001/* 002 * (C) Copyright 2015 Nuxeo SA (http://nuxeo.com/) and others. 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); 005 * you may not use this file except in compliance with the License. 006 * You may obtain a copy of the License at 007 * 008 * http://www.apache.org/licenses/LICENSE-2.0 009 * 010 * Unless required by applicable law or agreed to in writing, software 011 * distributed under the License is distributed on an "AS IS" BASIS, 012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 013 * See the License for the specific language governing permissions and 014 * limitations under the License. 015 * 016 * Contributors: 017 * dmetzler 018 * Vladimir Pasquier <vpasquier@nuxeo.com> 019 */ 020package org.nuxeo.ecm.automation.core.operations.document; 021 022import java.io.Serializable; 023import java.util.Calendar; 024import java.util.HashMap; 025import java.util.Map; 026 027import org.nuxeo.ecm.automation.core.Constants; 028import org.nuxeo.ecm.automation.core.annotations.Context; 029import org.nuxeo.ecm.automation.core.annotations.Operation; 030import org.nuxeo.ecm.automation.core.annotations.OperationMethod; 031import org.nuxeo.ecm.automation.core.annotations.Param; 032import org.nuxeo.ecm.automation.core.collectors.DocumentModelCollector; 033import org.nuxeo.ecm.core.api.CoreSession; 034import org.nuxeo.ecm.core.api.DocumentModel; 035import org.nuxeo.ecm.core.api.DocumentRef; 036import org.nuxeo.ecm.core.api.NuxeoPrincipal; 037import org.nuxeo.ecm.core.api.security.ACE; 038import org.nuxeo.ecm.core.api.security.ACL; 039import org.nuxeo.ecm.core.api.security.ACP; 040import org.nuxeo.ecm.core.api.security.impl.ACPImpl; 041import org.nuxeo.ecm.webengine.model.exceptions.IllegalParameterException; 042 043/** 044 * Operation that adds a permission to a given ACL for a given user. 045 * 046 * @since 5.7.3 047 */ 048@Operation(id = AddPermission.ID, category = Constants.CAT_DOCUMENT, label = "Add Permission", description = "Add Permission on the input document(s). Returns the document(s).", aliases = { "Document.AddACL" }) 049public class AddPermission { 050 051 public static final String ID = "Document.AddPermission"; 052 053 public static final String NOTIFY_KEY = "notify"; 054 055 public static final String COMMENT_KEY = "comment"; 056 057 @Context 058 protected CoreSession session; 059 060 @Param(name = "username", required = false, alias = "user", description = "ACE target user/group.") 061 protected String user; 062 063 /** 064 * @since 8.1 065 */ 066 @Param(name = "email", required = false, description = "ACE target user/group.") 067 protected String email; 068 069 @Param(name = "permission", description = "ACE permission.") 070 String permission; 071 072 @Param(name = "acl", required = false, values = { ACL.LOCAL_ACL }, description = "ACL name.") 073 String aclName = ACL.LOCAL_ACL; 074 075 @Param(name = "begin", required = false, description = "ACE begin date.") 076 Calendar begin; 077 078 @Param(name = "end", required = false, description = "ACE end date.") 079 Calendar end; 080 081 @Param(name = "blockInheritance", required = false, description = "Block inheritance or not.") 082 boolean blockInheritance = false; 083 084 @Param(name = "notify", required = false, description = "Notify the user or not") 085 boolean notify = false; 086 087 @Param(name = "comment", required = false, description = "Comment") 088 String comment; 089 090 @OperationMethod(collector = DocumentModelCollector.class) 091 public DocumentModel run(DocumentModel doc) { 092 addPermission(doc); 093 return session.getDocument(doc.getRef()); 094 } 095 096 @OperationMethod(collector = DocumentModelCollector.class) 097 public DocumentModel run(DocumentRef docRef) { 098 DocumentModel doc = session.getDocument(docRef); 099 addPermission(doc); 100 return doc; 101 } 102 103 protected void addPermission(DocumentModel doc) { 104 if (user == null && email == null) { 105 throw new IllegalParameterException("'username' or 'email' parameter must be set"); 106 } 107 108 if (user == null && end == null) { 109 throw new IllegalParameterException("'end' parameter must be set when adding a permission for an 'email'"); 110 } 111 112 String username = user; 113 if (username == null) { 114 username = NuxeoPrincipal.computeTransientUsername(email); 115 } 116 117 ACP acp = doc.getACP() != null ? doc.getACP() : new ACPImpl(); 118 Map<String, Serializable> contextData = new HashMap<>(); 119 contextData.put(NOTIFY_KEY, notify); 120 contextData.put(COMMENT_KEY, comment); 121 122 String creator = session.getPrincipal().getName(); 123 ACE ace = ACE.builder(username, permission) 124 .creator(creator) 125 .begin(begin) 126 .end(end) 127 .contextData(contextData) 128 .build(); 129 boolean permissionChanged = false; 130 if (blockInheritance) { 131 permissionChanged = acp.blockInheritance(aclName, creator); 132 } 133 permissionChanged = acp.addACE(aclName, ace) || permissionChanged; 134 if (permissionChanged) { 135 doc.setACP(acp, true); 136 } 137 } 138 139}