X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=security%2Fruntime%2Forg.argeo.security.core%2Fsrc%2Fmain%2Fjava%2Forg%2Fargeo%2Fsecurity%2Fjcr%2FJcrUserDetails.java;h=a59eabc0a8dd862083c3bb027bce5524d91b6ce2;hb=484dcb1507e4e35cc282e50522ea7eac7e99a7f9;hp=f7d016cf40cbd1983400c83adbd301e344a3d81e;hpb=fb4f7c451ea7d9025f7cf7fe032020f229df794a;p=lgpl%2Fargeo-commons.git

diff --git a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrUserDetails.java b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrUserDetails.java
index f7d016cf4..a59eabc0a 100644
--- a/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrUserDetails.java
+++ b/security/runtime/org.argeo.security.core/src/main/java/org/argeo/security/jcr/JcrUserDetails.java
@@ -3,41 +3,90 @@ package org.argeo.security.jcr;
 import java.util.ArrayList;
 import java.util.List;
 
+import javax.jcr.Node;
+import javax.jcr.RepositoryException;
+
+import org.argeo.jcr.ArgeoNames;
+import org.springframework.security.BadCredentialsException;
+import org.springframework.security.DisabledException;
 import org.springframework.security.GrantedAuthority;
 import org.springframework.security.GrantedAuthorityImpl;
+import org.springframework.security.LockedException;
 import org.springframework.security.userdetails.User;
 
-public class JcrUserDetails extends User {
-	private static final long serialVersionUID = -3594542993773402380L;
+/** User details based on a user profile node. */
+public class JcrUserDetails extends User implements ArgeoNames {
+	private static final long serialVersionUID = -8142764995842559646L;
 	private final String homePath;
+	private final String securityWorkspace;
 
-	public JcrUserDetails(String homePath, String username, String password,
-			boolean enabled, boolean accountNonExpired,
-			boolean credentialsNonExpired, boolean accountNonLocked,
-			GrantedAuthority[] authorities) throws IllegalArgumentException {
+	protected JcrUserDetails(String securityWorkspace, String homePath,
+			String username, String password, boolean enabled,
+			boolean accountNonExpired, boolean credentialsNonExpired,
+			boolean accountNonLocked, GrantedAuthority[] authorities)
+			throws IllegalArgumentException {
 		super(username, password, enabled, accountNonExpired,
 				credentialsNonExpired, accountNonLocked, authorities);
 		this.homePath = homePath;
+		this.securityWorkspace = securityWorkspace;
 	}
 
-	public String getHomePath() {
-		return homePath;
+	public JcrUserDetails(Node userProfile, String password,
+			GrantedAuthority[] authorities) throws RepositoryException {
+		super(
+				userProfile.getProperty(ARGEO_USER_ID).getString(),
+				password,
+				userProfile.getProperty(ARGEO_ENABLED).getBoolean(),
+				userProfile.getProperty(ARGEO_ACCOUNT_NON_EXPIRED).getBoolean(),
+				userProfile.getProperty(ARGEO_CREDENTIALS_NON_EXPIRED)
+						.getBoolean(), userProfile.getProperty(
+						ARGEO_ACCOUNT_NON_LOCKED).getBoolean(), authorities);
+		// home is defined as the parent of the profile
+		homePath = userProfile.getParent().getPath();
+		securityWorkspace = userProfile.getSession().getWorkspace().getName();
+	}
+
+	/**
+	 * Check the account status in JCR, throwing the exceptions expected by
+	 * Spring security if needed.
+	 */
+	public static void checkAccountStatus(Node userProfile) {
+		try {
+			if (!userProfile.getProperty(ARGEO_ENABLED).getBoolean())
+				throw new DisabledException(userProfile.getPath()
+						+ " is disabled");
+			if (!userProfile.getProperty(ARGEO_ACCOUNT_NON_LOCKED).getBoolean())
+				throw new LockedException(userProfile.getPath() + " is locked");
+		} catch (RepositoryException e) {
+			throw new BadCredentialsException("Cannot check account status", e);
+		}
 	}
 
+	/** Clone immutable with new roles */
 	public JcrUserDetails cloneWithNewRoles(List<String> roles) {
 		List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
 		for (String role : roles) {
 			authorities.add(new GrantedAuthorityImpl(role));
 		}
-		return new JcrUserDetails(homePath, getUsername(), getPassword(),
-				isEnabled(), isAccountNonExpired(), isAccountNonExpired(),
-				isAccountNonLocked(),
+		return new JcrUserDetails(securityWorkspace, homePath, getUsername(),
+				getPassword(), isEnabled(), isAccountNonExpired(),
+				isAccountNonExpired(), isAccountNonLocked(),
 				authorities.toArray(new GrantedAuthority[authorities.size()]));
 	}
 
+	/** Clone immutable with new password */
 	public JcrUserDetails cloneWithNewPassword(String password) {
-		return new JcrUserDetails(homePath, getUsername(), password,
-				isEnabled(), isAccountNonExpired(), isAccountNonExpired(),
-				isAccountNonLocked(), getAuthorities());
+		return new JcrUserDetails(securityWorkspace, homePath, getUsername(),
+				password, isEnabled(), isAccountNonExpired(),
+				isAccountNonExpired(), isAccountNonLocked(), getAuthorities());
+	}
+
+	public String getHomePath() {
+		return homePath;
+	}
+
+	/** Not yet API */
+	public String getSecurityWorkspace() {
+		return securityWorkspace;
 	}
 }