head	1.37;
access;
symbols
	TIGRIS_1_1_0RC2:1.11
	TIGRIS_1_1_0RC1:1.11
	TIGRIS_1_1:1.11.0.4
	TIGRIS_1_0_8:1.11
	TIGRIS_1_0_8RC3:1.11
	TIGRIS_1_0_8RC2:1.11
	TIGRIS_1_0_8RC1:1.11
	TIGRIS_1_0_7:1.11
	TIGRIS_1_0_7RC3:1.11
	TIGRIS_1_0_7RC2:1.11
	TIGRIS_1_0_7RC1:1.11
	TIGRIS_1_0_6:1.11
	TIGRIS_1_0_6RC5:1.11
	TIGRIS_1_0_6RC4:1.11
	TIGRIS_1_0_6RC3:1.11
	TIGRIS_1_0_6RC2:1.11
	TIGRIS_1_0_6RC1:1.11
	TIGRIS_1_0_5:1.11
	TIGRIS_1_0_5RC6:1.11
	TIGRIS_1_0_5RC5:1.11
	TIGRIS_1_0_5RC4:1.11
	TIGRIS_1_0_5RC3:1.11
	TIGRIS_1_0_5RC2:1.11
	TIGRIS_1_0_5RC1:1.11
	TIGRIS_1_0_4:1.11
	TIGRIS_1_0_3:1.11
	TIGRIS_1_0_2:1.11
	TIGRIS_1_0_1:1.11
	TIGRIS_1_0:1.11.0.6
	TIGRIS_1_0_0:1.11
	TIGRIS_1_0_0_RC1:1.11.0.2
	dlr:1.1.1
	HELM_PEER_PORT_BRANCH:1.1.1.1;
locks; strict;
comment	@# @;


1.37
date	2001.08.30.16.57.42;	author dlr;	state Exp;
branches;
next	1.36;

1.36
date	2001.08.27.08.41.27;	author dlr;	state Exp;
branches;
next	1.35;

1.35
date	2001.08.15.18.35.06;	author leonardr;	state Exp;
branches;
next	1.34;

1.34
date	2001.08.11.09.08.03;	author dlr;	state Exp;
branches;
next	1.33;

1.33
date	2001.08.03.18.39.29;	author leonardr;	state Exp;
branches;
next	1.32;

1.32
date	2001.07.30.19.29.57;	author leonardr;	state Exp;
branches;
next	1.31;

1.31
date	2001.07.30.18.40.41;	author leonardr;	state Exp;
branches;
next	1.30;

1.30
date	2001.07.27.22.36.06;	author leonardr;	state Exp;
branches;
next	1.29;

1.29
date	2001.07.09.17.00.34;	author leonardr;	state Exp;
branches;
next	1.28;

1.28
date	2001.07.02.22.47.43;	author leonardr;	state Exp;
branches;
next	1.27;

1.27
date	2001.07.02.21.41.46;	author leonardr;	state Exp;
branches;
next	1.26;

1.26
date	2001.07.02.18.56.42;	author leonardr;	state Exp;
branches;
next	1.25;

1.25
date	2001.06.19.22.28.00;	author leonardr;	state Exp;
branches;
next	1.24;

1.24
date	2001.06.19.21.19.19;	author leonardr;	state Exp;
branches;
next	1.23;

1.23
date	2001.06.15.20.23.08;	author leonardr;	state Exp;
branches;
next	1.22;

1.22
date	2001.06.05.18.53.08;	author leonardr;	state Exp;
branches;
next	1.21;

1.21
date	2001.06.05.16.45.40;	author leonardr;	state Exp;
branches;
next	1.20;

1.20
date	2001.05.23.01.50.13;	author dlr;	state Exp;
branches;
next	1.19;

1.19
date	2001.05.11.19.38.55;	author leonardr;	state Exp;
branches;
next	1.18;

1.18
date	2001.05.02.08.11.04;	author dlr;	state Exp;
branches;
next	1.17;

1.17
date	2001.05.02.07.56.23;	author dlr;	state Exp;
branches;
next	1.16;

1.16
date	2001.05.02.07.06.23;	author dlr;	state Exp;
branches;
next	1.15;

1.15
date	2001.05.01.21.47.21;	author leonardr;	state Exp;
branches;
next	1.14;

1.14
date	2001.04.20.21.19.40;	author leonardr;	state Exp;
branches;
next	1.13;

1.13
date	2001.04.20.15.30.21;	author dlr;	state Exp;
branches;
next	1.12;

1.12
date	2001.04.12.20.40.50;	author leonardr;	state Exp;
branches;
next	1.11;

1.11
date	2001.03.21.16.43.27;	author leonardr;	state Exp;
branches;
next	1.10;

1.10
date	2001.03.21.16.33.00;	author leonardr;	state Exp;
branches;
next	1.9;

1.9
date	2001.03.16.00.49.38;	author leonardr;	state Exp;
branches;
next	1.8;

1.8
date	2001.03.13.03.09.55;	author dlr;	state Exp;
branches;
next	1.7;

1.7
date	2001.03.13.02.21.16;	author leonardr;	state Exp;
branches;
next	1.6;

1.6
date	2001.03.08.03.30.42;	author dlr;	state Exp;
branches;
next	1.5;

1.5
date	2001.03.07.01.53.22;	author lucas;	state Exp;
branches;
next	1.4;

1.4
date	2001.03.02.18.07.07;	author leonardr;	state Exp;
branches;
next	1.3;

1.3
date	2001.02.24.03.59.53;	author dlr;	state Exp;
branches;
next	1.2;

1.2
date	2001.02.21.03.02.22;	author edk;	state Exp;
branches;
next	1.1;

1.1
date	2001.01.28.01.18.22;	author dlr;	state dead;
branches
	1.1.1.1
	1.1.2.1;
next	;

1.1.1.1
date	2001.02.21.00.32.59;	author dlr;	state Exp;
branches;
next	;

1.1.2.1
date	2001.01.28.01.18.22;	author dlr;	state Exp;
branches;
next	1.1.2.2;

1.1.2.2
date	2001.01.29.04.30.42;	author dlr;	state Exp;
branches;
next	1.1.2.3;

1.1.2.3
date	2001.01.31.01.18.27;	author leonardr;	state Exp;
branches;
next	1.1.2.4;

1.1.2.4
date	2001.01.31.02.16.01;	author dlr;	state Exp;
branches;
next	1.1.2.5;

1.1.2.5
date	2001.01.31.21.51.37;	author dlr;	state Exp;
branches;
next	1.1.2.6;

1.1.2.6
date	2001.02.01.02.57.46;	author leonardr;	state Exp;
branches;
next	1.1.2.7;

1.1.2.7
date	2001.02.01.21.18.20;	author leonardr;	state Exp;
branches;
next	1.1.2.8;

1.1.2.8
date	2001.02.01.22.08.03;	author leonardr;	state Exp;
branches;
next	1.1.2.9;

1.1.2.9
date	2001.02.02.16.58.34;	author leonardr;	state Exp;
branches;
next	1.1.2.10;

1.1.2.10
date	2001.02.02.19.27.46;	author leonardr;	state Exp;
branches;
next	1.1.2.11;

1.1.2.11
date	2001.02.03.00.07.12;	author leonardr;	state Exp;
branches;
next	1.1.2.12;

1.1.2.12
date	2001.02.05.20.18.42;	author leonardr;	state Exp;
branches;
next	1.1.2.13;

1.1.2.13
date	2001.02.09.02.15.09;	author dlr;	state Exp;
branches;
next	1.1.2.14;

1.1.2.14
date	2001.02.09.16.05.17;	author leonardr;	state Exp;
branches;
next	1.1.2.15;

1.1.2.15
date	2001.02.10.01.14.02;	author leonardr;	state Exp;
branches;
next	1.1.2.16;

1.1.2.16
date	2001.02.10.02.20.48;	author leonardr;	state Exp;
branches;
next	1.1.2.17;

1.1.2.17
date	2001.02.10.06.04.38;	author dlr;	state Exp;
branches;
next	1.1.2.18;

1.1.2.18
date	2001.02.12.16.24.32;	author leonardr;	state Exp;
branches;
next	1.1.2.19;

1.1.2.19
date	2001.02.14.23.20.29;	author leonardr;	state Exp;
branches;
next	1.1.2.20;

1.1.2.20
date	2001.02.15.20.50.38;	author leonardr;	state Exp;
branches;
next	1.1.2.21;

1.1.2.21
date	2001.02.16.03.01.27;	author dlr;	state Exp;
branches;
next	1.1.2.22;

1.1.2.22
date	2001.02.16.16.09.07;	author leonardr;	state Exp;
branches;
next	1.1.2.23;

1.1.2.23
date	2001.02.16.16.26.36;	author leonardr;	state Exp;
branches;
next	1.1.2.24;

1.1.2.24
date	2001.02.21.00.21.22;	author dlr;	state Exp;
branches;
next	;


desc
@@


1.37
log
@Updated for latest Turbine API changes.
@
text
@/* ================================================================
 * Copyright (c) 2000-2001 CollabNet.  All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 
 * 3. The end-user documentation included with the redistribution, if
 * any, must include the following acknowlegement: "This product includes
 * software developed by CollabNet (http://www.collab.net/)."
 * Alternately, this acknowlegement may appear in the software itself, if
 * and wherever such third-party acknowlegements normally appear.
 * 
 * 4. The hosted project names must not be used to endorse or promote
 * products derived from this software without prior written
 * permission. For written permission, please contact info@@collab.net.
 * 
 * 5. Products derived from this software may not use the "Tigris" name
 * nor may "Tigris" appear in their names without prior written
 * permission of CollabNet.
 * 
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL COLLABNET OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * ====================================================================
 * 
 * This software consists of voluntary contributions made by many
 * individuals on behalf of CollabNet.
 */

package org.tigris.helm.om;

import java.util.*;

import gnu.regexp.*;

import org.apache.torque.util.BasePeer;
import org.apache.torque.util.Criteria;
import org.apache.commons.util.ObjectUtils;
import org.apache.commons.util.StringUtils;
import org.apache.turbine.ParameterParser;
import org.apache.turbine.util.Log;
import org.apache.commons.util.exception.NestableException;
import org.apache.torque.pool.DBConnection;

import org.tigris.helm.om.*;
import org.tigris.helm.security.*;
import org.tigris.helm.DoesNotExist;
import org.tigris.helm.tool.*;

import org.tigris.helm.tool.audit.AuditLog;

/** 
 * Role business object.
 */
public class Role extends BaseRole 
    implements BOType
{
    /**
     * The regular expression used to check role names for validity.
     */
    private static final String ROLE_NAME_RE = "(^[^\\.]{1,99}$)";

    /**
     * Description of the audit log entry created when a role is added.  
     */
    private static final String AUDIT_LOG_ON_ADD = "Role added: ";

    /**
     * Description of the audit log entry created when a role is edited. 
     */
    private static final String AUDIT_LOG_ON_EDIT = "Role edited: ";

    /**
     * Description of the audit log entry created when a role is deleted.  
     */
    private static final String AUDIT_LOG_ON_DELETE = "Role deleted: ";

    /**
     * Description of the audit log entry created when a permission is
     * added to this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_ADD =
        "Permission added to role: ";

    /**
     * Description of the audit log entry created when a permission is
     * removed from this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_REMOVE = 
        "Permission removed from role: ";

    /**
     * Checks whether a role name is valid.
     *
     * @@param name The role name to check.
     * @@return     Whether the name is valid.
     */
    public static boolean isValidName(String name)
    {
        boolean isValid = false;
        if (name != null && name.length() > 0)
        {
            RE roleRE = null;
            try
            {
                roleRE = new RE(ROLE_NAME_RE);
                isValid = roleRE.isMatch(name);
            }
            catch (REException e)
            {
                Log.error(e);
            }
        }
        return isValid;
    }

    /**
     * Description of the role.
     */
    public final String toString()
    {
        return getUnqualifiedName();
    }

    /**
     * Returns the fully qualified name of the role, preceded by the
     * dotted path of the project with which it is associated.  
     */
    public String getFullName()
        throws Exception
    {
        String name = getUnqualifiedName();
        String dottedPath = getProject().getDottedPath();
        if (!dottedPath.equals(""))
        {
            name = dottedPath + "." + name;
        }
        return name;
    }

    /**
     * Returns the unqualified name of the role.
     */
    public String getUnqualifiedName()
    {
        return super.getName();
    }

    /**
     * Returns true iff this role is requestable by end-users.
     */
    public boolean isRequestable()
        throws Exception
    {
        return hasBooleanAttribute(Attribute.REQUESTABLE);
    }

    /**
     * Returns true iff having this role in a project gives you the
     * same role in the project's private subprojects. 
     */
    public boolean canRecurseIntoPrivateProjects()
        throws Exception
    {
        return !hasBooleanAttribute
            (Attribute.BLOCK_RECURSION_INTO_PRIVATE_PROJECTS);
    }

    /**
     * Returns true iff this role denotes ownership of the
     * project/domain/host in which it is granted.  
     */
    public boolean denotesOwner()
        throws Exception
    {
        return hasBooleanAttribute(Attribute.DENOTES_OWNERSHIP);
    }

    /**
     * Returns <code>true</code> iff this role has an associated
     * boolean attribute set to <code>"true"</code>.
     */
    public final boolean hasBooleanAttribute(String name)
        throws Exception
    {
        return DBFlag.booleanValueOf(getValueForAttribute(name));
    }

    /**
     * Returns the value corresponding to the given attribute for this
     * role. If not specified, the value is null.
     */
    public String getValueForAttribute(String attribute)
        throws Exception
    {
        AttributeValue valueObj =  AttributeValuePeer.getInstanceByName
            (ROLE_TYPE, getID(), attribute);
        String value = null;
        if (valueObj != null)
        {
            value = valueObj.getValue();
        }
        return value;
    }

    /**
     * Returns true iff this role is in a deletable state (ie. nobody
     * gets permissions from it).
     */
    public boolean canBeDeleted()
        throws Exception
    {
        return (timesGranted() == 0);
    }
    
    /**
     * Returns a List of Permission objects corresponding to the
     * permissions of this role.
     */
    public List getPermissions()
        throws Exception
    {
        List permissions = new ArrayList();

        //Get the mappings of this role to actions and extents.
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, 
                 Integer.parseInt(getID()));
        List mappings = RoleActionResourcePeer.doSelect(c);
        
        //Turn the mappings into permissions
        for (Iterator i = mappings.iterator(); i.hasNext();)
        {
            RoleActionResource mapping = (RoleActionResource)i.next();
            Action a = ActionPeer.getInstance(mapping.getActionId().toString());
            Resource r = ResourcePeer.getInstance(mapping.getResourceId().toString());
            permissions.add(new Permission(a,r));
        }
        return permissions;
    }

    /**
     * Returns the resources on which this role holds the specified action.
     */
    public List getResourcesForAction(Action action)
        throws Exception
    {
        Map permissions = RoleActionResourcePeer.getPermissionsForRole(this);
        List resourcesForAction = null;
        if (permissions.containsKey(action))
        {
            resourcesForAction = (List)permissions.get(action);
        }
        else
        {
            resourcesForAction = new ArrayList(0);
        }
        return resourcesForAction;
    }

    /**
     * Returns the number of times this role has been granted.
     */
    private int timesGranted()
        throws Exception
    {
        Criteria c = UserRoleProjectPeer.approvedRoleCriteria()
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        return UserRoleProjectPeer.doSelect(c).size();
    }
   
    //
    // Mutator methods
    //

    /**
     * Overrides BaseRole save to remove this role from the cache.
     * There might be a cached representation of the role associated
     * with this key floating around.  
     */
    public void save()
        throws Exception
    {
        super.save();
        uncache();
    }

    /**
     * Create a new entry in the role table and return the corresponding
     * Role object.
     */
    public static Role add(AccessControlList acl, Project associatedProject,
                           String name, String description, String type,
                           List permissions, Map attributes)
        throws ACLException, Exception
    {
        if (!isValidName(name))
        {
            throw new Exception("Invalid role name: " + name);
        }
        Role role = new Role();
        Log.debug("Roel name: " + name);
        role.setName(name);
        role.setDescription(description);
        role.setProject(associatedProject);
        role.setType(type);
        role.assertAddPermission(acl, associatedProject);
        role.save();

        //Set attributes.
        role.updateAttributes(attributes);

        //Now add the appropriate permissions
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission perm = (Permission)i.next();            
            role.addPermission(acl, perm);
        }
        AuditLog.logEvent(acl.getUser(), associatedProject, 
                          AUDIT_LOG_ON_ADD + role.getName());
        return role;
    }

    /**
     * Changes the database information in the role table.
     */
    public void update(AccessControlList acl, String name, 
                       String description, String type, Map attributes)
        throws ACLException, Exception
    {
        assertEditPermission(acl);
        if (!isValidName(name))
        {
            throw new Exception("Invalid role name: " + name);
        }

        Project associatedProject = getProject();
        setName(name);
        setDescription(description);
        setType(type);
        save();
        updateAttributes(attributes);
        AuditLog.logEvent(acl.getUser(), associatedProject, 
                          AUDIT_LOG_ON_EDIT + getName());
    }


    /**
     * Defines a set of attributes for a role.
     */
    public void updateAttributes(Map attributes)
        throws Exception
    {
        List possibleAttributes = AttributePeer.getAttributes(ROLE_TYPE);
        for (Iterator i = possibleAttributes.iterator(); i.hasNext();)
        {
            Attribute attribute = (Attribute) i.next();
            String value = (String)attributes.get(attribute.getName());
            setValueForAttribute(attribute, value);
        }
    }

    /**
     * Sets an attribute value for this role.  Passing
     * <code>null</code> deletes the value for the specified
     * attribute (effectively unsetting it).
     */
    public void setValueForAttribute(Attribute attribute, String value)
        throws Exception
    {
        Criteria c = new Criteria(2)
            .add(AttributeValuePeer.ATTRIBUTE_ID, attribute.getID())
            .add(AttributeValuePeer.ENTITY_ID, getID());
        
        if (value == null)
        {
            AttributeValuePeer.doDelete(c);
        }
        else
        {
            AttributeValue av = null;
            try
            {                
                av = (AttributeValue) PeerTool.getFirstBO
                    (AttributeValuePeer.doSelect(c),
                     Attribute.ROLE_TYPE + " attribute " 
                     + attribute.getName() + " for role " + getName());
            }
            catch (DoesNotExist e)
            {
                av = new AttributeValue();                
                av.setAttributeId(attribute.getID());
                av.setEntityId(getID());
            }
            av.setValue(value);
            av.save();
        }
    }

    /**
     * Add a permission to a role. 
     */
    public void addPermission(AccessControlList acl, Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        Project associatedProject = getProject();
        assertEditPermission(acl);
        
        Action action = permission.getAction();
        Resource resource = permission.getResource();

        RoleActionResource mapping = null;
        //We get an error if we try to grant a role someone already
        //has, so check for one first. 
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID, action.getActionId())
            .add(RoleActionResourcePeer.RESOURCE_ID, resource.getResourceId());
        try 
        {
            mapping = (RoleActionResource)
                PeerTool.getFirstBO(RoleActionResourcePeer.doSelect(c), "");
        } catch (DoesNotExist e) {
            mapping = new RoleActionResource();
        }

        mapping.setRoleId(getRoleId());
        mapping.setActionId(permission.getAction().getActionId());
        mapping.setResourceId(permission.getResource().getResourceId());
        mapping.save();

        AuditLog.logEvent(acl.getUser(), associatedProject, 
                          AUDIT_LOG_ON_PERMISSION_ADD 
                          + getName() + " <- " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());

        RoleActionResourcePeer.uncache(this);
    }


    /**
     * Remove a permission from a role. 
     */
    public void removePermission(AccessControlList acl, Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        assertEditPermission(acl);

        Action action = permission.getAction();        
        String type = action.getType();
        if ((Action.HOST_TYPE.equals(type) || Action.DOMAIN_TYPE.equals(type))
            && AccessControlList.getSuperUserACL()
            .wouldLosePermissionWithout(action, this))
        {
            throw new  Exception("Superuser would lose " + action.getName() 
                                 + " if you removed it from this role.");
        }
        
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID,
                 permission.getAction().getActionId())
            .add(RoleActionResourcePeer.RESOURCE_ID, 
                 permission.getResource().getResourceId());
        RoleActionResourcePeer.doDelete(c);

        AuditLog.logEvent(acl.getUser(), getProject(), 
                          AUDIT_LOG_ON_PERMISSION_REMOVE
                          + getName() + " -> " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());
        RoleActionResourcePeer.uncache(this);
    }

    /**
     * Deletes a role, its definitions, and its assignments.
     */
    public void delete(AccessControlList acl)
        throws ACLException, Exception
    {
        assertDeletePermission(acl);

        int times = timesGranted();
        if (times > 0)
        {            
            StringBuffer err = new StringBuffer
                ("This role is currently granted ")
                .append(times).append("time").append(times==1?"":"s")
                .append(". You cannot delete a role unless nobody has it.");
            throw new Exception(err.toString());
        }
        
        //Delete the definition.
        Criteria allRARs = new Criteria(1)
            .add(RoleActionResourcePeer.ROLE_ID, getID());
        UserRoleProjectPeer.doDelete(allRARs);

        Project associatedProject = getProject();

        //Delete the role proper.
        Criteria thisRole = new Criteria(1).add(RolePeer.ROLE_ID, getID());
        RolePeer.doDelete(thisRole);

        AuditLog.logEvent(acl.getUser(), associatedProject, 
                          AUDIT_LOG_ON_DELETE + getName());
    }

    //
    // Permission checking methods
    //

    /**
     * Throws an exception if the given ACL does not have permission to
     * add a role to the given project.
     */
    public void assertAddPermission(AccessControlList acl, 
                                    Project associatedProject)
        throws ACLException, Exception
    {
        acl.assertPermission("Role - Add", associatedProject);
    }

    /**
     * Throws an exception if the given ACL does not have permission
     * to change the given role.
     */
    public void assertEditPermission(AccessControlList acl)
        throws ACLException, Exception
    {
        acl.assertPermission("Role - Edit", getProject());
    }

    /**
     * Throws an exception if the given ACL does not have permission to
     * remove the given role.
     */
    public void assertDeletePermission(AccessControlList acl)
        throws ACLException, Exception
    {
        acl.assertPermission("Role - Delete", getProject());
    }

    //Deprecated methods.
    /**
     * Returns a list of users who have this role approved in some project.
     * @@deprecated This was never used AFAIK.
     */
    public List assignedUsers()
        throws Exception
    {        
        Criteria c = UserRoleProjectPeer.approvedRoleCriteria()
            .addJoin(UserPeer.USER_ID, UserRoleProjectPeer.USER_ID)
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        c.setDistinct();
        return UserPeer.doSelect(c);
    }

    /**
     * Returns a list of projects in which some user has this role.
     * @@deprecated This was never used AFAIK.
     */
    public List assignedProjects()
        throws Exception
    {        
        Criteria c = UserRoleProjectPeer.approvedRoleCriteria()
            .addJoin(ProjectPeer.PROJECT_ID, UserRoleProjectPeer.PROJECT_ID)
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        c.setDistinct();
        return ProjectPeer.doSelect(c);
    }   

}
@


1.36
log
@Updated for Turbine API change.
@
text
@d57 1
a57 1
import org.apache.fulcrum.util.parser.ParameterParser;
@


1.35
log
@Refactored methods for filtering out unapproved roles.
@
text
@d57 1
a57 1
import org.apache.turbine.util.ParameterParser;
@


1.34
log
@Upgrading to Turbine 3.0-dev, Fulcrum 1.0, and Torque 1.0.
@
text
@d284 1
a284 1
        Criteria c = approvedRoleCriteria(1)
a562 10
    /**
     * Returns a criteria for obtaining only approved role assignments.
     */ 
    public final Criteria approvedRoleCriteria(int size)
    {
        return new Criteria(size+2)
            .add(UserRoleProjectPeer.APPROVED_BY, 
                 UserPeer.getNobodyUser().getUserId(), Criteria.NOT_EQUAL);
    }

d571 1
a571 1
        Criteria c = approvedRoleCriteria(2)
d585 1
a585 1
        Criteria c = approvedRoleCriteria(2)
@


1.33
log
@A cache for attribute values, and code to use it when getting role attribute values.
@
text
@d53 4
a56 5
import org.apache.turbine.om.*;
import org.apache.turbine.om.peer.BasePeer;
import org.apache.turbine.util.db.Criteria;
import org.apache.turbine.util.ObjectUtils;
import org.apache.turbine.util.StringUtils;
d59 2
a60 2
import org.apache.turbine.util.TurbineException;
import org.apache.turbine.util.db.pool.DBConnection;
@


1.32
log
@Stop coddling IZ in terms of user accounts; assume that IZ can get its permissions from Helm through the XML-RPC interface.
@
text
@d214 2
a215 3
        Criteria c = attributeValueCriteria()
            .add(AttributePeer.NAME, attribute);

d217 1
a217 8
        try
        {
            AttributeValue av = (AttributeValue) PeerTool.getFirstBO
                (AttributeValuePeer.doSelect(c), 
                 "Attribute for role " + getName(), "");
            value = av.getValue();
        }
        catch (DoesNotExist ignore)
d219 1
a571 13
    }

    /**
     * Returns a criteria for obtaining the value for one of
     * this roles' attributes.
     */ 
    private final Criteria attributeValueCriteria()
    {
        return new Criteria()
            .add(AttributeValuePeer.ENTITY_ID, getID())
            .addJoin(AttributeValuePeer.ATTRIBUTE_ID, 
                     AttributePeer.ATTRIBUTE_ID)
            .add(AttributePeer.ENTITY_TYPE, ROLE_TYPE);
@


1.31
log
@Action cleanup. Some role actions, and Audit Log - View, had three actions apiece when one would do. We're now down to 76 actions.
@
text
@a241 23
     * Returns true iff the role has a permission which might change
     * the type of issue tracking account a user had if it were
     * granted to or revoked from that user.
     */
    public boolean affectsIssueTracking()
        throws Exception
    {
        boolean affects = false;
        List permissions = getPermissions();
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission p = (Permission)i.next();
            Action a = p.getAction();
            if (a.isIssueTracking())
            {
                affects = true;
                break;
            }
        }
        return affects;
    }

    /**
d426 1
a426 4
     * Add a permission to a role. Note that this does not recalculate
     * issue tracking accounts--that is done in RoleMemberAdd because it
     * takes a *long* time, and we might be adding more than one issue
     * tracking permission here.  
d469 1
a469 4
     * Remove a permission from a role. Note that this does not
     * recalculate issue tracking accounts--that is done in RoleEdit
     * because it takes a *long* time, and we might be removing more
     * than one issue tracking permission here.  
@


1.30
log
@Made Role.getName() get unqualified role name; this was neccessary because BaseRolePeer calls Role.getName(), which was causing roles to be created with their fully-qualified names being stored where their unqualified names should be. Templates which used to use Role.getName() now need to use Role.getFullName()
@
text
@d577 1
a577 15
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) 
        {
            acl.assertPermission
                ("Project Role - Add", associatedProject);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) 
        {
            acl.assertPermission
                ("Domain Role - Add", associatedProject);
        }
        else 
        {
            acl.assertPermission("Host Role - Add", associatedProject);
        }
d587 1
a587 16
        Project associatedProject = getProject();
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) 
        {
            acl.assertPermission
                ("Project Role - Edit", associatedProject);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) 
        {
            acl.assertPermission
                ("Domain Role - Edit", associatedProject);
        }
        else 
        {
            acl.assertPermission("Host Role - Edit", associatedProject);
        }
d597 1
a597 16
        Project associatedProject = getProject();
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) 
        {
            acl.assertPermission
                ("Project Role - Delete", associatedProject);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) 
        {
            acl.assertPermission
                ("Domain Role - Delete", associatedProject);
        }
        else 
        {
            acl.assertPermission("Host Role - Delete", associatedProject);
        }
@


1.29
log
@How about checking the permission designed explicitly for this purpose.
@
text
@d147 1
a147 19
    public String getName()
    {
        String s = null;
        try 
        {
            s = getFullyQualifiedName();
        }
        catch (Exception e)
        {
            s = getUnqualifiedName();
        }
        return s;
    }

    /**
     * Returns the fully qualified name of the role, preceded by the
     * dotted path of the project with which it is associated.  
     */
    public String getFullyQualifiedName()
d350 1
d695 1
@


1.28
log
@The period character is now a separator between the names of projects and their roles, and as such can no longer be used as the name of a role.
@
text
@d648 1
a648 1
                ("Project Role - Add", associatedProject);
d653 1
a653 1
                ("Domain Role - Add", associatedProject);
d657 1
a657 1
            acl.assertPermission("Host Role - Add", associatedProject);
@


1.27
log
@Prohibit actions which would cause root to lose a host or domain permission.
@
text
@d51 2
d76 4
d111 25
d363 4
d397 4
@


1.26
log
@Implemented project-scoped roles.
@
text
@d484 10
@


1.25
log
@Select/delete only the object for this particular role.
@
text
@a58 1
import org.apache.turbine.util.TurbineException;
d71 2
a72 1
public class Role extends BaseRole implements BOType
d86 5
d109 1
a109 1
        return getName();
d113 43
a155 1
     * Returns true if this role is requestable by end-users.
d163 4
d175 1
a175 1
     * Returns true if this role denotes ownership of the
a218 26
     * Returns a list of users who have this role approved in some project.
     */
    public List assignedUsers()
        throws Exception
    {        
        Criteria c = approvedRoleCriteria(2)
            .addJoin(UserPeer.USER_ID, UserRoleProjectPeer.USER_ID)
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        c.setDistinct();
        return UserPeer.doSelect(c);
    }

    /**
     * Returns a list of projects in which some user has this role.
     */
    public List assignedProjects()
        throws Exception
    {        
        Criteria c = approvedRoleCriteria(2)
            .addJoin(ProjectPeer.PROJECT_ID, UserRoleProjectPeer.PROJECT_ID)
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        c.setDistinct();
        return ProjectPeer.doSelect(c);
    }

    /**
a228 11
     * Returns the number of times this role has been granted.
     */
    public int timesGranted()
        throws Exception
    {
        Criteria c = approvedRoleCriteria(1)
            .add(UserRoleProjectPeer.ROLE_ID, getID());
        return UserRoleProjectPeer.doSelect(c).size();
    }
    
    /**
d295 11
d327 1
a327 1
    public static Role add(AccessControlList acl, Domain domain,
d335 1
d337 1
a337 1
        role.assertAddPermission(acl, domain);
d347 1
a347 1
            role.addPermission(acl, domain, perm);
d349 1
a349 1
        AuditLog.logEvent(acl.getUser(), domain, 
d357 2
a358 3
    public void update(AccessControlList acl, Domain domain,
                       String name, String description, String type,
                       Map attributes)
d361 3
a366 1
        assertEditPermission(acl, domain);        
d369 1
a369 1
        AuditLog.logEvent(acl.getUser(), domain, 
d397 1
a397 1
        Criteria c = attributeValueCriteria()
d400 1
a400 1

d417 1
a417 1
                av = new AttributeValue();
d432 1
a432 2
    public void addPermission(AccessControlList acl, Domain domain,
                              Permission permission)
d436 2
a437 1
        assertEditPermission(acl, domain);
d462 1
a462 1
        AuditLog.logEvent(acl.getUser(), domain, 
d478 1
a478 2
    public void removePermission(AccessControlList acl, Domain domain,
                                 Permission permission)
d482 2
a483 1
        assertEditPermission(acl, domain);
d492 1
a492 1
        AuditLog.logEvent(acl.getUser(), domain, 
d503 1
a503 1
    public void delete(AccessControlList acl, Domain domain)
d506 1
a506 1
        assertDeletePermission(acl, domain);
d523 2
d528 3
d539 1
a539 1
     * add a role to the given domain.
d541 2
a542 1
    public void assertAddPermission(AccessControlList acl, Domain domain)
d549 1
a549 1
                ("Project Role - Add", domain);
d554 1
a554 1
                ("Domain Role - Add", domain);
d558 1
a558 1
            acl.assertPermission("Host Role - Add");
d564 1
a564 1
     * to change a role in the given domain.
d566 1
a566 1
    public void assertEditPermission(AccessControlList acl, Domain domain)
d569 1
d571 2
a572 1
        if (type.equals(Role.PROJECT_TYPE)) {
d574 1
a574 1
                ("Project Role - Edit", domain);
d576 2
a577 1
        else if (type.equals(Role.DOMAIN_TYPE)) {
d579 1
a579 1
                ("Domain Role - Edit", domain);
d581 3
a583 2
        else {
            acl.assertPermission("Host Role - Edit");
d589 1
a589 1
     * add a role to the given domain.
d591 1
a591 1
    public void assertDeletePermission(AccessControlList acl, Domain domain)
d594 1
d599 1
a599 1
                ("Project Role - Add", domain);
d604 1
a604 1
                ("Domain Role - Add", domain);
d608 1
a608 1
            acl.assertPermission("Host Role - Add");
d612 3
d622 4
d634 29
@


1.24
log
@Handle the case where the role doesn't have the given attribute set.
@
text
@d371 2
a372 1
            .add(AttributeValuePeer.ATTRIBUTE_ID, attribute.getID());
d391 1
a392 1
                av.setAttributeId(attribute.getID());
@


1.23
log
@Rearranged attribute constants and added generic host attribute-editing interface to AdminUtils.
@
text
@d379 14
a392 3
            AttributeValue av = (AttributeValue) PeerTool.getFirstBO
                (AttributeValuePeer.doSelect(c),
                 Attribute.ROLE_TYPE + " attribute " + attribute);
@


1.22
log
@Added more functionality for role deletion.
@
text
@d113 1
a113 1
        return hasBooleanAttribute(AttributePeer.REQUESTABLE_ATTRIBUTE);
d120 1
a120 1
            (AttributePeer.BLOCK_RECURSION_INTO_PRIVATE_PROJECTS_ATTRIBUTE);
d130 1
a130 2
        return hasBooleanAttribute
            (AttributePeer.DENOTES_OWNERSHIP_ATTRIBUTE);
@


1.21
log
@Added some data-gathering methods, and code to delete a role if nobody currently has it.
@
text
@d169 1
a169 1
     * Returns a list of users who have this role in some project.
d174 1
a174 1
        Criteria c = new Criteria(1)
d187 1
a187 1
        Criteria c = new Criteria(1)
d195 10
d210 1
a210 1
        Criteria c = new Criteria(1)
d550 1
a550 1
                ("Project Role - Delete", domain);
d555 1
a555 1
                ("Domain Role - Delete", domain);
d559 1
a559 1
            acl.assertPermission("Host Role - Delete");
d561 7
@


1.20
log
@Ported Helm from WebMacro to Velocity.
@
text
@d167 37
d227 1
a227 1
    
d452 28
d492 2
a493 1
        if (type.equals(Role.PROJECT_TYPE)) {
d497 2
a498 1
        else if (type.equals(Role.DOMAIN_TYPE)) {
d502 2
a503 1
        else {
d526 24
@


1.19
log
@A Heartbreaking Patch of Staggering Genius: adds capacity (but no interface) for deeply nested projects, categories, and project groups. As a side effect, gets rid of the hacky special 'all public projects in domain' group. There are probably bugs in this, and some of those bugs are probably security holes, so watch out.
@
text
@d58 2
@


1.18
log
@Corrected getAttributes() call in Role and made use of HelmPeer's new NO_CRITERIA constant.
@
text
@d114 7
@


1.17
log
@* Renamed getAttributeValue() to getValueForAttribute() for
orthogonality.

* Refactored getValueForAttribute() and setValueForAttribute() to only
retrieve Role-specific entries.

* Added attributeValueCriteria() helper method.
@
text
@d298 1
a298 1
        List possibleAttributes = AttributePeer.getAttributes();
@


1.16
log
@Migrating code to make proper use of the new generic attribute tables.  Things are still a bit rough.
@
text
@d132 1
a132 1
        return DBFlag.booleanValueOf(getAttributeValue(name));
d139 1
a139 1
    public String getAttributeValue(String attribute)
d142 2
a143 6
        // TODO: Only get Role-specific entries.
        Criteria c = new Criteria(3)
            .add(AttributePeer.NAME, attribute)
            .add(AttributeValuePeer.ROLE_ID, getID())
            .addJoin(AttributePeer.ATTRIBUTE_ID, 
                     AttributeValuePeer.ATTRIBUTE_ID);
a144 1
        AttributeValue result = null;
d148 1
a148 1
            result = (AttributeValue) PeerTool.getFirstBO
d151 1
a151 1
            value = result.getValue();
a304 1

d308 3
a310 1
     * Sets an attribute value for this role. 
d315 1
a315 3
        // TODO: Only get Role-specific entries.
        Criteria c = new Criteria()
            .add(AttributeValuePeer.ROLE_ID, getID())
d318 5
a322 2
        AttributeValuePeer.doDelete(c);
        if (value != null)
d324 5
a328 2
            c.add(AttributeValuePeer.VALUE, value);
            AttributeValuePeer.doInsert(c);
d450 9
@


1.15
log
@Big architecture and schema change: booleans in the HELM_ROLE table have been replaced by entries in the HELM_ROLE_ATTRIBUTE_VALUE table. Also, a new attribute has been added which controls which roles a user gets upon creation of a project.
@
text
@d111 1
a111 1
        return hasBooleanAttribute(RoleAttributePeer.REQUESTABLE_ATTRIBUTE);
d122 1
a122 1
            (RoleAttributePeer.DENOTES_OWNERSHIP_ATTRIBUTE);
d126 2
a127 2
     * Returns true iff this role has an associated boolean attribute
     * set to "true".
d129 1
a129 1
    public boolean hasBooleanAttribute(String name)
d142 1
d144 4
a147 4
            .add(RoleAttributePeer.NAME, attribute)
            .add(RoleAttributeValuePeer.ROLE_ID, getID())
            .addJoin(RoleAttributePeer.ATTRIBUTE_ID, 
                     RoleAttributeValuePeer.ATTRIBUTE_ID);
d149 1
a149 1
        RoleAttributeValue result = null;
d153 2
a154 2
            result = (RoleAttributeValue)PeerTool.getFirstBO
                (RoleAttributeValuePeer.doSelect(c), 
d303 1
a303 1
        List possibleAttributes = RoleAttributePeer.getAttributes();
d306 1
a306 1
            RoleAttribute attribute = (RoleAttribute)i.next();
d316 1
a316 1
    public void setValueForAttribute(RoleAttribute attribute, String value)
d319 1
d321 2
a322 2
            .add(RoleAttributeValuePeer.ROLE_ID, getID())
            .add(RoleAttributeValuePeer.ATTRIBUTE_ID, attribute.getID());
d324 1
a324 1
        RoleAttributeValuePeer.doDelete(c);
d327 2
a328 2
            c.add(RoleAttributeValuePeer.VALUE, value);
            RoleAttributeValuePeer.doInsert(c);
@


1.14
log
@Send CacheInvalidationEvents on deletes, and on saves of objects which are not themselves cached but which invalidate other caches when they are changed.
@
text
@d109 1
d111 1
a111 1
        return DBFlag.booleanValueOf(getRequestable());
d119 12
d132 1
a132 1
        return DBFlag.booleanValueOf(getDenotesOwner());
d136 28
d230 1
a230 1

d253 1
a253 2
                           boolean requestable, boolean denotesOwner,
                           List permissions)
a259 2
        role.setRequestable(DBFlag.flagValueOf(requestable));
        role.setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
d263 3
d282 1
a282 1
                       boolean requestable, boolean denotesOwner)
d288 1
a288 3
        setRequestable(DBFlag.flagValueOf(requestable));
        setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
        assertEditPermission(acl, domain);
d290 1
d293 35
@


1.13
log
@Added semi-selective cache invalidation which invalidates particular caches on a write instead of all the caches.
@
text
@d203 1
a203 1
        RolePeer.uncache(this);
@


1.12
log
@Added toString();
@
text
@d195 12
@


1.11
log
@Corrected compile error.
@
text
@d98 8
@


1.10
log
@Invalidate cached resources and role definitions when they change.
@
text
@d277 1
a277 1
        RoleActionResourcePeer.uncache(self);
d306 1
a306 1
        RoleActionResourcePeer.uncache(self);
@


1.9
log
@More fixes for caching.
@
text
@d277 1
a277 1
        //RoleActionResourcePeer.buildActionsByRole();
d306 1
@


1.8
log
@If the specified action passed to getResourcesForAction() doesn't map
to a specific action, we return an empty list.  Since we know that
there'll be nothing in the list, allocate space accordingly.
@
text
@d151 1
a151 1

d155 3
a157 4
            RoleActionResource mapping = (RoleActionResource)
                i.next();
            Action a = ActionPeer.retrieveByPK(mapping.getActionId());
            Resource r = ResourcePeer.retrieveByPK(mapping.getResourceId());
@


1.7
log
@Added more caching.
@
text
@d178 1
a178 1
            resourcesForAction = new ArrayList();
@


1.6
log
@Pushed getID() method into base class as a final method.
@
text
@d72 1
d170 11
a180 7
        List resources = new ArrayList();
        Criteria c = new Criteria()
            .addJoin(ResourcePeer.RESOURCE_ID, 
                     RoleActionResourcePeer.RESOURCE_ID)
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID, action.getActionId());
        return ResourcePeer.doSelect(c);
@


1.5
log
@Corrected regex madness for Torque upgrade.  -dlr
@
text
@a95 12
    //
    // Accessor methods
    //

    /**
     * Returns the ID of this role as a string.
     */
    public final String getID()
    {
        return getPrimaryKey().toString();
    }

@


1.4
log
@Don't barf if a role gets added a permission it already has.
@
text
@d60 1
a60 2
import org.tigris.helm.om.peer.*;
import org.tigris.helm.om.base.*;
@


1.3
log
@Sync'd with latest Turbine changes.  Mostly this consists of the use of the new SimpleKey class to handle primary database keys.
@
text
@d256 19
a274 1
        RoleActionResource mapping = new RoleActionResource();
@


1.2
log
@adding files from the branch to the head
@
text
@d51 1
a51 1
import org.apache.turbine.om.BaseObject;
d106 1
a106 1
        return (String)getPrimaryKey();
@


1.1
log
@file Role.java was initially added on branch HELM_PEER_PORT_BRANCH.
@
text
@d1 344
@


1.1.1.1
log
@Replacing the HEAD with the HELM_PEER_PORT_BRANCH.
@
text
@a0 344
/* ================================================================
 * Copyright (c) 2000-2001 CollabNet.  All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 
 * 3. The end-user documentation included with the redistribution, if
 * any, must include the following acknowlegement: "This product includes
 * software developed by CollabNet (http://www.collab.net/)."
 * Alternately, this acknowlegement may appear in the software itself, if
 * and wherever such third-party acknowlegements normally appear.
 * 
 * 4. The hosted project names must not be used to endorse or promote
 * products derived from this software without prior written
 * permission. For written permission, please contact info@@collab.net.
 * 
 * 5. Products derived from this software may not use the "Tigris" name
 * nor may "Tigris" appear in their names without prior written
 * permission of CollabNet.
 * 
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL COLLABNET OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * ====================================================================
 * 
 * This software consists of voluntary contributions made by many
 * individuals on behalf of CollabNet.
 */

package org.tigris.helm.om;

import java.util.*;

import org.apache.turbine.om.BaseObject;
import org.apache.turbine.om.peer.BasePeer;
import org.apache.turbine.util.db.Criteria;
import org.apache.turbine.util.ObjectUtils;
import org.apache.turbine.util.StringUtils;
import org.apache.turbine.util.ParameterParser;
import org.apache.turbine.util.Log;
import org.apache.turbine.util.db.pool.DBConnection;

import org.tigris.helm.om.peer.*;
import org.tigris.helm.om.base.*;
import org.tigris.helm.security.*;
import org.tigris.helm.DoesNotExist;
import org.tigris.helm.tool.*;

import org.tigris.helm.tool.audit.AuditLog;

/** 
 * Role business object.
 */
public class Role extends BaseRole implements BOType
{
    /**
     * Description of the audit log entry created when a role is added.  
     */
    private static final String AUDIT_LOG_ON_ADD = "Role added: ";

    /**
     * Description of the audit log entry created when a role is edited. 
     */
    private static final String AUDIT_LOG_ON_EDIT = "Role edited: ";

    /**
     * Description of the audit log entry created when a permission is
     * added to this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_ADD =
        "Permission added to role: ";

    /**
     * Description of the audit log entry created when a permission is
     * removed from this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_REMOVE = 
        "Permission removed from role: ";

    //
    // Accessor methods
    //

    /**
     * Returns the ID of this role as a string.
     */
    public final String getID()
    {
        return (String)getPrimaryKey();
    }

    /**
     * Returns true if this role is requestable by end-users.
     */
    public boolean isRequestable()
    {
        return DBFlag.booleanValueOf(getRequestable());
    }

    /**
     * Returns true if this role denotes ownership of the
     * project/domain/host in which it is granted.  
     */
    public boolean denotesOwner()
    {
        return DBFlag.booleanValueOf(getDenotesOwner());
    }

    /**
     * Returns true iff the role has a permission which might change
     * the type of issue tracking account a user had if it were
     * granted to or revoked from that user.
     */
    public boolean affectsIssueTracking()
        throws Exception
    {
        boolean affects = false;
        List permissions = getPermissions();
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission p = (Permission)i.next();
            Action a = p.getAction();
            if (a.isIssueTracking())
            {
                affects = true;
                break;
            }
        }
        return affects;
    }
    
    /**
     * Returns a List of Permission objects corresponding to the
     * permissions of this role.
     */
    public List getPermissions()
        throws Exception
    {
        List permissions = new ArrayList();

        //Get the mappings of this role to actions and extents.
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, 
                 Integer.parseInt(getID()));
        List mappings = RoleActionResourcePeer.doSelect(c);

        //Turn the mappings into permissions
        for (Iterator i = mappings.iterator(); i.hasNext();)
        {
            RoleActionResource mapping = (RoleActionResource)
                i.next();
            Action a = ActionPeer.retrieveByPK(mapping.getActionId());
            Resource r = ResourcePeer.retrieveByPK(mapping.getResourceId());
            permissions.add(new Permission(a,r));
        }
        return permissions;
    }

    /**
     * Returns the resources on which this role holds the specified action.
     */
    public List getResourcesForAction(Action action)
        throws Exception
    {
        List resources = new ArrayList();
        Criteria c = new Criteria()
            .addJoin(ResourcePeer.RESOURCE_ID, 
                     RoleActionResourcePeer.RESOURCE_ID)
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID, action.getActionId());
        return ResourcePeer.doSelect(c);
    }

    //
    // Mutator methods
    //

    /**
     * Create a new entry in the role table and return the corresponding
     * Role object.
     */
    public static Role add(AccessControlList acl, Domain domain,
                           String name, String description, String type,
                           boolean requestable, boolean denotesOwner,
                           List permissions)
        throws ACLException, Exception
    {
        Role role = new Role();
        role.setName(name);
        role.setDescription(description);
        role.setType(type);
        role.setRequestable(DBFlag.flagValueOf(requestable));
        role.setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
        role.assertAddPermission(acl, domain);
        role.save();

        //Now add the appropriate permissions
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission perm = (Permission)i.next();            
            role.addPermission(acl, domain, perm);
        }
        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_ADD + role.getName());
        return role;
    }

    /**
     * Changes the database information in the role table.
     */
    public void update(AccessControlList acl, Domain domain,
                       String name, String description, String type,
                       boolean requestable, boolean denotesOwner)
        throws ACLException, Exception
    {
        setName(name);
        setDescription(description);
        setType(type);
        setRequestable(DBFlag.flagValueOf(requestable));
        setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
        assertEditPermission(acl, domain);
        save();
        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_EDIT + getName());
    }

    /**
     * Add a permission to a role. Note that this does not recalculate
     * issue tracking accounts--that is done in RoleMemberAdd because it
     * takes a *long* time, and we might be adding more than one issue
     * tracking permission here.  
     */
    public void addPermission(AccessControlList acl, Domain domain,
                              Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        assertEditPermission(acl, domain);
        RoleActionResource mapping = new RoleActionResource();
        mapping.setRoleId(getRoleId());
        mapping.setActionId(permission.getAction().getActionId());
        mapping.setResourceId(permission.getResource().getResourceId());
        mapping.save();

        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_PERMISSION_ADD 
                          + getName() + " <- " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());

        //RoleActionResourcePeer.buildActionsByRole();
    }


    /**
     * Remove a permission from a role. Note that this does not
     * recalculate issue tracking accounts--that is done in RoleEdit
     * because it takes a *long* time, and we might be removing more
     * than one issue tracking permission here.  
     */
    public void removePermission(AccessControlList acl, Domain domain,
                                 Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        assertEditPermission(acl, domain);
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID,
                 permission.getAction().getActionId())
            .add(RoleActionResourcePeer.RESOURCE_ID, 
                 permission.getResource().getResourceId());
        RoleActionResourcePeer.doDelete(c);

        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_PERMISSION_REMOVE
                          + getName() + " -> " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());
    }

    //
    // Permission checking methods
    //

    /**
     * Throws an exception if the given ACL does not have permission to
     * add a role to the given domain.
     */
    public void assertAddPermission(AccessControlList acl, Domain domain)
        throws ACLException, Exception
    {
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) {
            acl.assertPermission
                ("Project Role - Add", domain);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) {
            acl.assertPermission
                ("Domain Role - Add", domain);
        }
        else {
            acl.assertPermission("Host Role - Add");
        }
    }

    /**
     * Throws an exception if the given ACL does not have permission
     * to change a role in the given domain.
     */
    public void assertEditPermission(AccessControlList acl, Domain domain)
        throws ACLException, Exception
    {
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) {
            acl.assertPermission
                ("Project Role - Edit", domain);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) {
            acl.assertPermission
                ("Domain Role - Edit", domain);
        }
        else {
            acl.assertPermission("Host Role - Edit");
        }
    }
}
@


1.1.2.1
log
@Classes ported to the Turbine Peer system. -dlr and leonardr
@
text
@a0 136
/* ================================================================
 * Copyright (c) 2000 CollabNet.  All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions are
 * met:
 * 
 * 1. Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 * 
 * 2. Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the distribution.
 * 
 * 3. The end-user documentation included with the redistribution, if
 * any, must include the following acknowlegement: "This product includes
 * software developed by CollabNet (http://www.collab.net/)."
 * Alternately, this acknowlegement may appear in the software itself, if
 * and wherever such third-party acknowlegements normally appear.
 * 
 * 4. The hosted project names must not be used to endorse or promote
 * products derived from this software without prior written
 * permission. For written permission, please contact info@@collab.net.
 * 
 * 5. Products derived from this software may not use the "Tigris" name
 * nor may "Tigris" appear in their names without prior written
 * permission of CollabNet.
 * 
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL COLLABNET OR ITS CONTRIBUTORS BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
 * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * ====================================================================
 * 
 * This software consists of voluntary contributions made by many
 * individuals on behalf of CollabNet.
 */

package org.tigris.helm.om;

import java.util.*;

import org.apache.turbine.om.BaseObject;
import org.apache.turbine.om.peer.BasePeer;
import org.apache.turbine.util.db.Criteria;
import org.apache.turbine.util.ObjectUtils;
import org.apache.turbine.util.StringUtils;
import org.apache.turbine.util.ParameterParser;
import org.apache.turbine.util.Log;
import org.apache.turbine.util.db.pool.DBConnection;

import org.tigris.helm.om.peer.*;
import org.tigris.helm.security.*;
import org.tigris.helm.DoesNotExist;
import org.tigris.helm.tool.PeerTool;
import org.tigris.helm.tool.DBFlag;

/** 
 * Role business object.
 */
public class Role extends BaseRole
{
    public static Role add(AccessControlList acl, Domain domain,
                           String name, String description, String type,
                           boolean requestable, List permissions)
        throws ACLException, Exception
    {
        Role role = new Role();
        role.setName(name);
        role.setDescription(description);
        role.setType(type);
        role.setRequestable(DBFlag.flagValueOf(requestable));
        // TODO
        role.save(acl, domain, type);
        return role;
    }

    public void update(AccessControlList acl, Domain domain,
                       String name, String description, String type,
                       boolean requestable, List permissions)
        throws ACLException, Exception
    {
        setName(name);
        setDescription(description);
        setType(type);
        setRequestable(DBFlag.flagValueOf(requestable));
        // TODO
        save(acl, domain, type);
    }

    private void save(AccessControlList acl, Domain domain, String type)
        throws ACLException, Exception
    {
        if (isNew()) {
            if (type.equals(RolePeer.PROJECT_ROLE))
            {
                acl.assertPermissionForDomain
                    ("Project Role - Add", domain);
            }
            else if (type.equals(RolePeer.DOMAIN_ROLE)) {
                acl.assertPermissionForDomain
                    ("Domain Role - Add", domain);
            }
            else {
                acl.assertPermissionForHost("Host Role - Add");
            }
        }
        else {
            if (type.equals(RolePeer.PROJECT_ROLE))
            {
                acl.assertPermissionForDomain
                    ("Project Role - Edit", domain);
            }
            else if (type.equals(RolePeer.DOMAIN_ROLE)) {
                acl.assertPermissionForDomain
                    ("Domain Role - Edit", domain);
            }
            else {
                acl.assertPermissionForHost("Host Role - Edit");
            }
        }
    }

    public final int getID()
    {
        return getRoleId();
    }
}
@


1.1.2.2
log
@The getID() business object method returns the primary key of the
associated table as a String object for ease of use with WM/Velocity.
@
text
@d103 2
a104 1
            if (type.equals(RolePeer.PROJECT_ROLE)) {
d117 2
a118 1
            if (type.equals(RolePeer.PROJECT_ROLE)) {
d132 1
a132 1
    public final String getID()
d134 1
a134 1
        return getPrimaryKeyAsString();
@


1.1.2.3
log
@More permissions checking.
@
text
@a129 22
    public List getResourcesForAction(Action action)
        throws Exception
    {
        List resources = new ArrayList();
        //Get the extents to which the role holds this action.
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, 
                 getPrimaryKeyAsInt())
            .add(RoleActionResourcePeer.ACTION_ID, 
                 action.getPrimaryKeyAsInt());                
              
        List mappings = RoleActionResourcePeer.doSelect(c);
        for (Iterator i = mappings.iterator(); i.hasNext();)
        {
            RoleActionResource mapping = (RoleActionResource)
                i.next();
            Resource r = ResourcePeer.retrieveByPK(mapping.getResourceId());
            resources.add(r);
        }
        return resources;
    }

@


1.1.2.4
log
@Implement the RoleType interface.
@
text
@d69 1
a69 1
public class Role extends BaseRole implements RoleType
d103 1
a103 1
            if (type.equals(Role.PROJECT_TYPE)) {
d107 1
a107 1
            else if (type.equals(Role.DOMAIN_TYPE)) {
d116 1
a116 1
            if (type.equals(Role.PROJECT_TYPE)) {
d120 1
a120 1
            else if (type.equals(Role.DOMAIN_TYPE)) {
@


1.1.2.5
log
@Changed getPrimaryKeyAsString() to (String)getPrimaryKey().
@
text
@d154 1
a154 1
        return (String)getPrimaryKey();
@


1.1.2.6
log
@Big patch to make access control work.
@
text
@d137 1
a137 1
                 Integer.parseInt(getID()))
d139 2
a140 1
                 Integer.parseInt(action.getID()));                
@


1.1.2.7
log
@added isRequestable method.
@
text
@a70 6

    public boolean isRequestable()
    {
        return getRequestable().equals("Y");
    }

@


1.1.2.8
log
@Added getPermissions method.
@
text
@a70 9
    
    //
    // Accessor methods
    //

    public final String getID()
    {
        return (String)getPrimaryKey();
    }
a75 48
    
    public List getPermissions()
        throws Exception
    {
        List permissions = new ArrayList();

        //Get the mappings of this role to actions and extents.
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, 
                 Integer.parseInt(getID()));
        List mappings = RoleActionResourcePeer.doSelect(c);

        //Turn the mappings into permissions
        for (Iterator i = mappings.iterator(); i.hasNext();)
        {
            RoleActionResource mapping = (RoleActionResource)
                i.next();
            Action a = ActionPeer.retrieveByPK(mapping.getActionId());
            Resource r = ResourcePeer.retrieveByPK(mapping.getResourceId());
            permissions.add(new Permission(a,r));
        }
        return permissions;
    }

    public List getResourcesForAction(Action action)
        throws Exception
    {
        List resources = new ArrayList();
        //Get the extents to which the role holds this action.
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, 
                 Integer.parseInt(getID()))
            .add(RoleActionResourcePeer.ACTION_ID, 
                 Integer.parseInt(action.getID()));                
        List mappings = RoleActionResourcePeer.doSelect(c);
        for (Iterator i = mappings.iterator(); i.hasNext();)
        {
            RoleActionResource mapping = (RoleActionResource)
                i.next();
            Resource r = ResourcePeer.retrieveByPK(mapping.getResourceId());
            resources.add(r);
        }
        return resources;
    }

    //
    // Mutator methods
    //
d136 25
@


1.1.2.9
log
@How about actually saving the role.
@
text
@a190 1
        super.save();
@


1.1.2.10
log
@Ported RoleAdd servlet and infrastructure for same.
@
text
@d145 1
a145 8
        role.save(acl, domain);

        //Now add the appropriate permissions
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission perm = (Permission)i.next();            
            role.addPermission(acl, domain, perm);
        }
d151 1
a151 1
                       boolean requestable)
d159 1
a159 63
        save(acl, domain);
    }

    /**
     * Add a permission to a role. Note that this does not recalculate
     * issue tracking accounts--that is done in RoleMemberAdd because it
     * takes a *long* time, and we might be adding more than one issue
     * tracking permission here.  
     */
    public void addPermission(AccessControlList acl, Domain domain,
                              Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        assertEditPermission(acl, domain);
        RoleActionResource mapping = new RoleActionResource();
        mapping.setRoleId(getRoleId());
        mapping.setActionId(permission.getAction().getActionId());
        mapping.setResourceId(permission.getResource().getResourceId());
        Log.debug("RoleID: " + mapping.getRoleId());
        Log.debug("ActionID: " + mapping.getActionId());
        Log.debug("ResourceID: " + mapping.getResourceId());
        Log.debug("SAving.");
        mapping.save();

        //RoleActionResourcePeer.buildActionsByRole(conn, dMgr);
    }

    //
    // Permission checking methods
    //
    public void assertAddPermission(AccessControlList acl, Domain domain)
        throws ACLException, Exception
    {
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) {
            acl.assertPermissionForDomain
                ("Project Role - Add", domain);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) {
            acl.assertPermissionForDomain
                ("Domain Role - Add", domain);
        }
        else {
            acl.assertPermissionForHost("Host Role - Add");
        }
    }

    public void assertEditPermission(AccessControlList acl, Domain domain)
        throws ACLException, Exception
    {
        String type = getType();
        if (type.equals(Role.PROJECT_TYPE)) {
            acl.assertPermissionForDomain
                ("Project Role - Edit", domain);
        }
        else if (type.equals(Role.DOMAIN_TYPE)) {
            acl.assertPermissionForDomain
                ("Domain Role - Edit", domain);
        }
        else {
            acl.assertPermissionForHost("Host Role - Edit");
        }
d162 1
a162 5
    //
    // Overloaded methods
    //

    private void save(AccessControlList acl, Domain domain)
d166 11
a176 1
            assertAddPermission(acl, domain);
d179 11
a189 1
            assertEditPermission(acl, domain);
@


1.1.2.11
log
@Added removePermission method.
@
text
@d185 4
d191 1
a191 21
        //RoleActionResourcePeer.buildActionsByRole();
    }


    /**
     * Remove a permission from a role. Note that this does not
     * recalculate issue tracking accounts--that is done in RoleEdit
     * because it takes a *long* time, and we might be removing more
     * than one issue tracking permission here.  
     */
    public void removePermission(AccessControlList acl, Domain domain,
                                 Permission permission)
        throws ACLException, Exception
    {
        //Make sure they have permission.
        assertEditPermission(acl, domain);
        Criteria c = new Criteria()
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID, permission.getAction().getActionId())
            .add(RoleActionResourcePeer.RESOURCE_ID, permission.getResource().getResourceId());
        RoleActionResourcePeer.doDelete(c);
@


1.1.2.12
log
@Added method to determine whether or not a role would affect issue tracking if granted to a user.
@
text
@a84 18

    public boolean affectsIssueTracking()
        throws Exception
    {
        boolean affects = false;
        List permissions = getPermissions();
        for (Iterator i = permissions.iterator(); i.hasNext();)
        {
            Permission p = (Permission)i.next();
            Action a = p.getAction();
            if (a.isIssueTracking())
            {
                affects = true;
                break;
            }
        }
        return affects;
    }
@


1.1.2.13
log
@Implement BOType instead of RoleType.
@
text
@d69 1
a69 1
public class Role extends BaseRole implements BOType
@


1.1.2.14
log
@Changed role methods to use the ownership field.
@
text
@a85 5
    /**
     * Returns true if the role has a permission which might change
     * the type of issue tracking account a user had if it were
     * granted or revoked.
     */
d154 1
a154 2
                           boolean requestable, boolean denotesOwner,
                           List permissions)
a161 1
        role.setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
d176 1
a176 1
                       boolean requestable, boolean denotesOwner)
a182 1
        setDenotesOwner(DBFlag.flagValueOf(denotesOwner));
@


1.1.2.15
log
@Added import statement.
@
text
@d63 2
a64 1
import org.tigris.helm.tool.*;
@


1.1.2.16
log
@Got rid of compile errors.
@
text
@a84 5
    public boolean denotesOwner()
    {
        return getDenotesOwner().equals("Y");
    }

@


1.1.2.17
log
@Make use of database flag API encapsulated by DBFlag class.
@
text
@d82 1
a82 1
        return DBFlag.booleanValueOf(getRequestable());
d87 1
a87 1
        return DBFlag.booleanValueOf(getDenotesOwner());
@


1.1.2.18
log
@Changed code to no longer use deprecated methods.
@
text
@d248 1
a248 1
            acl.assertPermission
d252 1
a252 1
            acl.assertPermission
d256 1
a256 1
            acl.assertPermission("Host Role - Add");
d265 1
a265 1
            acl.assertPermission
d269 1
a269 1
            acl.assertPermission
d273 1
a273 1
            acl.assertPermission("Host Role - Edit");
@


1.1.2.19
log
@Big wide-ranging patch being committed all at once due to network downness. Features of this patch include: lots of added and updated JavaDoc, conversion of emails to use TemplateInterpolator and HelmEmailer, rearrangement of methods, changing code that gets mappings and loops over them to code that just gets the appropriate objects from the peer using AddJoin.
@
text
@d2 1
a2 1
 * Copyright (c) 2001 CollabNet.  All rights reserved.
a74 3
    /**
     * Returns the ID of this role as a string.
     */
a79 3
    /**
     * Returns true if this role is requestable by end-users.
     */
a84 4
    /**
     * Returns true if this role denotes ownership of the
     * project/domain/host in which it is granted.  
     */
d91 1
a91 1
     * Returns true iff the role has a permission which might change
d93 1
a93 1
     * granted to or revoked from that user.
a112 4
    /**
     * Returns a List of Permission objects corresponding to the
     * permissions of this role.
     */
a135 3
    /**
     * Returns the resources on which this role holds the specified action.
     */
d140 1
d142 13
a154 5
            .addJoin(ResourcePeer.RESOURCE_ID, 
                     RoleActionResourcePeer.RESOURCE_ID)
            .add(RoleActionResourcePeer.ROLE_ID, getRoleId())
            .add(RoleActionResourcePeer.ACTION_ID, action.getActionId());
        return ResourcePeer.doSelect(c);
a160 4
    /**
     * Create a new entry in the role table and return the corresponding
     * Role object.
     */
d173 2
a174 2
        role.assertAddPermission(acl, domain);
        role.save();
a184 3
    /**
     * Changes the database information in the role table.
     */
d195 2
a196 2
        assertEditPermission(acl, domain);
        save();
d235 2
a236 4
            .add(RoleActionResourcePeer.ACTION_ID,
                 permission.getAction().getActionId())
            .add(RoleActionResourcePeer.RESOURCE_ID, 
                 permission.getResource().getResourceId());
a242 5

    /**
     * Throws an exception if the given ACL does not have permission to
     * add a role to the given domain.
     */
a259 4
    /**
     * Throws an exception if the given ACL does not have permission
     * to change a role in the given domain.
     */
d276 17
@


1.1.2.20
log
@Normalized copyright dates.
@
text
@d2 1
a2 1
 * Copyright (c) 2000-2001 CollabNet.  All rights reserved.
@


1.1.2.21
log
@Added new imports necessitated by Torque.
@
text
@a60 1
import org.tigris.helm.om.base.*;
@


1.1.2.22
log
@Added audit logging in a bunch of places.
@
text
@a71 19
    /**
     * Description of the audit log entry created when a role is added.  
     */
    private static final String AUDIT_LOG_ON_ADD = "Role added: ";

    /**
     * Description of the audit log entry created when a permission is
     * added to this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_ADD =
        "Permission added to role: ";

    /**
     * Description of the audit log entry created when a permission is
     * removed from this role.
     */
    private static final String AUDIT_LOG_ON_PERMISSION_REMOVE = 
        "Permission removed from role: ";

a194 2
        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_ADD + role.getName());
a212 2
        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_EDIT + role.getName());
a232 6
        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_PERMISSION_ADD 
                          + role.getName() + " <- " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());

a255 6

        AuditLog.logEvent(acl.getUser(), domain, 
                          AUDIT_LOG_ON_PERMISSION_REMOVE
                          + role.getName() + " -> " 
                          + permission.getAction().getName() + "/"
                          + permission.getResource().getPattern());
@


1.1.2.23
log
@Fixed compile errors introduced in audit logging patch.
@
text
@a65 2
import org.tigris.helm.tool.audit.AuditLog;

a77 5
     * Description of the audit log entry created when a role is edited. 
     */
    private static final String AUDIT_LOG_ON_EDIT = "Role edited: ";

    /**
d235 1
a235 1
                          AUDIT_LOG_ON_EDIT + getName());
d258 1
a258 1
                          + getName() + " <- " 
d288 1
a288 1
                          + getName() + " -> " 
@


1.1.2.24
log
@Removed extraneous whitespace.
@
text
@d73 1
@


