Author: tripod
Date: Wed Jan 8 19:02:18 2014
New Revision: 1556607
URL: http://svn.apache.org/r1556607
Log:
Reverting changes of r1556370 (OAK-1247: Non-deterministic access control test
failures)
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/AuthorizationConfigurationImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/CompiledPermissionImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProvider.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProviderImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
jackrabbit/oak/trunk/oak-jcr/pom.xml
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/AuthorizationConfigurationImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/AuthorizationConfigurationImpl.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/AuthorizationConfigurationImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/AuthorizationConfigurationImpl.java
Wed Jan 8 19:02:18 2014
@@ -32,6 +32,7 @@ import org.apache.jackrabbit.oak.plugins
import
org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlImporter;
import
org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlManagerImpl;
import
org.apache.jackrabbit.oak.security.authorization.accesscontrol.AccessControlValidatorProvider;
+import
org.apache.jackrabbit.oak.security.authorization.permission.PermissionEntryCache;
import
org.apache.jackrabbit.oak.security.authorization.permission.PermissionHook;
import
org.apache.jackrabbit.oak.security.authorization.permission.PermissionProviderImpl;
import
org.apache.jackrabbit.oak.security.authorization.permission.PermissionStoreValidatorProvider;
@@ -60,6 +61,8 @@ import com.google.common.collect.Immutab
@Service({AuthorizationConfiguration.class, SecurityConfiguration.class})
public class AuthorizationConfigurationImpl extends ConfigurationBase
implements AuthorizationConfiguration {
+ private final PermissionEntryCache permissionEntryCache = new
PermissionEntryCache();
+
public AuthorizationConfigurationImpl() {
super();
}
@@ -91,7 +94,7 @@ public class AuthorizationConfigurationI
public List<? extends CommitHook> getCommitHooks(String workspaceName) {
return ImmutableList.of(
new VersionablePathHook(workspaceName),
- new PermissionHook(workspaceName, getRestrictionProvider()));
+ new PermissionHook(workspaceName, getRestrictionProvider(),
permissionEntryCache));
}
@Override
@@ -128,7 +131,7 @@ public class AuthorizationConfigurationI
@Nonnull
@Override
public PermissionProvider getPermissionProvider(Root root, String
workspaceName, Set<Principal> principals) {
- return new PermissionProviderImpl(root, workspaceName, principals,
this);
+ return new PermissionProviderImpl(root, workspaceName, principals,
this, permissionEntryCache.createLocalCache());
}
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/CompiledPermissionImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/CompiledPermissionImpl.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/CompiledPermissionImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/CompiledPermissionImpl.java
Wed Jan 8 19:02:18 2014
@@ -86,7 +86,8 @@ final class CompiledPermissionImpl imple
private PrivilegeBitsProvider bitsProvider;
- private CompiledPermissionImpl(@Nonnull Set<Principal> principals,
+ private CompiledPermissionImpl(@Nonnull PermissionEntryCache.Local cache,
+ @Nonnull Set<Principal> principals,
@Nonnull ImmutableRoot root, @Nonnull
String workspaceName,
@Nonnull RestrictionProvider
restrictionProvider,
@Nonnull Set<String> readPaths) {
@@ -108,19 +109,20 @@ final class CompiledPermissionImpl imple
}
}
- userStore = new PermissionEntryProviderImpl(store, userNames);
- groupStore = new PermissionEntryProviderImpl(store, groupNames);
+ userStore = new PermissionEntryProviderImpl(store, cache, userNames);
+ groupStore = new PermissionEntryProviderImpl(store, cache, groupNames);
}
static CompiledPermissions create(@Nonnull ImmutableRoot root, @Nonnull
String workspaceName,
@Nonnull Set<Principal> principals,
- @Nonnull AuthorizationConfiguration
acConfig) {
+ @Nonnull AuthorizationConfiguration
acConfig,
+ @Nonnull PermissionEntryCache.Local
cache) {
Tree permissionsTree = PermissionUtil.getPermissionsRoot(root,
workspaceName);
if (!permissionsTree.exists() || principals.isEmpty()) {
return NoPermissions.getInstance();
} else {
Set<String> readPaths =
acConfig.getParameters().getConfigValue(PARAM_READ_PATHS, DEFAULT_READ_PATHS);
- return new CompiledPermissionImpl(principals, root, workspaceName,
acConfig.getRestrictionProvider(), readPaths);
+ return new CompiledPermissionImpl(cache, principals, root,
workspaceName, acConfig.getRestrictionProvider(), readPaths);
}
}
@@ -130,6 +132,8 @@ final class CompiledPermissionImpl imple
this.root = root;
this.bitsProvider = new PrivilegeBitsProvider(root);
store.flush(root);
+ userStore.flush();
+ groupStore.flush();
}
@Override
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProvider.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProvider.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProvider.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProvider.java
Wed Jan 8 19:02:18 2014
@@ -38,4 +38,5 @@ interface PermissionEntryProvider {
@Nonnull
Collection<PermissionEntry> getEntries(@Nonnull String
accessControlledPath);
-}
+ void flush();
+}
\ No newline at end of file
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProviderImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProviderImpl.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProviderImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryProviderImpl.java
Wed Jan 8 19:02:18 2014
@@ -18,7 +18,10 @@ package org.apache.jackrabbit.oak.securi
import java.util.Collection;
import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
import java.util.Iterator;
+import java.util.Map;
import java.util.Set;
import java.util.TreeSet;
@@ -36,37 +39,98 @@ import com.google.common.collect.Iterato
*/
class PermissionEntryProviderImpl implements PermissionEntryProvider {
+ private static final long MAX_SIZE = 250; // TODO define size or make
configurable
+
private final Set<String> principalNames;
+ private final Set<String> existingNames = new HashSet<String>();
+
+ private Map<String, Collection<PermissionEntry>> pathEntryMap;
+
private final PermissionStore store;
- PermissionEntryProviderImpl(@Nonnull PermissionStore store,
+ private final PermissionEntryCache.Local cache;
+
+ PermissionEntryProviderImpl(@Nonnull PermissionStore store, @Nonnull
PermissionEntryCache.Local cache,
@Nonnull Set<String> principalNames) {
this.store = store;
+ this.cache = cache;
this.principalNames = Collections.unmodifiableSet(principalNames);
+ init();
+ }
+
+ private void init() {
+ long cnt = 0;
+ existingNames.clear();
+ for (String name: principalNames) {
+ if (cnt > MAX_SIZE) {
+ if (cache.hasEntries(store, name)) {
+ existingNames.add(name);
+ }
+ } else {
+ long n = cache.getNumEntries(store, name);
+ cnt+= n;
+ if (n > 0) {
+ existingNames.add(name);
+ }
+ }
+ }
+ if (cnt < MAX_SIZE) {
+ // cache all entries of all principals
+ pathEntryMap = new HashMap<String, Collection<PermissionEntry>>();
+ for (String name: principalNames) {
+ cache.load(store, pathEntryMap, name);
+ }
+ } else {
+ pathEntryMap = null;
+ }
+ }
+
+ public void flush() {
+ cache.flush(principalNames);
+ init();
}
@Nonnull
public Iterator<PermissionEntry> getEntryIterator(@Nonnull EntryPredicate
predicate) {
- return new EntryIterator(predicate);
+ if (existingNames.isEmpty()) {
+ return Iterators.emptyIterator();
+ } else {
+ return new EntryIterator(predicate);
+ }
}
@Nonnull
public Collection<PermissionEntry> getEntries(@Nonnull Tree
accessControlledTree) {
- if (accessControlledTree.hasChild(AccessControlConstants.REP_POLICY)) {
- return getEntries(accessControlledTree.getPath());
+ if (existingNames.isEmpty()) {
+ return Collections.emptyList();
+ } else if (pathEntryMap != null) {
+ Collection<PermissionEntry> entries =
pathEntryMap.get(accessControlledTree.getPath());
+ return (entries != null) ? entries :
Collections.<PermissionEntry>emptyList();
} else {
- return Collections.<PermissionEntry>emptyList();
+ return
(accessControlledTree.hasChild(AccessControlConstants.REP_POLICY)) ?
+ loadEntries(accessControlledTree.getPath()) :
+ Collections.<PermissionEntry>emptyList();
}
}
@Nonnull
public Collection<PermissionEntry> getEntries(@Nonnull String path) {
+ if (existingNames.isEmpty()) {
+ return Collections.emptyList();
+ } else if (pathEntryMap != null) {
+ Collection<PermissionEntry> entries = pathEntryMap.get(path);
+ return (entries != null) ? entries :
Collections.<PermissionEntry>emptyList();
+ } else {
+ return loadEntries(path);
+ }
+ }
+
+ @Nonnull
+ private Collection<PermissionEntry> loadEntries(@Nonnull String path) {
Collection<PermissionEntry> ret = new TreeSet<PermissionEntry>();
- for (String name: principalNames) {
- // todo: conditionally load entries if too many
- PrincipalPermissionEntries ppe = store.load(name);
- ret.addAll(ppe.getEntries(path));
+ for (String name: existingNames) {
+ cache.load(store, ret, name, path);
}
return ret;
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
Wed Jan 8 19:02:18 2014
@@ -84,6 +84,7 @@ public class PermissionHook implements P
private final RestrictionProvider restrictionProvider;
private final String workspaceName;
+ private final PermissionEntryCache cache;
private NodeBuilder permissionRoot;
private PrivilegeBitsProvider bitsProvider;
@@ -95,9 +96,10 @@ public class PermissionHook implements P
private Map<String, Acl> modified = new HashMap<String, Acl>();
private Map<String, Acl> deleted = new HashMap<String, Acl>();
- public PermissionHook(String workspaceName, RestrictionProvider
restrictionProvider) {
+ public PermissionHook(String workspaceName, RestrictionProvider
restrictionProvider, PermissionEntryCache cache) {
this.workspaceName = workspaceName;
this.restrictionProvider = restrictionProvider;
+ this.cache = cache;
}
@Nonnull
@@ -126,6 +128,7 @@ public class PermissionHook implements P
for (Map.Entry<String, Acl> entry : modified.entrySet()) {
entry.getValue().update(principalNames);
}
+ cache.flush(principalNames);
}
@Nonnull
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionProviderImpl.java
Wed Jan 8 19:02:18 2014
@@ -58,7 +58,8 @@ public class PermissionProviderImpl impl
private ImmutableRoot immutableRoot;
public PermissionProviderImpl(@Nonnull Root root, @Nonnull String
workspaceName, @Nonnull Set<Principal> principals,
- @Nonnull AuthorizationConfiguration
acConfig) {
+ @Nonnull AuthorizationConfiguration acConfig,
+ @Nonnull PermissionEntryCache.Local cache) {
this.root = root;
this.workspaceName = workspaceName;
this.acConfig = acConfig;
@@ -68,7 +69,7 @@ public class PermissionProviderImpl impl
if (principals.contains(SystemPrincipal.INSTANCE) ||
isAdmin(principals)) {
compiledPermissions = AllPermissions.getInstance();
} else {
- compiledPermissions = CompiledPermissionImpl.create(immutableRoot,
workspaceName, principals, acConfig);
+ compiledPermissions = CompiledPermissionImpl.create(immutableRoot,
workspaceName, principals, acConfig, cache);
}
}
Modified: jackrabbit/oak/trunk/oak-jcr/pom.xml
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-jcr/pom.xml?rev=1556607&r1=1556606&r2=1556607&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-jcr/pom.xml (original)
+++ jackrabbit/oak/trunk/oak-jcr/pom.xml Wed Jan 8 19:02:18 2014
@@ -117,10 +117,6 @@
org.apache.jackrabbit.oak.jcr.security.authorization.CopyTest#testCopyInvisibleAcContent
<!-- OAK-920 -->
org.apache.jackrabbit.oak.jcr.security.authorization.SessionMoveTest#testMoveAddSubTreeWithRestriction
<!-- OAK-1223 -->
-
org.apache.jackrabbit.oak.jcr.security.authorization.SessionMoveTest#testMoveAndRemoveSubTree3
<!-- OAK-710 -->
-
org.apache.jackrabbit.oak.jcr.security.authorization.SessionMoveTest#testMoveAndAddSubTree3
<!-- OAK-710 -->
-
org.apache.jackrabbit.oak.jcr.security.authorization.SessionMoveTest#testMoveAndAddProperty2
<!-- OAK-710 -->
-
org.apache.jackrabbit.oak.jcr.security.authorization.SessionMoveTest#testMoveAndRemoveProperty2
<!-- OAK-710 -->
<!-- Query -->
org.apache.jackrabbit.test.api.query.ElementTest#testElementTestNameTestSomeNTWithSNS
<!-- OAK-203 -->
