Author: tommaso
Date: Wed Feb 11 14:59:32 2015
New Revision: 1658977
URL: http://svn.apache.org/r1658977
Log:
OAK-2490 - made it possible to use the PermissionProvider in query indexes
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/ImmutableRoot.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/MutableRoot.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ExecutionContext.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/QueryImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ast/SelectorImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/index/FilterImpl.java
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/query/Filter.java
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/ImmutableRoot.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/ImmutableRoot.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/ImmutableRoot.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/ImmutableRoot.java
Wed Feb 11 14:59:32 2015
@@ -127,7 +127,7 @@ public final class ImmutableRoot impleme
return new ExecutionContext(
rootTree.getNodeState(), ImmutableRoot.this,
new QueryEngineSettings(),
- new PropertyIndexProvider());
+ new PropertyIndexProvider(), null);
}
};
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/MutableRoot.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/MutableRoot.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/MutableRoot.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/core/MutableRoot.java
Wed Feb 11 14:59:32 2015
@@ -306,7 +306,7 @@ class MutableRoot implements Root {
provider, getBaseState(), getRootState());
}
return new ExecutionContext(
- getBaseState(), MutableRoot.this, queryEngineSettings,
provider);
+ getBaseState(), MutableRoot.this, queryEngineSettings,
provider, permissionProvider.get());
}
};
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ExecutionContext.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ExecutionContext.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ExecutionContext.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ExecutionContext.java
Wed Feb 11 14:59:32 2015
@@ -19,10 +19,12 @@
package org.apache.jackrabbit.oak.query;
+import javax.annotation.CheckForNull;
import javax.annotation.Nonnull;
import org.apache.jackrabbit.oak.api.Root;
import org.apache.jackrabbit.oak.spi.query.QueryIndexProvider;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider;
import org.apache.jackrabbit.oak.spi.state.NodeState;
/**
@@ -43,14 +45,17 @@ public class ExecutionContext {
private final QueryIndexProvider indexProvider;
+ private final PermissionProvider permissionProvider;
+
public ExecutionContext(
NodeState baseState, Root root,
QueryEngineSettings settings,
- QueryIndexProvider indexProvider) {
+ QueryIndexProvider indexProvider, PermissionProvider
permissionProvider) {
this.baseState = baseState;
this.root = root;
this.settings = settings;
this.indexProvider = indexProvider;
+ this.permissionProvider = permissionProvider;
}
/**
@@ -87,5 +92,9 @@ public class ExecutionContext {
public QueryEngineSettings getSettings() {
return settings;
}
-
+
+ @CheckForNull
+ public PermissionProvider getPermissionProvider() {
+ return permissionProvider;
+ }
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/QueryImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/QueryImpl.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/QueryImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/QueryImpl.java
Wed Feb 11 14:59:32 2015
@@ -987,10 +987,14 @@ public class QueryImpl implements Query
public QueryEngineSettings getSettings() {
return settings;
}
-
+
@Override
public void setInternal(boolean isInternal) {
this.isInternal = isInternal;
}
+ public ExecutionContext getExecutionContext() {
+ return context;
+ }
+
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ast/SelectorImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ast/SelectorImpl.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ast/SelectorImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/ast/SelectorImpl.java
Wed Feb 11 14:59:32 2015
@@ -635,13 +635,9 @@ public class SelectorImpl extends Source
} else if (oakPropertyName.equals(QueryImpl.REP_EXCERPT)) {
result = currentRow.getValue(QueryImpl.REP_EXCERPT);
} else if (oakPropertyName.equals(QueryImpl.REP_SPELLCHECK)) {
- // TODO : filter spellcheck corrections by ACLs ?
result = currentRow.getValue(QueryImpl.REP_SPELLCHECK);
} else if (oakPropertyName.equals(QueryImpl.REP_SUGGEST)) {
- // TODO : filter suggestions by ACLs
- PropertyValue value = currentRow.getValue(QueryImpl.REP_SUGGEST);
-
- result = value;
+ result = currentRow.getValue(QueryImpl.REP_SUGGEST);
} else {
result = PropertyValues.create(t.getProperty(oakPropertyName));
}
@@ -752,4 +748,8 @@ public class SelectorImpl extends Source
return this.outerJoinRightHandSide;
}
+ public QueryImpl getQuery() {
+ return query;
+ }
+
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/index/FilterImpl.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/index/FilterImpl.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/index/FilterImpl.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/query/index/FilterImpl.java
Wed Feb 11 14:59:32 2015
@@ -29,6 +29,7 @@ import java.util.Set;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import javax.jcr.PropertyType;
+import javax.jcr.Session;
import org.apache.jackrabbit.oak.api.PropertyValue;
import org.apache.jackrabbit.oak.commons.PathUtils;
@@ -39,6 +40,7 @@ import org.apache.jackrabbit.oak.query.a
import org.apache.jackrabbit.oak.query.ast.SelectorImpl;
import org.apache.jackrabbit.oak.query.fulltext.FullTextExpression;
import org.apache.jackrabbit.oak.spi.query.Filter;
+import
org.apache.jackrabbit.oak.spi.security.authorization.permission.PermissionProvider;
/**
* A filter or lookup condition.
@@ -594,4 +596,10 @@ public class FilterImpl implements Filte
return settings;
}
+ @Override
+ public boolean isAccessible(String path) {
+ PermissionProvider permissionProvider =
selector.getQuery().getExecutionContext().getPermissionProvider();
+ return permissionProvider != null &&
permissionProvider.isGranted(path, Session.ACTION_READ);
+ }
+
}
Modified:
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/query/Filter.java
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/query/Filter.java?rev=1658977&r1=1658976&r2=1658977&view=diff
==============================================================================
---
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/query/Filter.java
(original)
+++
jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/spi/query/Filter.java
Wed Feb 11 14:59:32 2015
@@ -74,7 +74,14 @@ public interface Filter {
FullTextExpression getFullTextConstraint();
QueryEngineSettings getQueryEngineSettings();
-
+
+ /**
+ * check whether a certain (valid) path is accessible (can be read) from
the user associated with the query Session
+ * @param path a valid JCR path
+ * @return <code>true</code> if path can be read by the calling user,
<code>false</code> otherwise.
+ */
+ boolean isAccessible(String path);
+
/**
* Whether the filter contains a native condition.
*
