[jackrabbit-oak] branch trunk updated: OAK-10425: Ability to remove mixin type without read permission on jcr:mixinTypes property

[mreutegg]

This is an automated email from the ASF dual-hosted git repository.

mreutegg pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 757553face OAK-10425: Ability to remove mixin type without read 
permission on jcr:mixinTypes property
     new 09aaa8164f Merge pull request #1100 from mreutegg/OAK-10425
757553face is described below

commit 757553faceabac62093b7e62669d2c6fb8a69759
Author: Marcel Reutegger <marcel.reuteg...@gmail.com>
AuthorDate: Tue Sep 5 08:40:52 2023 +0200

    OAK-10425: Ability to remove mixin type without read permission on 
jcr:mixinTypes property
    
    Add ignored test
---
 oak-jcr/pom.xml                                    |  3 +++
 .../security/authorization/ReadPropertyTest.java   | 25 ++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/oak-jcr/pom.xml b/oak-jcr/pom.xml
index ef2b88e172..6748ca36e8 100644
--- a/oak-jcr/pom.xml
+++ b/oak-jcr/pom.xml
@@ -149,6 +149,9 @@
       org.apache.jackrabbit.core.query.ShareableNodeTest#testName              
                      <!-- OAK-118 -->
       org.apache.jackrabbit.core.query.ShareableNodeTest#testPathConstraint    
                      <!-- OAK-118 -->
       org.apache.jackrabbit.oak.jcr.query.QueryTest#fnNameEncoding             
                      <!-- OAK-1000 -->
+
+      <!-- node type -->
+      
org.apache.jackrabbit.oak.jcr.security.authorization.ReadPropertyTest#testRemoveMixinType
      <!-- OAK-10425 -->
     </known.issues>
   </properties>
 
diff --git 
a/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadPropertyTest.java
 
b/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadPropertyTest.java
index 25188337c1..01d5cf6eae 100644
--- 
a/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadPropertyTest.java
+++ 
b/oak-jcr/src/test/java/org/apache/jackrabbit/oak/jcr/security/authorization/ReadPropertyTest.java
@@ -217,6 +217,31 @@ public class ReadPropertyTest extends 
AbstractEvaluationTest {
         assertMixinTypes(superuser.getNode(path), MIX_REFERENCEABLE, 
MIX_REP_ACCESS_CONTROLLABLE, mixTitle);
     }
 
+    @Test // (OAK-10425) ignored and marked as known issue in pom.xml
+    public void testRemoveMixinType() throws Exception {
+        String mixTitle = "mix:title";
+        superuser.getNode(path).addMixin(mixTitle);
+        superuser.getNode(path).addMixin(MIX_REFERENCEABLE);
+        superuser.save();
+
+        deny(path, privilegesFromName(PrivilegeConstants.JCR_READ));
+        allow(path, privilegesFromName(PrivilegeConstants.REP_READ_NODES));
+        allow(path, privilegesFromName(PrivilegeConstants.REP_WRITE));
+
+        assertMixinTypes(superuser.getNode(path), mixTitle, MIX_REFERENCEABLE, 
MIX_REP_ACCESS_CONTROLLABLE);
+
+        Node node = testSession.getNode(path);
+        assertFalse(node.hasProperty(JcrConstants.JCR_MIXINTYPES));
+
+        // must be able to remove mixin even if session
+        // does not have permission to read jcr:mixinTypes
+        node.removeMixin(mixTitle);
+        testSession.save();
+
+        // we should be able to see two mixin types
+        assertMixinTypes(superuser.getNode(path), MIX_REFERENCEABLE, 
MIX_REP_ACCESS_CONTROLLABLE);
+    }
+
     private void assertMixinTypes(Node node, String... mixins)
             throws RepositoryException {
         Set<String> expected = 
Arrays.stream(mixins).collect(Collectors.toSet());