Menu
▾
▴
[Openutils-svn] SF.net SVN: openutils: [680] tags
|
From: <fc...@us...> - 2008-02-21 14:57:20
|
Revision: 680
http://openutils.svn.sourceforge.net/openutils/?rev=680&view=rev
Author: fcarone
Date: 2008-02-21 06:57:26 -0800 (Thu, 21 Feb 2008)
Log Message:
-----------
[maven-release-plugin] copy for tag openutils-hibernate-security-0.0.4
Added Paths:
-----------
tags/openutils-hibernate-security-0.0.4/
tags/openutils-hibernate-security-0.0.4/pom.xml
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/impl/SecurityRuleManagerImpl.java
Removed Paths:
-------------
tags/openutils-hibernate-security-0.0.4/pom.xml
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java
tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/impl/SecurityRuleManagerImpl.java
Copied: tags/openutils-hibernate-security-0.0.4 (from rev 673, trunk/openutils-hibernate-security)
Deleted: tags/openutils-hibernate-security-0.0.4/pom.xml
===================================================================
--- trunk/openutils-hibernate-security/pom.xml 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/pom.xml 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,223 +0,0 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <parent>
- <artifactId>openutils</artifactId>
- <groupId>net.sourceforge.openutils</groupId>
- <version>7</version>
- <relativePath>..</relativePath>
- </parent>
- <modelVersion>4.0.0</modelVersion>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-hibernate-security</artifactId>
- <name>openutils hibernate security</name>
- <version>0.0.4-SNAPSHOT</version>
- <description>Hibernate Security classes</description>
- <properties>
- <spring.version>2.5.1</spring.version>
- <aspectj.version>1.5.3</aspectj.version>
- </properties>
- <dependencies>
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-core</artifactId>
- <version>${spring.version}</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-context</artifactId>
- <version>${spring.version}</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-aop</artifactId>
- <version>${spring.version}</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-orm</artifactId>
- <version>${spring.version}</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- <exclusion>
- <!-- already imported cglib-nodep by spring -->
- <groupId>cglib</groupId>
- <artifactId>cglib</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>aspectj</groupId>
- <artifactId>aspectjrt</artifactId>
- <version>${aspectj.version}</version>
- </dependency>
- <dependency>
- <groupId>aspectj</groupId>
- <artifactId>aspectjweaver</artifactId>
- <version>${aspectj.version}</version>
- </dependency>
- <dependency>
- <groupId>cglib</groupId>
- <artifactId>cglib-nodep</artifactId>
- <version>2.1_3</version>
- </dependency>
- <dependency>
- <groupId>asm</groupId>
- <artifactId>asm</artifactId>
- <version>2.2.3</version>
- </dependency>
- <dependency>
- <groupId>asm</groupId>
- <artifactId>asm-attrs</artifactId>
- <version>2.2.3</version>
- </dependency>
- <dependency>
- <groupId>asm</groupId>
- <artifactId>asm-commons</artifactId>
- <version>2.2.3</version>
- </dependency>
- <dependency>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-usermanagement</artifactId>
- <version>2.0</version>
- </dependency>
- <dependency>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-usermanagement-dataobjects</artifactId>
- <version>2.0</version>
- </dependency>
- <dependency>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-bshd5</artifactId>
- <version>2.0.1</version>
- </dependency>
- <dependency>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-testing-junit</artifactId>
- <version>2.0.2</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>net.sourceforge.openutils</groupId>
- <artifactId>openutils-testing</artifactId>
- <version>2.0.3</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>org.slf4j</groupId>
- <artifactId>slf4j-log4j12</artifactId>
- <version>1.4.1</version>
- </dependency>
- <dependency>
- <groupId>org.hibernate</groupId>
- <artifactId>hibernate</artifactId>
- <version>3.2.5.ga</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- <exclusion>
- <groupId>cglib</groupId>
- <artifactId>cglib</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>org.hibernate</groupId>
- <artifactId>hibernate-annotations</artifactId>
- <version>3.2.1.ga</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- <exclusion>
- <groupId>cglib</groupId>
- <artifactId>cglib</artifactId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>commons-dbcp</groupId>
- <artifactId>commons-dbcp</artifactId>
- <version>1.2.1</version>
- <scope>test</scope>
- <exclusions>
- <exclusion>
- <artifactId>xerces</artifactId>
- <groupId>xerces</groupId>
- </exclusion>
- <exclusion>
- <artifactId>xml-apis</artifactId>
- <groupId>xml-apis</groupId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>commons-lang</groupId>
- <artifactId>commons-lang</artifactId>
- <version>2.2</version>
- </dependency>
- <dependency>
- <groupId>org.acegisecurity</groupId>
- <artifactId>acegi-security</artifactId>
- <version>1.0.6</version>
- <exclusions>
- <exclusion>
- <groupId>commons-logging</groupId>
- <artifactId>commons-logging</artifactId>
- </exclusion>
- <exclusion>
- <artifactId>spring-remoting</artifactId>
- <groupId>org.springframework</groupId>
- </exclusion>
- <exclusion>
- <artifactId>spring-jdbc</artifactId>
- <groupId>org.springframework</groupId>
- </exclusion>
- <exclusion>
- <artifactId>spring-support</artifactId>
- <groupId>org.springframework</groupId>
- </exclusion>
- </exclusions>
- </dependency>
- <dependency>
- <groupId>hsqldb</groupId>
- <artifactId>hsqldb</artifactId>
- <version>1.8.0.7</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <version>4.4</version>
- <scope>test</scope>
- </dependency>
- <dependency>
- <groupId>dbunit</groupId>
- <artifactId>dbunit</artifactId>
- <version>2.1</version>
- <scope>test</scope>
- </dependency>
- </dependencies>
-</project>
\ No newline at end of file
Copied: tags/openutils-hibernate-security-0.0.4/pom.xml (from rev 679, trunk/openutils-hibernate-security/pom.xml)
===================================================================
--- tags/openutils-hibernate-security-0.0.4/pom.xml (rev 0)
+++ tags/openutils-hibernate-security-0.0.4/pom.xml 2008-02-21 14:57:26 UTC (rev 680)
@@ -0,0 +1,229 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+ <parent>
+ <artifactId>openutils</artifactId>
+ <groupId>net.sourceforge.openutils</groupId>
+ <version>7</version>
+ <relativePath>..</relativePath>
+ </parent>
+ <modelVersion>4.0.0</modelVersion>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-hibernate-security</artifactId>
+ <name>openutils hibernate security</name>
+ <version>0.0.4</version>
+ <description>Hibernate Security classes</description>
+ <properties>
+ <spring.version>2.5.1</spring.version>
+ <aspectj.version>1.5.3</aspectj.version>
+ </properties>
+ <dependencies>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-core</artifactId>
+ <version>${spring.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-context</artifactId>
+ <version>${spring.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-aop</artifactId>
+ <version>${spring.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.springframework</groupId>
+ <artifactId>spring-orm</artifactId>
+ <version>${spring.version}</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ <exclusion>
+ <!-- already imported cglib-nodep by spring -->
+ <groupId>cglib</groupId>
+ <artifactId>cglib</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>aspectj</groupId>
+ <artifactId>aspectjrt</artifactId>
+ <version>${aspectj.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>aspectj</groupId>
+ <artifactId>aspectjweaver</artifactId>
+ <version>${aspectj.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>cglib</groupId>
+ <artifactId>cglib-nodep</artifactId>
+ <version>2.1_3</version>
+ </dependency>
+ <dependency>
+ <groupId>asm</groupId>
+ <artifactId>asm</artifactId>
+ <version>2.2.3</version>
+ </dependency>
+ <dependency>
+ <groupId>asm</groupId>
+ <artifactId>asm-attrs</artifactId>
+ <version>2.2.3</version>
+ </dependency>
+ <dependency>
+ <groupId>asm</groupId>
+ <artifactId>asm-commons</artifactId>
+ <version>2.2.3</version>
+ </dependency>
+ <dependency>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-usermanagement</artifactId>
+ <version>2.0</version>
+ </dependency>
+ <dependency>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-usermanagement-dataobjects</artifactId>
+ <version>2.0</version>
+ </dependency>
+ <dependency>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-bshd5</artifactId>
+ <version>2.0.1</version>
+ </dependency>
+ <dependency>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-testing-junit</artifactId>
+ <version>2.0.2</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>net.sourceforge.openutils</groupId>
+ <artifactId>openutils-testing</artifactId>
+ <version>2.0.3</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>org.slf4j</groupId>
+ <artifactId>slf4j-log4j12</artifactId>
+ <version>1.4.1</version>
+ </dependency>
+ <dependency>
+ <groupId>org.hibernate</groupId>
+ <artifactId>hibernate</artifactId>
+ <version>3.2.5.ga</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>cglib</groupId>
+ <artifactId>cglib</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>org.hibernate</groupId>
+ <artifactId>hibernate-annotations</artifactId>
+ <version>3.2.1.ga</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ <exclusion>
+ <groupId>cglib</groupId>
+ <artifactId>cglib</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>commons-dbcp</groupId>
+ <artifactId>commons-dbcp</artifactId>
+ <version>1.2.1</version>
+ <scope>test</scope>
+ <exclusions>
+ <exclusion>
+ <artifactId>xerces</artifactId>
+ <groupId>xerces</groupId>
+ </exclusion>
+ <exclusion>
+ <artifactId>xml-apis</artifactId>
+ <groupId>xml-apis</groupId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>commons-lang</groupId>
+ <artifactId>commons-lang</artifactId>
+ <version>2.2</version>
+ </dependency>
+ <dependency>
+ <groupId>org.acegisecurity</groupId>
+ <artifactId>acegi-security</artifactId>
+ <version>1.0.6</version>
+ <exclusions>
+ <exclusion>
+ <groupId>commons-logging</groupId>
+ <artifactId>commons-logging</artifactId>
+ </exclusion>
+ <exclusion>
+ <artifactId>spring-remoting</artifactId>
+ <groupId>org.springframework</groupId>
+ </exclusion>
+ <exclusion>
+ <artifactId>spring-jdbc</artifactId>
+ <groupId>org.springframework</groupId>
+ </exclusion>
+ <exclusion>
+ <artifactId>spring-support</artifactId>
+ <groupId>org.springframework</groupId>
+ </exclusion>
+ </exclusions>
+ </dependency>
+ <dependency>
+ <groupId>hsqldb</groupId>
+ <artifactId>hsqldb</artifactId>
+ <version>1.8.0.7</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>junit</groupId>
+ <artifactId>junit</artifactId>
+ <version>4.4</version>
+ <scope>test</scope>
+ </dependency>
+ <dependency>
+ <groupId>dbunit</groupId>
+ <artifactId>dbunit</artifactId>
+ <version>2.1</version>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+
+ <scm>
+ <connection>scm:svn:https://openutils.svn.sourceforge.net/svnroot/openutils/tags/openutils-hibernate-security-0.0.4</connection>
+ <developerConnection>scm:svn:https://openutils.svn.sourceforge.net/svnroot/openutils/tags/openutils-hibernate-security-0.0.4</developerConnection>
+ <url>http://openutils.svn.sourceforge.net/viewcvs.cgi/openutils/tags/openutils-hibernate-security-0.0.4</url>
+ </scm>
+</project>
\ No newline at end of file
Deleted: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java
===================================================================
--- trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,154 +0,0 @@
-/*
- * Copyright Openmind http://www.openmindonline.it
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.openutils.hibernate.security.aop;
-
-import it.openutils.hibernate.security.dataobject.SecurityRule;
-import it.openutils.hibernate.security.services.SecurityRuleManager;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.acegisecurity.Authentication;
-import org.acegisecurity.GrantedAuthority;
-import org.acegisecurity.context.SecurityContextHolder;
-import org.apache.commons.lang.StringUtils;
-import org.aspectj.lang.ProceedingJoinPoint;
-import org.aspectj.lang.annotation.Around;
-import org.aspectj.lang.annotation.Aspect;
-import org.hibernate.Filter;
-import org.hibernate.criterion.Criterion;
-import org.hibernate.criterion.Restrictions;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-/**
- * @author fcarone
- * @version $Id$
- */
-@Aspect
-public class AOPSecurity
-{
-
- /**
- * Logger.
- */
- private Logger log = LoggerFactory.getLogger(AOPSecurity.class);
-
- private SecurityRuleManager securityRuleManager;
-
- private List<String> securedDAOs;
-
- private boolean enabled;
-
- /**
- * @param pjp The proceeding joinpoint
- * @param filter The entity we are going to filter
- * @param additionalCriteria The additional criteria list, cannot be null
- * @return The execution invocation result
- * @throws Throwable Any exception occurring in the invoked method
- */
- @Around("execution(* it.openutils.dao.hibernate.*.*(Object, .., java.util.List<org.hibernate.criterion.Criterion>)) && "
- + //
- " args(filter, .., additionalCriteria)")
- public Object applySecurityRules(ProceedingJoinPoint pjp, Object filter, List<Criterion> additionalCriteria)
- throws Throwable
- {
- if (!enabled)
- {
- log.debug("DAO security disabled, proceeding.");
- return pjp.proceed();
- }
-
- if (!securedDAOs.contains(pjp.getTarget().getClass().getCanonicalName()))
- {
- log.debug("The intercepted DAO {} is not secured, proceeding.", pjp.getTarget().toString());
- return pjp.proceed();
- }
-
- log.debug("applying security rules for {} with criteria {}", filter.toString(), additionalCriteria);
- Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
- if (authentication == null)
- {
- throw new SecurityException("Authentication is not valid");
- }
- GrantedAuthority[] authorities = authentication.getAuthorities();
- List<String> roles = new ArrayList<String>();
- for (int i = 0; i < authorities.length; i++)
- {
- roles.add(authorities[i].getAuthority());
- }
-
- String entity = filter.getClass().getCanonicalName();
- List<SecurityRule> rules = securityRuleManager.getRulesForRoles(entity, roles);
-
- if (rules.isEmpty())
- {
- if (log.isWarnEnabled())
- {
- String grantedRoles = StringUtils.EMPTY;
- for (int i = 0; i < authorities.length; i++)
- {
- grantedRoles += authorities[i].getAuthority() + " ";
- }
- log.warn(
- "No rules found. Access is denied on " + entity + ", for user {} with roles {}",
- SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString(),
- grantedRoles);
- }
- throw new SecurityException("Access denied");
- }
-
- Filter hibernateFilter = securityRuleManager.getEntityFilterFromRules(entity, rules);
-
- Criterion sqlCriterion = Restrictions.sqlRestriction(hibernateFilter
- .getFilterDefinition()
- .getDefaultFilterCondition());
-
- log.debug("Adding sql restriction: {}", sqlCriterion.toString());
- additionalCriteria.add(sqlCriterion);
-
- Object result = pjp.proceed();
- return result;
- }
-
- /**
- * Sets the securityRuleManager.
- * @param securityRuleManager the securityRuleManager to set
- */
- public void setSecurityRuleManager(SecurityRuleManager securityRuleManager)
- {
- this.securityRuleManager = securityRuleManager;
- }
-
- /**
- * Sets the securedDAOs.
- * @param securedDAOs the securedDAOs to set
- */
- public void setSecuredDAOs(List<String> securedDAOs)
- {
- this.securedDAOs = securedDAOs;
- }
-
- /**
- * Sets the enabled.
- * @param enabled the enabled to set
- */
- public void setEnabled(boolean enabled)
- {
- this.enabled = enabled;
- }
-}
Copied: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java (from rev 675, trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java)
===================================================================
--- tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java (rev 0)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/aop/AOPSecurity.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -0,0 +1,154 @@
+/*
+ * Copyright Openmind http://www.openmindonline.it
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.openutils.hibernate.security.aop;
+
+import it.openutils.hibernate.security.dataobject.SecurityRule;
+import it.openutils.hibernate.security.services.SecurityRuleManager;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.acegisecurity.Authentication;
+import org.acegisecurity.GrantedAuthority;
+import org.acegisecurity.context.SecurityContextHolder;
+import org.apache.commons.lang.StringUtils;
+import org.aspectj.lang.ProceedingJoinPoint;
+import org.aspectj.lang.annotation.Around;
+import org.aspectj.lang.annotation.Aspect;
+import org.hibernate.Filter;
+import org.hibernate.criterion.Criterion;
+import org.hibernate.criterion.Restrictions;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/**
+ * @author fcarone
+ * @version $Id$
+ */
+@Aspect
+public class AOPSecurity
+{
+
+ /**
+ * Logger.
+ */
+ private Logger log = LoggerFactory.getLogger(AOPSecurity.class);
+
+ private SecurityRuleManager securityRuleManager;
+
+ private List<String> securedDAOs;
+
+ private boolean enabled;
+
+ /**
+ * @param pjp The proceeding joinpoint
+ * @param filter The entity we are going to filter
+ * @param additionalCriteria The additional criteria list, cannot be null
+ * @return The execution invocation result
+ * @throws Throwable Any exception occurring in the invoked method
+ */
+ @Around("execution(* it.openutils.dao.hibernate.*.*(Object, .., java.util.List<org.hibernate.criterion.Criterion>)) && "
+ + //
+ " args(filter, .., additionalCriteria)")
+ public Object applySecurityRules(ProceedingJoinPoint pjp, Object filter, List<Criterion> additionalCriteria)
+ throws Throwable
+ {
+ if (!enabled)
+ {
+ log.debug("DAO security disabled, proceeding.");
+ return pjp.proceed();
+ }
+
+ if (!securedDAOs.contains(pjp.getTarget().getClass().getCanonicalName()))
+ {
+ log.debug("The intercepted DAO {} is not secured, proceeding.", pjp.getTarget().toString());
+ return pjp.proceed();
+ }
+
+ log.debug("applying security rules for {} with criteria {}", filter.toString(), additionalCriteria);
+ Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+ if (authentication == null)
+ {
+ throw new SecurityException("Authentication is not valid");
+ }
+ GrantedAuthority[] authorities = authentication.getAuthorities();
+ List<String> roles = new ArrayList<String>();
+ for (int i = 0; i < authorities.length; i++)
+ {
+ roles.add(authorities[i].getAuthority());
+ }
+
+ String entity = filter.getClass().getCanonicalName();
+ List<SecurityRule> rules = securityRuleManager.getRulesForRoles(filter, roles);
+
+ if (rules.isEmpty())
+ {
+ if (log.isWarnEnabled())
+ {
+ String grantedRoles = StringUtils.EMPTY;
+ for (int i = 0; i < authorities.length; i++)
+ {
+ grantedRoles += authorities[i].getAuthority() + " ";
+ }
+ log.warn(
+ "No rules found. Access is denied on " + entity + ", for user {} with roles {}",
+ SecurityContextHolder.getContext().getAuthentication().getPrincipal().toString(),
+ grantedRoles);
+ }
+ throw new SecurityException("Access denied");
+ }
+
+ Filter hibernateFilter = securityRuleManager.getEntityFilterFromRules(entity, rules);
+
+ Criterion sqlCriterion = Restrictions.sqlRestriction(hibernateFilter
+ .getFilterDefinition()
+ .getDefaultFilterCondition());
+
+ log.debug("Adding sql restriction: {}", sqlCriterion.toString());
+ additionalCriteria.add(sqlCriterion);
+
+ Object result = pjp.proceed();
+ return result;
+ }
+
+ /**
+ * Sets the securityRuleManager.
+ * @param securityRuleManager the securityRuleManager to set
+ */
+ public void setSecurityRuleManager(SecurityRuleManager securityRuleManager)
+ {
+ this.securityRuleManager = securityRuleManager;
+ }
+
+ /**
+ * Sets the securedDAOs.
+ * @param securedDAOs the securedDAOs to set
+ */
+ public void setSecuredDAOs(List<String> securedDAOs)
+ {
+ this.securedDAOs = securedDAOs;
+ }
+
+ /**
+ * Sets the enabled.
+ * @param enabled the enabled to set
+ */
+ public void setEnabled(boolean enabled)
+ {
+ this.enabled = enabled;
+ }
+}
Deleted: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java
===================================================================
--- trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,258 +0,0 @@
-/*
- * Copyright Openmind http://www.openmindonline.it
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package it.openutils.hibernate.security.filter;
-
-import it.openutils.hibernate.security.dataobject.PermissionEnum;
-import it.openutils.hibernate.security.dataobject.SecurityRule;
-
-import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.Table;
-
-import org.apache.commons.lang.StringEscapeUtils;
-import org.apache.commons.lang.StringUtils;
-import org.hibernate.Filter;
-import org.hibernate.HibernateException;
-import org.hibernate.engine.FilterDefinition;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-
-/**
- * @author fcarone
- * @version $Id$
- */
-public class JavaBeanFilter implements Filter
-{
-
- private FilterDefinition filterDefinition;
-
- /**
- * Logger.
- */
- private Logger log = LoggerFactory.getLogger(JavaBeanFilter.class);
-
-
- /**
- * @param bean The bean to set rules for
- * @param securityRules The list of {@link SecurityRule}s to apply.
- * @throws ClassNotFoundException If the bean class has not been found
- * @throws InstantiationException If the bean doesn't contain the no-arg constructor
- * @throws IllegalAccessException If the bean properties cannot be accessed
- * @throws SecurityException If the bean class cannot be accessed
- * @throws NoSuchFieldException If the property contained in the security rule refers to a bean non-existent field
- */
- @SuppressWarnings("unchecked")
- public JavaBeanFilter(String bean, List<SecurityRule> securityRules)
- throws ClassNotFoundException,
- InstantiationException,
- IllegalAccessException,
- SecurityException,
- NoSuchFieldException
- {
- Class< ? extends Object> beanClass = Class.forName(bean, true, this.getClass().getClassLoader());
-
- if (!beanClass.isAnnotationPresent(Entity.class))
- {
- throw new IllegalArgumentException("Class " + bean + " must contain the @Entity annotation.");
- }
- if (!(beanClass.isAnnotationPresent(Table.class) || beanClass
- .isAnnotationPresent(org.hibernate.annotations.Table.class)))
- {
- throw new IllegalArgumentException("Class " + bean + " must contain the @Table annotation.");
- }
-
- Map<String, String> propertyColumnMap = new HashMap<String, String>();
-
- StringBuffer filterDefCondition = new StringBuffer();
- String filterName = StringUtils.EMPTY;
-
- Map<String, List<SecurityRule>> roleRuleMap = new LinkedHashMap<String, List<SecurityRule>>();
- for (SecurityRule securityRule : securityRules)
- {
- if (!roleRuleMap.containsKey(securityRule.getRole()))
- {
- roleRuleMap.put(securityRule.getRole(), new ArrayList<SecurityRule>());
- }
- roleRuleMap.get(securityRule.getRole()).add(securityRule);
- }
-
- for (Map.Entry<String, List<SecurityRule>> entry : roleRuleMap.entrySet())
- {
- filterName += entry.getKey();
-
- List<SecurityRule> rules = entry.getValue();
- if (rules == null || rules.isEmpty())
- {
- log.debug("No rules defined for role {}", entry.getKey());
- continue;
- }
-
- if (!rulesContainLoad(rules))
- {
- log.debug("No LOAD rules defined for role {}", entry.getKey());
- continue;
- }
-
- if (!StringUtils.isEmpty(filterDefCondition.toString()))
- {
- filterDefCondition.append(" OR ");
- }
- filterDefCondition.append("(");
- StringBuffer subFilterCond = new StringBuffer();
- for (SecurityRule securityRule : rules)
- {
- if (!securityRule.getPermissions().contains(PermissionEnum.LOAD))
- {
- log.debug("Skipping rule {} since it is not related to LOAD.", securityRule);
- continue;
- }
- String property = securityRule.getProperty();
- filterName += property;
-
- Field field = beanClass.getDeclaredField(property);
-
- // @todo: annotations may also be defined on getters/setters...
- propertyColumnMap.put(property, field.getAnnotation(Column.class).name());
- if (!StringUtils.isEmpty(subFilterCond.toString()))
- {
- subFilterCond.append(" AND ");
- }
- String modifier = null;
- String startQuote = null;
- String endQuote = null;
-
- if (String.class.isAssignableFrom(field.getType()))
- {
- startQuote = "\'";
- endQuote = startQuote;
- }
- else if (Number.class.isAssignableFrom(field.getType()))
- {
- startQuote = StringUtils.EMPTY;
- endQuote = StringUtils.EMPTY;
- }
-
- switch (securityRule.getModifier())
- {
- case EQUALS :
- modifier = " = ";
- break;
-
- case NOT :
- modifier = " != ";
- break;
-
- default :
- throw new IllegalArgumentException("Modifier " + securityRule.getModifier() + "not recognized.");
- }
- subFilterCond.append(field.getAnnotation(Column.class).name());
- subFilterCond.append(modifier);
- if (StringUtils.isNotEmpty(startQuote))
- {
- subFilterCond.append(startQuote);
- }
- subFilterCond.append(StringEscapeUtils.escapeSql(securityRule.getValue()));
- if (StringUtils.isNotEmpty(endQuote))
- {
- subFilterCond.append(endQuote);
- }
-
- filterName += securityRule.getValue();
- }
- filterDefCondition.append(subFilterCond);
- filterDefCondition.append(")");
- }
-
- // filtername is unique, but untraceable
- this.filterDefinition = new FilterDefinition(Integer.toString(filterName.hashCode()), filterDefCondition
- .toString(), new HashMap());
- }
-
- /**
- * @param rules
- * @return
- */
- private boolean rulesContainLoad(List<SecurityRule> rules)
- {
- for (SecurityRule rule : rules)
- {
- if (rule.getPermissions().contains(PermissionEnum.LOAD))
- {
- return true;
- }
- }
- return false;
- }
-
- /**
- * {@inheritDoc}
- */
- public FilterDefinition getFilterDefinition()
- {
- return this.filterDefinition;
- }
-
- /**
- * {@inheritDoc}
- */
- public String getName()
- {
- return this.filterDefinition.getFilterName();
- }
-
- /**
- * {@inheritDoc}
- */
- public Filter setParameter(String name, Object value)
- {
- return this;
- }
-
- /**
- * {@inheritDoc}
- */
- @SuppressWarnings("unchecked")
- public Filter setParameterList(String name, Collection values)
- {
- return this;
- }
-
- /**
- * {@inheritDoc}
- */
- public Filter setParameterList(String name, Object[] values)
- {
- return this;
- }
-
- /**
- * {@inheritDoc}
- */
- public void validate() throws HibernateException
- {
- //
- }
-
-}
Copied: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java (from rev 674, trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java)
===================================================================
--- tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java (rev 0)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/JavaBeanFilter.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -0,0 +1,259 @@
+/*
+ * Copyright Openmind http://www.openmindonline.it
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package it.openutils.hibernate.security.filter;
+
+import it.openutils.hibernate.security.dataobject.PermissionEnum;
+import it.openutils.hibernate.security.dataobject.SecurityRule;
+
+import java.lang.reflect.Field;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.Table;
+
+import org.acegisecurity.util.FieldUtils;
+import org.apache.commons.lang.StringEscapeUtils;
+import org.apache.commons.lang.StringUtils;
+import org.hibernate.Filter;
+import org.hibernate.HibernateException;
+import org.hibernate.engine.FilterDefinition;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+
+/**
+ * @author fcarone
+ * @version $Id$
+ */
+public class JavaBeanFilter implements Filter
+{
+
+ private FilterDefinition filterDefinition;
+
+ /**
+ * Logger.
+ */
+ private Logger log = LoggerFactory.getLogger(JavaBeanFilter.class);
+
+
+ /**
+ * @param bean The bean to set rules for
+ * @param securityRules The list of {@link SecurityRule}s to apply.
+ * @throws ClassNotFoundException If the bean class has not been found
+ * @throws InstantiationException If the bean doesn't contain the no-arg constructor
+ * @throws IllegalAccessException If the bean properties cannot be accessed
+ * @throws SecurityException If the bean class cannot be accessed
+ * @throws NoSuchFieldException If the property contained in the security rule refers to a bean non-existent field
+ */
+ @SuppressWarnings("unchecked")
+ public JavaBeanFilter(String bean, List<SecurityRule> securityRules)
+ throws ClassNotFoundException,
+ InstantiationException,
+ IllegalAccessException,
+ SecurityException,
+ NoSuchFieldException
+ {
+ Class< ? extends Object> beanClass = Class.forName(bean, true, this.getClass().getClassLoader());
+
+ if (!beanClass.isAnnotationPresent(Entity.class))
+ {
+ throw new IllegalArgumentException("Class " + bean + " must contain the @Entity annotation.");
+ }
+ if (!(beanClass.isAnnotationPresent(Table.class) || beanClass
+ .isAnnotationPresent(org.hibernate.annotations.Table.class)))
+ {
+ throw new IllegalArgumentException("Class " + bean + " must contain the @Table annotation.");
+ }
+
+ Map<String, String> propertyColumnMap = new HashMap<String, String>();
+
+ StringBuffer filterDefCondition = new StringBuffer();
+ String filterName = StringUtils.EMPTY;
+
+ Map<String, List<SecurityRule>> roleRuleMap = new LinkedHashMap<String, List<SecurityRule>>();
+ for (SecurityRule securityRule : securityRules)
+ {
+ if (!roleRuleMap.containsKey(securityRule.getRole()))
+ {
+ roleRuleMap.put(securityRule.getRole(), new ArrayList<SecurityRule>());
+ }
+ roleRuleMap.get(securityRule.getRole()).add(securityRule);
+ }
+
+ for (Map.Entry<String, List<SecurityRule>> entry : roleRuleMap.entrySet())
+ {
+ filterName += entry.getKey();
+
+ List<SecurityRule> rules = entry.getValue();
+ if (rules == null || rules.isEmpty())
+ {
+ log.debug("No rules defined for role {}", entry.getKey());
+ continue;
+ }
+
+ if (!rulesContainLoad(rules))
+ {
+ log.debug("No LOAD rules defined for role {}", entry.getKey());
+ continue;
+ }
+
+ if (!StringUtils.isEmpty(filterDefCondition.toString()))
+ {
+ filterDefCondition.append(" OR ");
+ }
+ filterDefCondition.append("(");
+ StringBuffer subFilterCond = new StringBuffer();
+ for (SecurityRule securityRule : rules)
+ {
+ if (!securityRule.getPermissions().contains(PermissionEnum.LOAD))
+ {
+ log.debug("Skipping rule {} since it is not related to LOAD.", securityRule);
+ continue;
+ }
+ String property = securityRule.getProperty();
+ filterName += property;
+
+ Field field = FieldUtils.getField(beanClass, property);
+
+ // @todo: annotations may also be defined on getters/setters...
+ propertyColumnMap.put(property, field.getAnnotation(Column.class).name());
+ if (!StringUtils.isEmpty(subFilterCond.toString()))
+ {
+ subFilterCond.append(" AND ");
+ }
+ String modifier = null;
+ String startQuote = null;
+ String endQuote = null;
+
+ if (String.class.isAssignableFrom(field.getType()))
+ {
+ startQuote = "\'";
+ endQuote = startQuote;
+ }
+ else if (Number.class.isAssignableFrom(field.getType()))
+ {
+ startQuote = StringUtils.EMPTY;
+ endQuote = StringUtils.EMPTY;
+ }
+
+ switch (securityRule.getModifier())
+ {
+ case EQUALS :
+ modifier = " = ";
+ break;
+
+ case NOT :
+ modifier = " != ";
+ break;
+
+ default :
+ throw new IllegalArgumentException("Modifier " + securityRule.getModifier() + "not recognized.");
+ }
+ subFilterCond.append(field.getAnnotation(Column.class).name());
+ subFilterCond.append(modifier);
+ if (StringUtils.isNotEmpty(startQuote))
+ {
+ subFilterCond.append(startQuote);
+ }
+ subFilterCond.append(StringEscapeUtils.escapeSql(securityRule.getValue()));
+ if (StringUtils.isNotEmpty(endQuote))
+ {
+ subFilterCond.append(endQuote);
+ }
+
+ filterName += securityRule.getValue();
+ }
+ filterDefCondition.append(subFilterCond);
+ filterDefCondition.append(")");
+ }
+
+ // filtername is unique, but untraceable
+ this.filterDefinition = new FilterDefinition(Integer.toString(filterName.hashCode()), filterDefCondition
+ .toString(), new HashMap());
+ }
+
+ /**
+ * @param rules
+ * @return
+ */
+ private boolean rulesContainLoad(List<SecurityRule> rules)
+ {
+ for (SecurityRule rule : rules)
+ {
+ if (rule.getPermissions().contains(PermissionEnum.LOAD))
+ {
+ return true;
+ }
+ }
+ return false;
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ public FilterDefinition getFilterDefinition()
+ {
+ return this.filterDefinition;
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ public String getName()
+ {
+ return this.filterDefinition.getFilterName();
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ public Filter setParameter(String name, Object value)
+ {
+ return this;
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ @SuppressWarnings("unchecked")
+ public Filter setParameterList(String name, Collection values)
+ {
+ return this;
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ public Filter setParameterList(String name, Object[] values)
+ {
+ return this;
+ }
+
+ /**
+ * {@inheritDoc}
+ */
+ public void validate() throws HibernateException
+ {
+ //
+ }
+
+}
Deleted: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java
===================================================================
--- trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,67 +0,0 @@
-/*
- * Copyright (c) Openmind. All rights reserved. http://www.openmindonline.it
- */
-package it.openutils.hibernate.security.filter;
-
-import it.openutils.hibernate.security.dataobject.SecurityRule;
-import it.openutils.hibernate.security.filter.utils.SecurityRuleUtils;
-import it.openutils.hibernate.security.services.SecurityRuleManager;
-
-import java.util.List;
-
-import org.acegisecurity.Authentication;
-import org.acegisecurity.ConfigAttributeDefinition;
-import org.apache.commons.collections.Predicate;
-
-
-/**
- * @author fcarone
- * @version $Id$
- */
-public class SecurityRulePredicate implements Predicate
-{
-
- private Authentication authentication;
-
- private SecurityRuleManager securityRuleManager;
-
- private ConfigAttributeDefinition configAttribute;
-
- private SecurityRuleUtils ruleUtils = new SecurityRuleUtils();
-
- /**
- * @param authentication The current authentication
- * @param configAttribute The config attribute of the current method invocation interceptor
- * @param securityRuleManager The security rule manager to retrieve rules from
- */
- public SecurityRulePredicate(
- Authentication authentication,
- ConfigAttributeDefinition configAttribute,
- SecurityRuleManager securityRuleManager)
- {
- this.authentication = authentication;
- this.securityRuleManager = securityRuleManager;
- this.configAttribute = configAttribute;
- }
-
- /**
- * {@inheritDoc}
- * If we return false here, the element will be removed from the original collection.
- */
- @SuppressWarnings("unchecked")
- public boolean evaluate(Object object)
- {
- List<String> roles = ruleUtils.getRolesFromAuthentication(authentication);
- List<SecurityRule> rules = securityRuleManager.getRulesForRoles(ruleUtils.getClassName(object), roles);
-
- // @todo: this should be configurable
- // denyAll by default
- if (rules == null || rules.isEmpty())
- {
- return false;
- }
- return (ruleUtils.checkPermissions(rules, configAttribute) && ruleUtils.checkRules(rules, object));
- }
-
-
-}
Copied: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java (from rev 677, trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java)
===================================================================
--- tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java (rev 0)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/filter/SecurityRulePredicate.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -0,0 +1,85 @@
+/*
+ * Copyright (c) Openmind. All rights reserved. http://www.openmindonline.it
+ */
+package it.openutils.hibernate.security.filter;
+
+import it.openutils.hibernate.security.dataobject.SecurityRule;
+import it.openutils.hibernate.security.filter.utils.SecurityRuleUtils;
+import it.openutils.hibernate.security.services.SecurityRuleManager;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.acegisecurity.Authentication;
+import org.acegisecurity.ConfigAttributeDefinition;
+import org.apache.commons.collections.Predicate;
+import org.apache.commons.lang.StringUtils;
+
+
+/**
+ * @author fcarone
+ * @version $Id$
+ */
+public class SecurityRulePredicate implements Predicate
+{
+
+ private Authentication authentication;
+
+ private SecurityRuleManager securityRuleManager;
+
+ private ConfigAttributeDefinition configAttribute;
+
+ private SecurityRuleUtils ruleUtils = new SecurityRuleUtils();
+
+ /**
+ * @param authentication The current authentication
+ * @param configAttribute The config attribute of the current method invocation interceptor
+ * @param securityRuleManager The security rule manager to retrieve rules from
+ */
+ public SecurityRulePredicate(
+ Authentication authentication,
+ ConfigAttributeDefinition configAttribute,
+ SecurityRuleManager securityRuleManager)
+ {
+ this.authentication = authentication;
+ this.securityRuleManager = securityRuleManager;
+ this.configAttribute = configAttribute;
+ }
+
+ /**
+ * {@inheritDoc} If we return false here, the element will be removed from the original collection.
+ */
+ @SuppressWarnings("unchecked")
+ public boolean evaluate(Object object)
+ {
+ List<String> roles = ruleUtils.getRolesFromAuthentication(authentication);
+ List<SecurityRule> rules = findAllRules(object, roles);
+
+ // @todo: this should be configurable
+ // denyAll by default
+ if (rules == null || rules.isEmpty())
+ {
+ return false;
+ }
+ return (ruleUtils.checkPermissions(rules, configAttribute) && ruleUtils.checkRules(rules, object));
+ }
+
+ @SuppressWarnings("unchecked")
+ // @todo: needs unit test methods
+ private List<SecurityRule> findAllRules(Object object, List<String> roles)
+ {
+ List<SecurityRule> result = new ArrayList<SecurityRule>();
+
+ Class objectClass = object.getClass();
+ while (!objectClass.isAssignableFrom(Object.class))
+ {
+ result.addAll(securityRuleManager.getRulesForRoles(
+ StringUtils.substringBefore(objectClass.getName(), "$$"),
+ roles));
+
+ objectClass = objectClass.getSuperclass();
+ }
+ return result;
+ }
+
+}
Deleted: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java
===================================================================
--- trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,84 +0,0 @@
-/*
- * Copyright (c) Openmind. All rights reserved. http://www.openmindonline.it
- */
-package it.openutils.hibernate.security.services;
-
-import it.openutils.hibernate.security.dataobject.SecurityRule;
-
-import java.util.List;
-
-import org.hibernate.Filter;
-
-
-/**
- * @author fcarone
- * @version $Id$
- */
-public interface SecurityRuleManager
-{
-
- /**
- * @return All the defined {@link SecurityRule}s.
- */
- List<SecurityRule> findAll();
-
- /**
- * @param filter The {@link SecurityRule} to use as search filter
- * @return The list of matching {@link SecurityRule}s.
- */
- List<SecurityRule> findFiltered(SecurityRule filter);
-
- /**
- * @param id The id of the {@link SecurityRule} to load
- * @return The {@link SecurityRule} with the given id
- */
- SecurityRule load(Long id);
-
- /**
- * @param id The id of the {@link SecurityRule} to load
- * @return The {@link SecurityRule} with the given id, or null if it is not found
- */
- SecurityRule loadIfAvailable(Long id);
-
- /**
- * @param id The security rule id
- * @return The removed {@link SecurityRule}
- */
- boolean delete(Long id);
-
- /**
- * @param securityRule The {@link SecurityRule} to save or update
- */
- void saveOrUpdate(SecurityRule securityRule);
-
- /**
- * @param securityRule The {@link SecurityRule} to save
- * @return The id of the saved {@link SecurityRule}
- */
- Long save(SecurityRule securityRule);
-
- /**
- * @param securityRule The {@link SecurityRule} to update
- */
- void update(SecurityRule securityRule);
-
- /**
- * @param entity The entity to apply rules for
- * @param rules The list of rules to apply
- * @return The Hibernate Filter responding to the given criteria
- * @throws SecurityException
- * @throws ClassNotFoundException
- * @throws InstantiationException
- * @throws IllegalAccessException
- * @throws NoSuchFieldException
- */
- public Filter getEntityFilterFromRules(String entity, List<SecurityRule> rules) throws SecurityException,
- ClassNotFoundException, InstantiationException, IllegalAccessException, NoSuchFieldException;
-
- /**
- * @param entity The entity we want rules for
- * @param roles The list of roles
- * @return The list of security rules matching entity - roles
- */
- List<SecurityRule> getRulesForRoles(String entity, List<String> roles);
-}
Copied: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java (from rev 678, trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java)
===================================================================
--- tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java (rev 0)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/SecurityRuleManager.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -0,0 +1,92 @@
+/*
+ * Copyright (c) Openmind. All rights reserved. http://www.openmindonline.it
+ */
+package it.openutils.hibernate.security.services;
+
+import it.openutils.hibernate.security.dataobject.SecurityRule;
+
+import java.util.List;
+
+import org.hibernate.Filter;
+
+
+/**
+ * @author fcarone
+ * @version $Id$
+ */
+public interface SecurityRuleManager
+{
+
+ /**
+ * @return All the defined {@link SecurityRule}s.
+ */
+ List<SecurityRule> findAll();
+
+ /**
+ * @param filter The {@link SecurityRule} to use as search filter
+ * @return The list of matching {@link SecurityRule}s.
+ */
+ List<SecurityRule> findFiltered(SecurityRule filter);
+
+ /**
+ * @param id The id of the {@link SecurityRule} to load
+ * @return The {@link SecurityRule} with the given id
+ */
+ SecurityRule load(Long id);
+
+ /**
+ * @param id The id of the {@link SecurityRule} to load
+ * @return The {@link SecurityRule} with the given id, or null if it is not found
+ */
+ SecurityRule loadIfAvailable(Long id);
+
+ /**
+ * @param id The security rule id
+ * @return The removed {@link SecurityRule}
+ */
+ boolean delete(Long id);
+
+ /**
+ * @param securityRule The {@link SecurityRule} to save or update
+ */
+ void saveOrUpdate(SecurityRule securityRule);
+
+ /**
+ * @param securityRule The {@link SecurityRule} to save
+ * @return The id of the saved {@link SecurityRule}
+ */
+ Long save(SecurityRule securityRule);
+
+ /**
+ * @param securityRule The {@link SecurityRule} to update
+ */
+ void update(SecurityRule securityRule);
+
+ /**
+ * @param entity The entity to apply rules for
+ * @param rules The list of rules to apply
+ * @return The Hibernate Filter responding to the given criteria
+ * @throws SecurityException
+ * @throws ClassNotFoundException
+ * @throws InstantiationException
+ * @throws IllegalAccessException
+ * @throws NoSuchFieldException
+ */
+ public Filter getEntityFilterFromRules(String entity, List<SecurityRule> rules) throws SecurityException,
+ ClassNotFoundException, InstantiationException, IllegalAccessException, NoSuchFieldException;
+
+ /**
+ * @param entity The entity name we want rules for
+ * @param roles The list of roles
+ * @return The list of security rules matching entity - roles
+ */
+ List<SecurityRule> getRulesForRoles(String entity, List<String> roles);
+
+ /**
+ * @param entity The entity we want rules for
+ * @param roles The list of roles
+ * @return The list of security rules matching entity - roles
+ */
+ List<SecurityRule> getRulesForRoles(Object entity, List<String> roles);
+
+}
Deleted: tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/impl/SecurityRuleManagerImpl.java
===================================================================
--- trunk/openutils-hibernate-security/src/main/java/it/openutils/hibernate/security/services/impl/SecurityRuleManagerImpl.java 2008-02-21 09:17:34 UTC (rev 673)
+++ tags/openutils-hibernate-security-0.0.4/src/main/java/it/openutils/hibernate/security/services/impl/SecurityRuleManagerImpl.java 2008-02-21 14:57:26 UTC (rev 680)
@@ -1,122 +0,0 @@
-/*
- * Copyright (c) Openmind. All rights reserved. http://www.openmindonline.it
- */
-package it.openutils.hibernate.security.services.impl;
-
-import it.openutils.hibernate.security.dao.SecurityRuleDAO;
-import ...
[truncated message content] |
