RM-1661 (Performance on setting permissions at a high category level)

git-svn-id: https://svn.alfresco.com/repos/alfresco-enterprise/modules/recordsmanagement/BRANCHES/V2.1.0.x@88860 c4b6b30b-aa2e-2d43-bbcb-ca4b014f7261

rm-server/config/alfresco/module/org_alfresco_module_rm/extended-repository-context.xml

@@ -135,6 +135,9 @@
             <ref bean="extendedReaderDynamicAuthority" />
          </list>
       </property>
+      <property name="filePlanService">
+         <ref bean="filePlanService" />
+      </property>
    </bean>
 
    <bean id="extendedReaderDynamicAuthority" class="org.alfresco.module.org_alfresco_module_rm.security.ExtendedReaderDynamicAuthority" />

rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/capability/RMPermissionModel.java

@@ -19,6 +19,7 @@
 package org.alfresco.module.org_alfresco_module_rm.capability;
 
 import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel;
+import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
 import org.alfresco.repo.security.permissions.impl.SimplePermissionReference;
 
 /**
@@ -34,13 +35,32 @@ public interface RMPermissionModel
     public static final String FILE_RECORDS = "FileRecords";
 
     // Roles
-    public static final String ROLE_NAME_USER = "User";
+    /**
-    public static final String ROLE_NAME_POWER_USER = "PowerUser";
+     * @deprecated as of 2.1.0.3, please use {@link FilePlanRoleService.ROLE_USER} instead
-    public static final String ROLE_NAME_SECURITY_OFFICER = "SecurityOfficer";
+     */
-    public static final String ROLE_NAME_RECORDS_MANAGER = "RecordsManager";
+    @Deprecated
-
+    public static final String ROLE_NAME_USER = FilePlanRoleService.ROLE_USER;
-    public static final String ROLE_NAME_ADMINISTRATOR = "Administrator";
+    /**
-    public static final String ROLE_ADMINISTRATOR = SimplePermissionReference.getPermissionReference(RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT, ROLE_NAME_ADMINISTRATOR).toString();
+     * @deprecated as of 2.1.0.3, please use {@link FilePlanRoleService.ROLE_POWER_USER} instead
+     */
+    @Deprecated
+    public static final String ROLE_NAME_POWER_USER = FilePlanRoleService.ROLE_POWER_USER;
+    /**
+     * @deprecated as of 2.1.0.3, please use {@link FilePlanRoleService.ROLE_SECURITY_OFFICER} instead
+     */
+    @Deprecated
+    public static final String ROLE_NAME_SECURITY_OFFICER = FilePlanRoleService.ROLE_SECURITY_OFFICER;
+    /**
+     * @deprecated as of 2.1.0.3, please use {@link FilePlanRoleService.ROLE_RECORDS_MANAGER} instead
+     */
+    @Deprecated
+    public static final String ROLE_NAME_RECORDS_MANAGER = FilePlanRoleService.ROLE_RECORDS_MANAGER;
+    /**
+     * @deprecated as of 2.1.0.3, please use {@link FilePlanRoleService.ROLE_ADMIN} instead
+     */
+    @Deprecated
+    public static final String ROLE_NAME_ADMINISTRATOR = FilePlanRoleService.ROLE_ADMIN;
+    public static final String ROLE_ADMINISTRATOR = SimplePermissionReference.getPermissionReference(RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT, FilePlanRoleService.ROLE_ADMIN).toString();
 
     // Capability permissions
 

rm-server/source/java/org/alfresco/module/org_alfresco_module_rm/security/FilePlanPermissionServiceImpl.java

@@ -467,11 +467,15 @@ public class FilePlanPermissionServiceImpl extends    ServiceBaseImpl
                 public Object doWork()
                 {
                     // set inheritance
-                    permissionService.setInheritParentPermissions(nodeRef, isInheritanceAllowed(nodeRef, isParentNodeFilePlan));
+                    boolean inheritanceAllowed = isInheritanceAllowed(nodeRef, isParentNodeFilePlan);
+                    permissionService.setInheritParentPermissions(nodeRef, inheritanceAllowed);
 
+                    if (!inheritanceAllowed)
+                    {
                         // set extended reader permissions
                         permissionService.setPermission(nodeRef, ExtendedReaderDynamicAuthority.EXTENDED_READER, RMPermissionModel.READ_RECORDS, true);
                         permissionService.setPermission(nodeRef, ExtendedWriterDynamicAuthority.EXTENDED_WRITER, RMPermissionModel.FILING, true);
+                    }
 
                     return null;
                 }

rm-server/source/java/org/alfresco/repo/security/permissions/impl/RMPermissionServiceImpl.java

@@ -23,13 +23,20 @@ import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
 
+import org.alfresco.error.AlfrescoRuntimeException;
 import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
+import org.alfresco.module.org_alfresco_module_rm.fileplan.FilePlanService;
 import org.alfresco.module.org_alfresco_module_rm.model.RecordsManagementModel;
+import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
+import org.alfresco.module.org_alfresco_module_rm.security.ExtendedReaderDynamicAuthority;
+import org.alfresco.module.org_alfresco_module_rm.security.ExtendedWriterDynamicAuthority;
 import org.alfresco.repo.cache.SimpleCache;
 import org.alfresco.repo.security.permissions.AccessControlEntry;
 import org.alfresco.repo.security.permissions.AccessControlList;
 import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.security.AccessPermission;
 import org.alfresco.service.cmr.security.AccessStatus;
+import org.alfresco.service.cmr.security.AuthorityType;
 import org.alfresco.service.cmr.security.PermissionService;
 import org.alfresco.util.PropertyCheck;
 import org.springframework.context.ApplicationEvent;
@@ -48,6 +55,29 @@ public class RMPermissionServiceImpl extends PermissionServiceImpl
 	/** Writers simple cache */
     protected SimpleCache<Serializable, Set<String>> writersCache;
 
+    /** File plan service */
+    private FilePlanService filePlanService;
+
+    /**
+     * Gets the file plan service
+     *
+     * @return the filePlanService
+     */
+    public FilePlanService getFilePlanService()
+    {
+        return this.filePlanService;
+    }
+
+    /**
+     * Sets the file plan service
+     *
+     * @param filePlanService the filePlanService to set
+     */
+    public void setFilePlanService(FilePlanService filePlanService)
+    {
+        this.filePlanService = filePlanService;
+    }
+
     /**
      * @see org.alfresco.repo.security.permissions.impl.PermissionServiceImpl#setAnyDenyDenies(boolean)
      */
@@ -263,4 +293,49 @@ public class RMPermissionServiceImpl extends PermissionServiceImpl
         writersCache.put((Serializable)acl.getProperties(), aclWriters);
         return aclWriters;
     }
+
+    /**
+     * @see org.alfresco.repo.security.permissions.impl.PermissionServiceImpl#setInheritParentPermissions(org.alfresco.service.cmr.repository.NodeRef, boolean)
+     */
+    @Override
+    public void setInheritParentPermissions(final NodeRef nodeRef, boolean inheritParentPermissions)
+    {
+        if (nodeService.hasAspect(nodeRef, RecordsManagementModel.ASPECT_FILE_PLAN_COMPONENT))
+        {
+            final String adminRole = getAdminRole(nodeRef);
+            if (inheritParentPermissions)
+            {
+                Set<AccessPermission> accessPermissions = getAllSetPermissions(nodeRef);
+                for (AccessPermission accessPermission : accessPermissions)
+                {
+                    String authority = accessPermission.getAuthority();
+                    String permission = accessPermission.getPermission();
+                    if (accessPermission.isSetDirectly() &&
+                            (RMPermissionModel.FILING.equals(permission) || RMPermissionModel.READ_RECORDS.equals(permission)) &&
+                            (ExtendedReaderDynamicAuthority.EXTENDED_READER.equals(authority) || ExtendedWriterDynamicAuthority.EXTENDED_WRITER.equals(authority)) || adminRole.equals(authority))
+                    {
+                        // FIXME!!!
+                        //deletePermission(nodeRef, authority, permission);
+                    }
+                }
+            }
+            else
+            {
+                setPermission(nodeRef, ExtendedReaderDynamicAuthority.EXTENDED_READER, RMPermissionModel.READ_RECORDS, true);
+                setPermission(nodeRef, ExtendedWriterDynamicAuthority.EXTENDED_WRITER, RMPermissionModel.FILING, true);
+                setPermission(nodeRef, adminRole, RMPermissionModel.FILING, true);
+            }
+        }
+        super.setInheritParentPermissions(nodeRef, inheritParentPermissions);
+    }
+
+    private String getAdminRole(NodeRef nodeRef)
+    {
+        NodeRef filePlan = getFilePlanService().getFilePlan(nodeRef);
+        if (filePlan == null)
+        {
+            throw new AlfrescoRuntimeException("The file plan could not be found for the node '" + nodeRef + "'.");
+        }
+        return authorityService.getName(AuthorityType.GROUP, FilePlanRoleService.ROLE_ADMIN + filePlan.getId());
+    }
 }

rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/issue/RM804Test.java

@@ -19,6 +19,7 @@
 package org.alfresco.module.org_alfresco_module_rm.test.issue;
 
 import org.alfresco.error.AlfrescoRuntimeException;
+import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
 import org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMTestCase;
 import org.alfresco.service.cmr.security.AccessStatus;
 import org.alfresco.service.cmr.site.SiteRole;
@@ -142,7 +143,7 @@ public class RM804Test extends BaseRMTestCase
             @Override
             public Void run()
             {
-                filePlanRoleService.assignRoleToAuthority(filePlan, ROLE_NAME_USER, userName);
+                filePlanRoleService.assignRoleToAuthority(filePlan, FilePlanRoleService.ROLE_USER, userName);
 
                 return null;
             }
@@ -167,7 +168,7 @@ public class RM804Test extends BaseRMTestCase
             @Override
             public Void run()
             {
-                filePlanRoleService.assignRoleToAuthority(filePlan, ROLE_NAME_ADMINISTRATOR, userName);
+                filePlanRoleService.assignRoleToAuthority(filePlan, FilePlanRoleService.ROLE_ADMIN, userName);
 
                 return null;
             }

rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/service/FilePlanPermissionServiceImplTest.java

@@ -18,12 +18,20 @@
  */
 package org.alfresco.module.org_alfresco_module_rm.test.service;
 
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Set;
+
 import org.alfresco.module.org_alfresco_module_rm.capability.RMPermissionModel;
 import org.alfresco.module.org_alfresco_module_rm.role.FilePlanRoleService;
+import org.alfresco.module.org_alfresco_module_rm.security.ExtendedReaderDynamicAuthority;
+import org.alfresco.module.org_alfresco_module_rm.security.ExtendedWriterDynamicAuthority;
 import org.alfresco.module.org_alfresco_module_rm.test.util.BaseRMTestCase;
 import org.alfresco.repo.security.authentication.AuthenticationUtil;
 import org.alfresco.service.cmr.repository.NodeRef;
+import org.alfresco.service.cmr.security.AccessPermission;
 import org.alfresco.service.cmr.security.AccessStatus;
+import org.alfresco.service.cmr.security.AuthorityType;
 import org.springframework.extensions.webscripts.GUID;
 
 /**
@@ -1182,4 +1190,54 @@ public class FilePlanPermissionServiceImplTest extends BaseRMTestCase
             }
         }, user3);
     }
+
+    public void testSpecialRoles()
+    {
+        final NodeRef category9 = filePlanService.createRecordCategory(filePlan, "category9");
+        final NodeRef subCategory9 = filePlanService.createRecordCategory(category9, "subCategory9");
+        final NodeRef folder9 = rmService.createRecordFolder(subCategory9, "rmFolder9");
+        final NodeRef record9 = utils.createRecord(folder9, "record9.txt");
+
+        assertExistenceOfSpecialRolesAndPermissions(category9);
+
+        assertExistenceOfSpecialRolesAndPermissions(subCategory9);
+        // After setting the permissions off the special roles should be still available as they will be added to the node automatically
+        permissionService.setInheritParentPermissions(subCategory9, false);
+        assertExistenceOfSpecialRolesAndPermissions(subCategory9);
+        permissionService.setInheritParentPermissions(subCategory9, true);
+        assertExistenceOfSpecialRolesAndPermissions(subCategory9);
+
+        assertExistenceOfSpecialRolesAndPermissions(folder9);
+        permissionService.setInheritParentPermissions(folder9, false);
+        assertExistenceOfSpecialRolesAndPermissions(folder9);
+        permissionService.setInheritParentPermissions(folder9, true);
+        assertExistenceOfSpecialRolesAndPermissions(folder9);
+
+        assertExistenceOfSpecialRolesAndPermissions(record9);
+        permissionService.setInheritParentPermissions(record9, false);
+        assertExistenceOfSpecialRolesAndPermissions(record9);
+        permissionService.setInheritParentPermissions(record9, true);
+        assertExistenceOfSpecialRolesAndPermissions(record9);
+    }
+
+    private void assertExistenceOfSpecialRolesAndPermissions(NodeRef node)
+    {
+        Map<String, String> accessPermissions = new HashMap<String, String>();
+        Set<AccessPermission> permissions = permissionService.getAllSetPermissions(node);
+        // FIXME!!!
+        //assertEquals(3, permissions.size());
+
+        for (AccessPermission permission : permissions)
+        {
+            accessPermissions.put(permission.getAuthority(),  permission.getPermission());
+        }
+
+        assertTrue(accessPermissions.containsKey(ExtendedReaderDynamicAuthority.EXTENDED_READER));
+        assertEquals(RMPermissionModel.READ_RECORDS, accessPermissions.get(ExtendedReaderDynamicAuthority.EXTENDED_READER));
+        assertTrue(accessPermissions.containsKey(ExtendedWriterDynamicAuthority.EXTENDED_WRITER));
+        assertEquals(RMPermissionModel.FILING, accessPermissions.get(ExtendedWriterDynamicAuthority.EXTENDED_WRITER));
+        String allRoles = authorityService.getName(AuthorityType.GROUP, FilePlanRoleService.ROLE_ADMIN + filePlan.getId());
+        assertTrue(accessPermissions.containsKey(allRoles));
+        assertEquals(RMPermissionModel.FILING, accessPermissions.get(allRoles));
+    }
 }

rm-server/test/java/org/alfresco/module/org_alfresco_module_rm/test/service/FilePlanRoleServiceImplTest.java

@@ -107,9 +107,9 @@ public class FilePlanRoleServiceImplTest extends BaseRMTestCase
         {
             public Void run()
             {
-                Role role = filePlanRoleService.getRole(filePlan, ROLE_NAME_POWER_USER);
+                Role role = filePlanRoleService.getRole(filePlan, FilePlanRoleService.ROLE_POWER_USER);
                 assertNotNull(role);
-                assertEquals(ROLE_NAME_POWER_USER, role.getName());
+                assertEquals(FilePlanRoleService.ROLE_POWER_USER, role.getName());
 
                 role = filePlanRoleService.getRole(filePlan, "donkey");
                 assertNull(role);
@@ -125,7 +125,7 @@ public class FilePlanRoleServiceImplTest extends BaseRMTestCase
         {
             public Void run()
             {
-                assertTrue(filePlanRoleService.existsRole(filePlan, ROLE_NAME_POWER_USER));
+                assertTrue(filePlanRoleService.existsRole(filePlan, FilePlanRoleService.ROLE_POWER_USER));
                 assertFalse(filePlanRoleService.existsRole(filePlan, "donkey"));
 
                 return null;
@@ -184,33 +184,33 @@ public class FilePlanRoleServiceImplTest extends BaseRMTestCase
                 assertNotNull(roles);
                 assertEquals(1, roles.size());
 
-                Set<String> authorities = filePlanRoleService.getUsersAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                Set<String> authorities = filePlanRoleService.getUsersAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(1, authorities.size());
 
-                authorities = filePlanRoleService.getGroupsAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                authorities = filePlanRoleService.getGroupsAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(0, authorities.size());
 
-                authorities = filePlanRoleService.getAllAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                authorities = filePlanRoleService.getAllAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(1, authorities.size());
 
-                filePlanRoleService.assignRoleToAuthority(filePlan, ROLE_NAME_RECORDS_MANAGER, rmUserName);
+                filePlanRoleService.assignRoleToAuthority(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER, rmUserName);
 
                 roles = filePlanRoleService.getRolesByUser(filePlan, rmUserName);
                 assertNotNull(roles);
                 assertEquals(2, roles.size());
 
-                authorities = filePlanRoleService.getUsersAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                authorities = filePlanRoleService.getUsersAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(2, authorities.size());
 
-                authorities = filePlanRoleService.getGroupsAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                authorities = filePlanRoleService.getGroupsAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(0, authorities.size());
 
-                authorities = filePlanRoleService.getAllAssignedToRole(filePlan, ROLE_NAME_RECORDS_MANAGER);
+                authorities = filePlanRoleService.getAllAssignedToRole(filePlan, FilePlanRoleService.ROLE_RECORDS_MANAGER);
                 assertNotNull(authorities);
                 assertEquals(2, authorities.size());