Added: jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHookTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHookTest.java?rev=1720618&view=auto ============================================================================== --- jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHookTest.java (added) +++ jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHookTest.java Thu Dec 17 17:40:03 2015 @@ -0,0 +1,375 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jackrabbit.oak.spi.security.authorization.cug.impl; + +import java.util.Set; +import javax.annotation.Nonnull; +import javax.jcr.security.AccessControlManager; +import javax.jcr.security.AccessControlPolicy; + +import com.google.common.collect.ImmutableSet; +import org.apache.jackrabbit.oak.api.PropertyState; +import org.apache.jackrabbit.oak.api.Root; +import org.apache.jackrabbit.oak.api.Tree; +import org.apache.jackrabbit.oak.api.Type; +import org.apache.jackrabbit.oak.commons.PathUtils; +import org.apache.jackrabbit.oak.plugins.tree.RootFactory; +import org.apache.jackrabbit.oak.spi.security.authorization.cug.CugPolicy; +import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal; +import org.apache.jackrabbit.oak.util.NodeUtil; +import org.junit.Test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertNotNull; +import static org.junit.Assert.assertTrue; +import static org.apache.jackrabbit.oak.commons.PathUtils.ROOT_PATH; + + +public class NestedCugHookTest extends AbstractCugTest { + + protected static void assertNestedCugs(@Nonnull Root root, @Nonnull String cugHoldingPath, + boolean hasCugPolicy, @Nonnull String... expectedNestedPaths) { + Root immutableRoot = RootFactory.createReadOnlyRoot(root); + + Tree tree = immutableRoot.getTree(cugHoldingPath); + if (hasCugPolicy) { + assertFalse(tree.hasProperty(HIDDEN_NESTED_CUGS)); + tree = tree.getChild(REP_CUG_POLICY); + } + + assertTrue(tree.exists()); + + if (tree.isRoot()) { + if (expectedNestedPaths.length == 0) { + assertFalse(tree.hasProperty(HIDDEN_TOP_CUG_CNT)); + } else { + assertTrue(tree.hasProperty(HIDDEN_TOP_CUG_CNT)); + assertEquals(Long.valueOf(expectedNestedPaths.length), tree.getProperty(HIDDEN_TOP_CUG_CNT).getValue(Type.LONG)); + } + } else { + assertFalse(tree.hasProperty(HIDDEN_TOP_CUG_CNT)); + } + + if (expectedNestedPaths.length == 0) { + assertFalse(tree.hasProperty(HIDDEN_NESTED_CUGS)); + } else { + assertTrue(tree.hasProperty(HIDDEN_NESTED_CUGS)); + + PropertyState nestedCugs = tree.getProperty(HIDDEN_NESTED_CUGS); + assertNotNull(nestedCugs); + + Set<String> nestedPaths = ImmutableSet.copyOf(nestedCugs.getValue(Type.PATHS)); + assertEquals(ImmutableSet.copyOf(expectedNestedPaths), nestedPaths); + } + } + + protected boolean removeCug(@Nonnull String path, boolean doCommit) throws Exception { + AccessControlManager acMgr = getAccessControlManager(root); + for (AccessControlPolicy policy : acMgr.getPolicies(path)) { + if (policy instanceof CugPolicy) { + acMgr.removePolicy(path, policy); + if (doCommit) { + root.commit(); + } + return true; + } + } + return false; + } + + @Test + public void testToString() { + assertEquals("NestedCugHook", new NestedCugHook().toString()); + } + + @Test + public void testAddCug() throws Exception { + createCug("/content", getTestGroupPrincipal()); + root.commit(); + + assertNestedCugs(root, "/", false, "/content"); + assertNestedCugs(root, "/content", true); + } + + @Test + public void testAddNestedCug() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + assertNestedCugs(root, ROOT_PATH, false, "/content/a", "/content/aa/bb", "/content2"); + assertNestedCugs(root, "/content/a", true, "/content/a/b/c"); + + // add CUG at /content after having created CUGs in the subtree + createCug("/content", EveryonePrincipal.getInstance()); + root.commit(); + assertNestedCugs(root, ROOT_PATH, false, "/content", "/content2"); + assertNestedCugs(root, "/content", true, "/content/a", "/content/aa/bb"); + assertNestedCugs(root, "/content/a", true, "/content/a/b/c"); + } + + @Test + public void testAddNodeWithCug() throws Exception { + createCug(SUPPORTED_PATH2, EveryonePrincipal.getInstance()); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH2)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(path, getTestGroupPrincipal()); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH2); + assertNestedCugs(root, SUPPORTED_PATH2, true, path); + } + + @Test + public void testAddNodeWithCugManually() throws Exception { + createCug(root, SUPPORTED_PATH3, EveryonePrincipal.NAME); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(root, path, getTestGroupPrincipal().getName()); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH3); + assertNestedCugs(root, SUPPORTED_PATH3, true, path); + } + + @Test + public void testAddAtUnsupportedPath() throws Exception { + String unsupportedPath = UNSUPPORTED_PATH + "/child"; + + createCug(root, unsupportedPath, EveryonePrincipal.NAME); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, unsupportedPath); + } + + @Test + public void testAddAtRoot() throws Exception { + createCug(root, ROOT_PATH, EveryonePrincipal.NAME); + root.commit(); + + assertTrue(root.getTree(ROOT_PATH).hasChild(REP_CUG_POLICY)); + + createCug("/content", getTestGroupPrincipal()); + createCug("/content2", EveryonePrincipal.getInstance()); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, true, "/content", "/content2"); + } + + @Test + public void testRemoveCug() throws Exception { + // create cugs at /content + createCug("/content", getTestGroupPrincipal()); + root.commit(); + + // remove CUG at /content + assertTrue(removeCug("/content", true)); + assertNestedCugs(root, ROOT_PATH, false); + } + + @Test + public void testRemoveNestedCug() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + // remove CUG at /content/a/b/c + assertTrue(removeCug("/content/a/b/c", true)); + + assertNestedCugs(root, ROOT_PATH, false, "/content/a", "/content/aa/bb", "/content2"); + assertNestedCugs(root, "/content/a", true); + } + + @Test + public void testRemoveIntermediateCug() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + // remove CUG at /content/a + assertTrue(removeCug("/content/a", true)); + + assertNestedCugs(root, ROOT_PATH, false, "/content/aa/bb", "/content2", "/content/a/b/c"); + assertFalse(root.getTree("/content/a").hasChild(REP_CUG_POLICY)); + } + + @Test + public void testRemoveMultipleCug() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + assertTrue(removeCug("/content/a", false)); + assertTrue(removeCug("/content/aa/bb", false)); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, "/content2", "/content/a/b/c"); + } + + @Test + public void testRemoveMultipleCug2() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + assertTrue(removeCug("/content/a", false)); + assertTrue(removeCug("/content/a/b/c", false)); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, "/content/aa/bb", "/content2"); + } + + @Test + public void testRemoveContentNode() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + root.getTree("/content").remove(); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, "/content2"); + } + + @Test + public void testRemoveContentANode() throws Exception { + // create cugs + // - /content/a : allow testGroup, deny everyone + // - /content/aa/bb : allow testGroup, deny everyone + // - /content/a/b/c : allow everyone, deny testGroup (isolated) + // - /content2 : allow everyone, deny testGroup (isolated) + setupCugsAndAcls(); + + root.getTree("/content/a").remove(); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, "/content2", "/content/aa/bb"); + } + + @Test + public void testRemoveRootCug() throws Exception { + // add cug at / + createCug(root, ROOT_PATH, EveryonePrincipal.NAME); + createCug("/content", getTestGroupPrincipal()); + createCug("/content2", EveryonePrincipal.getInstance()); + root.commit(); + + assertTrue(root.getTree(PathUtils.concat(ROOT_PATH, REP_CUG_POLICY)).remove()); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, "/content", "/content2"); + + assertTrue(removeCug("/content", true)); + assertNestedCugs(root, ROOT_PATH, false, "/content2"); + + assertTrue(removeCug("/content2", true)); + assertNestedCugs(root, ROOT_PATH, false); + } + + @Test + public void testRemoveAndReadd() throws Exception { + createCug(root, SUPPORTED_PATH3, EveryonePrincipal.NAME); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(path, getTestGroupPrincipal()); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH3); + assertNestedCugs(root, SUPPORTED_PATH3, true, path); + + removeCug(path, false); + createCug(path, EveryonePrincipal.getInstance()); + root.commit(); + + assertNestedCugs(root, SUPPORTED_PATH3, true, path); + } + + @Test + public void testMoveToUnsupportedPath() throws Exception { + createCug(root, SUPPORTED_PATH3, EveryonePrincipal.NAME); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(path, getTestGroupPrincipal()); + root.commit(); + + String destPath = PathUtils.concat(UNSUPPORTED_PATH, "moved"); + root.move(path, destPath); + root.commit(); + + assertNestedCugs(root, SUPPORTED_PATH3, true); + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH3, destPath); + } + + @Test + public void testMoveToSupportedPath() throws Exception { + createCug(root, SUPPORTED_PATH3, EveryonePrincipal.NAME); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(path, getTestGroupPrincipal()); + root.commit(); + + String destPath = PathUtils.concat(SUPPORTED_PATH, "moved"); + root.move(path, destPath); + root.commit(); + + assertNestedCugs(root, SUPPORTED_PATH3, true); + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH3, destPath); + } + + @Test + public void testMoveToNested() throws Exception { + createCug(root, SUPPORTED_PATH2, EveryonePrincipal.NAME); + createCug(root, SUPPORTED_PATH3, EveryonePrincipal.NAME); + + Tree newTree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NT_OAK_UNSTRUCTURED).getTree(); + String path = newTree.getPath(); + createCug(path, getTestGroupPrincipal()); + root.commit(); + + String destPath = PathUtils.concat(SUPPORTED_PATH2, "moved"); + root.move(path, destPath); + root.commit(); + + assertNestedCugs(root, ROOT_PATH, false, SUPPORTED_PATH3, SUPPORTED_PATH2); + assertNestedCugs(root, SUPPORTED_PATH3, true); + assertNestedCugs(root, SUPPORTED_PATH2, true, destPath); + } +} \ No newline at end of file
Added: jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NoCugTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NoCugTest.java?rev=1720618&view=auto ============================================================================== --- jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NoCugTest.java (added) +++ jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NoCugTest.java Thu Dec 17 17:40:03 2015 @@ -0,0 +1,130 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jackrabbit.oak.spi.security.authorization.cug.impl; + +import java.util.List; + +import javax.jcr.Session; + +import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableSet; +import org.apache.jackrabbit.oak.api.Root; +import org.apache.jackrabbit.oak.commons.PathUtils; +import org.apache.jackrabbit.oak.plugins.tree.RootFactory; +import org.apache.jackrabbit.oak.plugins.tree.TreeLocation; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.Permissions; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission; +import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal; +import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBits; +import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeBitsProvider; +import org.apache.jackrabbit.oak.spi.security.privilege.PrivilegeConstants; +import org.junit.Test; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; + +public class NoCugTest extends AbstractCugTest { + + private static final List<String> PATHS = ImmutableList.of(PathUtils.ROOT_PATH, SUPPORTED_PATH, SUPPORTED_PATH + "/subtree", SUPPORTED_PATH3, UNSUPPORTED_PATH, INVALID_PATH); + + private CugPermissionProvider cugPermProvider; + + + @Override + public void before() throws Exception { + super.before(); + + cugPermProvider = createCugPermissionProvider(ImmutableSet.of(SUPPORTED_PATH), getTestUser().getPrincipal(), EveryonePrincipal.getInstance()); + } + + @Test + public void getPrivileges() { + for (String p : PATHS) { + assertTrue(p, cugPermProvider.getPrivileges(root.getTree(p)).isEmpty()); + } + } + + @Test + public void hasPrivileges() { + for (String p : PATHS) { + assertFalse(p, cugPermProvider.hasPrivileges(root.getTree(p), PrivilegeConstants.JCR_READ)); + } + } + + @Test + public void testGetTreePermission() { + assertSame(TreePermission.NO_RECOURSE, cugPermProvider.getTreePermission(root.getTree(PathUtils.ROOT_PATH), TreePermission.EMPTY)); + } + + @Test + public void testIsGranted() { + for (String p : PATHS) { + assertFalse(p, cugPermProvider.isGranted(root.getTree(p), null, Permissions.READ)); + } + } + + @Test + public void testIsGrantedActions() { + for (String p : PATHS) { + assertFalse(p, cugPermProvider.isGranted(p, Session.ACTION_READ)); + } + } + + @Test + public void testSupportedPrivileges() { + PrivilegeBits bits = new PrivilegeBitsProvider(root).getBits(PrivilegeConstants.JCR_READ); + for (String p : PATHS) { + assertTrue(p, cugPermProvider.supportedPrivileges(root.getTree(p), bits).isEmpty()); + } + } + + @Test + public void testSupportedPrivileges2() { + for (String p : PATHS) { + assertTrue(p, cugPermProvider.supportedPrivileges(root.getTree(p), null).isEmpty()); + } + } + + @Test + public void testSupportedPermissions() { + for (String p : PATHS) { + assertEquals(p, Permissions.NO_PERMISSION, cugPermProvider.supportedPermissions(root.getTree(p), null, Permissions.READ)); + } + } + + @Test + public void testSupportedPermissionsTreeLocation() { + for (String p : PATHS) { + assertEquals(p, Permissions.NO_PERMISSION, cugPermProvider.supportedPermissions(TreeLocation.create(root.getTree(p)), Permissions.READ)); + } + } + + @Test + public void testIsGrantedTreeLocation() { + for (String p : PATHS) { + assertFalse(p, cugPermProvider.isGranted(TreeLocation.create(root.getTree(p)), Permissions.READ)); + } + } + + @Test + public void testHiddenProperty() { + Root immutableRoot = RootFactory.createReadOnlyRoot(root); + assertFalse(immutableRoot.getTree(PathUtils.ROOT_PATH).hasProperty(HIDDEN_NESTED_CUGS)); + } +} \ No newline at end of file Added: jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/TopLevelPathTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/TopLevelPathTest.java?rev=1720618&view=auto ============================================================================== --- jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/TopLevelPathTest.java (added) +++ jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/TopLevelPathTest.java Thu Dec 17 17:40:03 2015 @@ -0,0 +1,194 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.jackrabbit.oak.spi.security.authorization.cug.impl; + +import java.util.List; + +import com.google.common.collect.ImmutableList; +import com.google.common.collect.ImmutableSet; +import org.apache.jackrabbit.oak.api.Root; +import org.apache.jackrabbit.oak.api.Tree; +import org.apache.jackrabbit.oak.commons.PathUtils; +import org.apache.jackrabbit.oak.plugins.nodetype.NodeTypeConstants; +import org.apache.jackrabbit.oak.plugins.tree.RootFactory; +import org.apache.jackrabbit.oak.spi.security.authorization.permission.TreePermission; +import org.apache.jackrabbit.oak.spi.security.principal.EveryonePrincipal; +import org.apache.jackrabbit.oak.util.NodeUtil; +import org.apache.jackrabbit.util.Text; +import org.junit.Test; + +import static org.apache.jackrabbit.oak.commons.PathUtils.ROOT_PATH; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertSame; +import static org.junit.Assert.assertTrue; + +public class TopLevelPathTest extends AbstractCugTest { + + private static final List<String> PATHS = ImmutableList.of(ROOT_PATH, SUPPORTED_PATH, SUPPORTED_PATH + "/subtree", SUPPORTED_PATH3, UNSUPPORTED_PATH, INVALID_PATH); + + @Test + public void testHasAnyNoCug() { + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + assertFalse(tlp.hasAny()); + assertFalse(tlp.hasAny()); + } + + @Test + public void testHasAnyWithCug() throws Exception { + Tree tree = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NodeTypeConstants.NT_OAK_UNSTRUCTURED).getTree(); + createCug(tree.getPath(), EveryonePrincipal.getInstance()); + root.commit(); + + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + assertTrue(tlp.hasAny()); + assertTrue(tlp.hasAny()); + } + + @Test + public void testContainsNoCug() throws Exception { + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + for (String p : PATHS) { + assertFalse(tlp.contains(p)); + } + } + + @Test + public void testContainsWithCug() throws Exception { + String cugPath = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NodeTypeConstants.NT_OAK_UNSTRUCTURED).getTree().getPath(); + createCug(cugPath, EveryonePrincipal.getInstance()); + root.commit(); + + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + + assertTrue(tlp.contains(ROOT_PATH)); + assertTrue(tlp.contains(SUPPORTED_PATH3)); + assertTrue(tlp.contains(cugPath)); + + assertFalse(tlp.contains(cugPath + "/subtree")); + assertFalse(tlp.contains(SUPPORTED_PATH)); + assertFalse(tlp.contains(UNSUPPORTED_PATH)); + } + + @Test + public void testContainsWithCugAtRoot() throws Exception { + createCug(root, ROOT_PATH, EveryonePrincipal.NAME); + root.commit(); + + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + + assertTrue(tlp.contains(ROOT_PATH)); + + assertFalse(tlp.contains(SUPPORTED_PATH)); + assertFalse(tlp.contains(SUPPORTED_PATH2)); + assertFalse(tlp.contains(SUPPORTED_PATH3)); + assertFalse(tlp.contains(UNSUPPORTED_PATH)); + } + + @Test + public void testContainsMany() throws Exception { + NodeUtil n = new NodeUtil(root.getTree(SUPPORTED_PATH3)); + for (int i = 0; i <= TopLevelPaths.MAX_CNT; i++) { + Tree c = n.addChild("c" + i, NT_OAK_UNSTRUCTURED).getTree(); + createCug(c.getPath(), EveryonePrincipal.getInstance()); + } + root.commit(); + + TopLevelPaths tlp = new TopLevelPaths(RootFactory.createReadOnlyRoot(root)); + assertTrue(tlp.contains(ROOT_PATH)); + assertTrue(tlp.contains(SUPPORTED_PATH)); + assertTrue(tlp.contains(SUPPORTED_PATH2)); + assertTrue(tlp.contains(SUPPORTED_PATH3)); + assertTrue(tlp.contains(UNSUPPORTED_PATH)); + assertTrue(tlp.contains(Text.getRelativeParent(SUPPORTED_PATH3, 1))); + assertTrue(tlp.contains(SUPPORTED_PATH3 + "/c0")); + } + + @Test + public void testMayContainWithCug() throws Exception { + String cugPath = new NodeUtil(root.getTree(SUPPORTED_PATH3)).addChild("child", NodeTypeConstants.NT_OAK_UNSTRUCTURED).getTree().getPath(); + createCug(cugPath, EveryonePrincipal.getInstance()); + root.commit(); + + Root readOnlyRoot = RootFactory.createReadOnlyRoot(root); + TopLevelPaths tlp = new TopLevelPaths(readOnlyRoot); + for (String p : PATHS) { + assertEquals(p, Text.isDescendantOrEqual(p, cugPath), tlp.contains(p)); + } + + assertTrue(tlp.contains(Text.getAbsoluteParent(SUPPORTED_PATH3, 0))); + assertTrue(tlp.contains(cugPath)); + + CugPermissionProvider cugPermProvider = createCugPermissionProvider( + ImmutableSet.of(SUPPORTED_PATH, SUPPORTED_PATH2, SUPPORTED_PATH3), + getTestUser().getPrincipal(), EveryonePrincipal.getInstance()); + + Tree t = readOnlyRoot.getTree(ROOT_PATH); + TreePermission rootTp = cugPermProvider.getTreePermission(t, TreePermission.EMPTY); + assertTrue(rootTp instanceof EmptyCugTreePermission); + + TreePermission tp = rootTp; + for (String segm : PathUtils.elements(cugPath)) { + t = t.getChild(segm); + tp = cugPermProvider.getTreePermission(t, tp); + assertCugPermission(tp, Text.isDescendantOrEqual(SUPPORTED_PATH3, t.getPath())); + } + + for (String p : new String[] {SUPPORTED_PATH, SUPPORTED_PATH2, UNSUPPORTED_PATH }) { + tp = getTreePermission(readOnlyRoot, p, cugPermProvider); + assertSame(p, TreePermission.NO_RECOURSE, tp); + } + } + + @Test + public void testMayContainWithCug2() throws Exception { + String cugPath = SUPPORTED_PATH + "/subtree"; + createCug(cugPath, EveryonePrincipal.getInstance()); + root.commit(); + + Root readOnlyRoot = RootFactory.createReadOnlyRoot(root); + TopLevelPaths tlp = new TopLevelPaths(readOnlyRoot); + + assertTrue(tlp.contains(PathUtils.ROOT_PATH)); + assertTrue(tlp.contains(SUPPORTED_PATH)); + assertTrue(tlp.contains(cugPath)); + assertFalse(tlp.contains(SUPPORTED_PATH3)); + + CugPermissionProvider cugPermProvider = createCugPermissionProvider( + ImmutableSet.of(SUPPORTED_PATH, SUPPORTED_PATH2, SUPPORTED_PATH3), + getTestUser().getPrincipal(), EveryonePrincipal.getInstance()); + + Tree t = readOnlyRoot.getTree(PathUtils.ROOT_PATH); + TreePermission rootTp = cugPermProvider.getTreePermission(t, TreePermission.EMPTY); + assertTrue(rootTp instanceof EmptyCugTreePermission); + + TreePermission tp = rootTp; + for (String segm : PathUtils.elements(cugPath)) { + t = t.getChild(segm); + tp = cugPermProvider.getTreePermission(t, tp); + assertCugPermission(tp, Text.isDescendantOrEqual(SUPPORTED_PATH, t.getPath())); + } + + tp = getTreePermission(readOnlyRoot, Text.getAbsoluteParent(SUPPORTED_PATH3, 0), cugPermProvider); + assertSame(TreePermission.NO_RECOURSE, tp); + + for (String p : new String[] {SUPPORTED_PATH2, UNSUPPORTED_PATH }) { + tp = getTreePermission(readOnlyRoot, p, cugPermProvider); + assertSame(p, TreePermission.NO_RECOURSE, tp); + } + } +} \ No newline at end of file Modified: jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/VersionTest.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/VersionTest.java?rev=1720618&r1=1720617&r2=1720618&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/VersionTest.java (original) +++ jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/VersionTest.java Thu Dec 17 17:40:03 2015 @@ -346,9 +346,7 @@ public class VersionTest extends Abstrac String vhPath = checkNotNull(versionManager.getVersionHistory(versionable)).getPath(); try { - NodeUtil rootnode = new NodeUtil(root.getTree("/")); - rootnode.setNames(JCR_MIXINTYPES, MIX_REP_CUG_MIXIN); - rootnode.addChild(REP_CUG_POLICY, NT_REP_CUG_POLICY).setStrings(REP_PRINCIPAL_NAMES, EveryonePrincipal.NAME); + createCug(root, PathUtils.ROOT_PATH, EveryonePrincipal.NAME); root.commit(); CugPermissionProvider pp = createCugPermissionProvider(ImmutableSet.of("/")); Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/PropertyBuilder.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/PropertyBuilder.java?rev=1720618&r1=1720617&r2=1720618&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/PropertyBuilder.java (original) +++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/PropertyBuilder.java Thu Dec 17 17:40:03 2015 @@ -25,6 +25,7 @@ import java.util.List; import javax.annotation.Nonnull; import javax.jcr.PropertyType; +import com.google.common.collect.Iterables; import com.google.common.collect.Lists; import org.apache.jackrabbit.oak.api.Blob; import org.apache.jackrabbit.oak.api.PropertyState; @@ -247,6 +248,12 @@ public class PropertyBuilder<T> { return this; } + @Nonnull + public PropertyBuilder<T> addValues(Iterable<T> values) { + Iterables.addAll(this.values, values); + return this; + } + @Nonnull public PropertyBuilder<T> setValue(T value, int index) { values.set(index, value); Modified: jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/package-info.java URL: http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/package-info.java?rev=1720618&r1=1720617&r2=1720618&view=diff ============================================================================== --- jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/package-info.java (original) +++ jackrabbit/oak/trunk/oak-core/src/main/java/org/apache/jackrabbit/oak/plugins/memory/package-info.java Thu Dec 17 17:40:03 2015 @@ -14,7 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -@Version("2.0.0") +@Version("2.1.0") @Export(optional = "provide:=true") package org.apache.jackrabbit.oak.plugins.memory;
