001/* 002 * (C) Copyright 2012 Nuxeo SA (http://nuxeo.com/) and others. 003 * 004 * Licensed under the Apache License, Version 2.0 (the "License"); 005 * you may not use this file except in compliance with the License. 006 * You may obtain a copy of the License at 007 * 008 * http://www.apache.org/licenses/LICENSE-2.0 009 * 010 * Unless required by applicable law or agreed to in writing, software 011 * distributed under the License is distributed on an "AS IS" BASIS, 012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 013 * See the License for the specific language governing permissions and 014 * limitations under the License. 015 * 016 * Contributors: 017 * Antoine Taillefer <ataillefer@nuxeo.com> 018 */ 019package org.nuxeo.drive.hierarchy.permission.adapter; 020 021import java.security.Principal; 022import java.util.ArrayList; 023import java.util.Collections; 024import java.util.Iterator; 025import java.util.List; 026import java.util.Map; 027import java.util.Set; 028 029import org.apache.commons.logging.Log; 030import org.apache.commons.logging.LogFactory; 031import org.nuxeo.drive.adapter.FileSystemItem; 032import org.nuxeo.drive.adapter.FolderItem; 033import org.nuxeo.drive.adapter.impl.AbstractVirtualFolderItem; 034import org.nuxeo.drive.service.NuxeoDriveManager; 035import org.nuxeo.drive.service.SynchronizationRoots; 036import org.nuxeo.ecm.core.api.CoreInstance; 037import org.nuxeo.ecm.core.api.CoreSession; 038import org.nuxeo.ecm.core.api.DocumentModel; 039import org.nuxeo.ecm.core.api.IdRef; 040import org.nuxeo.ecm.core.api.security.SecurityConstants; 041import org.nuxeo.runtime.api.Framework; 042 043/** 044 * Permission based implementation of the parent {@link FolderItem} of the user's shared synchronization roots. 045 * 046 * @author Antoine Taillefer 047 */ 048public class SharedSyncRootParentFolderItem extends AbstractVirtualFolderItem { 049 050 private static final long serialVersionUID = 1L; 051 052 private static final Log log = LogFactory.getLog(SharedSyncRootParentFolderItem.class); 053 054 public SharedSyncRootParentFolderItem(String factoryName, Principal principal, String parentId, String parentPath, 055 String folderName) { 056 super(factoryName, principal, parentId, parentPath, folderName); 057 } 058 059 protected SharedSyncRootParentFolderItem() { 060 // Needed for JSON deserialization 061 } 062 063 @Override 064 public List<FileSystemItem> getChildren() { 065 066 List<FileSystemItem> children = new ArrayList<FileSystemItem>(); 067 Map<String, SynchronizationRoots> syncRootsByRepo = Framework.getService(NuxeoDriveManager.class) 068 .getSynchronizationRoots(principal); 069 for (String repositoryName : syncRootsByRepo.keySet()) { 070 try (CoreSession session = CoreInstance.openCoreSession(repositoryName, principal)) { 071 Set<IdRef> syncRootRefs = syncRootsByRepo.get(repositoryName).getRefs(); 072 Iterator<IdRef> syncRootRefsIt = syncRootRefs.iterator(); 073 while (syncRootRefsIt.hasNext()) { 074 IdRef idRef = syncRootRefsIt.next(); 075 // TODO: ensure sync roots cache is up-to-date if ACL 076 // change, for now need to check permission 077 // See https://jira.nuxeo.com/browse/NXP-11146 078 if (!session.hasPermission(idRef, SecurityConstants.READ)) { 079 if (log.isDebugEnabled()) { 080 log.debug(String.format( 081 "User %s has no READ access on synchronization root %s, not including it in children.", 082 session.getPrincipal().getName(), idRef)); 083 } 084 continue; 085 } 086 DocumentModel doc = session.getDocument(idRef); 087 // Filter by creator 088 // TODO: allow filtering by dc:creator in 089 // NuxeoDriveManager#getSynchronizationRoots(Principal 090 // principal) 091 if (!session.getPrincipal().getName().equals(doc.getPropertyValue("dc:creator"))) { 092 // NXP-19442: Avoid useless and costly call to DocumentModel#getLockInfo 093 FileSystemItem child = getFileSystemItemAdapterService().getFileSystemItem(doc, this, false, 094 false, false); 095 if (child == null) { 096 if (log.isDebugEnabled()) { 097 log.debug(String.format( 098 "Synchronization root %s cannot be adapted as a FileSystemItem, maybe because user %s doesn't have the required permission on it (default required permission is ReadWrite). Not including it in children.", 099 idRef, session.getPrincipal().getName())); 100 } 101 continue; 102 } 103 if (log.isDebugEnabled()) { 104 log.debug(String.format("Including synchronization root %s in children.", idRef)); 105 } 106 children.add(child); 107 } 108 } 109 } 110 } 111 Collections.sort(children); 112 return children; 113 } 114 115}