Author: tripod
Date: Fri Jan 10 00:42:29 2014
New Revision: 1556998
URL: http://svn.apache.org/r1556998
Log:
OAK-1311 Permission Cache causes non-deterministic access control test failures
- replaced timestamp with mod counter
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryCache.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntries.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.java
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryCache.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryCache.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryCache.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionEntryCache.java
Fri Jan 10 00:42:29 2014
@@ -74,10 +74,10 @@ public class PermissionEntryCache {
PrincipalPermissionEntries ppe = entries.get(principalName);
if (ppe == null) {
ppe = store.load(principalName);
-// entries.put(principalName, ppe);
+ entries.put(principalName, ppe);
} else {
if (!verified.contains(principalName)) {
- if (store.getTimestamp(principalName) !=
ppe.getTimestamp()) {
+ if (store.getModCount(principalName) != ppe.getModCount())
{
ppe = store.load(principalName);
entries.put(principalName, ppe);
}
@@ -89,13 +89,13 @@ public class PermissionEntryCache {
Currently this cache only handles entries for the Everyone
principal.
TODO: the cache should dynamically cache the principals that are
used often.
*/
-// if (EveryonePrincipal.NAME.equals(principalName)) {
-// // check if base cache has the entries
-// PrincipalPermissionEntries baseppe = base.get(principalName);
-// if (baseppe == null || ppe.getTimestamp() >
baseppe.getTimestamp()) {
-// base.put(principalName, ppe);
-// }
-// }
+ if (EveryonePrincipal.NAME.equals(principalName)) {
+ // check if base cache has the entries
+ PrincipalPermissionEntries baseppe = base.get(principalName);
+ if (baseppe == null || ppe.getModCount() >
baseppe.getModCount()) {
+ base.put(principalName, ppe);
+ }
+ }
return ppe;
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionHook.java
Fri Jan 10 00:42:29 2014
@@ -29,6 +29,7 @@ import com.google.common.base.Objects;
import com.google.common.base.Strings;
import org.apache.jackrabbit.oak.api.CommitFailedException;
+import org.apache.jackrabbit.oak.api.PropertyState;
import org.apache.jackrabbit.oak.api.Type;
import org.apache.jackrabbit.oak.core.ImmutableRoot;
import org.apache.jackrabbit.oak.core.ImmutableTree;
@@ -301,8 +302,7 @@ public class PermissionHook implements P
}
}
}
- principalRoot.setProperty(REP_NUM_PERMISSIONS, numEntries);
- principalRoot.setProperty(REP_TIMESTAMP,
System.currentTimeMillis());
+ touch(principalRoot, numEntries);
} else {
log.error("{} {}: Principal root missing.", msg, this);
}
@@ -357,8 +357,7 @@ public class PermissionHook implements P
}
long numEntries =
PermissionUtil.getNumPermissions(principalRoot);
numEntries+= updateEntries(parent, entries.get(principalName));
- principalRoot.setProperty(REP_NUM_PERMISSIONS, numEntries);
- principalRoot.setProperty(REP_TIMESTAMP,
System.currentTimeMillis());
+ touch(principalRoot, numEntries);
}
}
@@ -377,6 +376,12 @@ public class PermissionHook implements P
}
return numEntries;
}
+
+ private void touch(NodeBuilder node, long numEntries) {
+ PropertyState ps = node.getProperty(REP_MOD_COUNT);
+ node.setProperty(REP_MOD_COUNT, ps == null ? 1 :
ps.getValue(Type.LONG) + 1);
+ node.setProperty(REP_NUM_PERMISSIONS, numEntries);
+ }
}
private final class AcEntry {
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStore.java
Fri Jan 10 00:42:29 2014
@@ -38,5 +38,5 @@ public interface PermissionStore {
long getNumEntries(@Nonnull String principalName);
- long getTimestamp(@Nonnull String principalName);
+ long getModCount(@Nonnull String principalName);
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PermissionStoreImpl.java
Fri Jan 10 00:42:29 2014
@@ -114,10 +114,10 @@ public class PermissionStoreImpl impleme
}
@Override
- public long getTimestamp(@Nonnull String principalName) {
+ public long getModCount(@Nonnull String principalName) {
Tree principalRoot = getPrincipalRoot(principalName);
if (principalRoot != null) {
- PropertyState ps =
principalRoot.getProperty(PermissionConstants.REP_TIMESTAMP);
+ PropertyState ps =
principalRoot.getProperty(PermissionConstants.REP_MOD_COUNT);
if (ps != null) {
return ps.getValue(Type.LONG);
}
@@ -134,8 +134,8 @@ public class PermissionStoreImpl impleme
for (Tree entryTree : principalRoot.getChildren()) {
loadPermissionEntries(entryTree, ret.getEntries(),
restrictionProvider);
}
- PropertyState ps =
principalRoot.getProperty(PermissionConstants.REP_TIMESTAMP);
- ret.setTimestamp(ps == null ? System.currentTimeMillis() :
ps.getValue(Type.LONG));
+ PropertyState ps =
principalRoot.getProperty(PermissionConstants.REP_MOD_COUNT);
+ ret.setModCount(ps == null ? -1 : ps.getValue(Type.LONG));
}
return ret;
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntries.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntries.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntries.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/permission/PrincipalPermissionEntries.java
Fri Jan 10 00:42:29 2014
@@ -35,7 +35,7 @@ public class PrincipalPermissionEntries
/**
* timestamp of the per-principal permission store
*/
- private long timestamp;
+ private long modCount;
/**
* map of permission entries, accessed by path
@@ -51,12 +51,12 @@ public class PrincipalPermissionEntries
return name;
}
- public long getTimestamp() {
- return timestamp;
+ public long getModCount() {
+ return modCount;
}
- public void setTimestamp(long timestamp) {
- this.timestamp = timestamp;
+ public void setModCount(long modCount) {
+ this.modCount = modCount;
}
@Nonnull
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.java?rev=1556998&r1=1556997&r2=1556998&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/permission/PermissionConstants.java
Fri Jan 10 00:42:29 2014
@@ -38,7 +38,7 @@ public interface PermissionConstants {
String REP_ACCESS_CONTROLLED_PATH = "rep:accessControlledPath";
String REP_NUM_PERMISSIONS = "rep:numPermissions";
- String REP_TIMESTAMP = "rep:timestamp";
+ String REP_MOD_COUNT = "rep:modCount";
String REP_IS_ALLOW = "rep:isAllow";
String REP_PRIVILEGE_BITS = "rep:privileges";
