001/* 002 * (C) Copyright 2006-2016 Nuxeo SA (http://nuxeo.com/) and others. 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); 005 * you may not use this file except in compliance with the License. 006 * You may obtain a copy of the License at 007 * 008 * http://www.apache.org/licenses/LICENSE-2.0 009 * 010 * Unless required by applicable law or agreed to in writing, software 011 * distributed under the License is distributed on an "AS IS" BASIS, 012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 013 * See the License for the specific language governing permissions and 014 * limitations under the License. 015 * 016 * Contributors: 017 * Florent Guillaume 018 */ 019package org.nuxeo.ecm.core.security; 020 021import java.security.Principal; 022import java.util.Arrays; 023 024import org.nuxeo.ecm.core.api.security.ACP; 025import org.nuxeo.ecm.core.api.security.Access; 026import org.nuxeo.ecm.core.api.security.SecurityConstants; 027import org.nuxeo.ecm.core.model.Document; 028import org.nuxeo.ecm.core.query.sql.model.SQLQuery; 029 030/** 031 * Security policy that denies write access on a live document when it is in the checked-in state. 032 * <p> 033 * The document must be checked out before modification is allowed. 034 * 035 * @since 5.4 036 */ 037public class CheckInSecurityPolicy extends AbstractSecurityPolicy { 038 039 @Override 040 public Access checkPermission(Document doc, ACP mergedAcp, Principal principal, String permission, 041 String[] resolvedPermissions, String[] additionalPrincipals) { 042 Access access = Access.UNKNOWN; 043 if (Arrays.asList(resolvedPermissions).contains(SecurityConstants.WRITE_PROPERTIES) && !doc.isVersion() 044 && !doc.isProxy()) { 045 if (!doc.isCheckedOut()) { 046 access = Access.DENY; 047 } 048 } 049 return access; 050 } 051 052 @Override 053 public boolean isRestrictingPermission(String permission) { 054 return permission.equals(SecurityConstants.WRITE); 055 } 056 057 @Override 058 public boolean isExpressibleInQuery(String repositoryName) { 059 return true; 060 } 061 062 @Override 063 public SQLQuery.Transformer getQueryTransformer(String repositoryName) { 064 return SQLQuery.Transformer.IDENTITY; 065 } 066 067}