Interface PermissionService
The public API for a permission service The implementation may be changed in the application configuration
- Author:
- Andy Hind
-
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final String
static final String
The admin authority - currently a role.static final String
The group that contains everyone except guest.static final String
The permission for all - not defined in the model.static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
Prefix used for authorities of type group.static final String
The guest authoritystatic final String
static final String
static final String
The dynamic authority used for the ownership of locks.static final String
The dynamic authority used for ownershipstatic final String
static final String
static final String
static final String
static final String
static final String
static final String
static final String
Prefixes used for authorities of type role.static final String
static final String
static final String
static final String
static final String
static final String
-
Method Summary
Modifier and TypeMethodDescriptionvoid
clearPermission
(NodeRef nodeRef, String authority) Delete all permission for the given authority.void
clearPermission
(StoreRef storeRef, String authority) Clear all permission masks for an authority on a storevoid
deletePermission
(NodeRef nodeRef, String authority, String permission) Find and delete a access control entry by node, authentication and permission.void
deletePermission
(StoreRef storeRef, String authority, String permission) Remove part of a permission mask on a storevoid
deletePermissions
(NodeRef nodeRef) Delete all the permission assigned to the nodevoid
deletePermissions
(StoreRef storeRef) Remove all permission mask on a storeGet the All AuthoritiesGet the All PermissiongetAllSetPermissions
(NodeRef nodeRef) Get all the AccessPermissions that are set for anyone for the given nodegetAllSetPermissions
(StoreRef storeRef) Get all the AccessPermissions that are set for anyone for the given nodeGet the set of authorities for currently authenticated userboolean
getInheritParentPermissions
(NodeRef nodeRef) Return the global inheritance behaviour for permissions on a node.Get the Owner AuthoritygetPermissions
(NodeRef nodeRef) Get all the AccessPermissions that are granted/denied to the current authentication for the given nodegetReaders
(Long aclId) Get the readers associated with a given ACLgetReadersDenied
(Long aclId) Get the denied authorities associated with a given ACLgetSettablePermissions
(NodeRef nodeRef) Get the permissions that can be set for a given nodegetSettablePermissions
(QName type) Get the permissions that can be set for a given typehasPermission
(Long aclID, PermissionContext context, String permission) Check if a permission is allowed on an acl.hasPermission
(NodeRef nodeRef, String permission) Check that the given authentication has a particular permission for the given node.hasReadPermission
(NodeRef nodeRef) Check if read permission is allowed on an acl (optimised) caveats: doesn't take into account dynamic authorities/groups doesn't take into account node types/aspects for permissionsvoid
setInheritParentPermissions
(NodeRef nodeRef, boolean inheritParentPermissions) Set the global inheritance behaviour for permissions on a node.void
setInheritParentPermissions
(NodeRef nodeRef, boolean inheritParentPermissions, boolean asyncCall) Set the global inheritance behavior for permissions on a node.void
setPermission
(NodeRef nodeRef, String authority, String permission, boolean allow) Set a specific permission on a node.void
setPermission
(StoreRef storeRef, String authority, String permission, boolean allow) Add a permission mask to a store
-
Field Details
-
ROLE_PREFIX
Prefixes used for authorities of type role. This is intended for external roles, e.g. those set by ACEGI implementations It is only used for admin at the moment - which is done outside the usual permission assignments at the moment. It could be a dynamic authority.- See Also:
-
GROUP_PREFIX
Prefix used for authorities of type group.- See Also:
-
ALL_AUTHORITIES
The group that contains everyone except guest.- See Also:
-
OWNER_AUTHORITY
The dynamic authority used for ownership- See Also:
-
LOCK_OWNER_AUTHORITY
The dynamic authority used for the ownership of locks.- See Also:
-
ADMINISTRATOR_AUTHORITY
The admin authority - currently a role.- See Also:
-
GUEST_AUTHORITY
The guest authority- See Also:
-
ALL_PERMISSIONS
The permission for all - not defined in the model. Repsected in the code.- See Also:
-
FULL_CONTROL
- See Also:
-
READ
- See Also:
-
WRITE
- See Also:
-
DELETE
- See Also:
-
ADD_CHILDREN
- See Also:
-
READ_PROPERTIES
- See Also:
-
READ_CHILDREN
- See Also:
-
WRITE_PROPERTIES
- See Also:
-
DELETE_NODE
- See Also:
-
DELETE_CHILDREN
- See Also:
-
CREATE_CHILDREN
- See Also:
-
LINK_CHILDREN
- See Also:
-
DELETE_ASSOCIATIONS
- See Also:
-
READ_ASSOCIATIONS
- See Also:
-
CREATE_ASSOCIATIONS
- See Also:
-
READ_PERMISSIONS
- See Also:
-
CHANGE_PERMISSIONS
- See Also:
-
EXECUTE
- See Also:
-
READ_CONTENT
- See Also:
-
WRITE_CONTENT
- See Also:
-
EXECUTE_CONTENT
- See Also:
-
TAKE_OWNERSHIP
- See Also:
-
SET_OWNER
- See Also:
-
COORDINATOR
- See Also:
-
CONTRIBUTOR
- See Also:
-
EDITOR
- See Also:
-
CONSUMER
- See Also:
-
LOCK
- See Also:
-
UNLOCK
- See Also:
-
CHECK_OUT
- See Also:
-
CHECK_IN
- See Also:
-
CANCEL_CHECK_OUT
- See Also:
-
ASPECTS
- See Also:
-
PROPERTIES
- See Also:
-
-
Method Details
-
getOwnerAuthority
Get the Owner Authority- Returns:
- the owner authority
-
getAllAuthorities
Get the All Authorities- Returns:
- the All authorities
-
getAllPermission
Get the All Permission- Returns:
- the All permission
-
getPermissions
Get all the AccessPermissions that are granted/denied to the current authentication for the given node- Parameters:
nodeRef
- - the reference to the node- Returns:
- the set of allowed permissions
-
getAllSetPermissions
Get all the AccessPermissions that are set for anyone for the given node- Parameters:
nodeRef
- - the reference to the node- Returns:
- the set of allowed permissions
-
getSettablePermissions
Get the permissions that can be set for a given node -
getSettablePermissions
Get the permissions that can be set for a given type- Returns:
- - set of permissions
-
hasPermission
@Auditable(parameters={"nodeRef","permission"}) AccessStatus hasPermission(NodeRef nodeRef, String permission) Check that the given authentication has a particular permission for the given node. (The default behaviour is to inherit permissions)- Returns:
- - access status
-
hasReadPermission
Check if read permission is allowed on an acl (optimised) caveats: doesn't take into account dynamic authorities/groups doesn't take into account node types/aspects for permissions- Parameters:
nodeRef
- - the reference to the node- Returns:
- access status
-
getReaders
Get the readers associated with a given ACL- Parameters:
aclId
- the low-level ACL ID- Returns:
- set of authorities with read permission on the ACL
-
getReadersDenied
Get the denied authorities associated with a given ACL- Parameters:
aclId
- the low-level ACL ID- Returns:
- set of authorities denied permission on the ACL
-
hasPermission
@Auditable(parameters={"aclID","context","permission"}) AccessStatus hasPermission(Long aclID, PermissionContext context, String permission) Check if a permission is allowed on an acl.- Returns:
- the access status
-
deletePermissions
Delete all the permission assigned to the node -
clearPermission
@Auditable(parameters={"nodeRef","authority"}) void clearPermission(NodeRef nodeRef, String authority) Delete all permission for the given authority.- Parameters:
authority
- (if null then this will match all authorities)
-
deletePermission
@Auditable(parameters={"nodeRef","authority","permission"}) void deletePermission(NodeRef nodeRef, String authority, String permission) Find and delete a access control entry by node, authentication and permission. It is possible to delete- a specific permission;
- all permissions for an authority (if the permission is null);
- entries for all authorities that have a specific permission (if the authority is null); and
- all permissions set for the node (if both the permission and authority are null).
- Parameters:
nodeRef
- the node that the entry applies toauthority
- the authority recipient (if null then this will match all authorities)permission
- the entry permission (if null then this will match all permissions)
-
setPermission
@Auditable(parameters={"nodeRef","authority","permission","allow"}) void setPermission(NodeRef nodeRef, String authority, String permission, boolean allow) Set a specific permission on a node. -
setInheritParentPermissions
@Auditable(parameters={"nodeRef","inheritParentPermissions"}) void setInheritParentPermissions(NodeRef nodeRef, boolean inheritParentPermissions) Set the global inheritance behaviour for permissions on a node. -
setInheritParentPermissions
@Auditable(parameters={"nodeRef","inheritParentPermissions","asyncCall"}) void setInheritParentPermissions(NodeRef nodeRef, boolean inheritParentPermissions, boolean asyncCall) Set the global inheritance behavior for permissions on a node. If the operation takes too long and asyncCall parameter set accordingly, fixed ACLs method will be asynchronously called.- Parameters:
nodeRef
- node for which inheritance will be set.inheritParentPermissions
- true to inherit parent permissions, false otherwise.asyncCall
- true if fixed ACLs should be asynchronously set when operation execution takes too long, false to execute synchronously regardless of execution time.
-
getInheritParentPermissions
Return the global inheritance behaviour for permissions on a node. -
setPermission
@Auditable(parameters={"storeRef","authority","permission","allow"}) void setPermission(StoreRef storeRef, String authority, String permission, boolean allow) Add a permission mask to a store -
deletePermission
@Auditable(parameters={"storeRef","authority","permission"}) void deletePermission(StoreRef storeRef, String authority, String permission) Remove part of a permission mask on a store -
clearPermission
@Auditable(parameters={"storeRef","authority"}) void clearPermission(StoreRef storeRef, String authority) Clear all permission masks for an authority on a store -
deletePermissions
Remove all permission mask on a store -
getAllSetPermissions
Get all the AccessPermissions that are set for anyone for the given node- Parameters:
storeRef
- - the reference to the store- Returns:
- the set of allowed permissions
-
getAuthorisations
Get the set of authorities for currently authenticated user- Returns:
- a set of authorities applying to the currently-authenticated user
-