wamblee.org Git - utils/blob - security/impl/src/main/java/org/wamblee/security/authorization/DefaultAuthorizationService.java

   1 /*
   2  * Copyright 2005-2010 the original author or authors.
   3  *
   4  * Licensed under the Apache License, Version 2.0 (the "License");
   5  * you may not use this file except in compliance with the License.
   6  * You may obtain a copy of the License at
   7  *
   8  *      http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16 package org.wamblee.security.authorization;
  17
  18 import java.util.ArrayList;
  19 import java.util.List;
  20
  21 import javax.persistence.CascadeType;
  22 import javax.persistence.DiscriminatorValue;
  23 import javax.persistence.Entity;
  24 import javax.persistence.ManyToMany;
  25 import javax.persistence.OneToMany;
  26 import javax.persistence.OrderColumn;
  27 import javax.persistence.Transient;
  28
  29 import org.wamblee.usermgt.User;
  30 import org.wamblee.usermgt.UserAccessor;
  31
  32 /**
  33  * Default implementation of an authorization service. To determine whether
  34  * access to a resource is allowed, the service consults a number of
  35  * authorization rules in a fixed order. The first rule that gives a result
  36  * GRANTED or DENIED determines the result of the evaluation. Rules that return
  37  * any other result are ignoed. If none of the rules match, than access is
  38  * denied.
  39  *
  40  * @author Erik Brakkee
  41  */
  42 @Entity
  43 @DiscriminatorValue("DEFAULT")
  44 public class DefaultAuthorizationService extends AbstractAuthorizationService {
  45
  46
  47     /**
  48      * List of ordered authorization rules.
  49      */
  50     @OneToMany(cascade = CascadeType.ALL, orphanRemoval = true, targetEntity = AbstractAuthorizationRule.class)
  51     @OrderColumn(name = "RULE_INDEX")
  52     private List<AuthorizationRule> rules;
  53
  54     /**
  55      * User accessor used to obtain the current user.
  56      */
  57     @Transient
  58     private UserAccessor userAccessor;
  59
  60     /**
  61      * Constructs the service.
  62      *
  63      * @param aAccessor
  64      *            User accessor.
  65      * @param aName
  66      *            Name of this instance of the service.
  67      */
  68     public DefaultAuthorizationService(UserAccessor aAccessor, String aName) {
  69         super(aName);
  70         rules = new ArrayList<AuthorizationRule>();
  71         userAccessor = aAccessor;
  72     }
  73
  74     /**
  75      * Constructs the authorization service.
  76      */
  77     public DefaultAuthorizationService() {
  78         rules = new ArrayList<AuthorizationRule>();
  79         userAccessor = null;
  80     }
  81
  82     /**
  83      * Sets the user accessor.
  84      *
  85      * @param aUserAccessor
  86      *            User accessor.
  87      */
  88     @Override
  89     public void setUserAccessor(UserAccessor aUserAccessor) {
  90         userAccessor = aUserAccessor;
  91     }
  92
  93     /*
  94      * (non-Javadoc)
  95      *
  96      * @see
  97      * org.wamblee.security.authorization.AuthorizationService#isAllowed(java
  98      * .lang.Object, org.wamblee.security.authorization.Operation)
  99      */
 100     public boolean isAllowed(Object aResource, Operation aOperation) {
 101         User user = userAccessor.getCurrentUser();
 102
 103         for (AuthorizationRule rule : rules) {
 104             switch (rule.isAllowed(aResource, aOperation, user)) {
 105             case DENIED:
 106                 return false;
 107
 108             case GRANTED:
 109                 return true;
 110             }
 111         }
 112
 113         return false;
 114     }
 115
 116     /*
 117      * (non-Javadoc)
 118      *
 119      * @see org.wamblee.security.authorization.AuthorizationService#check(T,
 120      * org.wamblee.security.authorization.Operation)
 121      */
 122     public <T> T check(T aResource, Operation aOperation) {
 123         if (!isAllowed(aResource, aOperation)) {
 124             throw new AuthorizationException(aResource, aOperation);
 125         }
 126
 127         return aResource;
 128     }
 129
 130     /*
 131      * (non-Javadoc)
 132      *
 133      * @see org.wamblee.security.authorization.AuthorizationService#getRules()
 134      */
 135     public AuthorizationRule[] getRules() {
 136         return rules.toArray(new AbstractAuthorizationRule[0]);
 137     }
 138
 139     /*
 140      * (non-Javadoc)
 141      *
 142      * @see
 143      * org.wamblee.security.authorization.AuthorizationService#appendRule(org
 144      * .wamblee.security.authorization.AuthorizationRule)
 145      */
 146     public void appendRule(AuthorizationRule aRule) {
 147         rules.add(aRule);
 148     }
 149
 150     /*
 151      * (non-Javadoc)
 152      *
 153      * @see
 154      * org.wamblee.security.authorization.AuthorizationService#insertRuleAfter
 155      * (int, org.wamblee.security.authorization.AuthorizationRule)
 156      */
 157     public void insertRuleAfter(int aIndex, AuthorizationRule aRule) {
 158         rules.add(aIndex, aRule);
 159     }
 160
 161     /*
 162      * (non-Javadoc)
 163      *
 164      * @see
 165      * org.wamblee.security.authorization.AuthorizationService#removeRule(int)
 166      */
 167     public void removeRule(int aIndex) {
 168         rules.remove(aIndex);
 169     }
 170
 171     /**
 172      * For OR mapping.
 173      *
 174      * @return The rules.
 175      */
 176     protected List<AuthorizationRule> getMappedRules() {
 177         return rules;
 178     }
 179
 180     /**
 181      * For OR mapping.
 182      *
 183      * @param aRules
 184      *            The rules.
 185      */
 186     protected void setMappedRules(List<AuthorizationRule> aRules) {
 187         rules = aRules;
 188     }
 189 }