From 7bcb1199812e3d353f94d4ef817bd2204cb53fea Mon Sep 17 00:00:00 2001 From: Tom Page Date: Wed, 18 Jan 2017 12:22:24 +0000 Subject: [PATCH 1/3] MNT-16881 Check permission hierarchy using PermissionModel. Use the permission group hierarchy to determine whether the configured permissions imply the queried permission or not. --- .../org_alfresco_module_rm/module-context.xml | 1 + ...ordsManagementPermissionPostProcessor.java | 110 ++++++++++++------ .../processor/PermissionPostProcessor.java | 2 +- 3 files changed, 75 insertions(+), 38 deletions(-) diff --git a/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/module-context.xml b/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/module-context.xml index 4ef9447a72..63242f2ab1 100644 --- a/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/module-context.xml +++ b/rm-community/rm-community-repo/config/alfresco/module/org_alfresco_module_rm/module-context.xml @@ -78,6 +78,7 @@ + diff --git a/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessor.java b/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessor.java index 660cb6bc90..9fc6e6bc1f 100644 --- a/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessor.java +++ b/rm-community/rm-community-repo/source/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessor.java @@ -31,6 +31,8 @@ import java.util.List; import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel; import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel; +import org.alfresco.repo.security.permissions.PermissionReference; +import org.alfresco.repo.security.permissions.impl.model.PermissionModel; import org.alfresco.repo.security.permissions.processor.impl.PermissionPostProcessorBaseImpl; import org.alfresco.service.cmr.repository.NodeRef; import org.alfresco.service.cmr.repository.NodeService; @@ -39,47 +41,81 @@ import org.alfresco.service.cmr.security.PermissionService; /** * Records management permission post processor. - * + * * @author Roy Wetherall * @since 2.4.a */ -public class RecordsManagementPermissionPostProcessor extends PermissionPostProcessorBaseImpl +public class RecordsManagementPermissionPostProcessor extends PermissionPostProcessorBaseImpl { - /** node service */ - private NodeService nodeService; - public void setNodeService(NodeService nodeService) {this.nodeService=nodeService;} - - /** permission service */ - private PermissionService permissionService; - public void setPermissionService(PermissionService permissionService) {this.permissionService=permissionService;} - - /** - * @see org.alfresco.repo.security.permissions.processor.PermissionPostProcessor#process(org.alfresco.service.cmr.security.AccessStatus, org.alfresco.service.cmr.repository.NodeRef, java.lang.String) - */ - @Override - public AccessStatus process(AccessStatus accessStatus, NodeRef nodeRef, String perm, - List configuredReadPermissions, List configuredFilePermissions) - { - AccessStatus result = accessStatus; - if (AccessStatus.DENIED.equals(accessStatus) && + /** node service */ + private NodeService nodeService; + public void setNodeService(NodeService nodeService) {this.nodeService=nodeService;} + + /** permission service */ + private PermissionService permissionService; + public void setPermissionService(PermissionService permissionService) {this.permissionService=permissionService;} + + /** The permission model DAO. */ + private PermissionModel permissionModel; + public void setPermissionModel(PermissionModel permissionModel) {this.permissionModel=permissionModel;} + + /** + * @see org.alfresco.repo.security.permissions.processor.PermissionPostProcessor#process(org.alfresco.service.cmr.security.AccessStatus, org.alfresco.service.cmr.repository.NodeRef, java.lang.String) + */ + @Override + public AccessStatus process(AccessStatus accessStatus, NodeRef nodeRef, String perm, + List configuredReadPermissions, List configuredFilePermissions) + { + AccessStatus result = accessStatus; + if (AccessStatus.DENIED.equals(accessStatus) && nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) - { - // if read denied on rm artifact - if (PermissionService.READ.equals(perm) || configuredReadPermissions.contains(perm)) - { - // check for read record - result = permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS); - } - // if write deinied on rm artificat - else if (PermissionService.WRITE.equals(perm) || configuredFilePermissions.contains(perm)) - { - // check for file record - result = permissionService.hasPermission(nodeRef, RMPermissionModel.FILE_RECORDS); - } - } - - return result; - - } + { + // if read denied on rm artifact + if (PermissionService.READ.equals(perm) || isPermissionContained(perm, configuredReadPermissions)) + { + // check for read record + result = permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS); + } + // if write denied on rm artifact + else if (PermissionService.WRITE.equals(perm) || isPermissionContained(perm, configuredFilePermissions)) + { + // check for file record + result = permissionService.hasPermission(nodeRef, RMPermissionModel.FILE_RECORDS); + } + } + + return result; + + } + + /** + * Check if a given permission is implied by a list of permission groups. + * + * @param perm The name of the permission in question. + * @param configuredPermissions The list of permission group names. + * @return true if the permission is contained or implied by the list of permissions. + */ + private boolean isPermissionContained(String perm, List configuredPermissions) + { + // Check if the permission is explicitly in the list + if (configuredPermissions.contains(perm)) + { + return true; + } + // Check if the permission is implied by one from the list. + for (String configuredPermission : configuredPermissions) + { + // TODO: Here we are assuming the permission name is unique across all contexts (but I think we're doing that in the properties file anyway). + PermissionReference permissionReference = permissionModel.getPermissionReference(null, configuredPermission); + for (PermissionReference granteePermission : permissionModel.getGranteePermissions(permissionReference)) + { + if (granteePermission.getName().equals(perm)) + { + return true; + } + } + } + return false; + } } diff --git a/rm-community/rm-community-repo/source/java/org/alfresco/repo/security/permissions/processor/PermissionPostProcessor.java b/rm-community/rm-community-repo/source/java/org/alfresco/repo/security/permissions/processor/PermissionPostProcessor.java index 438b3bbd4a..3a38462f5a 100644 --- a/rm-community/rm-community-repo/source/java/org/alfresco/repo/security/permissions/processor/PermissionPostProcessor.java +++ b/rm-community/rm-community-repo/source/java/org/alfresco/repo/security/permissions/processor/PermissionPostProcessor.java @@ -52,5 +52,5 @@ public interface PermissionPostProcessor * @return {@link AccessStatus} */ AccessStatus process(AccessStatus accessStatus, NodeRef nodeRef, String perm, - List configuredReadPermissions, List configuredFilePermissions); + List configuredReadPermissions, List configuredFilePermissions); } From 3b6204873b99f9476a7427d2b6fdec2eea5f6698 Mon Sep 17 00:00:00 2001 From: Tom Page Date: Thu, 19 Jan 2017 16:26:52 +0000 Subject: [PATCH 2/3] MNT-16881 Fix unit test and write an additional one. --- ...gementPermissionPostProcessorUnitTest.java | 66 ++++++++++++++++--- 1 file changed, 56 insertions(+), 10 deletions(-) diff --git a/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java b/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java index cfa99cae76..db87c4a511 100644 --- a/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java +++ b/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java @@ -28,8 +28,8 @@ package org.alfresco.module.org_alfresco_module_rm.permission; import static java.util.Arrays.asList; - import static org.junit.Assert.assertEquals; +import static org.mockito.Mockito.mock; import static org.mockito.Mockito.when; import java.util.List; @@ -37,6 +37,8 @@ import java.util.List; import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel; import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel; import org.alfresco.module.org_alfresco_module_rm.test.util.AlfMock; +import org.alfresco.repo.security.permissions.PermissionReference; +import org.alfresco.repo.security.permissions.impl.model.PermissionModel; import org.alfresco.service.cmr.repository.NodeRef; import org.alfresco.service.cmr.repository.NodeService; import org.alfresco.service.cmr.security.AccessStatus; @@ -47,20 +49,26 @@ import org.mockito.InjectMocks; import org.mockito.Mock; import org.mockito.MockitoAnnotations; +import com.google.common.collect.Sets; + /** * Unit tests for {@link RecordsManagementPermissionPostProcessor}. * * @author David Webster + * @author Tom Page * @since 2.4.1 */ public class RecordsManagementPermissionPostProcessorUnitTest { + @InjectMocks + private RecordsManagementPermissionPostProcessor recordsManagementPermissionPostProcessor = new RecordsManagementPermissionPostProcessor(); - private @InjectMocks - RecordsManagementPermissionPostProcessor recordsManagementPermissionPostProcessor = new RecordsManagementPermissionPostProcessor(); - - private @Mock NodeService nodeService; - private @Mock PermissionService permissionService; + @Mock + private NodeService mockNodeService; + @Mock + private PermissionService mockPermissionService; + @Mock + private PermissionModel mockPermissionModel; @Before public void setup() @@ -83,9 +91,9 @@ public class RecordsManagementPermissionPostProcessorUnitTest List configuredReadPermissions = asList("ReadProperties", "ReadChildren", perm); List configuredFilePermissions = asList("WriteProperties", "AddChildren"); - when(nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) + when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) .thenReturn(true); - when(permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS)) + when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS)) .thenReturn(AccessStatus.ALLOWED); AccessStatus result = recordsManagementPermissionPostProcessor.process(accessStatus, nodeRef, perm, configuredReadPermissions, configuredFilePermissions); @@ -108,13 +116,51 @@ public class RecordsManagementPermissionPostProcessorUnitTest List configuredReadPermissions = asList("ReadProperties", "ReadChildren"); List configuredFilePermissions = asList("WriteProperties", "AddChildren"); - when(nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) + when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) .thenReturn(true); - when(permissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS)) + when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.READ_RECORDS)) .thenReturn(AccessStatus.ALLOWED); AccessStatus result = recordsManagementPermissionPostProcessor.process(accessStatus, nodeRef, perm, configuredReadPermissions, configuredFilePermissions); assertEquals(AccessStatus.DENIED, result); } + + /** + * Test that the permission groups configured in the global properties file imply descendant permission groups. + *

+ * Given a configured permission is an ancestor of another permission P + * And the post processor checks if the user has P + * Then the post processor says that they do. + */ + @Test + public void permissionInherittedFromConfiguredGroup() + { + NodeRef nodeRef = new NodeRef("node://ref/"); + // permissions do not include perm created above + List configuredReadPermissions = asList(); + List configuredFilePermissions = asList("WriteProperties"); + + when(mockNodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT)) + .thenReturn(true); + when(mockPermissionService.hasPermission(nodeRef, RMPermissionModel.FILE_RECORDS)) + .thenReturn(AccessStatus.ALLOWED); + + // Set up "WriteProperties" to imply three other permission groups. + PermissionReference mockWritePropsPermRef = mock(PermissionReference.class); + when(mockPermissionModel.getPermissionReference(null, "WriteProperties")).thenReturn(mockWritePropsPermRef); + PermissionReference childOne = mock(PermissionReference.class); + when(childOne.getName()).thenReturn("Not this one"); + PermissionReference childTwo = mock(PermissionReference.class); + when(childOne.getName()).thenReturn("This is the requested permission"); + PermissionReference childThree = mock(PermissionReference.class); + when(childThree.getName()).thenReturn("Not this one either"); + when(mockPermissionModel.getGranteePermissions(mockWritePropsPermRef)).thenReturn(Sets.newHashSet(childOne, childTwo, childThree)); + + // Call the method under test. + AccessStatus result = recordsManagementPermissionPostProcessor.process(AccessStatus.DENIED, nodeRef, + "This is the requested permission", configuredReadPermissions, configuredFilePermissions); + + assertEquals(AccessStatus.ALLOWED, result); + } } From b74b84ab075431b031a8689cd7b04093b9256425 Mon Sep 17 00:00:00 2001 From: Tom Page Date: Tue, 24 Jan 2017 11:45:39 +0000 Subject: [PATCH 3/3] MNT-16881 Fix typo in unit test. Due to the lack of ordering in hash sets, this was passing locally but failing on Bamboo with a NPE. --- .../RecordsManagementPermissionPostProcessorUnitTest.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java b/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java index db87c4a511..f0c25e9e96 100644 --- a/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java +++ b/rm-community/rm-community-repo/unit-test/java/org/alfresco/module/org_alfresco_module_rm/permission/RecordsManagementPermissionPostProcessorUnitTest.java @@ -152,7 +152,7 @@ public class RecordsManagementPermissionPostProcessorUnitTest PermissionReference childOne = mock(PermissionReference.class); when(childOne.getName()).thenReturn("Not this one"); PermissionReference childTwo = mock(PermissionReference.class); - when(childOne.getName()).thenReturn("This is the requested permission"); + when(childTwo.getName()).thenReturn("This is the requested permission"); PermissionReference childThree = mock(PermissionReference.class); when(childThree.getName()).thenReturn("Not this one either"); when(mockPermissionModel.getGranteePermissions(mockWritePropsPermRef)).thenReturn(Sets.newHashSet(childOne, childTwo, childThree));