Make add privilege smarter

git-svn-id: https://svn.argeo.org/commons/trunk@5753 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc

diff --git a/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/JcrUtils.java b/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/JcrUtils.java
index 0a2377b61b52ec7ba4d7d7da5856d38beae5f0c8..5afebcee4811073514c498b064e525b0450ace5b 100644 (file)
--- a/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/JcrUtils.java
+++ b/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/JcrUtils.java
@@ -1242,25 +1242,46 @@ public class JcrUtils implements ArgeoJcrConstants {
         * exist. Session is saved. Synchronized to prevent concurrent modifications
         * of the same node.
         */
-       public synchronized static void addPrivileges(Session session, String path,
-                       Principal principal, List<Privilege> privs)
+       public synchronized static Boolean addPrivileges(Session session,
+                       String path, Principal principal, List<Privilege> privs)
                        throws RepositoryException {
                // make sure the session is in line with the persisted state
                session.refresh(false);
                AccessControlManager acm = session.getAccessControlManager();
                AccessControlList acl = getAccessControlList(acm, path);
-               acl.addAccessControlEntry(principal,
-                               privs.toArray(new Privilege[privs.size()]));
+
+               accessControlEntries: for (AccessControlEntry ace : acl
+                               .getAccessControlEntries()) {
+                       Principal currentPrincipal = ace.getPrincipal();
+                       if (currentPrincipal.getName().equals(principal.getName())) {
+                               Privilege[] currentPrivileges = ace.getPrivileges();
+                               if (currentPrivileges.length != privs.size())
+                                       break accessControlEntries;
+                               for (int i = 0; i < currentPrivileges.length; i++) {
+                                       Privilege currP = currentPrivileges[i];
+                                       Privilege p = privs.get(i);
+                                       if (!currP.getName().equals(p.getName())) {
+                                               break accessControlEntries;
+                                       }
+                               }
+                               return false;
+                       }
+               }
+
+               Privilege[] privileges = privs.toArray(new Privilege[privs.size()]);
+               acl.addAccessControlEntry(principal, privileges);
                acm.setPolicy(path, acl);
-//             if (log.isTraceEnabled()) {
-//                     StringBuffer privBuf = new StringBuffer();
-//                     for (Privilege priv : privs)
-//                             privBuf.append(priv.getName());
-//                     log.trace("Added privileges " + privBuf + " to " + principal
-//                                     + " on " + path);
-//             }
+               if (log.isDebugEnabled()) {
+                       StringBuffer privBuf = new StringBuffer();
+                       for (Privilege priv : privs)
+                               privBuf.append(priv.getName());
+                       log.debug("Added privileges " + privBuf + " to "
+                                       + principal.getName() + " on " + path + " in '"
+                                       + session.getWorkspace().getName() + "'");
+               }
                session.refresh(true);
                session.save();
+               return true;
        }
 
        /** Gets access control list for this path, throws exception if not found */

diff --git a/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/security/JcrAuthorizations.java b/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/security/JcrAuthorizations.java
index 14ac2bc340f78342ebf01963245b9b835d69d364..7e698602eb78c461f9d1a25fc469f1e8e2cad782 100644 (file)
--- a/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/security/JcrAuthorizations.java
+++ b/server/runtime/org.argeo.server.jcr/src/main/java/org/argeo/jcr/security/JcrAuthorizations.java
@@ -27,15 +27,14 @@ import javax.jcr.Session;
 import javax.jcr.security.AccessControlManager;
 import javax.jcr.security.Privilege;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.argeo.ArgeoException;
 import org.argeo.jcr.JcrUtils;
 import org.argeo.util.security.SimplePrincipal;
 
 /** Apply authorizations to a JCR repository. */
 public class JcrAuthorizations implements Runnable {
-       private final static Log log = LogFactory.getLog(JcrAuthorizations.class);
+       // private final static Log log =
+       // LogFactory.getLog(JcrAuthorizations.class);
 
        private Repository repository;
        private String workspace = null;
@@ -127,14 +126,14 @@ public class JcrAuthorizations implements Runnable {
                                Principal principal = getOrCreatePrincipal(session,
                                                principalName);
                                JcrUtils.addPrivileges(session, path, principal, privs);
-                               if (log.isDebugEnabled()) {
-                                       StringBuffer privBuf = new StringBuffer();
-                                       for (Privilege priv : privs)
-                                               privBuf.append(priv.getName());
-                                       log.debug("Added privileges " + privBuf + " to "
-                                                       + principal.getName() + " on " + path + " in '"
-                                                       + session.getWorkspace().getName() + "'");
-                               }
+                               // if (log.isDebugEnabled()) {
+                               // StringBuffer privBuf = new StringBuffer();
+                               // for (Privilege priv : privs)
+                               // privBuf.append(priv.getName());
+                               // log.debug("Added privileges " + privBuf + " to "
+                               // + principal.getName() + " on " + path + " in '"
+                               // + session.getWorkspace().getName() + "'");
+                               // }
                        }
                }