This is an automated email from the ASF dual-hosted git repository. joerghoh pushed a commit to branch SLING-12642-cache-privileges in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-jcr-repoinit.git
commit a9e282a4e69fabd1f1aa5adf68f80d170be0bd66 Author: Joerg Hoh <[email protected]> AuthorDate: Sun Feb 9 13:50:33 2025 +0100 SLING-12642 introduce a wrapper for a session --- .../apache/sling/jcr/repoinit/impl/AclUtil.java | 90 +++++++++++----------- .../apache/sling/jcr/repoinit/impl/AclVisitor.java | 23 +++--- .../impl/PrivilegeCachingSessionWrapper.java | 54 +++++++++++++ .../sling/jcr/repoinit/PrincipalBasedAclTest.java | 3 +- .../sling/jcr/repoinit/impl/AclUtilTest.java | 28 ++++--- .../jcr/repoinit/impl/ManyServiceUsersTest.java | 2 +- .../apache/sling/jcr/repoinit/impl/TestUtil.java | 4 +- 7 files changed, 133 insertions(+), 71 deletions(-) diff --git a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java index e8a9e0b..8a3cbef 100644 --- a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java +++ b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java @@ -132,13 +132,13 @@ public class AclUtil { } public static void setAcl( - Session session, List<String> principals, List<String> paths, List<String> privileges, boolean isAllow) + PrivilegeCachingSessionWrapper pcsw, List<String> principals, List<String> paths, List<String> privileges, boolean isAllow) throws RepositoryException { - setAcl(session, principals, paths, privileges, isAllow, Collections.emptyList(), Collections.emptyList()); + setAcl(pcsw, principals, paths, privileges, isAllow, Collections.emptyList(), Collections.emptyList()); } public static void setAcl( - Session session, + PrivilegeCachingSessionWrapper pcsw, List<String> principals, List<String> paths, List<String> privileges, @@ -147,16 +147,16 @@ public class AclUtil { List<String> options) throws RepositoryException { - for (String jcrPath : getJcrPaths(session, paths)) { - if (jcrPath != null && !session.nodeExists(jcrPath)) { + for (String jcrPath : getJcrPaths(pcsw.getSession(), paths)) { + if (jcrPath != null && !pcsw.getSession().nodeExists(jcrPath)) { throw new PathNotFoundException("Cannot set ACL on non-existent path " + jcrPath); } - setAcl(session, principals, jcrPath, privileges, isAllow, restrictionClauses, options); + setAcl(pcsw, principals, jcrPath, privileges, isAllow, restrictionClauses, options); } } private static void setAcl( - Session session, + PrivilegeCachingSessionWrapper pcsw, List<String> principals, String jcrPath, List<String> privileges, @@ -165,7 +165,7 @@ public class AclUtil { List<String> options) throws RepositoryException { - AccessControlManager acMgr = session.getAccessControlManager(); + AccessControlManager acMgr = pcsw.getAccessControlManager(); final String[] privArray = privileges.toArray(new String[privileges.size()]); final Privilege[] jcrPriv = AccessControlUtils.privilegesFromNames(acMgr, privArray); @@ -173,7 +173,7 @@ public class AclUtil { JackrabbitAccessControlList acl = getAccessControlList(acMgr, jcrPath, true); checkState(acl != null, "No JackrabbitAccessControlList available for path {0}", jcrPath); - LocalRestrictions localRestrictions = createLocalRestrictions(restrictionClauses, acl, session); + LocalRestrictions localRestrictions = createLocalRestrictions(restrictionClauses, acl, pcsw.getSession()); AccessControlEntry[] existingAces = acl.getAccessControlEntries(); @@ -182,7 +182,7 @@ public class AclUtil { .map(o -> o.contains(AclVisitor.OPTION_IGNORE_MISSING_PRINCIPAL)) .orElse(false); for (String name : principals) { - final Principal principal = getPrincipal(session, name, ignoreMissingPrincipal); + final Principal principal = getPrincipal(pcsw.getSession(), name, ignoreMissingPrincipal); LocalAccessControlEntry newAce = new LocalAccessControlEntry(principal, jcrPriv, isAllow, localRestrictions); if (contains(existingAces, newAce)) { @@ -236,9 +236,9 @@ public class AclUtil { * @param principalName * @throws RepositoryException */ - public static void removePolicy(@NotNull Session session, @NotNull final String principalName) + public static void removePolicy(@NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull final String principalName) throws RepositoryException { - Principal principal = AccessControlUtils.getPrincipal(session, principalName); + Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); if (principal == null) { LOG.info("Principal {} does not exist.", principalName); // using PrincipalImpl will prevent 'removePolicy' from failing with AccessControlException @@ -246,7 +246,7 @@ public class AclUtil { principal = new PrincipalImpl(principalName); } - JackrabbitAccessControlManager acMgr = getJACM(session); + JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); for (JackrabbitAccessControlPolicy policy : acMgr.getPolicies(principal)) { // make sure not to remove the principal-based access control list but instead only drop // resource-based access control content for the given principal @@ -263,11 +263,11 @@ public class AclUtil { * @param paths * @throws RepositoryException */ - public static void removePolicies(@NotNull Session session, @NotNull List<String> paths) + public static void removePolicies(@NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull List<String> paths) throws RepositoryException { - AccessControlManager acMgr = session.getAccessControlManager(); - for (String jcrPath : getJcrPaths(session, paths)) { - if (!isValidPath(session, jcrPath)) { + AccessControlManager acMgr = pcsw.getAccessControlManager(); + for (String jcrPath : getJcrPaths(pcsw.session, paths)) { + if (!isValidPath(pcsw.getSession(), jcrPath)) { LOG.info("Cannot remove ACL; no node at {} ", jcrPath); continue; } @@ -282,12 +282,12 @@ public class AclUtil { } public static void removeEntries( - @NotNull Session session, @NotNull List<String> principals, @NotNull List<String> paths) + @NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull List<String> principals, @NotNull List<String> paths) throws RepositoryException { Set<String> principalNames = new HashSet<>(principals); - AccessControlManager acMgr = session.getAccessControlManager(); - for (String jcrPath : getJcrPaths(session, paths)) { - if (!isValidPath(session, jcrPath)) { + AccessControlManager acMgr = pcsw.getAccessControlManager(); + for (String jcrPath : getJcrPaths(pcsw.getSession(), paths)) { + if (!isValidPath(pcsw.getSession(), jcrPath)) { LOG.info("Cannot remove access control entries on non-existent path {}", jcrPath); } else { JackrabbitAccessControlList acl = getAccessControlList(acMgr, jcrPath, false); @@ -313,7 +313,7 @@ public class AclUtil { } public static void removeEntries( - @NotNull Session session, + @NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull List<String> principals, @NotNull List<String> paths, List<String> privileges, @@ -321,16 +321,16 @@ public class AclUtil { List<RestrictionClause> restrictionClauses) throws RepositoryException { Set<String> principalNames = new HashSet<>(principals); - AccessControlManager acMgr = session.getAccessControlManager(); - for (String jcrPath : getJcrPaths(session, paths)) { - if (!isValidPath(session, jcrPath)) { + AccessControlManager acMgr = pcsw.getAccessControlManager(); + for (String jcrPath : getJcrPaths(pcsw.getSession(), paths)) { + if (!isValidPath(pcsw.getSession(), jcrPath)) { LOG.info("Cannot remove access control entries on non-existent path {}", jcrPath); } else { JackrabbitAccessControlList acl = getAccessControlList(acMgr, jcrPath, false); if (acl != null) { boolean modified = false; - LocalRestrictions restr = createLocalRestrictions(restrictionClauses, acl, session); + LocalRestrictions restr = createLocalRestrictions(restrictionClauses, acl, pcsw.getSession()); Privilege[] privs = AccessControlUtils.privilegesFromNames(acMgr, privileges.toArray(new String[0])); @@ -368,15 +368,15 @@ public class AclUtil { } public static void setPrincipalAcl( - Session session, String principalName, Collection<AclLine> lines, boolean isStrict) + PrivilegeCachingSessionWrapper pcsw, String principalName, Collection<AclLine> lines, boolean isStrict) throws RepositoryException { - final JackrabbitAccessControlManager acMgr = getJACM(session); - Principal principal = AccessControlUtils.getPrincipal(session, principalName); + final JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); + Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); if (principal == null) { // due to transient nature of the repo-init the principal lookup may not succeed if completed through query // -> save transient changes and retry principal lookup - session.save(); - principal = AccessControlUtils.getPrincipal(session, principalName); + pcsw.getSession().save(); + principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); checkState(principal != null, PRINCIPAL_NOT_FOUND_PATTERN, principalName); } @@ -393,7 +393,7 @@ public class AclUtil { boolean modified = false; for (AclLine line : lines) { AclLine.Action action = line.getAction(); - List<String> jcrPaths = getJcrPaths(session, line.getProperty(PROP_PATHS)); + List<String> jcrPaths = getJcrPaths(pcsw.getSession(), line.getProperty(PROP_PATHS)); if (action == AclLine.Action.DENY) { throw new AccessControlException("PrincipalAccessControlList doesn't support 'deny' entries."); } else if (action == AclLine.Action.REMOVE) { @@ -413,7 +413,7 @@ public class AclUtil { // or if there exists no node at the effective path (unable to evaluate path-based entries). LOG.info("No PrincipalAccessControlList available for principal {}", principal); if (!containsEquivalentEntry( - session, effectivePath, principal, privileges, true, line.getRestrictions())) { + pcsw.getSession(), effectivePath, principal, privileges, true, line.getRestrictions())) { LOG.warn( "No equivalent path-based entry exists for principal {} and effective path {} ", principal.getName(), @@ -422,7 +422,7 @@ public class AclUtil { } } else { final LocalRestrictions restrictions = - createLocalRestrictions(line.getRestrictions(), acl, session); + createLocalRestrictions(line.getRestrictions(), acl, pcsw.getSession()); final boolean added = acl.addEntry( effectivePath, privileges, @@ -447,23 +447,23 @@ public class AclUtil { } } - public static void removePrincipalEntries(Session session, String principalName, Collection<AclLine> lines) + public static void removePrincipalEntries(@NotNull PrivilegeCachingSessionWrapper pcsw, String principalName, Collection<AclLine> lines) throws RepositoryException { - final JackrabbitAccessControlManager acMgr = getJACM(session); - Principal principal = AccessControlUtils.getPrincipal(session, principalName); + final JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); + Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); if (principal == null) { // due to transient nature of the repo-init the principal lookup may not succeed if completed through query // -> save transient changes and retry principal lookup - session.save(); - principal = AccessControlUtils.getPrincipal(session, principalName); + pcsw.getSession().save(); + principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); checkState(principal != null, PRINCIPAL_NOT_FOUND_PATTERN, principalName); } final PrincipalAccessControlList acl = getPrincipalAccessControlList(acMgr, principal, true); boolean modified = false; for (AclLine line : lines) { - List<String> jcrPaths = getJcrPaths(session, line.getProperty(PROP_PATHS)); - LocalRestrictions restr = createLocalRestrictions(line.getRestrictions(), acl, session); + List<String> jcrPaths = getJcrPaths(pcsw.getSession(), line.getProperty(PROP_PATHS)); + LocalRestrictions restr = createLocalRestrictions(line.getRestrictions(), acl, pcsw.getSession()); List<String> privNames = line.getProperty(PROP_PRIVILEGES); Privilege[] privs = AccessControlUtils.privilegesFromNames(acMgr, privNames.toArray(new String[0])); Predicate<PrincipalAccessControlList.Entry> predicate = entry -> { @@ -498,15 +498,15 @@ public class AclUtil { * @param principalName * @throws RepositoryException */ - public static void removePrincipalPolicy(@NotNull Session session, @NotNull String principalName) + public static void removePrincipalPolicy(@NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull String principalName) throws RepositoryException { - Principal principal = AccessControlUtils.getPrincipal(session, principalName); + Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); if (principal == null) { LOG.info("Cannot remove principal-based ACL. Principal {} does not exist.", principalName); return; } - JackrabbitAccessControlManager acMgr = getJACM(session); + JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); PrincipalAccessControlList acl = getPrincipalAccessControlList(acMgr, principal, false); if (acl == null) { LOG.info("Cannot remove principal-based ACL for principal {}. No such policy exists.", principalName); @@ -674,7 +674,7 @@ public class AclUtil { + entry.isAllow() + ", restrictionNames: " + entry.getRestrictionNames() + "]"; } - private static void checkState(boolean expression, String msgPattern, Object... args) { + static void checkState(boolean expression, String msgPattern, Object... args) { if (!expression) { if (args == null) { throw new IllegalStateException(msgPattern); diff --git a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclVisitor.java b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclVisitor.java index f96f696..492961f 100644 --- a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclVisitor.java +++ b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclVisitor.java @@ -55,6 +55,8 @@ class AclVisitor extends DoNothingVisitor { */ public static final String OPTION_IGNORE_MISSING_PRINCIPAL = "ignoreMissingPrincipal"; + private final PrivilegeCachingSessionWrapper pcsw; + private enum Instruction { SET, REMOVE @@ -66,8 +68,9 @@ class AclVisitor extends DoNothingVisitor { * @param s must have sufficient rights to create users * and set ACLs. */ - public AclVisitor(Session s) { + public AclVisitor(Session s) { super(s); + pcsw = new PrivilegeCachingSessionWrapper(s); } private void handleAclLine( @@ -77,17 +80,17 @@ class AclVisitor extends DoNothingVisitor { if (action == AclLine.Action.REMOVE) { report("remove not supported. use 'remove acl' instead."); } else if (action == AclLine.Action.REMOVE_ALL) { - AclUtil.removeEntries(session, principals, paths); + AclUtil.removeEntries(pcsw, principals, paths); } else { final boolean isAllow = action == AclLine.Action.ALLOW; final String actionName = isAllow ? "allow" : "deny"; final List<String> privileges = line.getProperty(PROP_PRIVILEGES); if (instruction == Instruction.SET) { log.info("Adding ACL '{}' entry '{}' for {} on {}", actionName, privileges, principals, paths); - AclUtil.setAcl(session, principals, paths, privileges, isAllow, line.getRestrictions(), options); + AclUtil.setAcl(pcsw, principals, paths, privileges, isAllow, line.getRestrictions(), options); } else if (instruction == Instruction.REMOVE) { log.info("Removing ACL '{}' entry '{}' for {} on {}", actionName, privileges, principals, paths); - AclUtil.removeEntries(session, principals, paths, privileges, isAllow, line.getRestrictions()); + AclUtil.removeEntries(pcsw, principals, paths, privileges, isAllow, line.getRestrictions()); } } } @@ -130,7 +133,7 @@ class AclVisitor extends DoNothingVisitor { for (String principalName : s.getPrincipals()) { try { log.info("Adding principal-based access control entry for {}", principalName); - AclUtil.setPrincipalAcl(session, principalName, s.getLines(), false); + AclUtil.setPrincipalAcl(pcsw, principalName, s.getLines(), false); } catch (Exception e) { report(e, "Failed to set principal-based ACL (" + e.getMessage() + ")"); } @@ -142,7 +145,7 @@ class AclVisitor extends DoNothingVisitor { for (String principalName : s.getPrincipals()) { try { log.info("Enforcing principal-based access control entry for {}", principalName); - AclUtil.setPrincipalAcl(session, principalName, s.getLines(), true); + AclUtil.setPrincipalAcl(pcsw, principalName, s.getLines(), true); } catch (Exception e) { report(e, "Failed to set principal-based ACL (" + e.getMessage() + ")"); } @@ -178,7 +181,7 @@ class AclVisitor extends DoNothingVisitor { for (String principalName : s.getPrincipals()) { try { log.info("Removing principal-based access control entries for {}", principalName); - AclUtil.removePrincipalEntries(session, principalName, s.getLines()); + AclUtil.removePrincipalEntries(pcsw, principalName, s.getLines()); } catch (Exception e) { report(e, "Failed to remove principal-based access control entries (" + e.getMessage() + ")"); } @@ -190,7 +193,7 @@ class AclVisitor extends DoNothingVisitor { for (String principalName : s.getPrincipals()) { try { log.info("Removing access control policy for {}", principalName); - AclUtil.removePolicy(session, principalName); + AclUtil.removePolicy(pcsw, principalName); } catch (RepositoryException e) { report(e, "Failed to remove ACL (" + e.getMessage() + ")"); } @@ -200,7 +203,7 @@ class AclVisitor extends DoNothingVisitor { @Override public void visitDeleteAclPaths(DeleteAclPaths s) { try { - AclUtil.removePolicies(session, s.getPaths()); + AclUtil.removePolicies(pcsw, s.getPaths()); } catch (RepositoryException e) { report(e, "Failed to remove ACL (" + e.getMessage() + ")"); } @@ -211,7 +214,7 @@ class AclVisitor extends DoNothingVisitor { for (String principalName : s.getPrincipals()) { try { log.info("Removing principal-based access control policy for {}", principalName); - AclUtil.removePrincipalPolicy(session, principalName); + AclUtil.removePrincipalPolicy(pcsw, principalName); } catch (RepositoryException e) { report(e, "Failed to remove principal-based ACL (" + e.getMessage() + ")"); } diff --git a/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java b/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java new file mode 100644 index 0000000..a9610cb --- /dev/null +++ b/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java @@ -0,0 +1,54 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.sling.jcr.repoinit.impl; + +import javax.jcr.RepositoryException; +import javax.jcr.Session; + +import org.apache.jackrabbit.api.JackrabbitSession; +import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager; + +/** + * A simple wrapper around a session, which can cache the privilege resolution + */ +public class PrivilegeCachingSessionWrapper { + + JackrabbitSession session; + JackrabbitAccessControlManager acMgr; + + public PrivilegeCachingSessionWrapper (Session session) { + AclUtil.checkState(session instanceof JackrabbitSession,"A Jackrabbit Session is required"); + this.session = (JackrabbitSession) session; + try { + AclUtil.checkState(session.getAccessControlManager() instanceof JackrabbitAccessControlManager, + "A Jachrabbit AccessControlManager is required"); + } catch (RepositoryException e) { + throw new IllegalStateException("Cannot retrieve the AcccessControlManager"); + } + } + + public JackrabbitSession getSession() { + return session; + } + + public JackrabbitAccessControlManager getAccessControlManager() { + return acMgr; + } + +} diff --git a/src/test/java/org/apache/sling/jcr/repoinit/PrincipalBasedAclTest.java b/src/test/java/org/apache/sling/jcr/repoinit/PrincipalBasedAclTest.java index 282a3a8..cf1d5af 100644 --- a/src/test/java/org/apache/sling/jcr/repoinit/PrincipalBasedAclTest.java +++ b/src/test/java/org/apache/sling/jcr/repoinit/PrincipalBasedAclTest.java @@ -57,6 +57,7 @@ import org.apache.jackrabbit.oak.spi.security.principal.SystemUserPrincipal; import org.apache.jackrabbit.oak.spi.security.user.UserConfiguration; import org.apache.jackrabbit.oak.spi.security.user.UserConstants; import org.apache.sling.jcr.repoinit.impl.AclUtil; +import org.apache.sling.jcr.repoinit.impl.PrivilegeCachingSessionWrapper; import org.apache.sling.jcr.repoinit.impl.RepoInitException; import org.apache.sling.jcr.repoinit.impl.TestUtil; import org.apache.sling.repoinit.parser.RepoInitParsingException; @@ -804,7 +805,7 @@ public class PrincipalBasedAclTest { line.setProperty(AclLine.PROP_PRINCIPALS, Collections.singletonList(principal.getName())); line.setProperty(AclLine.PROP_PRIVILEGES, Collections.singletonList(Privilege.JCR_READ)); line.setProperty(AclLine.PROP_PATHS, Collections.singletonList(":home:" + U.username + "#")); - AclUtil.setPrincipalAcl(U.adminSession, U.username, Collections.singletonList(line), false); + AclUtil.setPrincipalAcl(new PrivilegeCachingSessionWrapper(U.adminSession), U.username, Collections.singletonList(line), false); PrincipalAccessControlList acl = getAcl(principal, U.adminSession); assertNotNull(acl); diff --git a/src/test/java/org/apache/sling/jcr/repoinit/impl/AclUtilTest.java b/src/test/java/org/apache/sling/jcr/repoinit/impl/AclUtilTest.java index ff04c18..2d72021 100644 --- a/src/test/java/org/apache/sling/jcr/repoinit/impl/AclUtilTest.java +++ b/src/test/java/org/apache/sling/jcr/repoinit/impl/AclUtilTest.java @@ -243,7 +243,7 @@ public class AclUtilTest { assertNull(((JackrabbitSession) session).getUserManager().getAuthorizable(EveryonePrincipal.getInstance())); AclUtil.setAcl( - session, + toPCSessionWrapper(session), Collections.singletonList(EveryonePrincipal.NAME), Collections.singletonList(PathUtils.ROOT_PATH), Collections.singletonList(Privilege.JCR_READ), @@ -273,7 +273,7 @@ public class AclUtilTest { U.adminSession.save(); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(principal.getName()), Collections.singletonList(PathUtils.ROOT_PATH), Collections.singletonList(Privilege.JCR_READ), @@ -307,7 +307,7 @@ public class AclUtilTest { U.adminSession.save(); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), Collections.singletonList(PathUtils.ROOT_PATH), Collections.singletonList(Privilege.JCR_READ), @@ -342,7 +342,7 @@ public class AclUtilTest { List<String> paths = Collections.singletonList(":home:" + U.username + "#"); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -374,7 +374,7 @@ public class AclUtilTest { List<String> paths = Collections.singletonList(":home:" + U.username + "," + gr.getID() + "#"); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -399,7 +399,7 @@ public class AclUtilTest { List<String> paths = Arrays.asList(":home:" + U.username + "#", ":repository", PathUtils.ROOT_PATH); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_ALL), @@ -450,7 +450,7 @@ public class AclUtilTest { List<String> paths = Collections.singletonList(":home:" + U.username + "," + gr.getID() + "#/profiles/private"); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -504,7 +504,7 @@ public class AclUtilTest { List<String> paths = Collections.singletonList(":home:" + gr.getID() + "," + U.username + "#"); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -537,7 +537,7 @@ public class AclUtilTest { public void testSetAclWithHomePathMissingTrailingHash() throws Exception { List<String> paths = Collections.singletonList(":home:" + U.username); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -548,7 +548,7 @@ public class AclUtilTest { public void testSetAclWithHomePathUnknownUser() throws Exception { List<String> paths = Collections.singletonList(":home:alice#"); AclUtil.setAcl( - U.adminSession, + toPCSessionWrapper(U.adminSession), Collections.singletonList(U.username), paths, Collections.singletonList(Privilege.JCR_READ), @@ -559,7 +559,7 @@ public class AclUtilTest { public void repeatedSetAclCallIsNoOp() throws Throwable { final Session session = U.adminSession; final ThrowingRunnable setAcls = () -> AclUtil.setAcl( - session, + toPCSessionWrapper(session), Collections.singletonList(U.username), Arrays.asList(":home:" + U.username + "#", ":repository", PathUtils.ROOT_PATH), Collections.singletonList(Privilege.JCR_ALL), @@ -578,7 +578,7 @@ public class AclUtilTest { public void nullRestrictionClauseAndNullOptionsAreHandled() { final Session session = U.adminSession; Assertions.assertDoesNotThrow(() -> AclUtil.setAcl( - session, + toPCSessionWrapper(session), Collections.singletonList(U.username), Collections.singletonList(PathUtils.ROOT_PATH), Collections.singletonList(Privilege.JCR_READ), @@ -626,4 +626,8 @@ public class AclUtilTest { private Privilege[] privileges(String... privilegeNames) throws RepositoryException { return AccessControlUtils.privilegesFromNames(U.adminSession, privilegeNames); } + + private static PrivilegeCachingSessionWrapper toPCSessionWrapper (Session session) { + return new PrivilegeCachingSessionWrapper(session); + } } diff --git a/src/test/java/org/apache/sling/jcr/repoinit/impl/ManyServiceUsersTest.java b/src/test/java/org/apache/sling/jcr/repoinit/impl/ManyServiceUsersTest.java index 552689c..1a93836 100644 --- a/src/test/java/org/apache/sling/jcr/repoinit/impl/ManyServiceUsersTest.java +++ b/src/test/java/org/apache/sling/jcr/repoinit/impl/ManyServiceUsersTest.java @@ -85,7 +85,7 @@ public class ManyServiceUsersTest { try { AclUtil.setAcl( - otherSession, + new PrivilegeCachingSessionWrapper(otherSession), Arrays.asList(username), Arrays.asList(path), Arrays.asList("jcr:read"), diff --git a/src/test/java/org/apache/sling/jcr/repoinit/impl/TestUtil.java b/src/test/java/org/apache/sling/jcr/repoinit/impl/TestUtil.java index f5b0904..b057fae 100644 --- a/src/test/java/org/apache/sling/jcr/repoinit/impl/TestUtil.java +++ b/src/test/java/org/apache/sling/jcr/repoinit/impl/TestUtil.java @@ -76,13 +76,13 @@ public class TestUtil { username = "user_" + id; } - public List<Operation> parse(String... inputLines) throws RepoInitParsingException { + public static List<Operation> parse(String... inputLines) throws RepoInitParsingException { try (final StringReader r = new StringReader(String.join("\n", inputLines))) { return new RepoInitParserService().parse(r); } } - private void assertPathContains(Authorizable u, String pathShouldContain) throws RepositoryException { + private static void assertPathContains(Authorizable u, String pathShouldContain) throws RepositoryException { if (pathShouldContain != null) { final String path = u.getPath(); assertTrue("Expecting path " + path + " to contain " + pathShouldContain, path.contains(pathShouldContain));
