SEC-1023: Added support for hasPermission() based on Id and type

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -1,10 +1,13 @@
 package org.springframework.security.acls;
 
+import java.io.Serializable;
+
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.Authentication;
 import org.springframework.security.acls.domain.BasePermission;
 import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.objectidentity.ObjectIdentityGenerator;
 import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategy;
 import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategyImpl;
 import org.springframework.security.acls.sid.Sid;
@@ -27,6 +30,7 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 
     private AclService aclService;
     private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
+    private ObjectIdentityGenerator objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
     private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
 
     public AclPermissionEvaluator(AclService aclService) {
@@ -45,13 +49,23 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
 
         ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
 
+        return checkPermission(authentication, objectIdentity, permission);
+    }
+
+    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
+        ObjectIdentity objectIdentity = objectIdentityGenerator.createObjectIdentity(targetId, targetType);
+
+        return checkPermission(authentication, objectIdentity, permission);
+    }
+
+    private boolean checkPermission(Authentication authentication, ObjectIdentity oid, Object permission) {
         // Obtain the SIDs applicable to the principal
         Sid[] sids = sidRetrievalStrategy.getSids(authentication);
         Permission[] requiredPermission = resolvePermission(permission);
 
         try {
             // Lookup only ACLs for SIDs we're interested in
-            Acl acl = aclService.readAclById(objectIdentity, sids);
+            Acl acl = aclService.readAclById(oid, sids);
 
             if (acl.isGranted(requiredPermission, sids, false)) {
                 if (logger.isDebugEnabled()) {
@@ -72,6 +86,7 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
         }
 
         return false;
+
     }
 
     // TODO: Add permission resolver/PermissionFactory rewrite
@@ -111,5 +126,4 @@ public class AclPermissionEvaluator implements PermissionEvaluator {
     public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
         this.sidRetrievalStrategy = sidRetrievalStrategy;
     }
-
 }

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityGenerator.java

@@ -0,0 +1,23 @@
+package org.springframework.security.acls.objectidentity;
+
+import java.io.Serializable;
+
+/**
+ * Strategy which creates an <tt>ObjectIdentity</tt> from object identity and type information.
+ * Used in situations when the actual object instance isn't available.
+ *
+ * @author Luke Taylor
+ * @version $Id$
+ * @since 2.5
+ */
+public interface ObjectIdentityGenerator {
+
+    /**
+     *
+     * @param id the identifier of the domain object, not null
+     * @param type the type of the object (usually a class name), not null
+     * @return
+     */
+    ObjectIdentity createObjectIdentity(Serializable id, String type);
+
+}

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityImpl.java

@@ -63,7 +63,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
         this.identifier = identifier;
     }
 
-/**
+    /**
      * Creates the <code>ObjectIdentityImpl</code> based on the passed
      * object instance. The passed object must provide a <code>getId()</code>
      * method, otherwise an exception will be thrown. The object passed will
@@ -98,7 +98,7 @@ public class ObjectIdentityImpl implements ObjectIdentity {
     /**
      * Important so caching operates properly.<P>Considers an object of the same class equal if it has the same
      * <code>classname</code> and <code>id</code> properties.</p>
-     * 
+     *
      * <p>
      * Note that this class uses string equality for the identifier field, which ensures it better supports
      * differences between {@link LookupStrategy} requirements and the domain object represented by this

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java

@@ -15,17 +15,23 @@
 
 package org.springframework.security.acls.objectidentity;
 
+import java.io.Serializable;
+
 /**
- * Basic implementation of {@link ObjectIdentityRetrievalStrategy} that uses the constructor of {@link
- * ObjectIdentityImpl} to create the {@link ObjectIdentity}.
+ * Basic implementation of {@link ObjectIdentityRetrievalStrategy} and <tt>ObjectIdentityGenerator</tt>
+ * that uses the constructors of {@link ObjectIdentityImpl} to create the {@link ObjectIdentity}.
  *
  * @author Ben Alex
  * @version $Id$
  */
-public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy {
+public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy, ObjectIdentityGenerator {
     //~ Methods ========================================================================================================
 
     public ObjectIdentity getObjectIdentity(Object domainObject) {
         return new ObjectIdentityImpl(domainObject);
     }
+
+    public ObjectIdentity createObjectIdentity(Serializable id, String type) {
+        return new ObjectIdentityImpl(type, id);
+    }
 }