SEC-1051: Moved voter and afterinvocation packages into acl package. Also moved filterer classes fom core, as they are used in the acl after-invocation classes

acl/src/main/java/org/springframework/security/acls/afterinvocation/AbstractAclProvider.java

@@ -13,7 +13,7 @@
  * limitations under the License.
  */
 
-package org.springframework.security.afterinvocation;
+package org.springframework.security.acls.afterinvocation;
 
 import org.springframework.security.Authentication;
 import org.springframework.security.ConfigAttribute;
@@ -29,6 +29,7 @@ import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalS
 import org.springframework.security.acls.sid.Sid;
 import org.springframework.security.acls.sid.SidRetrievalStrategy;
 import org.springframework.security.acls.sid.SidRetrievalStrategyImpl;
+import org.springframework.security.afterinvocation.AfterInvocationProvider;
 
 import org.springframework.util.Assert;
 

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

@@ -12,7 +12,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.afterinvocation;
+package org.springframework.security.acls.afterinvocation;
 
 import java.util.Collection;
 import java.util.Iterator;
@@ -84,11 +84,7 @@ public class AclEntryAfterInvocationCollectionFilteringProvider extends Abstract
             return null;
         }
 
-        Iterator iter = config.iterator();
-
-        while (iter.hasNext()) {
-            ConfigAttribute attr = (ConfigAttribute) iter.next();
-
+        for (ConfigAttribute attr : config) {
             if (!this.supports(attr)) {
                 continue;
             }
@@ -97,7 +93,7 @@ public class AclEntryAfterInvocationCollectionFilteringProvider extends Abstract
             Filterer filterer;
 
             if (returnedObject instanceof Collection) {
-                filterer = new CollectionFilterer((Collection) returnedObject);
+                filterer = new CollectionFilterer((Collection<?>) returnedObject);
             } else if (returnedObject.getClass().isArray()) {
                 filterer = new ArrayFilterer((Object[]) returnedObject);
             } else {
@@ -108,8 +104,7 @@ public class AclEntryAfterInvocationCollectionFilteringProvider extends Abstract
             // Locate unauthorised Collection elements
             Iterator collectionIter = filterer.iterator();
 
-            while (collectionIter.hasNext()) {
-                Object domainObject = collectionIter.next();
+            for (Object domainObject : filterer) {
 
                 // Ignore nulls or entries which aren't instances of the configured domain object class
                 if (domainObject == null || !getProcessDomainObjectClass().isAssignableFrom(domainObject.getClass())) {

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -12,7 +12,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.afterinvocation;
+package org.springframework.security.acls.afterinvocation;
 
 import java.util.Iterator;
 import java.util.List;

acl/src/main/java/org/springframework/security/acls/afterinvocation/ArrayFilterer.java

@@ -0,0 +1,101 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.afterinvocation;
+
+import org.apache.commons.collections.iterators.ArrayIterator;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import java.lang.reflect.Array;
+
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+
+/**
+ * A filter used to filter arrays.
+ *
+ * @author Ben Alex
+ * @author Paulo Neves
+ * @version $Id$
+ */
+class ArrayFilterer<T> implements Filterer<T> {
+    //~ Static fields/initializers =====================================================================================
+
+    protected static final Log logger = LogFactory.getLog(ArrayFilterer.class);
+
+    //~ Instance fields ================================================================================================
+
+    private Set<T> removeList;
+    private T[] list;
+
+    //~ Constructors ===================================================================================================
+
+    ArrayFilterer(T[] list) {
+        this.list = list;
+
+        // Collect the removed objects to a HashSet so that
+        // it is fast to lookup them when a filtered array
+        // is constructed.
+        removeList = new HashSet<T>();
+    }
+
+    //~ Methods ========================================================================================================
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
+     */
+    public T[] getFilteredObject() {
+        // Recreate an array of same type and filter the removed objects.
+        int originalSize = list.length;
+        int sizeOfResultingList = originalSize - removeList.size();
+        T[] filtered = (T[]) Array.newInstance(list.getClass().getComponentType(), sizeOfResultingList);
+
+        for (int i = 0, j = 0; i < list.length; i++) {
+            T object = list[i];
+
+            if (!removeList.contains(object)) {
+                filtered[j] = object;
+                j++;
+            }
+        }
+
+        if (logger.isDebugEnabled()) {
+            logger.debug("Original array contained " + originalSize + " elements; now contains " + sizeOfResultingList
+                + " elements");
+        }
+
+        return filtered;
+    }
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
+     */
+    public Iterator<T> iterator() {
+        return new ArrayIterator(list);
+    }
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
+     */
+    public void remove(T object) {
+        removeList.add(object);
+    }
+}

acl/src/main/java/org/springframework/security/acls/afterinvocation/CollectionFilterer.java

@@ -0,0 +1,104 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.afterinvocation;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+
+/**
+ * A filter used to filter Collections.
+ *
+ * @author Ben Alex
+ * @author Paulo Neves
+ * @version $Id$
+ */
+class CollectionFilterer<T> implements Filterer<T> {
+    //~ Static fields/initializers =====================================================================================
+
+    protected static final Log logger = LogFactory.getLog(CollectionFilterer.class);
+
+    //~ Instance fields ================================================================================================
+
+    private Collection<T> collection;
+
+    // collectionIter offers significant performance optimisations (as
+    // per security-developer mailing list conversation 19/5/05)
+    private Iterator<T> collectionIter;
+    private Set<T> removeList;
+
+    //~ Constructors ===================================================================================================
+
+    CollectionFilterer(Collection<T> collection) {
+        this.collection = collection;
+
+        // We create a Set of objects to be removed from the Collection,
+        // as ConcurrentModificationException prevents removal during
+        // iteration, and making a new Collection to be returned is
+        // problematic as the original Collection implementation passed
+        // to the method may not necessarily be re-constructable (as
+        // the Collection(collection) constructor is not guaranteed and
+        // manually adding may lose sort order or other capabilities)
+        removeList = new HashSet<T>();
+    }
+
+    //~ Methods ========================================================================================================
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
+     */
+    public Object getFilteredObject() {
+        // Now the Iterator has ended, remove Objects from Collection
+        Iterator<T> removeIter = removeList.iterator();
+
+        int originalSize = collection.size();
+
+        while (removeIter.hasNext()) {
+            collection.remove(removeIter.next());
+        }
+
+        if (logger.isDebugEnabled()) {
+            logger.debug("Original collection contained " + originalSize + " elements; now contains "
+                + collection.size() + " elements");
+        }
+
+        return collection;
+    }
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
+     */
+    public Iterator<T> iterator() {
+        collectionIter = collection.iterator();
+
+        return collectionIter;
+    }
+
+    /**
+     *
+     * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
+     */
+    public void remove(T object) {
+        removeList.add(object);
+    }
+}

acl/src/main/java/org/springframework/security/acls/afterinvocation/Filterer.java

@@ -0,0 +1,51 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.afterinvocation;
+
+import java.util.Iterator;
+
+
+/**
+ * Filterer strategy interface.
+ *
+ * @author Ben Alex
+ * @author Paulo Neves
+ * @version $Id$
+ */
+interface Filterer<T> extends Iterable<T> {
+    //~ Methods ========================================================================================================
+
+    /**
+     * Gets the filtered collection or array.
+     *
+     * @return the filtered collection or array
+     */
+    Object getFilteredObject();
+
+    /**
+     * Returns an iterator over the filtered collection or array.
+     *
+     * @return an Iterator
+     */
+    Iterator<T> iterator();
+
+    /**
+     * Removes the the given object from the resulting list.
+     *
+     * @param object the object to be removed
+     */
+    void remove(T object);
+}

acl/src/main/java/org/springframework/security/acls/vote/AclEntryVoter.java

@@ -12,13 +12,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.vote;
+package org.springframework.security.acls.vote;
 
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
-import java.util.Iterator;
 import java.util.List;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.security.Authentication;
 import org.springframework.security.AuthorizationServiceException;
 import org.springframework.security.ConfigAttribute;
@@ -32,8 +33,7 @@ import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalS
 import org.springframework.security.acls.sid.Sid;
 import org.springframework.security.acls.sid.SidRetrievalStrategy;
 import org.springframework.security.acls.sid.SidRetrievalStrategyImpl;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
+import org.springframework.security.vote.AbstractAclVoter;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 
@@ -167,7 +167,7 @@ public class AclEntryVoter extends AbstractAclVoter {
                     logger.debug("Voting to abstain - domainObject is null");
                 }
 
-                return AccessDecisionVoter.ACCESS_ABSTAIN;
+                return ACCESS_ABSTAIN;
             }
 
             // Evaluate if we are required to use an inner domain object
@@ -208,7 +208,7 @@ public class AclEntryVoter extends AbstractAclVoter {
                     logger.debug("Voting to deny access - no ACLs apply for this principal");
                 }
 
-                return AccessDecisionVoter.ACCESS_DENIED;
+                return ACCESS_DENIED;
             }
 
             try {
@@ -217,25 +217,25 @@ public class AclEntryVoter extends AbstractAclVoter {
                         logger.debug("Voting to grant access");
                     }
 
-                    return AccessDecisionVoter.ACCESS_GRANTED;
+                    return ACCESS_GRANTED;
                 } else {
                     if (logger.isDebugEnabled()) {
                         logger.debug(
                             "Voting to deny access - ACLs returned, but insufficient permissions for this principal");
                     }
 
-                    return AccessDecisionVoter.ACCESS_DENIED;
+                    return ACCESS_DENIED;
                 }
             } catch (NotFoundException nfe) {
                 if (logger.isDebugEnabled()) {
                     logger.debug("Voting to deny access - no ACLs apply for this principal");
                 }
 
-                return AccessDecisionVoter.ACCESS_DENIED;
+                return ACCESS_DENIED;
             }
         }
 
         // No configuration attribute matched, so abstain
-        return AccessDecisionVoter.ACCESS_ABSTAIN;
+        return ACCESS_ABSTAIN;
     }
 }