head	1.6;
access;
symbols;
locks; strict;
comment	@# @;


1.6
date	2001.08.10.16.37.20;	author leonardr;	state Exp;
branches;
next	1.5;

1.5
date	2001.07.30.21.25.14;	author leonardr;	state Exp;
branches;
next	1.4;

1.4
date	2001.07.30.19.58.17;	author stack;	state Exp;
branches;
next	1.3;

1.3
date	2001.07.30.18.09.55;	author dlr;	state Exp;
branches;
next	1.2;

1.2
date	2001.07.27.22.59.32;	author stack;	state Exp;
branches;
next	1.1;

1.1
date	2001.07.27.19.18.00;	author leonardr;	state Exp;
branches;
next	;


desc
@@


1.6
log
@Added Hashtable representation of Project for use in future XML-RPC handlers.
@
text
@/* ================================================================
 * Copyright (c) 2001 CollabNet.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 *
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 *
 * 3. The end-user documentation included with the redistribution, if
 * any, must include the following acknowlegement: "This product includes
 * software developed by CollabNet <http://www.collab.net/>."
 * Alternately, this acknowlegement may appear in the software itself, if
 * and wherever such third-party acknowlegements normally appear.
 *
 * 4. The hosted project names must not be used to endorse or promote
 * products derived from this software without prior written
 * permission. For written permission, please contact info@@collab.net.
 *
 * 5. Products derived from this software may not use the "Tigris" or
 * "Helm" names nor may "Tigris" or "Helm" appear in their names without
 * prior written permission of CollabNet.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL COLLABNET OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * ====================================================================
 *
 * This software consists of voluntary contributions made by many
 * individuals on behalf of CollabNet.
 */

package org.tigris.helm.tool.handler;

import java.util.*;

import org.apache.turbine.util.Log;

import org.tigris.helm.DoesNotExist;
import org.tigris.helm.om.*;
import org.tigris.helm.security.AccessControlList;

/**
 * Used to handle permission calls made via
 * <a href="http://xml-rpc.com/">XML-RPC</a>.
 *
 * @@author <a href="mailto:leonardr@@collab.net">Leonard Richardson</a>
 * @@author <a href="mailto:dlr@@collab.net">Daniel Rall</a>
 * @@author <a href="mailto:lucas@@collab.net">Josh Lucas</a>
 */
public class PermissionHandler extends HelmHandler
{
    /**
     * Whether or not to log debugging information;
     */
    public static final boolean DEBUG = false;

    /**
     * Takes a Vector of k strings representing actions, and returns
     * another vector containing only those actions which the user
     * posesses.  
     *
     * @@return Vector of permissions.  If user or project does not exist, 
     *         we return an empty vector (XML-RPC does not support nulls
     *         or the passing of exceptions).
     */
    public Vector getPermissionSet(String auth, int userID, int projectID, 
                                   Vector actionsToCheck)
        throws Exception
    {
        validateAuth(auth);
        Vector permissionSet = new Vector(0);

        try
        {
            User user = UserPeer.getInstance(String.valueOf(userID));
            Project project 
                = ProjectPeer.getInstance(String.valueOf(projectID));
            AccessControlList acl = user.getACL();
            for (Iterator i = actionsToCheck.iterator(); i.hasNext();)
            {
                String action = (String)i.next();
                if (acl.hasPermission(action, project))
                {
                    permissionSet.addElement(action);
                }
            }
        }
        catch( DoesNotExist dne )
        {
            // Do not propagate.  Instead return empty vector to xmlrpc client.
            //
            permissionSet.setSize( 0 );
        }

        return permissionSet;
    }

    /**
     * Returns all the resources in which the given user has the given
     * action in the given project.
     *
     * @@return Vector of permissions.  If user or project does not exist, 
     *         we return an empty vector (XML-RPC does not support nulls
     *         or the passing of exceptions).
     */
    public Vector getResourcesForAction(String auth, String domainName, 
                                        String projectName, String userName,
                                        String action)
        throws Exception
    {
        validateAuth(auth);
        Vector rv = new Vector(0);
        try
        {
            Domain domain = ProjectPeer.getDomain(domainName);
            Project project 
                = ProjectPeer.getInstanceByName(domain, projectName);
            User user = UserPeer.getInstanceByLoginName(domain, userName);
            List resources = user.getACL()
                .getResourcesForActionInProject(action, project, false);
            for (Iterator i = resources.iterator(); i.hasNext();)
            {
                String pattern = ((Resource)i.next()).getPattern();
                if(pattern != null)
                {
                    rv.add(pattern);
                }
            }
        }
        catch( DoesNotExist dne )
        {
            // Do not propagate.  Instead return empty vector to xmlrpc client.
            //
            rv.setSize( 0 );
        }

        return rv;
    }

    /**
     * Returns all the users who have the given action in the given
     * project.
     *
     * @@return Vector of hashes containing user info.  If project does
     * not exist, we return an empty vector (XML-RPC does not support
     * nulls or the passing of exceptions).  
     */
    public Vector getUsersWithAction(String auth, int projectID, String action)
        throws Exception
    {
        validateAuth(auth);
        Vector users = new Vector(0);
        try
        {
            Project project 
                = ProjectPeer.getInstance(String.valueOf(projectID));
            List userObjs = project.getUsersWithAction(action);
            for (Iterator i = userObjs.iterator(); i.hasNext();)
            {
                User u = (User)i.next();
                users.add(u.asHashtable());
            }
        }
        catch( DoesNotExist dne )
        {
            // Do not propagate.  Instead return empty vector to xmlrpc client.
            //
            users.setSize( 0 );
        }

        return users;
    }
}
@


1.5
log
@Permission check changes: don't return duplicate resources, and make all permission checks of any kind fail if the project is locked and the action is affected by the lock.
@
text
@d159 3
a161 3
     * @@return Vector of permissions.  If user or project does not exist, 
     *         we return an empty vector (XML-RPC does not support nulls
     *         or the passing of exceptions).
@


1.4
log
@Avoid duplicates in the list of resources returned to the xmlrpc client.
@
text
@d136 1
a136 1
            RESOURCE:for (Iterator i = resources.iterator(); i.hasNext();)
d139 1
a139 1
                if( pattern != null )
a140 9
                    // Avoid making duplicate entries.
                    //
                    PATTERN:for( Iterator ii = rv.iterator( ); ii.hasNext( ); )
                    {
                        if( ( ( String )ii.next( ) ).equals( pattern ) )
                        {
                            break RESOURCE;
                        }
                    }
@


1.3
log
@Added XML-RPC hyperlink to JavaDoc.
@
text
@d136 1
a136 1
            for (Iterator i = resources.iterator(); i.hasNext();)
d141 9
@


1.2
log
@Stop DoesNotExit exception and null values being returned to xmlrpc clients.

There is no provision for null values in the xmlrpc spec. and exceptions show
on the client as a general exception in the java client while the perl
client just does 'die'.

I also set the package to suit this location.
@
text
@d58 2
a59 1
 * Used to handle permission calls made via XML-RPC.
a70 7

    /**
     * Empty constructor.
     */
    public PermissionHandler()
    {
    }
@


1.1
log
@Factored out user code into a separate XML-RPC handler.
@
text
@d47 1
a47 1
package org.tigris.helm.security;
d53 1
d55 1
d82 4
a90 1
        Vector permissionSet = null;
d92 3
a94 6
        User user = UserPeer.getInstance(String.valueOf(userID));
        Project project = ProjectPeer.getInstance(String.valueOf(projectID));
        
        AccessControlList acl = user.getACL();
        permissionSet = new Vector(0);
        for (Iterator i = actionsToCheck.iterator(); i.hasNext();)
d96 5
a100 2
            String action = (String)i.next();
            if (acl.hasPermission(action, project))
d102 5
a106 1
                permissionSet.addElement(action);
d109 7
d122 4
d133 19
a151 7
        Domain domain = ProjectPeer.getDomain(domainName);
        Project project = ProjectPeer.getInstanceByName(domain, projectName);
        User user = UserPeer.getInstanceByLoginName(domain, userName);
        List resources = user.getACL()
            .getResourcesForActionInProject(action, project, false);
        Vector rv = new Vector(resources.size());
        for (Iterator i = resources.iterator(); i.hasNext();)
d153 3
a155 1
            rv.add(((Resource)i.next()).getPattern());
d157 1
d164 4
a171 1
        Vector users = null;
d173 2
a174 5
        Project project = ProjectPeer.getInstance(String.valueOf(projectID));
        
        List userObjs = project.getUsersWithAction(action);
        users = new Vector(userObjs.size());
        for (Iterator i = userObjs.iterator(); i.hasNext();)
d176 8
a183 2
            User u = (User)i.next();
            users.add(u.asHashtable());
d185 7
@

