with information
 	 * about him (read access)
 	 * 
-	 * @return the user profile (whose parent is the user home)
+	 * @return the user profile (whose parent is the user home), never null
 	 */
-	public Node sync(Session session, String username) {
-		// TODO check user name validity (e.g. should not start by ROLE_)
-
-		try {
-			Node userHome = UserJcrUtils.getUserHome(session, username);
-			if (userHome == null) {
-				String homePath = generateUserPath(homeBasePath, username);
-				userHome = JcrUtils.mkdirs(session, homePath);
-				// userHome = JcrUtils.mkfolders(session, homePath);
-				userHome.addMixin(ArgeoTypes.ARGEO_USER_HOME);
-				userHome.setProperty(ArgeoNames.ARGEO_USER_ID, username);
-				session.save();
-
-				JcrUtils.clearAccessControList(session, homePath, username);
-				JcrUtils.addPrivilege(session, homePath, username,
-						Privilege.JCR_ALL);
-			} else {
-				// for backward compatibility with pre 1.0 security model
-				if (userHome.hasNode(ArgeoNames.ARGEO_PROFILE)) {
-					userHome.getNode(ArgeoNames.ARGEO_PROFILE).remove();
-					userHome.getSession().save();
-				}
-			}
-
-			Node userProfile = UserJcrUtils.getUserProfile(session, username);
-			if (userProfile == null) {
-				String personPath = generateUserPath(
-						ArgeoJcrConstants.PEOPLE_BASE_PATH, username);
-				Node personBase = JcrUtils.mkdirs(session, personPath);
-				userProfile = personBase.addNode(ArgeoNames.ARGEO_PROFILE);
-				userProfile.addMixin(ArgeoTypes.ARGEO_USER_PROFILE);
-				userProfile.setProperty(ArgeoNames.ARGEO_USER_ID, username);
-				userProfile.setProperty(ArgeoNames.ARGEO_ENABLED, true);
-				userProfile.setProperty(ArgeoNames.ARGEO_ACCOUNT_NON_EXPIRED,
-						true);
-				userProfile.setProperty(ArgeoNames.ARGEO_ACCOUNT_NON_LOCKED,
-						true);
-				userProfile.setProperty(
-						ArgeoNames.ARGEO_CREDENTIALS_NON_EXPIRED, true);
-				session.save();
-
-				JcrUtils.clearAccessControList(session, userProfile.getPath(),
-						username);
-				JcrUtils.addPrivilege(session, userProfile.getPath(), username,
-						Privilege.JCR_READ);
-
-				VersionManager versionManager = session.getWorkspace()
-						.getVersionManager();
-				if (versionManager.isCheckedOut(userProfile.getPath()))
-					versionManager.checkin(userProfile.getPath());
-			}
-			return userProfile;
-		} catch (RepositoryException e) {
-			JcrUtils.discardQuietly(session);
-			throw new ArgeoException("Cannot sync node security model for "
-					+ username, e);
-		}
-	}
-
-	/** Generate path for a new user home */
-	protected String generateUserPath(String base, String username) {
-		int atIndex = username.indexOf('@');
-		if (atIndex > 0) {
-			String domain = username.substring(0, atIndex);
-			String name = username.substring(atIndex + 1);
-			return base + '/' + JcrUtils.firstCharsToPath(domain, 2) + '/'
-					+ domain + '/' + JcrUtils.firstCharsToPath(name, 2) + '/'
-					+ name;
-		} else if (atIndex == 0 || atIndex == (username.length() - 1)) {
-			throw new ArgeoException("Unsupported username " + username);
-		} else {
-			return base + '/' + JcrUtils.firstCharsToPath(username, 2) + '/'
-					+ username;
-		}
-	}
-
-	public void setHomeBasePath(String homeBasePath) {
-		this.homeBasePath = homeBasePath;
-	}
-
+	public Node sync(Session session, String username, List<String> roles);
 }