svn commit: r1873536 - in /jackrabbit/oak/branches/1.10: ./ oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/ oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/...

[angela]

Author: angela
Date: Mon Feb  3 12:39:43 2020
New Revision: 1873536

URL: http://svn.apache.org/viewvc?rev=1873536&view=rev
Log:
OAK-8855 : Permission evaluation of nodes broken after :nestedCug removed from 
parent node (merge r1873524 into 1.10 branch)

Added:
    
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/RestoreParentNestedCugTest.java
      - copied unchanged from r1873524, 
jackrabbit/oak/trunk/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/RestoreParentNestedCugTest.java
Modified:
    jackrabbit/oak/branches/1.10/   (props changed)
    
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java
    
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/AbstractCugTest.java

Propchange: jackrabbit/oak/branches/1.10/
------------------------------------------------------------------------------
  Merged /jackrabbit/oak/trunk:r1873524

Modified: 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java
URL: 
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java?rev=1873536&r1=1873535&r2=1873536&view=diff
==============================================================================
--- 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java
 (original)
+++ 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java
 Mon Feb  3 12:39:43 2020
@@ -198,6 +198,17 @@ class NestedCugHook implements PostValid
         @Override
         public boolean childNodeChanged(String name, NodeState before, 
NodeState after) {
             if (!NodeStateUtils.isHidden(name)) {
+                // OAK-8855 - Restore :nestedCugs on parent if it is removed.
+                if (CugUtil.definesCug(name, after)) {
+                    Diff diff = parentDiff;
+                    while (diff != null) {
+                        if (diff.afterHoldsCug) {
+                            NodeBuilder cugNode = 
diff.afterBuilder.getChildNode(REP_CUG_POLICY);
+                            addNestedCugPath(cugNode, 
afterBuilder.getChildNode(REP_CUG_POLICY), path);
+                        }
+                        diff = diff.parentDiff;
+                    }
+                }
                 after.compareAgainstBaseState(before, new Diff(this, name, 
before, afterBuilder.getChildNode(name)));
             }
             return true;

Modified: 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/AbstractCugTest.java
URL: 
http://svn.apache.org/viewvc/jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/AbstractCugTest.java?rev=1873536&r1=1873535&r2=1873536&view=diff
==============================================================================
--- 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/AbstractCugTest.java
 (original)
+++ 
jackrabbit/oak/branches/1.10/oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/AbstractCugTest.java
 Mon Feb  3 12:39:43 2020
@@ -19,6 +19,7 @@ package org.apache.jackrabbit.oak.spi.se
 import java.security.Principal;
 import java.util.Set;
 import java.util.UUID;
+import javax.jcr.AccessDeniedException;
 import javax.jcr.RepositoryException;
 import javax.jcr.SimpleCredentials;
 import javax.jcr.security.AccessControlList;
@@ -74,8 +75,8 @@ public class AbstractCugTest extends Abs
             CugConstants.PARAM_CUG_SUPPORTED_PATHS, SUPPORTED_PATHS,
             CugConstants.PARAM_CUG_ENABLED, true);
 
-    private static final String TEST_GROUP_ID = "testGroup" + 
UUID.randomUUID();
-    private static final String TEST_USER2_ID = "testUser2" + 
UUID.randomUUID();
+    static final String TEST_GROUP_ID = "testGroup" + UUID.randomUUID();
+    static final String TEST_USER2_ID = "testUser2" + UUID.randomUUID();
 
     @Override
     public void before() throws Exception {
@@ -152,6 +153,13 @@ public class AbstractCugTest extends Abs
         return new CugPermissionProvider(root, 
root.getContentSession().getWorkspaceName(), ImmutableSet.copyOf(principals), 
supportedPaths, getConfig(AuthorizationConfiguration.class).getContext(), 
getRootProvider(), getTreeProvider());
     }
 
+    void createTrees(@NotNull Tree tree, @NotNull String ntName, @NotNull 
String... names) throws AccessDeniedException {
+        Tree parent = tree;
+        for (String n : names) {
+            parent = TreeUtil.addChild(parent, n, ntName);
+        }
+    }
+
     void setupCugsAndAcls() throws Exception {
         UserManager uMgr = getUserManager(root);
         Principal testGroupPrincipal = getTestGroupPrincipal();