Skip to content

Commit 75df2a2

Browse files
kwinkwin
committed
JCRVLT-522 check effect of filter rules on ACLs
WIP
1 parent 61e920f commit 75df2a2

File tree

13 files changed

+230
-8
lines changed

13 files changed

+230
-8
lines changed

‎src/site/markdown/filter.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -120,15 +120,17 @@ The exact rules are outlined below
120120

121121
Item covered by filter rule | Item contained in the Content Package | Item contained in the Repository (prior to Import/Installation) | State of Item in Repository after Import/Installation
122122
--- | --- | --- | ---
123-
no | yes | yes | not touched
124-
no | no | yes | not touched
125-
no | yes | no | *nodes which are ancestors of covered rules*: deserialized from content package (for backwards compatibility reasons), *nodes which are not ancestors of covered rules*: not touched. One should not rely on this behaviour, i.e. all items in the content package should always be covered by some filter rule to make the behaviour more explicit.
123+
no | yes | yes | not touched(*)
124+
no | no | yes | not touched(*)
125+
no | yes | no | *nodes which are ancestors of covered rules*: deserialized from content package (for backwards compatibility reasons), *nodes which are not ancestors of covered rules*: not touched. One should not rely on this behaviour, i.e. all items in the content package should always be covered by some filter rule to make the behaviour more explicit.(*)
126126
no | no | no | not existing (not touched)
127127
yes | yes | yes | overwritten
128128
yes | no | yes | removed
129129
yes | yes | no | deserialized from content package
130130
yes | no | no | not existing
131131

132+
Mostly for historical reason both authorizable nodes and access control lists behave differently.
133+
132134
### Uncovered ancestor nodes
133135

134136
All *uncovered* ancestor nodes are either

‎src/site/markdown/importmode.md‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,10 @@ Details on how node ids are treated during import are outlined at [Referenceable
2525

2626
The import mode handling is inconsistent and has many edge cases for the mode `MERGE` and `UPDATE`. Therefore FileVault 3.5.0 introduces the new modes `MERGE_PROPERTIES` and `UPDATE_PROPERTIES` (in [JCRVLT-255][JCRVLT-255]) which behave much more predicatable. The details are outlined at the [JavaDoc][api.ImportMode].
2727

28-
Import Mode behaviour on authorizables
28+
As the import mode has other side effects for authorizable and authorization nodes, the behavior is described in the following sections
29+
30+
31+
Authorizable Nodes
2932
----------------------------------------------------
3033
If an authorizable with the same name already exists, the active `ImportMode` controls how the existing authorizables are affected:
3134

@@ -58,6 +61,13 @@ Note that the workspace filter of the package refers on the content of the packa
5861

5962
However, the importer keeps track of potential remapping of existing users and tries to calculate the filters accordingly.
6063

64+
Authorization Nodes
65+
----------------------------------------------------
66+
67+
All authorization nodes of node type `rep:ACL` or the derived `rep:CugPolicy` or `rep:PrincipalPolicy` are ignoring the import mode but rather only evaluate the [package property `acHandling`][properties].
68+
69+
6170
[api.WorkspaceFilter]: apidocs/org/apache/jackrabbit/vault/fs/api/WorkspaceFilter.html
6271
[api.ImportMode]: apidocs/org/apache/jackrabbit/vault/fs/api/ImportMode.html
63-
[JCRVLT-255]: https://issues.apache.org/jira/browse/JCRVLT-255
72+
[JCRVLT-255]: https://issues.apache.org/jira/browse/JCRVLT-255
73+
[properties]: properties.html

‎vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -515,6 +515,11 @@ public void run(Archive archive, Session session, String parentPath)
515515
}
516516
}
517517

518+
/**
519+
* This discards artifacts from the tree which are not contained in the filter
520+
* @param root the (sub)tree
521+
* @return the modified (sub)tree
522+
*/
518523
private TxInfo postFilter(TxInfo root) {
519524
TxInfo modifierRoot = root;
520525
if (filter.contains(modifierRoot.path)){

‎vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/ACLAndMergeIT.java‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,11 @@
2424

2525
import javax.jcr.RepositoryException;
2626

27+
import org.apache.jackrabbit.JcrConstants;
2728
import org.apache.jackrabbit.api.JackrabbitSession;
2829
import org.apache.jackrabbit.api.security.user.Authorizable;
2930
import org.apache.jackrabbit.api.security.user.UserManager;
31+
import org.apache.jackrabbit.commons.JcrUtils;
3032
import org.apache.jackrabbit.vault.fs.io.AccessControlHandling;
3133
import org.apache.jackrabbit.vault.fs.io.ImportOptions;
3234
import org.apache.jackrabbit.vault.packaging.JcrPackage;
@@ -416,7 +418,7 @@ public void testRepoACL() throws RepositoryException, IOException, PackageExcept
416418
}
417419

418420
/**
419-
* Installs a package with repository level acl and then installs another that removes them again.
421+
* Installs a package with repository level acl with AccessControlHandling.MERGE.
420422
*/
421423
@Test
422424
public void testRepoACLMerge() throws RepositoryException, IOException, PackageException {
@@ -437,7 +439,7 @@ public void testRepoACLMerge() throws RepositoryException, IOException, PackageE
437439
}
438440

439441
/**
440-
* Installs a package with repository level acl and then installs another that removes them again.
442+
* Installs a package with repository level acl with AccessControlHandling.MERGE_PRESERVE.
441443
*/
442444
@Test
443445
public void testRepoACLMergePreserve() throws RepositoryException, IOException, PackageException {
@@ -458,7 +460,7 @@ public void testRepoACLMergePreserve() throws RepositoryException, IOException,
458460
}
459461

460462
/**
461-
* Installs a package a the root level (JCRVLT-75)
463+
* Installs a package at the root level (JCRVLT-75)
462464
*/
463465
@Test
464466
public void testRootACL() throws RepositoryException, IOException, PackageException {
@@ -469,4 +471,17 @@ public void testRootACL() throws RepositoryException, IOException, PackageExcept
469471
// test if nodes and ACLs of first package exist
470472
assertPermission("/", true, new String[]{"jcr:all"}, "everyone", null);
471473
}
474+
475+
/** Check effect of filter definitions */
476+
@Test
477+
public void testACLsOutsideFilter() throws IOException, PackageException, RepositoryException {
478+
JcrUtils.getOrCreateByPath("/testroot/secured", JcrConstants.NT_FOLDER, admin);
479+
extractVaultPackageStrict("/test-packages/ac_outside_filter.zip");
480+
481+
// test if nodes and ACLs of package exist
482+
assertNodeExists("/testroot/node_a");
483+
assertPermission("/testroot", false, new String[]{"jcr:all"}, "everyone", null);
484+
/*
485+
assertPermission("/testroot/secured", false, new String[]{"jcr:all"}, "everyone", null);*/
486+
}
472487
}

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/META-INF/vault/definition/.content.xml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to You under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
19+
<jcr:root xmlns:vlt="http://www.day.com/jcr/vault/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
20+
jcr:created="{Date}2018-05-17T17:41:46.815+02:00"
21+
jcr:createdBy="admin"
22+
jcr:description="AC Handling: OverWrite"
23+
jcr:lastModified="{Date}2018-05-17T17:41:46.815+02:00"
24+
jcr:lastModifiedBy="admin"
25+
jcr:primaryType="vlt:PackageDefinition"
26+
acHandling="overwrite"
27+
buildCount="1"
28+
builtWith=""
29+
fixedBugs=""
30+
group="support"
31+
lastUnwrapped="{Date}2018-05-17T17:41:46.815+02:00"
32+
lastUnwrappedBy="admin"
33+
lastWrapped="{Date}2018-05-17T17:41:46.815+02:00"
34+
lastWrappedBy="admin"
35+
name=""
36+
providerLink=""
37+
providerName=""
38+
providerUrl=""
39+
testedWith=""
40+
version="">
41+
<filter jcr:primaryType="nt:unstructured">
42+
<f0
43+
jcr:primaryType="nt:unstructured"
44+
mode="replace"
45+
root="/testroot/secured"
46+
rules="[]"/>
47+
</filter>
48+
<screenshots jcr:primaryType="nt:unstructured"/>
49+
</jcr:root>

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/META-INF/vault/filter.xml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to You under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
<workspaceFilter version="1.0">
19+
<filter root="/testroot/node_a"/>
20+
</workspaceFilter>

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/META-INF/vault/nodetypes.cnd‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<'sling'='http://sling.apache.org/jcr/sling/1.0'>
2+
<'nt'='http://www.jcp.org/jcr/nt/1.0'>
3+
4+
[sling:Folder] > nt:folder
5+
- * (undefined)
6+
- * (undefined) multiple
7+
+ * (nt:base) = sling:Folder version
8+

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/META-INF/vault/properties.xml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<?xml version="1.0" encoding="utf-8" standalone="no"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to You under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
19+
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
20+
<properties>
21+
<comment>FileVault Package Properties</comment>
22+
<entry key="createdBy">admin</entry>
23+
<entry key="name">mode_ac_test_a</entry>
24+
<entry key="lastModified">2011-11-15T09:43:22.972+01:00</entry>
25+
<entry key="lastModifiedBy">admin</entry>
26+
<entry key="created">2011-11-15T09:43:22.993+01:00</entry>
27+
<entry key="buildCount">1</entry>
28+
<entry key="version"/>
29+
<entry key="dependencies"/>
30+
<entry key="packageFormatVersion">2</entry>
31+
<entry key="description"/>
32+
<entry key="lastWrapped">2011-11-15T09:43:22.972+01:00</entry>
33+
<entry key="group"/>
34+
<entry key="lastWrappedBy">admin</entry>
35+
<entry key="acHandling">overwrite</entry>
36+
</properties>

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/jcr_root/.content.xml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Licensed to the Apache Software Foundation (ASF) under one or more
4+
~ contributor license agreements. See the NOTICE file distributed with
5+
~ this work for additional information regarding copyright ownership.
6+
~ The ASF licenses this file to You under the Apache License, Version 2.0
7+
~ (the "License"); you may not use this file except in compliance with
8+
~ the License. You may obtain a copy of the License at
9+
~
10+
~ http://www.apache.org/licenses/LICENSE-2.0
11+
~
12+
~ Unless required by applicable law or agreed to in writing, software
13+
~ distributed under the License is distributed on an "AS IS" BASIS,
14+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
~ See the License for the specific language governing permissions and
16+
~ limitations under the License.
17+
-->
18+
19+
<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:rep="internal"
20+
jcr:mixinTypes="[rep:AccessControllable]"
21+
jcr:primaryType="rep:root"
22+
sling:resourceType="sling:redirect"
23+
sling:target="/index.html">
24+
<rep:policy/>
25+
<jcr:system/>
26+
<var/>
27+
<libs/>
28+
<etc/>
29+
<apps/>
30+
<content/>
31+
<tmp/>
32+
<home/>
33+
<testroot/>
34+
</jcr:root>

‎vault-core/src/test/resources/test-packages/ac_outside_filter.zip/jcr_root/testroot/_rep_policy.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<jcr:root
3+
xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:rep="internal"
4+
jcr:primaryType="rep:ACL">
5+
<deny
6+
jcr:primaryType="rep:DenyACE"
7+
rep:principalName="everyone"
8+
rep:privileges="{Name}[jcr:all]"/>
9+
</jcr:root>

0 commit comments

Comments
 (0)