ObjectIdentityImpl based on the passed
* object instance. The passed object must provide a getId()
* method, otherwise an exception will be thrown. The object passed will
@@ -98,7 +98,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
/**
* Important so caching operates properly.Considers an object of the same class equal if it has the same
* classname and id properties.
* Note that this class uses string equality for the identifier field, which ensures it better supports * differences between {@link LookupStrategy} requirements and the domain object represented by this diff --git a/acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java b/acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java index 893d20dd78..019437ecaa 100644 --- a/acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java +++ b/acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java @@ -15,17 +15,23 @@ package org.springframework.security.acls.objectidentity; +import java.io.Serializable; + /** - * Basic implementation of {@link ObjectIdentityRetrievalStrategy} that uses the constructor of {@link - * ObjectIdentityImpl} to create the {@link ObjectIdentity}. + * Basic implementation of {@link ObjectIdentityRetrievalStrategy} and ObjectIdentityGenerator + * that uses the constructors of {@link ObjectIdentityImpl} to create the {@link ObjectIdentity}. * * @author Ben Alex * @version $Id$ */ -public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy { +public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy, ObjectIdentityGenerator { //~ Methods ======================================================================================================== public ObjectIdentity getObjectIdentity(Object domainObject) { return new ObjectIdentityImpl(domainObject); } + + public ObjectIdentity createObjectIdentity(Serializable id, String type) { + return new ObjectIdentityImpl(type, id); + } } diff --git a/core/src/main/java/org/springframework/security/expression/DenyAllPermissionEvaluator.java b/core/src/main/java/org/springframework/security/expression/DenyAllPermissionEvaluator.java index ce5b1a021e..0046d0f76e 100644 --- a/core/src/main/java/org/springframework/security/expression/DenyAllPermissionEvaluator.java +++ b/core/src/main/java/org/springframework/security/expression/DenyAllPermissionEvaluator.java @@ -1,5 +1,7 @@ package org.springframework.security.expression; +import java.io.Serializable; + import org.springframework.security.Authentication; /** @@ -19,4 +21,12 @@ public class DenyAllPermissionEvaluator implements PermissionEvaluator { return false; } + /** + * @return false always + */ + public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, + Object permission) { + return false; + } + } diff --git a/core/src/main/java/org/springframework/security/expression/PermissionEvaluator.java b/core/src/main/java/org/springframework/security/expression/PermissionEvaluator.java index 1b4091fece..5406aea545 100644 --- a/core/src/main/java/org/springframework/security/expression/PermissionEvaluator.java +++ b/core/src/main/java/org/springframework/security/expression/PermissionEvaluator.java @@ -1,5 +1,7 @@ package org.springframework.security.expression; +import java.io.Serializable; + import org.springframework.security.Authentication; /** @@ -22,4 +24,16 @@ public interface PermissionEvaluator { * @return true if the permission is granted, false otherwise */ boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission); + + /** + * Alternative method for evaluating a permission where only the identifier of the target object + * is available, rather than the target instance itself. + * + * @param authentication represents the user in question. Should not be null. + * @param targetId the identifier for the object instance (usually a Long) + * @param targetType a String representing the target's type (usually a Java classname). Not null. + * @param permission a representation of the permission object as supplied by the expression system. Not null. + * @return true if the permission is granted, false otherwise + */ + boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission); } diff --git a/core/src/main/java/org/springframework/security/expression/SecurityExpressionRoot.java b/core/src/main/java/org/springframework/security/expression/SecurityExpressionRoot.java index 932c78aafa..09128c9819 100644 --- a/core/src/main/java/org/springframework/security/expression/SecurityExpressionRoot.java +++ b/core/src/main/java/org/springframework/security/expression/SecurityExpressionRoot.java @@ -1,5 +1,6 @@ package org.springframework.security.expression; +import java.io.Serializable; import java.util.Set; import org.springframework.security.Authentication; @@ -7,6 +8,7 @@ import org.springframework.security.AuthenticationTrustResolver; import org.springframework.security.GrantedAuthority; import org.springframework.security.util.AuthorityUtils; + /** * Default root object for use in Spring Security expression evaluations. * @@ -87,6 +89,10 @@ public class SecurityExpressionRoot { return permissionEvaluator.hasPermission(authentication, target, permission); } + public boolean hasPermission(Object targetId, String targetType, Object permission) { + return permissionEvaluator.hasPermission(authentication, (Serializable)targetId, targetType, permission); + } + public Authentication getAuthentication() { return authentication; } diff --git a/core/src/test/java/org/springframework/security/expression/SecurityExpressionRootTests.java b/core/src/test/java/org/springframework/security/expression/SecurityExpressionRootTests.java index 2a8cc2e04f..019f8dbdb5 100644 --- a/core/src/test/java/org/springframework/security/expression/SecurityExpressionRootTests.java +++ b/core/src/test/java/org/springframework/security/expression/SecurityExpressionRootTests.java @@ -2,14 +2,16 @@ package org.springframework.security.expression; import static org.junit.Assert.*; +import org.jmock.Expectations; +import org.jmock.Mockery; import org.junit.Before; import org.junit.Test; import org.springframework.expression.Expression; import org.springframework.expression.spel.SpelExpressionParser; import org.springframework.expression.spel.standard.StandardEvaluationContext; import org.springframework.security.Authentication; +import org.springframework.security.AuthenticationTrustResolver; import org.springframework.security.expression.SecurityExpressionRoot; -import org.springframework.security.providers.UsernamePasswordAuthenticationToken; /** @@ -20,15 +22,21 @@ import org.springframework.security.providers.UsernamePasswordAuthenticationToke */ public class SecurityExpressionRootTests { SpelExpressionParser parser = new SpelExpressionParser(); - UsernamePasswordAuthenticationToken joe = new UsernamePasswordAuthenticationToken("joe", "password"); SecurityExpressionRoot root; StandardEvaluationContext ctx; + Mockery jmock = new Mockery(); + private AuthenticationTrustResolver trustResolver; + private Authentication user; + @Before public void createContext() { - root = new SecurityExpressionRoot(joe); + user = jmock.mock(Authentication.class); + root = new SecurityExpressionRoot(user); ctx = new StandardEvaluationContext(); ctx.setRootObject(root); + trustResolver = jmock.mock(AuthenticationTrustResolver.class); + root.setTrustResolver(trustResolver); } @Test @@ -40,24 +48,68 @@ public class SecurityExpressionRootTests { } @Test - public void hasPermissionWorksWithIntegerExpressions() throws Exception { + public void isAnonymousReturnsTrueIfTrustResolverReportsAnonymous() { + jmock.checking(new Expectations() {{ + oneOf(trustResolver).isAnonymous(user); will(returnValue(true)); + }}); + assertTrue(root.isAnonymous()); + } + + @Test + public void isAnonymousReturnsFalseIfTrustResolverReportsNonAnonymous() { + jmock.checking(new Expectations() {{ + oneOf(trustResolver).isAnonymous(user); will(returnValue(false)); + }}); + assertFalse(root.isAnonymous()); + } + + @Test + public void hasPermissionOnDomainObjectReturnsFalseIfPermissionEvaluatorDoes() throws Exception { + final Object dummyDomainObject = new Object(); + final PermissionEvaluator pe = jmock.mock(PermissionEvaluator.class); + ctx.setVariable("domainObject", dummyDomainObject); + root.setPermissionEvaluator(pe); + jmock.checking(new Expectations() {{ + oneOf(pe).hasPermission(user, dummyDomainObject, "ignored"); will(returnValue(false)); + }}); + + assertFalse(root.hasPermission(dummyDomainObject, "ignored")); + } + + @Test + public void hasPermissionOnDomainObjectReturnsTrueIfPermissionEvaluatorDoes() throws Exception { + final Object dummyDomainObject = new Object(); + final PermissionEvaluator pe = jmock.mock(PermissionEvaluator.class); + ctx.setVariable("domainObject", dummyDomainObject); + root.setPermissionEvaluator(pe); + jmock.checking(new Expectations() {{ + oneOf(pe).hasPermission(user, dummyDomainObject, "ignored"); will(returnValue(true)); + }}); + + assertTrue(root.hasPermission(dummyDomainObject, "ignored")); + } + + + @Test + public void hasPermissionOnDomainObjectWorksWithIntegerExpressions() throws Exception { final Object dummyDomainObject = new Object(); ctx.setVariable("domainObject", dummyDomainObject); + final PermissionEvaluator pe = jmock.mock(PermissionEvaluator.class); + root.setPermissionEvaluator(pe); - root.setPermissionEvaluator(new PermissionEvaluator () { - public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) { - // Check the correct target object is passed in - assertEquals(dummyDomainObject, targetDomainObject); - - return permission instanceof Integer && ((Integer)permission).intValue() == 10; - } - }); + jmock.checking(new Expectations() {{ + exactly(3).of(pe).hasPermission(with(user), with(dummyDomainObject), with(any(Integer.class))); + will(onConsecutiveCalls(returnValue(true), returnValue(true), returnValue(false))); + }}); Expression e = parser.parseExpression("hasPermission(#domainObject, 0xA)"); + // evaluator returns true assertTrue(ExpressionUtils.evaluateAsBoolean(e, ctx)); e = parser.parseExpression("hasPermission(#domainObject, 10)"); + // evaluator returns true assertTrue(ExpressionUtils.evaluateAsBoolean(e, ctx)); e = parser.parseExpression("hasPermission(#domainObject, 0xFF)"); + // evaluator returns false, make sure return value matches assertFalse(ExpressionUtils.evaluateAsBoolean(e, ctx)); } }