Bump antora from 3.2.0-alpha.11 to 3.2.0-alpha.12

---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0-alpha.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.editorconfig

@@ -0,0 +1,22 @@
+# EditorConfig for Spring Security
+# see https://github.com/spring-projects/spring-security/blob/master/CONTRIBUTING.adoc#mind-the-whitespace
+
+root = true
+
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+max_line_length = 120
+
+[*.{java,xml}]
+indent_style = tab
+indent_size = 4
+charset = utf-8
+continuation_indent_size = 8
+
+ij_smart_tabs = false
+ij_java_align_multiline_parameters = false
+
+[*.gradle]
+indent_style = tab

.github/workflows/codeql.yml

@@ -0,0 +1,80 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+#
+# ******** NOTE ********
+# We have attempted to detect the languages in your repository. Please check
+# the `language` matrix defined below to confirm you have the correct set of
+# supported CodeQL languages.
+#
+name: "CodeQL Advanced"
+
+on:
+  push: # run if we update the workflow
+  workflow_dispatch:
+  schedule:
+    - cron: '39 13 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ubuntu-latest
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: actions
+            build-mode: none
+        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      # Add any setup steps before running the `github/codeql-action/init` action.
+      # This includes steps like installing compilers or runtimes (`actions/setup-node`
+      # or others). This is typically only required for manual builds.
+      # - name: Setup runtime (example)
+      #   uses: actions/setup-example@v1
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+          # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+          queries: security-extended,security-and-quality
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:${{matrix.language}}"

.github/workflows/deploy-docs.yml

@@ -0,0 +1,51 @@
+name: Deploy Docs
+run-name: ${{ format('{0} ({1})', github.workflow, github.event.inputs.build-refname || 'all') }}
+on:
+  workflow_dispatch:
+    inputs:
+      build-refname:
+        description: Enter git refname to build (e.g., 5.7.x).
+        required: false
+  push:
+    branches: docs-build
+env:
+  GRADLE_ENTERPRISE_SECRET_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_SECRET_ACCESS_KEY }}
+permissions: read-all
+jobs:
+  build:
+    if: github.repository_owner == 'spring-projects'
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+      with:
+        fetch-depth: 5
+    - name: Set Up Gradle
+      uses: spring-io/spring-gradle-build-action@v2
+      with:
+        # Use JDK 17 since 6.5.x Kotlin version does not support JDK 25 and thus will fail
+        java-version: '17'
+        distribution: temurin
+    - name: Set up refname build
+      if: github.event.inputs.build-refname
+      run: |
+        git fetch --depth 1 https://github.com/$GITHUB_REPOSITORY ${{ github.event.inputs.build-refname }}
+        echo BUILD_REFNAME=${{ github.event.inputs.build-refname }} >> $GITHUB_ENV
+        echo BUILD_VERSION=$(git cat-file --textconv FETCH_HEAD:gradle.properties | sed -n '/^version=/ { s/^version=//;p }') >> $GITHUB_ENV
+    - name: Run Antora
+      run: ./gradlew antora
+    - name: Copy the cache to be included in the site
+      run: cp -rf build/antora/inject-collector-cache-config-extension/.cache build/site/
+    - name: Publish Docs
+      uses: spring-io/spring-doc-actions/rsync-antora-reference@v0.0.22
+      with:
+        docs-username: ${{ secrets.DOCS_USERNAME }}
+        docs-host: ${{ secrets.DOCS_HOST }}
+        docs-ssh-key: ${{ secrets.DOCS_SSH_KEY }}
+        docs-ssh-host-key: ${{ secrets.DOCS_SSH_HOST_KEY }}
+    - name: Bust Clouflare Cache
+      uses: spring-io/spring-doc-actions/bust-cloudflare-antora-cache@v0.0.22
+      with:
+        context-root: spring-security
+        cloudflare-zone-id: ${{ secrets.CLOUDFLARE_ZONE_ID }}
+        cloudflare-cache-token: ${{ secrets.CLOUDFLARE_CACHE_TOKEN }}

.github/workflows/merge-dependabot-pr.yml

@@ -0,0 +1,30 @@
+name: Merge Dependabot PR
+
+on: pull_request_target
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  merge-dependabot-pr:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    steps:
+
+      - uses: actions/checkout@v6
+        with:
+          show-progress: false
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - name: Merge Dependabot pull request
+        run: gh pr merge ${{ github.event.pull_request.number }} --auto --rebase
+        env:
+          GH_TOKEN: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}

.gitignore

@@ -1,22 +1,13 @@
-target/
-*/src/*/java/META-INF
-*/src/META-INF/
-*/src/*/java/META-INF/
-.classpath
-.springBeans
-.project
-.DS_Store
-.settings/
-.idea/
-out/
-bin/
-intellij/
-build/
-*.log
-*.log.*
-*.iml
-*.ipr
-*.iws
-.gradle/
-gradle.properties
-atlassian-ide-plugin.xml
+/.gradle/
+/.idea/*
+/.settings/
+/.classpath
+/.project
+/build/
+/node_modules/
+/package-lock.json
+/*.iml
+/*.ipr
+/*.iws
+!/.idea/checkstyle-idea.xml
+!/.idea/externalDependencies.xml

.idea/checkstyle-idea.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="CheckStyle-IDEA">
+    <option name="configuration">
+      <map>
+        <entry key="checkstyle-version" value="8.14" />
+        <entry key="copy-libs" value="false" />
+        <entry key="location-0" value="BUNDLED:(bundled):Sun Checks" />
+        <entry key="location-1" value="BUNDLED:(bundled):Google Checks" />
+        <entry key="scan-before-checkin" value="false" />
+        <entry key="scanscope" value="JavaOnlyWithTests" />
+        <entry key="suppress-errors" value="false" />
+      </map>
+    </option>
+  </component>
+</project>

.idea/externalDependencies.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ExternalDependencies">
+    <plugin id="CheckStyle-IDEA" />
+    <plugin id="org.jetbrains.plugins.gradle" />
+  </component>
+</project>

.sdkmanrc

@@ -0,0 +1,6 @@
+# Use sdkman to run "sdk env" to initialize with correct JDK version
+# Enable auto-env through the sdkman_auto_env config
+# See https://sdkman.io/usage#config
+# A summary is to add the following to ~/.sdkman/etc/config
+# sdkman_auto_env=true
+java=17.0.3-tem

README.adoc

@@ -0,0 +1,478 @@
+= Spring Security Docs Home
+ifndef::env-github[:toc:]
+ifdef::env-github[]
+:important-caption: :exclamation:
+:note-caption: :paperclip:
+endif::[]
+
+This README describes the processes and tools used to build the documentation for production as well as how to generate a local preview of the documentation.
+
+== Overview
+
+The Spring Security reference docs are generated using Antora.
+The Gradle Antora Plugin is used as the primary interface to Antora.
+
+You're viewing the playbook branch for the Spring Security project.
+The playbook branch hosts the docs build used to build and publish the production docs site, and is thus the documentation home base.
+If you're a docs developer, you'll mostly work in this branch.
+If you're a writer, you'll mostly work in software branches.
+
+=== Layout
+
+The playbook branch, named *docs-build*, hosts the primary documentation build.
+The documentation itself is located in a dedicated subproject in each software branch (i.e., the docs are stored alongside the code).
+Software branches, also referred to as release line branches or content branches, follow the pattern `major.minor.x` (e.g., 6.0.x), or `main` for the latest release line.
+Software tags follow the pattern `major.minor.patch` (e.g., 6.0.1).
+The latest version of the docs for each release line is always sourced from a tag.
+The release line branches host the prerelease materials for the next version.
+
+=== Builds
+
+The build for the production site is stored at the root of the playbook branch.
+This branch also holds the search crawler configuration and runner for the production site.
+This build is only needed for building the production site (or for developing and testing the docs build itself).
+The build for each content branch is located in a subproject, typically the folder named _docs_.
+This is the build that authors use to preview the docs for a single version when writing content.
+
+Regardless of how the docs site is built, Antora is configured to run a separate command to compute the version of the docs per git reference.
+This command is run by an Antora extension named Antora Collector.
+Using Collector allows the version of the docs to be maintained centrally in the _gradle.properties_ file in each git reference.
+The command also populates a collection of AsciiDoc attributes that provide access to software versions and resource URLs.
+_The docs build will not work without Collector._
+
+=== UI
+
+The UI is developed in a separate project named https://github.com/spring-io/antora-ui-spring[antora-ui-spring].
+That project generates and publishes a UI bundle, which the docs build refers to using its public bundle URL.
+There is one UI for all versions of the documentation.
+
+The UI only shows the latest version in each release line.
+In order to access other versions that are published, the URL must be known in advance.
+
+[#usage]
+== Usage
+
+To prepare your system for building the documentation, <<prerequisites,install the prerequisites>>, then <<prepare-workspace,prepare your workspace>>.
+Then you can build the documentation in either the main branch or 6.0.x branch.
+
+.Branch checkout instead of worktrees
+[NOTE]
+====
+If you prefer to set up your workspace without worktrees, complete the steps in <<prerequisites,Prerequisites>> and clone the project repository onto your computer.
+Then, check out the desired branch and follow the instructions in each section starting from the `sdk env || sdk env install` step.
+====
+
+[#prerequisites]
+=== Prerequisites (everyone)
+
+These instructions assume you already have basic tools on your system, including bash, zip, unzip, git, and curl.
+In addition to these basic tools, you need https://sdkman.io/install[SDKMAN!] installed so that the correct JDK is set for each branch.
+
+. Open your terminal and enter the following command:
++
+--
+ $ curl -s "https://get.sdkman.io" | bash
+
+This command downloads and installs SDKMAN!
+Once installation is complete, you should see a command displayed in your terminal that will initiate SDKMAN!.
+--
+
+. Copy the command displayed in your terminal and run it.
+In the following command, `$HOME` is the path unique to your computer (e.g., _home/username/.sdkman/bin/sdkman-init.sh_).
+
+ $ source "$HOME/.sdkman/bin/sdkman-init.sh"
+
+You'll use SDKMAN! in the following sections to install and switch to the JDK required for each branch.
+Now you're ready to prepare your workspace.
+
+[#prepare-workspace]
+=== Prepare your workspace (everyone)
+
+Your workspace will be the folder that contains the git worktrees of the project.
+
+. In your terminal, create a directory for the project and then change into that directory.
+
+ $ mkdir spring-security
+ $ cd spring-security
+
+. Clone the project repository and create the worktree for the main branch.
+Then change into the new *main* worktree.
+
+ $ git clone https://github.com/spring-projects/spring-security main
+ $ cd main
+
+. Set up a worktree for the 6.0.x branch by running the following commands:
+
+ $ git worktree add ../6.0.x 6.0.x --track
+
+. Repeat the last step for all release line branches (e.g., 5.8.x, 5.7.x, etc) you intend to work with.
+
+Now you're ready to build the docs in the main or 6.0.x branches.
+
+=== Build the documentation in the main branch (writers)
+
+NOTE: The instructions in this section assume you've completed the steps in <<prepare-workspace>>.
+
+. First, make sure you're in the *main* worktree.
+. Switch to the required JDK using SDKMAN! by running the following command:
++
+--
+ $ sdk env || sdk env install
+
+SDKMAN! will switch to the required JDK, provisioning it first if it isn't already available on your machine.
+--
+
+. Generate the documentation with Antora using the following command:
++
+--
+ $ ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+
+You can also run this command directly from the _docs_ folder:
+
+ $ cd docs
+ $ ../gradlew -PbuildSrc.skipTests=true antora
+
+This command will build the documentation for the *main* branch.
+The Antora playbook is retrieved by the playbook provider from the *docs-build* branch.
+The retrieved playbook file will be cached as _cached-antora-playbook.yml_.
+--
+
+. Navigate to the local file URI shown in the terminal to view the generated documentation.
+
+=== Build the documentation in the 6.0.x branch (writers)
+
+NOTE: The instructions in this section assume you've completed the steps in <<prepare-workspace>>.
+
+. First, change to the *6.0.x* worktree.
+
+ $ cd ../6.0.x
+
+. Switch to the required JDK using SDKMAN! by running the following command:
++
+--
+ $ sdk env || sdk env install
+
+SDKMAN! will switch to the required JDK, provisioning it first if it isn't already available on your machine.
+--
+
+. Generate the documentation with the following command:
++
+--
+ $ ./gradlew -PbuildSrc.skipTests=true :spring-security-docs:antora
+
+This command will build the documentation for the *6.0.x* branch.
+The Antora playbook is retrieved by the playbook provider from the *docs-build* branch.
+The retrieved playbook file will be cached as _cached-antora-playbook.yml_.
+--
+
+. Navigate to the local file URI shown in the terminal to view the generated documentation.
+
+=== Build the documentation for production (docs developer)
+
+NOTE: The instructions in this section assume you've completed the steps in <<prepare-workspace>>.
+
+To build the project's production site, you'll set up a worktree for the *docs-build* branch of the repository.
+
+. To add a worktree, you have to be in the main worktree.
+In your terminal, change to the *main* worktree if you aren't already in it.
+
+ $ cd ../main
+
+. Run the following command to set up the worktree for the *docs-build* branch.
+Then change into the new _docs-build_ directory.
+
+ $ git worktree add ../docs-build docs-build --track
+ $ cd ../docs-build
+
+. Switch to the required JDK or install it.
+
+ $ sdk env || sdk env install
+
+. Generate the documentation for the project's production site using the following command:
++
+--
+ $ ./gradlew antora
+
+This command will build all of the documentation for the production site from the git repository on GitHub.
+
+(Optional) To build the documentation using the current clone, using any available worktrees, run the following command instead:
+
+ $ ./gradlew antora --playbook local-antora-playbook.yml
+--
+
+. Navigate to the local file URI shown in the terminal to view the generated documentation.
+
+=== Content authoring
+
+We highly recommend relying on the https://intellij-asciidoc-plugin.ahus1.de/docs/users-guide/index.html[IntelliJ AsciiDoc Plugin] while writing.
+It provides assistance and autocompletion for the AsciiDoc syntax, Antora resource IDs, attributes and keys set in the playbook, component version descriptor, etc.
+It also provides single page preview.
+
+Once you've completed your edits, you'll build the branch locally to review and validate the changes.
+*You don't need to build the entire site!*
+*You don't need to create or edit the playbook or gradle.properties file either.*
+Rather, you'll interface with the docs build, and it will automatically set up a playbook for your branch and manage any required extensions, right from the docs subproject in your software (content) branch.
+See <<usage>> to learn how to build the docs.
+
+If the branch you modified has any AsciiDoc or Antora errors, they'll be printed to your terminal.
+Once you've fixed any errors and reviewed your changes, submit a pull request to the relevant software branch.
+If the change applies to multiple versions of the docs, you'll want to submit the pull request to the oldest active software branch.
+The maintainer will then apply that change to each of the release line branches.
+
+== CI workflows
+
+CI workflows are run by GitHub Actions.
+CI workflows are defined in YAML files in the _.github/workflows_ directory.
+The CI workflows in the default (i.e., _main_) branch serve as the primary entry.
+Corresponding CI workflows in a non-default branch may specialize the workflow for that branch.
+However, the CI workflows in non-default branches do not receive all events and often have to be triggered.
+A CI workflow must also be present in the default branch in order for it to appear in the list of workflows in the GitHub Actions web UI.
+
+CI workflows are triggered either by activity, on schedule, by the `gh workflow` call, or manually through the GitHub Actions web UI.
+Scheduled workflows only run on the default branch (i.e., *main*).
+However, a scheduled workflow may trigger a workflow in another branch using the `gh workflow` call.
+Activity on a branch or tag is only picked up by workflows in that reference.
+However, a workflow running in a branch or tag may trigger a workflow in another branch using the `gh workflow` call.
+
+There are two key CI workflows that pertain to the docs:
+
+* Deploy Docs (_.github/workflows/deploy-docs.yml_)
+* Rebuild Search Index (_.github/workflows/rebuild-search-index.yml_)
+
+In both cases, the concrete steps are located in the CI workflow in the *docs-build* branch.
+The CI workflows in the *main* branch only trigger the workflows in the *docs-build* branch.
+
+The production site is only deployed from the CI workflow in the *docs-build* branch.
+Often times, activity in a git reference or a scheduled workflow will trigger the CI workflow in the *docs-build* branch.
+Thus, this workflow is also present in each software branch to pick up on that activity.
+
+The production search index is built from the CI workflow in the *docs-build* branch.
+This CI workflow is triggered once per day by the scheduler on the same workflow in the *main* branch.
+This CI workflow must reside in the *main* branch in order to appear in the list of workflows in the CI branch so it can be triggered manually.
+
+Here's a list of activity that does and does not trigger the Deploy Docs workflow:
+
+pull request:: Does not trigger the Deploy Docs workflow.
+
+push to software branch:: Triggers the Deploy Docs workflow in that branch, which in turn triggers the Deploy Docs workflow in the *docs-build* branch.
+Attempts to run the docs build as partial build, if applicable.
+
+push to docs-build branch:: Triggers the Deploy Docs workflow in that branch.
+Runs the docs build as a full build.
+
+push tag:: Triggers the Deploy Docs workflow in that tag, which in turn triggers the Deploy Docs workflow in the *docs-build* branch.
+Always runs the docs build as a full build.
+
+schedule:: Not configured for the Deploy Docs workflow.
+
+It's possible to trigger the Deploy Docs manually from the GitHub Actions web UI.
+Be sure to select docs-build as the branch so that it will run a full build.
+See <<trigger>> for details.
+
+Note that updating the UI bundle does not currently trigger the Deploy Docs workflow, though it could be configured to do so.
+
+The Rebuild Search Index workflow is only triggered on a schedule, currently once per day.
+
+== Publishing
+
+The project in the *docs-build* branch supports publishing both full and partial builds of the production docs site.
+The project uses a Gradle build to run Antora on the playbook file _antora-playbook.yml_ (i.e., `./gradlew antora`).
+The production docs site is hosted on Linux server running Apache httpd.
+Files are published over SSH to the server by the .github/actions/publish-docs.sh script.
+A CDN (CloudFlare) caches URLs for a brief window of time.
+The publish script attempts to invalidate the cache after publishing the files so new content is available immediately.
+
+=== Full build
+
+In a full build, the entire site is rebuilt from the content sources matched by the patterns listed in the playbook file.
+The UI assets are also published when a full build is run.
+
+[#partial-builds]
+=== Partial builds
+
+A partial build is a single version sources from a single git reference.
+A partial build requested by git reference using the CI workflow variable *build-refname*.
+Here's an example of how to trigger the CI workflow for a partial build:
+
+ $ gh workflow run deploy-docs.yml --repo spring-projects/spring-security --ref docs-build -f build-refname=5.7.x
+
+The partial build is coordinated by the Antora Atlas extension and set up by the @springio/antora-extensions/partial-build-extension extension.
+See https://github.com/spring-io/antora-extensions#partial-build[Partial Build] for a detailed explanation of the partial build extension and how to configure it.
+
+During a partial build, Atlas runs in same site mode, which means it creates relative links (rather than absolute links) to files imported from the site manifest.
+This feature assumes that the built files will be reunited with the previously built files in the published site.
+The @springio/antora-extensions/partial-build-extension reconfigures the playbook to run a partial build if the BUILD_REFNAME environment variable is set, reverting to a full build if it determines a partial build is not appropriate.
+
+During a partial build, only the version folder that was built is published to the web server.
+Files in other folders are untouched.
+The UI assets are not published when a partial build is run.
+
+[#trigger]
+=== Trigger the documentation build workflow (docs developer)
+
+You can trigger the production document build using the Deploy Docs entry in the GitHub Actions web UI or using the https://cli.github.com/[GitHub CLI].
+
+==== GitHub Actions web UI
+
+. In the GitHub Actions web UI, click the Deploy Docs entry.
+. Click on the "Run workflow" menu.
+.. *To trigger full build*, select the *docs-build* branch and click "Run workflow".
+.. *To trigger a partial build*, specify a release line branch name in the input field labeled "Enter git refname to build" and click "Run workflow".
+
+==== GitHub CLI
+
+*To trigger full build*, start from within the cloned repository (ideally the playbook branch) and enter the `gh` command and options in the GitHub CLI:
+
+ $ gh workflow run deploy-docs.yml --ref docs-build
+
+*To trigger a partial build*, enter the `gh` command and options to build a single version (based on the release line branch name):
+
+ $ gh workflow run deploy-docs.yml --ref docs-build -f build-refname=5.7.x
+
+Run `gh help workflow run` to show the docs for this command and other examples of how to use it.
+
+If you're not running the `gh` command from within the cloned repository, you can specify the repository using the `--repo` CLI option (e.g., `--repo spring-projects/spring-security`).
+
+== Extensions
+
+The Spring Security docs have additional requirements above what Antora provides by default.
+To fulfill these requirements, the docs build employs a handful of Antora and Asciidoctor extensions to build successfully.
+You can't build the Spring Security docs using the base distribution of Antora.
+Fortunately, this extra complexity is encapsulated in the Antora playbook and several distributed extensions.
+
+IMPORTANT: The order of Antora extensions in the playbook matters.
+If the order is changed, it could result in files or metadata that an extension relies on not being available at the time it runs.
+
+For the most part, the extensions are retrieved from the npm package registry (npmjs.com).
+There are also several local extensions in _lib/antora/extensions_.
+The local extensions handle logic specific to this project and are only used for the production build.
+
+Below is a summary of the Antora and Asciidoctor extensions used in the docs build.
+
+=== Antora extensions
+
+@springio/antora-extensions/partial-build-extension (prod only):: Configures a partial build, when requested, by setting the `primary-site-url` and `primary-site-manifest-url` AsciiDoc attributes.
+See <<partial-builds>> for more information.
+./lib/antora/extensions/inject-collector-config.js (prod only):: Injects configuration for Antora Collector into tags that predated Antora Collector being introduced.
+See the next extension for details.
+@antora/collector-extension:: Invokes a command (a Gradle task) to set the docs version from _gradle.properties_ and numerous AsciiDoc attributes that provide access to software versions and resource URLs.
+The command that Antora Collector runs is essential for Antora to classify the docs properly.
+./lib/antora/extensions/version-fix.js (prod only):: Fixes invalid metadata in _antora.yml_ and/or _gradle.properties_ in tags.
+@antora/atlas-extension (prod only):: Generates the site manifest (_site-manifest.json_) and publishes it with the site.
+Also coordinates the partial build when requested.
+See <<partial-builds>> for details.
+@opendevise/antora-release-line-extension:: Abbreviates the version segment (in the URL) of the latest version in each release line from major.minor.patch to major.minor.
+The version segment of the latest overall version is still abbreviated to empty string by Antora.
+@springio/antora-extensions/tabs-migration-extension:: Migrates the tabs syntax from Spring Tabs to Asciidoctor Tabs.
+See <<tabs-migration>> for details.
+./lib/antora/extensions/publish-docsearch-config.js (prod only):: Publishes the docsearch config file to the production site so the indexer can use it.
+See <<search>> for details.
+
+=== Asciidoctor extensions
+
+@asciidoctor/tabs:: Enables the tabs block in AsciiDoc.
+See <<tabs-migration>> and the https://github.com/asciidoctor/asciidoctor-tabs[Asciidoctor Tabs README] for details.
+@springio/asciidoctor-extensions (prod only):: Provides various enhancements to the output generated by Asciidoctor, mostly around code blocks.
+See https://github.com/spring-io/asciidoctor-extensions[Spring.io Asciidoctor Extensions] for an inventory of extensions and how to activate and configure them.
+
+[#tabs-migration]
+== Tabs migration
+
+The Spring Security docs contain two variations of the tabs syntax, https://github.com/spring-io/spring-asciidoctor-backends#tabs[Spring Tabs] and https://github.com/asciidoctor/asciidoctor-tabs[Asciidoctor Tabs].
+Moving forward, Asciidoctor Tabs is the syntax that should be used.
+However, since the Spring Security docs include content from tags that were written before Asciidoctor Tabs was introduced, the docs build must still be able to process the Spring Tabs syntax where it is used.
+
+When the docs build runs, the Spring Tabs are automatically converted to Asciidoctor Tabs by the @springio/antora-extensions/tabs-migration-extension extension.
+Spring Tabs are never in the final output (unless the tabs migration extension is switched off).
+This extension also has the ability to unwrap the example block that encloses adjacent tabs, when possible, so only the tabs block remains.
+If Spring Tabs are not detected in a document, the migration will not run on that document.
+See https://github.com/spring-io/antora-extensions#tabs-migration[Tabs Migration] for a detailed explanation of this extension and how to configure it.
+
+For the Spring Security docs, the tabs migration will always have to be used as long as there are tags in the build that contain Spring Tabs.
+However, to reduce the amount of work the tabs migration extension has to do, the migration should be made permanent where possible.
+Thus, we recommend making the migration permanent in release line branches that are active, and thus all future tags.
+
+Saving the result of the tabs migration is done one software branch at a time.
+To start, switch to a branch and run the docs build in that branch (this will retrieve the Antora playbook).
+Next, edit the _cached-antora-playbook.yml_ file and add `save: true` underneath the key `unwrap_example_block`.
+This setting will save the migrated files back to their original location under the _docs_ folder.
+Run the docs build in that branch again to apply the tabs migration.
+Now commit the changed files.
+Once that's done, the tabs migration won't have to run on any documents in that branch.
+
+[#search]
+== Search
+
+The search component in the docs site is powered by Algolia DocSearch (specifically 2.6).
+DocSearch is a documentation-oriented toolchain for using Algolia's search solution.
+It provides both a crawler (aka scraper or indexer) and a search interface.
+The search index is hosted on the Algolia platform and queried from the search interface via a web API.
+
+=== Client
+
+The search interface is integrated into the UI bundle and initialized when the page loads.
+The search interface is configured using a collection of environment variables: `ALGOLIA_API_KEY`, `ALGOLIA_APP_ID`, and `ALGOLIA_INDEX_NAME`.
+For now, these environment variables are defined in _build.gradle_ for the production build.
+The search interface is only activated when all of these values are set.
+
+NOTE: The docsearch.js 2.6 package is marked as deprecated in npmjs.com.
+However, the new client (@docsearch/js 3.x) has a completely different interaction model and search result display that's not compatible with customized client adapter currently in use.
+In other words, switching to it means developing the customizations from scratch.
+Even if that were to be done, the way the new client displays search results is over simplified.
+The search results provided by docsearch.js 2.6 have proven to be clearer and easier to comprehend.
+
+=== Crawler
+
+The search index is created by the crawler component of DocSearch.
+There are two steps involved.
+First, the crawler must be configured.
+Second, the crawler must be run with that configuration.
+
+==== Configure
+
+The behavior of the crawler is configured by a file name _docsearch-config.json_.
+However, this file is not stored directly in the playbook branch.
+Rather, it's generated from a template to account for the versions in the published site.
+
+The generation of the _docsearch-config.js_ file happens during the production build.
+This file is generated by the Antora extension _lib/antora/extensions/publish-docsearch-config.js_.
+The extension generates a docsearch config so that docsearch indexes the latest version in each release line.
+To do so, the extension configures Handlebars to run using a model derived from information in Antora's content catalog.
+It then evaluates the template at _.github/actions/docsearch-config.json.hbs_ to produce a file at the root of the generated site named _docsearch-config.js_.
+That file is published as part of the site.
+
+==== Run
+
+The crawler is periodically run on the production site by the *Rebuild Search Index* workflow.
+The crawler creates a fresh search index and replaces the previous one.
+The name of the index is *spring-security-docs*.
+
+When the crawler runs, it downloads the _docsearch-config.json_ file from the production site and runs the docsearch action on it.
+
+NOTE: The crawler only needs to be run on files that are publicly accessible, so it makes sense that the configuration be located there too.
+
+In order to publish the search records (and thus create the index), the crawler must be configured using a collection of variables: `ALGOLIA_APPLICATION_ID` and `ALGOLIA_WRITE_KEY`.
+These variables must be configured as secrets in GitHub Actions.
+The index name is not required here as it is stored in the docsearch config file.
+
+
+
+== Maintenance
+
+The docs build requires regular maintenance.
+Here's an inventory of the files or software versions to check and keep up to date.
+
+.Playbook branch (i.e., *docs-build*)
+* Gradle Antora Plugin (_build.gradle_)
+* GitHub Actions libraries (_.github/workflows/deploy-docs.yml_, _.github/workflows/rebuild-search-index.yml_)
+* Java version (_.sdkmanrc_)
+* Node.js packages (_build.gradle_ and _lib/antora/templates/per-branch-antora-playbook.yml_)
+* Gradle Wrapper (_gradle/wrapper/gradle-wrapper.properties_)
+* Content sources in playbook (_antora-playbook.yml_ and _local-antora-playbook.yml_; ideally use patterns to minimize maintenance)
+* List of registered extensions (_antora-playbook.yml_, _local-antora-playbook.yml_, and _lib/antora/templates/per-branch-antora-playbook.yml_)
+
+.Content branches (e.g., *6.0.x*)
+* Gradle Antora Plugin (_docs/spring-security-docs.gradle_)
+* GitHub Actions libraries (_.github/workflows/deploy-docs.yml_, _.github/workflows/rebuild-search-index.yml_)
+
+Recall that the playbook used for the local docs preview in content branches is maintained in the *docs-build* branch in _lib/antora/templates/per-branch-antora-playbook.yml_.

acl/acl.gradle

@@ -1,17 +0,0 @@
-// Acl Module build file
-
-dependencies {
-    compile project(':spring-security-core'),
-            'aopalliance:aopalliance:1.0',
-            "net.sf.ehcache:ehcache:$ehcacheVersion",
-            "org.springframework:spring-aop:$springVersion",
-            "org.springframework:spring-context:$springVersion",
-            "org.springframework:spring-tx:$springVersion",
-            "org.springframework:spring-jdbc:$springVersion"
-
-    testCompile "org.springframework:spring-beans:$springVersion",
-                "org.springframework:spring-context-support:$springVersion",
-                "org.springframework:spring-test:$springVersion"
-
-    testRuntime "hsqldb:hsqldb:$hsqlVersion"
-}

acl/src/main/java/org/springframework/security/acls/AclEntryVoter.java

@@ -1,240 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls;
-
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.List;
-
-import org.aopalliance.intercept.MethodInvocation;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.AuthorizationServiceException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.vote.AbstractAclVoter;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-
-/**
- * <p>
- * Given a domain object instance passed as a method argument, ensures the principal has appropriate permission
- * as indicated by the {@link AclService}.
- * <p>
- * The <tt>AclService</tt> is used to retrieve the access control list (ACL) permissions associated with a
- * domain object instance for the current <tt>Authentication</tt> object.
- * <p>
- * The voter will vote if any  {@link ConfigAttribute#getAttribute()} matches the {@link #processConfigAttribute}.
- * The provider will then locate the first method argument of type {@link #processDomainObjectClass}. Assuming that
- * method argument is non-null, the provider will then lookup the ACLs from the <code>AclManager</code> and ensure the
- * principal is {@link Acl#isGranted(List,
- * List, boolean)} when presenting the {@link #requirePermission} array to that
- * method.
- * <p>
- * If the method argument is <tt>null</tt>, the voter will abstain from voting. If the method argument
- * could not be found, an {@link AuthorizationServiceException} will be thrown.
- * <p>
- * In practical terms users will typically setup a number of <tt>AclEntryVoter</tt>s. Each will have a
- * different {@link #setProcessDomainObjectClass processDomainObjectClass}, {@link #processConfigAttribute} and
- * {@link #requirePermission} combination. For example, a small application might employ the following instances of
- * <tt>AclEntryVoter</tt>:
- *  <ul>
- *      <li>Process domain object class <code>BankAccount</code>, configuration attribute
- *      <code>VOTE_ACL_BANK_ACCONT_READ</code>, require permission <code>BasePermission.READ</code></li>
- *      <li>Process domain object class <code>BankAccount</code>, configuration attribute
- *      <code>VOTE_ACL_BANK_ACCOUNT_WRITE</code>, require permission list <code>BasePermission.WRITE</code> and
- *      <code>BasePermission.CREATE</code> (allowing the principal to have <b>either</b> of these two permissions)</li>
- *      <li>Process domain object class <code>Customer</code>, configuration attribute
- *      <code>VOTE_ACL_CUSTOMER_READ</code>, require permission <code>BasePermission.READ</code></li>
- *      <li>Process domain object class <code>Customer</code>, configuration attribute
- *      <code>VOTE_ACL_CUSTOMER_WRITE</code>, require permission list <code>BasePermission.WRITE</code> and
- *      <code>BasePermission.CREATE</code></li>
- *  </ul>
- *  Alternatively, you could have used a common superclass or interface for the {@link #processDomainObjectClass}
- * if both <code>BankAccount</code> and <code>Customer</code> had common parents.</p>
- *  <p>If the principal does not have sufficient permissions, the voter will vote to deny access.</p>
- *  <p>All comparisons and prefixes are case sensitive.</p>
- *
- * @author Ben Alex
- */
-public class AclEntryVoter extends AbstractAclVoter {
-    //~ Static fields/initializers =====================================================================================
-
-    private static final Log logger = LogFactory.getLog(AclEntryVoter.class);
-
-    //~ Instance fields ================================================================================================
-
-    private AclService aclService;
-    private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-    private String internalMethod;
-    private String processConfigAttribute;
-    private List<Permission> requirePermission;
-
-    //~ Constructors ===================================================================================================
-
-    public AclEntryVoter(AclService aclService, String processConfigAttribute, Permission[] requirePermission) {
-        Assert.notNull(processConfigAttribute, "A processConfigAttribute is mandatory");
-        Assert.notNull(aclService, "An AclService is mandatory");
-
-        if ((requirePermission == null) || (requirePermission.length == 0)) {
-            throw new IllegalArgumentException("One or more requirePermission entries is mandatory");
-        }
-
-        this.aclService = aclService;
-        this.processConfigAttribute = processConfigAttribute;
-        this.requirePermission = Arrays.asList(requirePermission);
-    }
-
-    //~ Methods ========================================================================================================
-
-    /**
-     * Optionally specifies a method of the domain object that will be used to obtain a contained domain
-     * object. That contained domain object will be used for the ACL evaluation. This is useful if a domain object
-     * contains a parent that an ACL evaluation should be targeted for, instead of the child domain object (which
-     * perhaps is being created and as such does not yet have any ACL permissions)
-     *
-     * @return <code>null</code> to use the domain object, or the name of a method (that requires no arguments) that
-     *         should be invoked to obtain an <code>Object</code> which will be the domain object used for ACL
-     *         evaluation
-     */
-    protected String getInternalMethod() {
-        return internalMethod;
-    }
-
-    public void setInternalMethod(String internalMethod) {
-        this.internalMethod = internalMethod;
-    }
-
-    protected String getProcessConfigAttribute() {
-        return processConfigAttribute;
-    }
-
-    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-        Assert.notNull(objectIdentityRetrievalStrategy, "ObjectIdentityRetrievalStrategy required");
-        this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-    }
-
-    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-        this.sidRetrievalStrategy = sidRetrievalStrategy;
-    }
-
-    public boolean supports(ConfigAttribute attribute) {
-        return (attribute.getAttribute() != null) && attribute.getAttribute().equals(getProcessConfigAttribute());
-    }
-
-    public int vote(Authentication authentication, MethodInvocation object, Collection<ConfigAttribute> attributes) {
-
-        for(ConfigAttribute attr : attributes) {
-
-            if (!this.supports(attr)) {
-                continue;
-            }
-            // Need to make an access decision on this invocation
-            // Attempt to locate the domain object instance to process
-            Object domainObject = getDomainObjectInstance(object);
-
-            // If domain object is null, vote to abstain
-            if (domainObject == null) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Voting to abstain - domainObject is null");
-                }
-
-                return ACCESS_ABSTAIN;
-            }
-
-            // Evaluate if we are required to use an inner domain object
-            if (StringUtils.hasText(internalMethod)) {
-                try {
-                    Class<?> clazz = domainObject.getClass();
-                    Method method = clazz.getMethod(internalMethod, new Class[0]);
-                    domainObject = method.invoke(domainObject);
-                } catch (NoSuchMethodException nsme) {
-                    throw new AuthorizationServiceException("Object of class '" + domainObject.getClass()
-                        + "' does not provide the requested internalMethod: " + internalMethod);
-                } catch (IllegalAccessException iae) {
-                    logger.debug("IllegalAccessException", iae);
-
-                    throw new AuthorizationServiceException("Problem invoking internalMethod: " + internalMethod
-                        + " for object: " + domainObject);
-                } catch (InvocationTargetException ite) {
-                    logger.debug("InvocationTargetException", ite);
-
-                    throw new AuthorizationServiceException("Problem invoking internalMethod: " + internalMethod
-                        + " for object: " + domainObject);
-                }
-            }
-
-            // Obtain the OID applicable to the domain object
-            ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
-
-            // Obtain the SIDs applicable to the principal
-            List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-            Acl acl;
-
-            try {
-                // Lookup only ACLs for SIDs we're interested in
-                acl = aclService.readAclById(objectIdentity, sids);
-            } catch (NotFoundException nfe) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Voting to deny access - no ACLs apply for this principal");
-                }
-
-                return ACCESS_DENIED;
-            }
-
-            try {
-                if (acl.isGranted(requirePermission, sids, false)) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Voting to grant access");
-                    }
-
-                    return ACCESS_GRANTED;
-                } else {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug(
-                            "Voting to deny access - ACLs returned, but insufficient permissions for this principal");
-                    }
-
-                    return ACCESS_DENIED;
-                }
-            } catch (NotFoundException nfe) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Voting to deny access - no ACLs apply for this principal");
-                }
-
-                return ACCESS_DENIED;
-            }
-        }
-
-        // No configuration attribute matched, so abstain
-        return ACCESS_ABSTAIN;
-    }
-}

acl/src/main/java/org/springframework/security/acls/AclPermissionCacheOptimizer.java

@@ -1,66 +0,0 @@
-package org.springframework.security.acls;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.PermissionCacheOptimizer;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-/**
- * Batch loads ACLs for collections of objects to allow optimised filtering.
- *
- * @author Luke Taylor
- * @since 3.1
- */
-public class AclPermissionCacheOptimizer implements PermissionCacheOptimizer {
-    private final Log logger = LogFactory.getLog(getClass());
-    private final AclService aclService;
-    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-    private ObjectIdentityRetrievalStrategy oidRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-
-    public AclPermissionCacheOptimizer(AclService aclService) {
-        this.aclService = aclService;
-    }
-
-    public void cachePermissionsFor(Authentication authentication, Collection<?> objects) {
-        if (objects.isEmpty()) {
-            return;
-        }
-
-        List<ObjectIdentity> oidsToCache = new ArrayList<ObjectIdentity>(objects.size());
-
-        for (Object domainObject : objects) {
-            if (domainObject == null) {
-                continue;
-            }
-            ObjectIdentity oid = oidRetrievalStrategy.getObjectIdentity(domainObject);
-            oidsToCache.add(oid);
-        }
-
-        List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-        if (logger.isDebugEnabled()) {
-            logger.debug("Eagerly loading Acls for " + oidsToCache.size() + " objects");
-        }
-
-        aclService.readAclsById(oidsToCache, sids);
-    }
-
-    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-        this.oidRetrievalStrategy = objectIdentityRetrievalStrategy;
-    }
-
-    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-        this.sidRetrievalStrategy = sidRetrievalStrategy;
-    }
-}

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -1,151 +0,0 @@
-package org.springframework.security.acls;
-
-import java.io.Serializable;
-import java.util.Arrays;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.PermissionEvaluator;
-import org.springframework.security.acls.domain.DefaultPermissionFactory;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.PermissionFactory;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-/**
- * Used by Spring Security's expression-based access control implementation to evaluate permissions for a particular
- * object using the ACL module. Similar in behaviour to
- * {@link org.springframework.security.acls.AclEntryVoter AclEntryVoter}.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public class AclPermissionEvaluator implements PermissionEvaluator {
-
-    private final Log logger = LogFactory.getLog(getClass());
-
-    private final AclService aclService;
-    private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-    private ObjectIdentityGenerator objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
-    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-    private PermissionFactory permissionFactory = new DefaultPermissionFactory();
-
-    public AclPermissionEvaluator(AclService aclService) {
-        this.aclService = aclService;
-    }
-
-    /**
-     * Determines whether the user has the given permission(s) on the domain object using the ACL
-     * configuration. If the domain object is null, returns false (this can always be overridden using a null
-     * check in the expression itself).
-     */
-    public boolean hasPermission(Authentication authentication, Object domainObject, Object permission) {
-        if (domainObject == null) {
-            return false;
-        }
-
-        ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
-
-        return checkPermission(authentication, objectIdentity, permission);
-    }
-
-    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType, Object permission) {
-        ObjectIdentity objectIdentity = objectIdentityGenerator.createObjectIdentity(targetId, targetType);
-
-        return checkPermission(authentication, objectIdentity, permission);
-    }
-
-    private boolean checkPermission(Authentication authentication, ObjectIdentity oid, Object permission) {
-        // Obtain the SIDs applicable to the principal
-        List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-        List<Permission> requiredPermission = resolvePermission(permission);
-
-        final boolean debug = logger.isDebugEnabled();
-
-        if (debug) {
-            logger.debug("Checking permission '" + permission + "' for object '" + oid + "'");
-        }
-
-        try {
-            // Lookup only ACLs for SIDs we're interested in
-            Acl acl = aclService.readAclById(oid, sids);
-
-            if (acl.isGranted(requiredPermission, sids, false)) {
-                if (debug) {
-                    logger.debug("Access is granted");
-                }
-
-                return true;
-            }
-
-            if (debug) {
-                logger.debug("Returning false - ACLs returned, but insufficient permissions for this principal");
-            }
-
-        } catch (NotFoundException nfe) {
-            if (debug) {
-                logger.debug("Returning false - no ACLs apply for this principal");
-            }
-        }
-
-        return false;
-
-    }
-
-    List<Permission> resolvePermission(Object permission) {
-        if (permission instanceof Integer) {
-            return Arrays.asList(permissionFactory.buildFromMask(((Integer)permission).intValue()));
-        }
-
-        if (permission instanceof Permission) {
-            return Arrays.asList((Permission)permission);
-        }
-
-        if (permission instanceof Permission[]) {
-            return Arrays.asList((Permission[])permission);
-        }
-
-        if (permission instanceof String) {
-            String permString = (String)permission;
-            Permission p;
-
-            try {
-                p = permissionFactory.buildFromName(permString);
-            } catch(IllegalArgumentException notfound) {
-                p = permissionFactory.buildFromName(permString.toUpperCase());
-            }
-
-            if (p != null) {
-                return Arrays.asList(p);
-            }
-
-        }
-        throw new IllegalArgumentException("Unsupported permission: " + permission);
-    }
-
-    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-        this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-    }
-
-    public void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-        this.objectIdentityGenerator = objectIdentityGenerator;
-    }
-
-    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-        this.sidRetrievalStrategy = sidRetrievalStrategy;
-    }
-
-    public void setPermissionFactory(PermissionFactory permissionFactory) {
-        this.permissionFactory = permissionFactory;
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AbstractAclProvider.java

@@ -1,125 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Arrays;
-import java.util.List;
-
-import org.springframework.security.access.AfterInvocationProvider;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.domain.BasePermission;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.util.Assert;
-
-
-/**
- * Abstract {@link AfterInvocationProvider} which provides commonly-used ACL-related services.
- *
- * @author Ben Alex
-  */
-public abstract class AbstractAclProvider implements AfterInvocationProvider {
-    //~ Instance fields ================================================================================================
-
-    protected final AclService aclService;
-    protected Class<?> processDomainObjectClass = Object.class;
-    protected ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-    protected SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-    protected String processConfigAttribute;
-    protected final List<Permission> requirePermission;
-
-    //~ Constructors ===================================================================================================
-
-    public AbstractAclProvider(AclService aclService, String processConfigAttribute, List<Permission> requirePermission) {
-        Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
-        Assert.notNull(aclService, "An AclService is mandatory");
-
-        if (requirePermission == null || requirePermission.isEmpty()) {
-            throw new IllegalArgumentException("One or more requirePermission entries is mandatory");
-        }
-
-        this.aclService = aclService;
-        this.processConfigAttribute = processConfigAttribute;
-        this.requirePermission = requirePermission;
-    }
-
-    //~ Methods ========================================================================================================
-
-    protected Class<?> getProcessDomainObjectClass() {
-        return processDomainObjectClass;
-    }
-
-    protected boolean hasPermission(Authentication authentication, Object domainObject) {
-        // Obtain the OID applicable to the domain object
-        ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
-
-        // Obtain the SIDs applicable to the principal
-        List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-        try {
-            // Lookup only ACLs for SIDs we're interested in
-            Acl acl = aclService.readAclById(objectIdentity, sids);
-
-            return acl.isGranted(requirePermission, sids, false);
-        } catch (NotFoundException ignore) {
-            return false;
-        }
-    }
-
-    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-        Assert.notNull(objectIdentityRetrievalStrategy, "ObjectIdentityRetrievalStrategy required");
-        this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-    }
-
-    protected void setProcessConfigAttribute(String processConfigAttribute) {
-        Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
-        this.processConfigAttribute = processConfigAttribute;
-    }
-
-    public void setProcessDomainObjectClass(Class<?> processDomainObjectClass) {
-        Assert.notNull(processDomainObjectClass, "processDomainObjectClass cannot be set to null");
-        this.processDomainObjectClass = processDomainObjectClass;
-    }
-
-    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-        this.sidRetrievalStrategy = sidRetrievalStrategy;
-    }
-
-    public boolean supports(ConfigAttribute attribute) {
-        return processConfigAttribute.equals(attribute.getAttribute());
-    }
-
-    /**
-     * This implementation supports any type of class, because it does not query the presented secure object.
-     *
-     * @param clazz the secure object
-     *
-     * @return always <code>true</code>
-     */
-    public boolean supports(Class<?> clazz) {
-        return true;
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

@@ -1,121 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.AuthorizationServiceException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.core.Authentication;
-
-
-/**
- * <p>
- * Given a <code>Collection</code> of domain object instances returned from a secure object invocation, remove
- * any <code>Collection</code> elements the principal does not have appropriate permission to access as defined by the
- * {@link AclService}.
- * <p>
- * The <code>AclService</code> is used to retrieve the access control list (ACL) permissions associated with
- * each <code>Collection</code> domain object instance element for the current <code>Authentication</code> object.
- * <p>
- * This after invocation provider will fire if any {@link ConfigAttribute#getAttribute()} matches the {@link
- * #processConfigAttribute}. The provider will then lookup the ACLs from the <code>AclService</code> and ensure the
- * principal is {@link org.springframework.security.acls.model.Acl#isGranted(List, List, boolean) Acl.isGranted()}
- * when presenting the {@link #requirePermission} array to that method.
- * <p>
- * If the principal does not have permission, that element will not be included in the returned
- * <code>Collection</code>.
- * <p>
- * Often users will setup a <code>BasicAclEntryAfterInvocationProvider</code> with a {@link
- * #processConfigAttribute} of <code>AFTER_ACL_COLLECTION_READ</code> and a {@link #requirePermission} of
- * <code>BasePermission.READ</code>. These are also the defaults.
- * <p>
- * If the provided <code>returnObject</code> is <code>null</code>, a <code>null</code><code>Collection</code>
- * will be returned. If the provided <code>returnObject</code> is not a <code>Collection</code>, an {@link
- * AuthorizationServiceException} will be thrown.
- * <p>
- * All comparisons and prefixes are case sensitive.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-public class AclEntryAfterInvocationCollectionFilteringProvider extends AbstractAclProvider {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationCollectionFilteringProvider.class);
-
-    //~ Constructors ===================================================================================================
-
-    public AclEntryAfterInvocationCollectionFilteringProvider(AclService aclService, List<Permission> requirePermission) {
-        super(aclService, "AFTER_ACL_COLLECTION_READ", requirePermission);
-    }
-
-    //~ Methods ========================================================================================================
-
-    @SuppressWarnings("unchecked")
-    public Object decide(Authentication authentication, Object object, Collection<ConfigAttribute> config,
-            Object returnedObject) throws AccessDeniedException {
-
-        if (returnedObject == null) {
-            logger.debug("Return object is null, skipping");
-
-            return null;
-        }
-
-        for (ConfigAttribute attr : config) {
-            if (!this.supports(attr)) {
-                continue;
-            }
-
-            // Need to process the Collection for this invocation
-            Filterer filterer;
-
-            if (returnedObject instanceof Collection) {
-                filterer = new CollectionFilterer((Collection) returnedObject);
-            } else if (returnedObject.getClass().isArray()) {
-                filterer = new ArrayFilterer((Object[]) returnedObject);
-            } else {
-                throw new AuthorizationServiceException("A Collection or an array (or null) was required as the "
-                        + "returnedObject, but the returnedObject was: " + returnedObject);
-            }
-
-            // Locate unauthorised Collection elements
-            for (Object domainObject : filterer) {
-                // Ignore nulls or entries which aren't instances of the configured domain object class
-                if (domainObject == null || !getProcessDomainObjectClass().isAssignableFrom(domainObject.getClass())) {
-                    continue;
-                }
-
-                if(!hasPermission(authentication, domainObject)) {
-                    filterer.remove(domainObject);
-
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Principal is NOT authorised for element: " + domainObject);
-                    }
-                }
-            }
-
-            return filterer.getFilteredObject();
-        }
-
-        return returnedObject;
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -1,118 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.context.MessageSource;
-import org.springframework.context.MessageSourceAware;
-import org.springframework.context.support.MessageSourceAccessor;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.SpringSecurityMessageSource;
-
-
-/**
- * Given a domain object instance returned from a secure object invocation, ensures the principal has
- * appropriate permission as defined by the {@link AclService}.
- * <p>
- * The <code>AclService</code> is used to retrieve the access control list (ACL) permissions associated with a
- * domain object instance for the current <code>Authentication</code> object.
- * <p>
- * This after invocation provider will fire if any  {@link ConfigAttribute#getAttribute()} matches the {@link
- * #processConfigAttribute}. The provider will then lookup the ACLs from the <tt>AclService</tt> and ensure the
- * principal is {@link org.springframework.security.acls.model.Acl#isGranted(List, List, boolean)
- * Acl.isGranted(List, List, boolean)} when presenting the {@link #requirePermission} array to that method.
- * <p>
- * Often users will set up an <code>AclEntryAfterInvocationProvider</code> with a {@link
- * #processConfigAttribute} of <code>AFTER_ACL_READ</code> and a {@link #requirePermission} of
- * <code>BasePermission.READ</code>. These are also the defaults.
- * <p>
- * If the principal does not have sufficient permissions, an <code>AccessDeniedException</code> will be thrown.
- * <p>
- * If the provided <tt>returnedObject</tt> is <code>null</code>, permission will always be granted and
- * <code>null</code> will be returned.
- * <p>
- * All comparisons and prefixes are case sensitive.
- */
-public class AclEntryAfterInvocationProvider extends AbstractAclProvider implements MessageSourceAware {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationProvider.class);
-
-    //~ Instance fields ================================================================================================
-
-    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
-
-    //~ Constructors ===================================================================================================
-
-    public AclEntryAfterInvocationProvider(AclService aclService, List<Permission> requirePermission) {
-        this(aclService, "AFTER_ACL_READ", requirePermission);
-    }
-
-    public AclEntryAfterInvocationProvider(AclService aclService, String processConfigAttribute,
-            List<Permission> requirePermission) {
-        super(aclService, processConfigAttribute, requirePermission);
-    }
-
-    //~ Methods ========================================================================================================
-
-    public Object decide(Authentication authentication, Object object, Collection<ConfigAttribute> config,
-            Object returnedObject) throws AccessDeniedException {
-
-        if (returnedObject == null) {
-            // AclManager interface contract prohibits nulls
-            // As they have permission to null/nothing, grant access
-            logger.debug("Return object is null, skipping");
-
-            return null;
-        }
-
-        if (!getProcessDomainObjectClass().isAssignableFrom(returnedObject.getClass())) {
-            logger.debug("Return object is not applicable for this provider, skipping");
-
-            return returnedObject;
-        }
-
-        for (ConfigAttribute attr : config) {
-            if (!this.supports(attr)) {
-                continue;
-            }
-            // Need to make an access decision on this invocation
-
-            if (hasPermission(authentication, returnedObject)) {
-                return returnedObject;
-            }
-
-            logger.debug("Denying access");
-
-            throw new AccessDeniedException(messages.getMessage("AclEntryAfterInvocationProvider.noPermission",
-                    new Object[] {authentication.getName(), returnedObject},
-                    "Authentication {0} has NO permissions to the domain object {1}"));
-        }
-
-        return returnedObject;
-    }
-
-    public void setMessageSource(MessageSource messageSource) {
-        this.messages = new MessageSourceAccessor(messageSource);
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/ArrayFilterer.java

@@ -1,117 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.lang.reflect.Array;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-import java.util.Set;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-
-/**
- * A filter used to filter arrays.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-class ArrayFilterer<T> implements Filterer<T> {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log logger = LogFactory.getLog(ArrayFilterer.class);
-
-    //~ Instance fields ================================================================================================
-
-    private final Set<T> removeList;
-    private final T[] list;
-
-    //~ Constructors ===================================================================================================
-
-    ArrayFilterer(T[] list) {
-        this.list = list;
-
-        // Collect the removed objects to a HashSet so that
-        // it is fast to lookup them when a filtered array
-        // is constructed.
-        removeList = new HashSet<T>();
-    }
-
-    //~ Methods ========================================================================================================
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
-     */
-    @SuppressWarnings("unchecked")
-    public T[] getFilteredObject() {
-        // Recreate an array of same type and filter the removed objects.
-        int originalSize = list.length;
-        int sizeOfResultingList = originalSize - removeList.size();
-        T[] filtered = (T[]) Array.newInstance(list.getClass().getComponentType(), sizeOfResultingList);
-
-        for (int i = 0, j = 0; i < list.length; i++) {
-            T object = list[i];
-
-            if (!removeList.contains(object)) {
-                filtered[j] = object;
-                j++;
-            }
-        }
-
-        if (logger.isDebugEnabled()) {
-            logger.debug("Original array contained " + originalSize + " elements; now contains " + sizeOfResultingList
-                + " elements");
-        }
-
-        return filtered;
-    }
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
-     */
-    public Iterator<T> iterator() {
-        return new Iterator<T>() {
-            private int index = 0;
-
-            public boolean hasNext() {
-                return index < list.length;
-            }
-
-            public T next() {
-                if (!hasNext()) {
-                    throw new NoSuchElementException();
-                }
-                return list[index++];
-            }
-
-            public void remove() {
-                throw new UnsupportedOperationException();
-            }
-        };
-    }
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
-     */
-    public void remove(T object) {
-        removeList.add(object);
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/CollectionFilterer.java

@@ -1,98 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import java.util.Collection;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Set;
-
-
-/**
- * A filter used to filter Collections.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-class CollectionFilterer<T> implements Filterer<T> {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log logger = LogFactory.getLog(CollectionFilterer.class);
-
-    //~ Instance fields ================================================================================================
-
-    private final Collection<T> collection;
-
-    private final Set<T> removeList;
-
-    //~ Constructors ===================================================================================================
-
-    CollectionFilterer(Collection<T> collection) {
-        this.collection = collection;
-
-        // We create a Set of objects to be removed from the Collection,
-        // as ConcurrentModificationException prevents removal during
-        // iteration, and making a new Collection to be returned is
-        // problematic as the original Collection implementation passed
-        // to the method may not necessarily be re-constructable (as
-        // the Collection(collection) constructor is not guaranteed and
-        // manually adding may lose sort order or other capabilities)
-        removeList = new HashSet<T>();
-    }
-
-    //~ Methods ========================================================================================================
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
-     */
-    public Object getFilteredObject() {
-        // Now the Iterator has ended, remove Objects from Collection
-        Iterator<T> removeIter = removeList.iterator();
-
-        int originalSize = collection.size();
-
-        while (removeIter.hasNext()) {
-            collection.remove(removeIter.next());
-        }
-
-        if (logger.isDebugEnabled()) {
-            logger.debug("Original collection contained " + originalSize + " elements; now contains "
-                + collection.size() + " elements");
-        }
-
-        return collection;
-    }
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
-     */
-    public Iterator<T> iterator() {
-        return collection.iterator();
-    }
-
-    /**
-     *
-     * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
-     */
-    public void remove(T object) {
-        removeList.add(object);
-    }
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/Filterer.java

@@ -1,50 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Iterator;
-
-
-/**
- * Filterer strategy interface.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-interface Filterer<T> extends Iterable<T> {
-    //~ Methods ========================================================================================================
-
-    /**
-     * Gets the filtered collection or array.
-     *
-     * @return the filtered collection or array
-     */
-    Object getFilteredObject();
-
-    /**
-     * Returns an iterator over the filtered collection or array.
-     *
-     * @return an Iterator
-     */
-    Iterator<T> iterator();
-
-    /**
-     * Removes the the given object from the resulting list.
-     *
-     * @param object the object to be removed
-     */
-    void remove(T object);
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/package-info.java

@@ -1,6 +0,0 @@
-/**
- * After-invocation providers for collection and array filtering. Consider using a {@code PostFilter} annotation in
- * preference.
- */
-package org.springframework.security.acls.afterinvocation;
-

acl/src/main/java/org/springframework/security/acls/domain/AbstractPermission.java

@@ -1,72 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-
-/**
- * Provides an abstract superclass for {@link Permission} implementations.
- *
- * @author Ben Alex
- * @since 2.0.3
- */
-public abstract class AbstractPermission implements Permission {
-
-    //~ Instance fields ================================================================================================
-
-    protected final char code;
-    protected int mask;
-
-    //~ Constructors ===================================================================================================
-    /**
-     * Sets the permission mask and uses the '*' character to represent active bits when represented as a bit
-     * pattern string.
-     *
-     * @param mask the integer bit mask for the permission
-     */
-    protected AbstractPermission(int mask) {
-        this.mask = mask;
-        this.code = '*';
-    }
-
-    /**
-     * Sets the permission mask and uses the specified character for active bits.
-     *
-     * @param mask the integer bit mask for the permission
-     * @param code the character to print for each active bit in the mask (see {@link Permission#getPattern()})
-     */
-    protected AbstractPermission(int mask, char code) {
-        this.mask = mask;
-        this.code = code;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public final boolean equals(Object arg0) {
-        if (arg0 == null) {
-            return false;
-        }
-
-        if (!(arg0 instanceof Permission)) {
-            return false;
-        }
-
-        Permission rhs = (Permission) arg0;
-
-        return (this.mask == rhs.getMask());
-    }
-
-    public final int getMask() {
-        return mask;
-    }
-
-    public String getPattern() {
-        return AclFormattingUtils.printBinary(mask, code);
-    }
-
-    public final String toString() {
-        return this.getClass().getSimpleName() + "[" + getPattern() + "=" + mask + "]";
-    }
-
-    public final int hashCode() {
-        return this.mask;
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/AccessControlEntryImpl.java

@@ -1,174 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-
-import org.springframework.util.Assert;
-
-import java.io.Serializable;
-
-
-/**
- * An immutable default implementation of <code>AccessControlEntry</code>.
- *
- * @author Ben Alex
- */
-public class AccessControlEntryImpl implements AccessControlEntry, AuditableAccessControlEntry {
-    //~ Instance fields ================================================================================================
-
-    private final Acl acl;
-    private Permission permission;
-    private final Serializable id;
-    private final Sid sid;
-    private boolean auditFailure = false;
-    private boolean auditSuccess = false;
-    private final boolean granting;
-
-    //~ Constructors ===================================================================================================
-
-    public AccessControlEntryImpl(Serializable id, Acl acl, Sid sid, Permission permission, boolean granting,
-        boolean auditSuccess, boolean auditFailure) {
-        Assert.notNull(acl, "Acl required");
-        Assert.notNull(sid, "Sid required");
-        Assert.notNull(permission, "Permission required");
-        this.id = id;
-        this.acl = acl; // can be null
-        this.sid = sid;
-        this.permission = permission;
-        this.granting = granting;
-        this.auditSuccess = auditSuccess;
-        this.auditFailure = auditFailure;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public boolean equals(Object arg0) {
-        if (!(arg0 instanceof AccessControlEntryImpl)) {
-            return false;
-        }
-
-        AccessControlEntryImpl rhs = (AccessControlEntryImpl) arg0;
-
-        if (this.acl == null) {
-            if (rhs.getAcl() != null) {
-                return false;
-            }
-            // Both this.acl and rhs.acl are null and thus equal
-        } else {
-            // this.acl is non-null
-            if (rhs.getAcl() == null) {
-                return false;
-            }
-
-            // Both this.acl and rhs.acl are non-null, so do a comparison
-            if (this.acl.getObjectIdentity() == null) {
-                if (rhs.acl.getObjectIdentity() != null) {
-                    return false;
-                }
-                // Both this.acl and rhs.acl are null and thus equal
-            } else {
-                // Both this.acl.objectIdentity and rhs.acl.objectIdentity are non-null
-                if (!this.acl.getObjectIdentity().equals(rhs.getAcl().getObjectIdentity())) {
-                    return false;
-                }
-            }
-        }
-
-        if (this.id == null) {
-            if (rhs.id != null) {
-                return false;
-            }
-            // Both this.id and rhs.id are null and thus equal
-        } else {
-            // this.id is non-null
-            if (rhs.id == null) {
-                return false;
-            }
-
-            // Both this.id and rhs.id are non-null
-            if (!this.id.equals(rhs.id)) {
-                return false;
-            }
-        }
-
-        if ((this.auditFailure != rhs.isAuditFailure()) || (this.auditSuccess != rhs.isAuditSuccess())
-            || (this.granting != rhs.isGranting())
-            || !this.permission.equals(rhs.getPermission()) || !this.sid.equals(rhs.getSid())) {
-            return false;
-        }
-
-        return true;
-    }
-
-    public Acl getAcl() {
-        return acl;
-    }
-
-    public Serializable getId() {
-        return id;
-    }
-
-    public Permission getPermission() {
-        return permission;
-    }
-
-    public Sid getSid() {
-        return sid;
-    }
-
-    public boolean isAuditFailure() {
-        return auditFailure;
-    }
-
-    public boolean isAuditSuccess() {
-        return auditSuccess;
-    }
-
-    public boolean isGranting() {
-        return granting;
-    }
-
-    void setAuditFailure(boolean auditFailure) {
-        this.auditFailure = auditFailure;
-    }
-
-    void setAuditSuccess(boolean auditSuccess) {
-        this.auditSuccess = auditSuccess;
-    }
-
-    void setPermission(Permission permission) {
-        Assert.notNull(permission, "Permission required");
-        this.permission = permission;
-    }
-
-    public String toString() {
-        StringBuilder sb = new StringBuilder();
-        sb.append("AccessControlEntryImpl[");
-        sb.append("id: ").append(this.id).append("; ");
-        sb.append("granting: ").append(this.granting).append("; ");
-        sb.append("sid: ").append(this.sid).append("; ");
-        sb.append("permission: ").append(this.permission).append("; ");
-        sb.append("auditSuccess: ").append(this.auditSuccess).append("; ");
-        sb.append("auditFailure: ").append(this.auditFailure);
-        sb.append("]");
-
-        return sb.toString();
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategy.java

@@ -1,37 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Acl;
-
-
-/**
- * Strategy used by {@link AclImpl} to determine whether a principal is permitted to call
- * adminstrative methods on the <code>AclImpl</code>.
- *
- * @author Ben Alex
- */
-public interface AclAuthorizationStrategy {
-    //~ Static fields/initializers =====================================================================================
-
-    int CHANGE_OWNERSHIP = 0;
-    int CHANGE_AUDITING = 1;
-    int CHANGE_GENERAL = 2;
-
-    //~ Methods ========================================================================================================
-
-    void securityCheck(Acl acl, int changeType);
-}

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java

@@ -1,126 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import java.util.Arrays;
-import java.util.List;
-
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.util.Assert;
-
-
-/**
- * Default implementation of {@link AclAuthorizationStrategy}.
- * <p>
- * Permission will be granted provided the current principal is either the owner (as defined by the ACL), has
- * {@link BasePermission#ADMINISTRATION} (as defined by the ACL and via a {@link Sid} retrieved for the current
- * principal via {@link #sidRetrievalStrategy}), or if the current principal holds the relevant system-wide
- * {@link GrantedAuthority} and injected into the constructor.
- *
- * @author Ben Alex
- */
-public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
-    //~ Instance fields ================================================================================================
-
-    private final GrantedAuthority gaGeneralChanges;
-    private final GrantedAuthority gaModifyAuditing;
-    private final GrantedAuthority gaTakeOwnership;
-    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructor. The only mandatory parameter relates to the system-wide {@link GrantedAuthority} instances that
-     * can be held to always permit ACL changes.
-     *
-     * @param auths the <code>GrantedAuthority</code>s that have
-     * special permissions (index 0 is the authority needed to change
-     * ownership, index 1 is the authority needed to modify auditing details,
-     * index 2 is the authority needed to change other ACL and ACE details) (required)
-     * <p>
-     * Alternatively, a single value can be supplied for all three permissions.
-     */
-    public AclAuthorizationStrategyImpl(GrantedAuthority... auths) {
-        Assert.isTrue(auths != null && (auths.length == 3 || auths.length == 1),
-                "One or three GrantedAuthority instances required");
-        if (auths.length == 3) {
-            gaTakeOwnership = auths[0];
-            gaModifyAuditing = auths[1];
-            gaGeneralChanges = auths[2];
-        } else {
-            gaTakeOwnership = gaModifyAuditing = gaGeneralChanges = auths[0];
-        }
-    }
-
-    //~ Methods ========================================================================================================
-
-    public void securityCheck(Acl acl, int changeType) {
-        if ((SecurityContextHolder.getContext() == null)
-            || (SecurityContextHolder.getContext().getAuthentication() == null)
-            || !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) {
-            throw new AccessDeniedException("Authenticated principal required to operate with ACLs");
-        }
-
-        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-
-        // Check if authorized by virtue of ACL ownership
-        Sid currentUser = new PrincipalSid(authentication);
-
-        if (currentUser.equals(acl.getOwner())
-                && ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
-            return;
-        }
-
-        // Not authorized by ACL ownership; try via adminstrative permissions
-        GrantedAuthority requiredAuthority;
-
-        if (changeType == CHANGE_AUDITING) {
-            requiredAuthority = this.gaModifyAuditing;
-        } else if (changeType == CHANGE_GENERAL) {
-            requiredAuthority = this.gaGeneralChanges;
-        } else if (changeType == CHANGE_OWNERSHIP) {
-            requiredAuthority = this.gaTakeOwnership;
-        } else {
-            throw new IllegalArgumentException("Unknown change type");
-        }
-
-        // Iterate this principal's authorities to determine right
-        if (authentication.getAuthorities().contains(requiredAuthority)) {
-            return;
-        }
-
-        // Try to get permission via ACEs within the ACL
-        List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-        if (acl.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), sids, false)) {
-            return;
-        }
-
-        throw new AccessDeniedException(
-                "Principal does not have required ACL permissions to perform requested operation");
-    }
-
-    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-        this.sidRetrievalStrategy = sidRetrievalStrategy;
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/AclFormattingUtils.java

@@ -1,107 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-import org.springframework.util.Assert;
-
-
-/**
- * Utility methods for displaying ACL information.
- *
- * @author Ben Alex
- */
-public abstract class AclFormattingUtils {
-
-    public static String demergePatterns(String original, String removeBits) {
-        Assert.notNull(original, "Original string required");
-        Assert.notNull(removeBits, "Bits To Remove string required");
-        Assert.isTrue(original.length() == removeBits.length(),
-            "Original and Bits To Remove strings must be identical length");
-
-        char[] replacement = new char[original.length()];
-
-        for (int i = 0; i < original.length(); i++) {
-            if (removeBits.charAt(i) == Permission.RESERVED_OFF) {
-                replacement[i] = original.charAt(i);
-            } else {
-                replacement[i] = Permission.RESERVED_OFF;
-            }
-        }
-
-        return new String(replacement);
-    }
-
-    public static String mergePatterns(String original, String extraBits) {
-        Assert.notNull(original, "Original string required");
-        Assert.notNull(extraBits, "Extra Bits string required");
-        Assert.isTrue(original.length() == extraBits.length(),
-            "Original and Extra Bits strings must be identical length");
-
-        char[] replacement = new char[extraBits.length()];
-
-        for (int i = 0; i < extraBits.length(); i++) {
-            if (extraBits.charAt(i) == Permission.RESERVED_OFF) {
-                replacement[i] = original.charAt(i);
-            } else {
-                replacement[i] = extraBits.charAt(i);
-            }
-        }
-
-        return new String(replacement);
-    }
-
-    /**
-     * Returns a representation of the active bits in the presented mask, with each active bit being denoted by
-     * character '*'.
-     * <p>
-     * Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.
-     *
-     * @param i the integer bit mask to print the active bits for
-     *
-     * @return a 32-character representation of the bit mask
-     */
-    public static String printBinary(int i) {
-        return printBinary(i, '*', Permission.RESERVED_OFF);
-    }
-
-    /**
-     * Returns a representation of the active bits in the presented mask, with each active bit being denoted by
-     * the passed character.
-     * <p>
-     * Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.
-     *
-     * @param mask the integer bit mask to print the active bits for
-     * @param code the character to print when an active bit is detected
-     *
-     * @return a 32-character representation of the bit mask
-     */
-    public static String printBinary(int mask, char code) {
-        Assert.doesNotContain(Character.toString(code), Character.toString(Permission.RESERVED_ON),
-            Permission.RESERVED_ON + " is a reserved character code");
-        Assert.doesNotContain(Character.toString(code), Character.toString(Permission.RESERVED_OFF),
-            Permission.RESERVED_OFF + " is a reserved character code");
-
-        return printBinary(mask, Permission.RESERVED_ON, Permission.RESERVED_OFF).replace(Permission.RESERVED_ON, code);
-    }
-
-    private static String printBinary(int i, char on, char off) {
-        String s = Integer.toString(i, 2);
-        String pattern = Permission.THIRTY_TWO_RESERVED_OFF;
-        String temp2 = pattern.substring(0, pattern.length() - s.length()) + s;
-
-        return temp2.replace('0', off).replace('1', on);
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -1,337 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.List;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAcl;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.OwnershipAcl;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.UnloadedSidException;
-import org.springframework.util.Assert;
-
-
-/**
- * Base implementation of <code>Acl</code>.
- *
- * @author Ben Alex
- */
-public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
-    //~ Instance fields ================================================================================================
-
-    private Acl parentAcl;
-    private transient AclAuthorizationStrategy aclAuthorizationStrategy;
-    private transient PermissionGrantingStrategy permissionGrantingStrategy;
-    private final List<AccessControlEntry> aces = new ArrayList<AccessControlEntry>();
-    private ObjectIdentity objectIdentity;
-    private Serializable id;
-    private Sid owner; // OwnershipAcl
-    private List<Sid> loadedSids = null; // includes all SIDs the WHERE clause covered, even if there was no ACE for a SID
-    private boolean entriesInheriting = true;
-
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Minimal constructor, which should be used {@link
-     * org.springframework.security.acls.model.MutableAclService#createAcl(ObjectIdentity)}.
-     *
-     * @param objectIdentity the object identity this ACL relates to (required)
-     * @param id the primary key assigned to this ACL (required)
-     * @param aclAuthorizationStrategy authorization strategy (required)
-     * @param auditLogger audit logger (required)
-     */
-    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
-                    AuditLogger auditLogger) {
-        Assert.notNull(objectIdentity, "Object Identity required");
-        Assert.notNull(id, "Id required");
-        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-        Assert.notNull(auditLogger, "AuditLogger required");
-        this.objectIdentity = objectIdentity;
-        this.id = id;
-        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-        this.permissionGrantingStrategy = new DefaultPermissionGrantingStrategy(auditLogger);
-    }
-
-    /**
-     * @deprecated Use the version which takes a  {@code PermissionGrantingStrategy} argument instead.
-     */
-    @Deprecated
-    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
-                    AuditLogger auditLogger, Acl parentAcl, List<Sid> loadedSids, boolean entriesInheriting, Sid owner) {
-        this(objectIdentity, id, aclAuthorizationStrategy, new DefaultPermissionGrantingStrategy(auditLogger),
-                parentAcl, loadedSids, entriesInheriting, owner);
-    }
-
-    /**
-     * Full constructor, which should be used by persistence tools that do not
-     * provide field-level access features.
-     *
-     * @param objectIdentity the object identity this ACL relates to
-     * @param id the primary key assigned to this ACL
-     * @param aclAuthorizationStrategy authorization strategy
-     * @param grantingStrategy the {@code PermissionGrantingStrategy} which will be used by the {@code isGranted()} method
-     * @param parentAcl the parent (may be may be {@code null})
-     * @param loadedSids the loaded SIDs if only a subset were loaded (may be {@code null})
-     * @param entriesInheriting if ACEs from the parent should inherit into
-     *        this ACL
-     * @param owner the owner (required)
-     */
-    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
-            PermissionGrantingStrategy grantingStrategy, Acl parentAcl, List<Sid> loadedSids, boolean entriesInheriting, Sid owner) {
-        Assert.notNull(objectIdentity, "Object Identity required");
-        Assert.notNull(id, "Id required");
-        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-        Assert.notNull(owner, "Owner required");
-
-        this.objectIdentity = objectIdentity;
-        this.id = id;
-        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-        this.parentAcl = parentAcl; // may be null
-        this.loadedSids = loadedSids; // may be null
-        this.entriesInheriting = entriesInheriting;
-        this.owner = owner;
-        this.permissionGrantingStrategy = grantingStrategy;
-    }
-
-    /**
-     * Private no-argument constructor for use by reflection-based persistence
-     * tools along with field-level access.
-     */
-    @SuppressWarnings("unused")
-    private AclImpl() {}
-
-    //~ Methods ========================================================================================================
-
-    public void deleteAce(int aceIndex) throws NotFoundException {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-        verifyAceIndexExists(aceIndex);
-
-        synchronized (aces) {
-            this.aces.remove(aceIndex);
-        }
-    }
-
-    private void verifyAceIndexExists(int aceIndex) {
-        if (aceIndex < 0) {
-            throw new NotFoundException("aceIndex must be greater than or equal to zero");
-        }
-        if (aceIndex >= this.aces.size()) {
-            throw new NotFoundException("aceIndex must refer to an index of the AccessControlEntry list. " +
-                    "List size is " + aces.size() + ", index was " + aceIndex);
-        }
-    }
-
-    public void insertAce(int atIndexLocation, Permission permission, Sid sid, boolean granting) throws NotFoundException {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-        Assert.notNull(permission, "Permission required");
-        Assert.notNull(sid, "Sid required");
-        if (atIndexLocation < 0) {
-            throw new NotFoundException("atIndexLocation must be greater than or equal to zero");
-        }
-        if (atIndexLocation > this.aces.size()) {
-            throw new NotFoundException("atIndexLocation must be less than or equal to the size of the AccessControlEntry collection");
-        }
-
-        AccessControlEntryImpl ace = new AccessControlEntryImpl(null, this, sid, permission, granting, false, false);
-
-        synchronized (aces) {
-            this.aces.add(atIndexLocation, ace);
-        }
-    }
-
-    public List<AccessControlEntry> getEntries() {
-        // Can safely return AccessControlEntry directly, as they're immutable outside the ACL package
-        return new ArrayList<AccessControlEntry>(aces);
-    }
-
-    public Serializable getId() {
-        return this.id;
-    }
-
-    public ObjectIdentity getObjectIdentity() {
-        return objectIdentity;
-    }
-
-    public boolean isEntriesInheriting() {
-        return entriesInheriting;
-    }
-
-    /**
-     * Delegates to the {@link PermissionGrantingStrategy}.
-     *
-     * @throws UnloadedSidException if the passed SIDs are unknown to this ACL because the ACL was only loaded for a
-     *         subset of SIDs
-     * @see DefaultPermissionGrantingStrategy
-     */
-    public boolean isGranted(List<Permission> permission, List<Sid> sids, boolean administrativeMode)
-            throws NotFoundException, UnloadedSidException {
-        Assert.notEmpty(permission, "Permissions required");
-        Assert.notEmpty(sids, "SIDs required");
-
-        if (!this.isSidLoaded(sids)) {
-            throw new UnloadedSidException("ACL was not loaded for one or more SID");
-        }
-
-        return permissionGrantingStrategy.isGranted(this, permission, sids, administrativeMode);
-    }
-
-    public boolean isSidLoaded(List<Sid> sids) {
-        // If loadedSides is null, this indicates all SIDs were loaded
-        // Also return true if the caller didn't specify a SID to find
-        if ((this.loadedSids == null) || (sids == null) || (sids.size() == 0)) {
-            return true;
-        }
-
-        // This ACL applies to a SID subset only. Iterate to check it applies.
-        for (Sid sid: sids) {
-            boolean found = false;
-
-            for (Sid loadedSid : loadedSids) {
-                if (sid.equals(loadedSid)) {
-                    // this SID is OK
-                    found = true;
-
-                    break; // out of loadedSids for loop
-                }
-            }
-
-            if (!found) {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
-    public void setEntriesInheriting(boolean entriesInheriting) {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-        this.entriesInheriting = entriesInheriting;
-    }
-
-    public void setOwner(Sid newOwner) {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-        Assert.notNull(newOwner, "Owner required");
-        this.owner = newOwner;
-    }
-
-    public Sid getOwner() {
-        return this.owner;
-    }
-
-    public void setParent(Acl newParent) {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-        Assert.isTrue(newParent == null || !newParent.equals(this), "Cannot be the parent of yourself");
-        this.parentAcl = newParent;
-    }
-
-    public Acl getParentAcl() {
-        return parentAcl;
-    }
-
-    public void updateAce(int aceIndex, Permission permission)
-        throws NotFoundException {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-        verifyAceIndexExists(aceIndex);
-
-        synchronized (aces) {
-            AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
-            ace.setPermission(permission);
-        }
-    }
-
-    public void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure) {
-        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_AUDITING);
-        verifyAceIndexExists(aceIndex);
-
-        synchronized (aces) {
-            AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
-            ace.setAuditSuccess(auditSuccess);
-            ace.setAuditFailure(auditFailure);
-        }
-    }
-
-    public boolean equals(Object obj) {
-        if (obj instanceof AclImpl) {
-            AclImpl rhs = (AclImpl) obj;
-            if (this.aces.equals(rhs.aces)) {
-                if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl !=null && this.parentAcl.equals(rhs.parentAcl))) {
-                    if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity != null && this.objectIdentity.equals(rhs.objectIdentity))) {
-                        if ((this.id == null && rhs.id == null) || (this.id != null && this.id.equals(rhs.id))) {
-                            if ((this.owner == null && rhs.owner == null) || (this.owner != null && this.owner.equals(rhs.owner))) {
-                                if (this.entriesInheriting == rhs.entriesInheriting) {
-                                    if ((this.loadedSids == null && rhs.loadedSids == null)) {
-                                        return true;
-                                    }
-                                    if (this.loadedSids != null && (this.loadedSids.size() == rhs.loadedSids.size())) {
-                                        for (int i = 0; i < this.loadedSids.size(); i++) {
-                                            if (!this.loadedSids.get(i).equals(rhs.loadedSids.get(i))) {
-                                                return false;
-                                            }
-                                        }
-                                        return true;
-                                    }
-                                }
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return false;
-    }
-
-    public String toString() {
-        StringBuilder sb = new StringBuilder();
-        sb.append("AclImpl[");
-        sb.append("id: ").append(this.id).append("; ");
-        sb.append("objectIdentity: ").append(this.objectIdentity).append("; ");
-        sb.append("owner: ").append(this.owner).append("; ");
-
-        int count = 0;
-
-        for (AccessControlEntry ace : aces) {
-            count++;
-
-            if (count == 1) {
-                sb.append("\n");
-            }
-
-            sb.append(ace).append("\n");
-        }
-
-        if (count == 0) {
-            sb.append("no ACEs; ");
-        }
-
-        sb.append("inheriting: ").append(this.entriesInheriting).append("; ");
-        sb.append("parent: ").append((this.parentAcl == null) ? "Null" : this.parentAcl.getObjectIdentity().toString());
-        sb.append("; ");
-        sb.append("aclAuthorizationStrategy: ").append(this.aclAuthorizationStrategy).append("; ");
-        sb.append("permissionGrantingStrategy: ").append(this.permissionGrantingStrategy);
-        sb.append("]");
-
-        return sb.toString();
-    }
-
-}

acl/src/main/java/org/springframework/security/acls/domain/AuditLogger.java

@@ -1,30 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-
-
-/**
- * Used by <code>AclImpl</code> to log audit events.
- *
- * @author Ben Alex
- *
- */
-public interface AuditLogger {
-    //~ Methods ========================================================================================================
-
-    void logIfNeeded(boolean granted, AccessControlEntry ace);
-}

acl/src/main/java/org/springframework/security/acls/domain/BasePermission.java

@@ -1,44 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-
-
-/**
- * A set of standard permissions.
- *
- * <p>
- * You may subclass this class to add additional permissions, or use this class as a guide
- * for creating your own permission classes.
- * </p>
- *
- * @author Ben Alex
- */
-public class BasePermission extends AbstractPermission {
-    public static final Permission READ = new BasePermission(1 << 0, 'R'); // 1
-    public static final Permission WRITE = new BasePermission(1 << 1, 'W'); // 2
-    public static final Permission CREATE = new BasePermission(1 << 2, 'C'); // 4
-    public static final Permission DELETE = new BasePermission(1 << 3, 'D'); // 8
-    public static final Permission ADMINISTRATION = new BasePermission(1 << 4, 'A'); // 16
-
-    protected BasePermission(int mask) {
-       super(mask);
-    }
-
-    protected BasePermission(int mask, char code) {
-        super(mask, code);
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/ConsoleAuditLogger.java

@@ -1,44 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-
-import org.springframework.util.Assert;
-
-
-/**
- * A basic implementation of {@link AuditLogger}.
- *
- * @author Ben Alex
- */
-public class ConsoleAuditLogger implements AuditLogger {
-    //~ Methods ========================================================================================================
-
-    public void logIfNeeded(boolean granted, AccessControlEntry ace) {
-        Assert.notNull(ace, "AccessControlEntry required");
-
-        if (ace instanceof AuditableAccessControlEntry) {
-            AuditableAccessControlEntry auditableAce = (AuditableAccessControlEntry) ace;
-
-            if (granted && auditableAce.isAuditSuccess()) {
-                System.out.println("GRANTED due to ACE: " + ace);
-            } else if (!granted && auditableAce.isAuditFailure()) {
-                System.out.println("DENIED due to ACE: " + ace);
-            }
-        }
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/CumulativePermission.java

@@ -1,60 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-
-
-/**
- * Represents a <code>Permission</code> that is constructed at runtime from other permissions.
- *
- * <p>Methods return <code>this</code>, in order to facilitate method chaining.</p>
- *
- * @author Ben Alex
- */
-public class CumulativePermission extends AbstractPermission {
-
-    private String pattern = THIRTY_TWO_RESERVED_OFF;
-
-    public CumulativePermission() {
-        super(0, ' ');
-    }
-
-    public CumulativePermission clear(Permission permission) {
-        this.mask &= ~permission.getMask();
-        this.pattern = AclFormattingUtils.demergePatterns(this.pattern, permission.getPattern());
-
-        return this;
-    }
-
-    public CumulativePermission clear() {
-        this.mask = 0;
-        this.pattern = THIRTY_TWO_RESERVED_OFF;
-
-        return this;
-    }
-
-    public CumulativePermission set(Permission permission) {
-        this.mask |= permission.getMask();
-        this.pattern = AclFormattingUtils.mergePatterns(this.pattern, permission.getPattern());
-
-        return this;
-    }
-
-    public String getPattern() {
-        return this.pattern;
-    }
-
-}

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionFactory.java

@@ -1,147 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import org.springframework.security.acls.model.Permission;
-import org.springframework.util.Assert;
-
-/**
- * Default implementation of {@link PermissionFactory}.
- * <p>
- * Used as a strategy by classes which wish to map integer masks and permission names to <tt>Permission</tt>
- * instances for use with the ACL implementation.
- * <p>
- * Maintains a registry of permission names and masks to <tt>Permission</tt> instances.
- *
- * @author Ben Alex
- * @author Luke Taylor
- * @since 2.0.3
- */
-public class DefaultPermissionFactory implements PermissionFactory {
-    private final Map<Integer, Permission> registeredPermissionsByInteger = new HashMap<Integer, Permission>();
-    private final Map<String, Permission> registeredPermissionsByName = new HashMap<String, Permission>();
-
-    /**
-     * Registers the <tt>Permission</tt> fields from the <tt>BasePermission</tt> class.
-     */
-    public DefaultPermissionFactory() {
-        registerPublicPermissions(BasePermission.class);
-    }
-
-    /**
-     * Registers the <tt>Permission</tt> fields from the supplied class.
-     */
-    public DefaultPermissionFactory(Class<? extends Permission> permissionClass) {
-        registerPublicPermissions(permissionClass);
-    }
-
-    /**
-     * Registers a map of named <tt>Permission</tt> instances.
-     *
-     * @param namedPermissions the map of <tt>Permission</tt>s, keyed by name.
-     */
-    public DefaultPermissionFactory(Map<String, ? extends Permission> namedPermissions) {
-        for (String name : namedPermissions.keySet()) {
-            registerPermission(namedPermissions.get(name), name);
-        }
-    }
-
-    /**
-     * Registers the public static fields of type {@link Permission} for a give class.
-     * <p>
-     * These permissions will be registered under the name of the field. See {@link BasePermission}
-     * for an example.
-     *
-     * @param clazz a {@link Permission} class with public static fields to register
-     */
-    protected void registerPublicPermissions(Class<? extends Permission> clazz) {
-        Assert.notNull(clazz, "Class required");
-
-        Field[] fields = clazz.getFields();
-
-        for (Field field : fields) {
-            try {
-                Object fieldValue = field.get(null);
-
-                if (Permission.class.isAssignableFrom(fieldValue.getClass())) {
-                    // Found a Permission static field
-                    Permission perm = (Permission) fieldValue;
-                    String permissionName = field.getName();
-
-                    registerPermission(perm, permissionName);
-                }
-            } catch (Exception ignore) {
-            }
-        }
-    }
-
-    protected void registerPermission(Permission perm, String permissionName) {
-        Assert.notNull(perm, "Permission required");
-        Assert.hasText(permissionName, "Permission name required");
-
-        Integer mask = Integer.valueOf(perm.getMask());
-
-        // Ensure no existing Permission uses this integer or code
-        Assert.isTrue(!registeredPermissionsByInteger.containsKey(mask), "An existing Permission already provides mask " + mask);
-        Assert.isTrue(!registeredPermissionsByName.containsKey(permissionName), "An existing Permission already provides name '" + permissionName + "'");
-
-        // Register the new Permission
-        registeredPermissionsByInteger.put(mask, perm);
-        registeredPermissionsByName.put(permissionName, perm);
-    }
-
-    public Permission buildFromMask(int mask) {
-        if (registeredPermissionsByInteger.containsKey(Integer.valueOf(mask))) {
-            // The requested mask has an exact match against a statically-defined Permission, so return it
-            return registeredPermissionsByInteger.get(Integer.valueOf(mask));
-        }
-
-        // To get this far, we have to use a CumulativePermission
-        CumulativePermission permission = new CumulativePermission();
-
-        for (int i = 0; i < 32; i++) {
-            int permissionToCheck = 1 << i;
-
-            if ((mask & permissionToCheck) == permissionToCheck) {
-                Permission p = registeredPermissionsByInteger.get(Integer.valueOf(permissionToCheck));
-
-                if (p == null) {
-                    throw new IllegalStateException("Mask '" + permissionToCheck + "' does not have a corresponding static Permission");
-                }
-                permission.set(p);
-            }
-        }
-
-        return permission;
-    }
-
-    public Permission buildFromName(String name) {
-        Permission p = registeredPermissionsByName.get(name);
-
-        if (p == null) {
-            throw new IllegalArgumentException("Unknown permission '" + name + "'");
-        }
-
-        return p;
-    }
-
-    public List<Permission> buildFromNames(List<String> names) {
-        if ((names == null) || (names.size() == 0)) {
-            return Collections.emptyList();
-        }
-
-        List<Permission> permissions = new ArrayList<Permission>(names.size());
-
-        for (String name : names) {
-            permissions.add(buildFromName(name));
-        }
-
-        return permissions;
-    }
-
-}

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionGrantingStrategy.java

@@ -1,119 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import java.util.List;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.util.Assert;
-
-public class DefaultPermissionGrantingStrategy implements PermissionGrantingStrategy {
-
-    private final transient AuditLogger auditLogger;
-
-    /**
-     * Creates an instance with the logger which will be used to record granting and denial of requested permissions.
-     */
-    public DefaultPermissionGrantingStrategy(AuditLogger auditLogger) {
-        Assert.notNull(auditLogger, "auditLogger cannot be null");
-        this.auditLogger = auditLogger;
-    }
-
-    /**
-     * Determines authorization. The order of the <code>permission</code> and <code>sid</code> arguments is
-     * <em>extremely important</em>! The method will iterate through each of the <code>permission</code>s in the order
-     * specified. For each iteration, all of the <code>sid</code>s will be considered, again in the order they are
-     * presented. A search will then be performed for the first {@link AccessControlEntry} object that directly
-     * matches that <code>permission:sid</code> combination. When the <em>first full match</em> is found (ie an ACE
-     * that has the SID currently being searched for and the exact permission bit mask being search for), the grant or
-     * deny flag for that ACE will prevail. If the ACE specifies to grant access, the method will return
-     * <code>true</code>. If the ACE specifies to deny access, the loop will stop and the next <code>permission</code>
-     * iteration will be performed. If each permission indicates to deny access, the first deny ACE found will be
-     * considered the reason for the failure (as it was the first match found, and is therefore the one most logically
-     * requiring changes - although not always). If absolutely no matching ACE was found at all for any permission,
-     * the parent ACL will be tried (provided that there is a parent and {@link Acl#isEntriesInheriting()} is
-     * <code>true</code>. The parent ACL will also scan its parent and so on. If ultimately no matching ACE is found,
-     * a <code>NotFoundException</code> will be thrown and the caller will need to decide how to handle the permission
-     * check. Similarly, if any of the SID arguments presented to the method were not loaded by the ACL,
-     * <code>UnloadedSidException</code> will be thrown.
-     *
-     * @param permission the exact permissions to scan for (order is important)
-     * @param sids the exact SIDs to scan for (order is important)
-     * @param administrativeMode if <code>true</code> denotes the query is for administrative purposes and no auditing
-     *        will be undertaken
-     *
-     * @return <code>true</code> if one of the permissions has been granted, <code>false</code> if one of the
-     *         permissions has been specifically revoked
-     *
-     * @throws NotFoundException if an exact ACE for one of the permission bit masks and SID combination could not be
-     *         found
-     */
-    public boolean isGranted(Acl acl, List<Permission> permission, List<Sid> sids, boolean administrativeMode)
-            throws NotFoundException {
-
-        final List<AccessControlEntry> aces = acl.getEntries();
-
-        AccessControlEntry firstRejection = null;
-
-        for (Permission p : permission) {
-            for (Sid sid: sids) {
-                // Attempt to find exact match for this permission mask and SID
-                boolean scanNextSid = true;
-
-                for (AccessControlEntry ace : aces ) {
-
-                    if ((ace.getPermission().getMask() == p.getMask()) && ace.getSid().equals(sid)) {
-                        // Found a matching ACE, so its authorization decision will prevail
-                        if (ace.isGranting()) {
-                            // Success
-                            if (!administrativeMode) {
-                                auditLogger.logIfNeeded(true, ace);
-                            }
-
-                            return true;
-                        }
-
-                        // Failure for this permission, so stop search
-                        // We will see if they have a different permission
-                        // (this permission is 100% rejected for this SID)
-                        if (firstRejection == null) {
-                            // Store first rejection for auditing reasons
-                            firstRejection = ace;
-                        }
-
-                        scanNextSid = false; // helps break the loop
-
-                        break; // exit aces loop
-                    }
-                }
-
-                if (!scanNextSid) {
-                    break; // exit SID for loop (now try next permission)
-                }
-            }
-        }
-
-        if (firstRejection != null) {
-            // We found an ACE to reject the request at this point, as no
-            // other ACEs were found that granted a different permission
-            if (!administrativeMode) {
-                auditLogger.logIfNeeded(false, firstRejection);
-            }
-
-            return false;
-        }
-
-        // No matches have been found so far
-        if (acl.isEntriesInheriting() && (acl.getParentAcl() != null)) {
-            // We have a parent, so let them try to find a matching ACE
-            return acl.getParentAcl().isGranted(permission, sids, false);
-        } else {
-            // We either have no parent, or we're the uppermost parent
-            throw new NotFoundException("Unable to locate a matching ACE for passed permissions and SIDs");
-        }
-    }
-
-}

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -1,159 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-
-import net.sf.ehcache.CacheException;
-import net.sf.ehcache.Ehcache;
-import net.sf.ehcache.Element;
-
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.util.FieldUtils;
-import org.springframework.util.Assert;
-
-
-/**
- * Simple implementation of {@link AclCache} that delegates to EH-CACHE.
- * <p>
- * Designed to handle the transient fields in {@link AclImpl}. Note that this implementation assumes all
- * {@link AclImpl} instances share the same {@link PermissionGrantingStrategy} and {@link AclAuthorizationStrategy}
- * instances.
- *
- * @author Ben Alex
- */
-public class EhCacheBasedAclCache implements AclCache {
-    //~ Instance fields ================================================================================================
-
-    private final Ehcache cache;
-    private PermissionGrantingStrategy permissionGrantingStrategy;
-    private AclAuthorizationStrategy aclAuthorizationStrategy;
-
-    //~ Constructors ===================================================================================================
-
-    /**
-     * @deprecated use the second constructor which injects the strategy objects. See SEC-1498.
-     */
-    @Deprecated
-    public EhCacheBasedAclCache(Ehcache cache) {
-        Assert.notNull(cache, "Cache required");
-        this.cache = cache;
-    }
-
-    public EhCacheBasedAclCache(Ehcache cache, PermissionGrantingStrategy permissionGrantingStrategy,
-            AclAuthorizationStrategy aclAuthorizationStrategy) {
-        Assert.notNull(cache, "Cache required");
-        Assert.notNull(permissionGrantingStrategy, "PermissionGrantingStrategy required");
-        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-        this.cache = cache;
-        this.permissionGrantingStrategy = permissionGrantingStrategy;
-        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public void evictFromCache(Serializable pk) {
-        Assert.notNull(pk, "Primary key (identifier) required");
-
-        MutableAcl acl = getFromCache(pk);
-
-        if (acl != null) {
-            cache.remove(acl.getId());
-            cache.remove(acl.getObjectIdentity());
-        }
-    }
-
-    public void evictFromCache(ObjectIdentity objectIdentity) {
-        Assert.notNull(objectIdentity, "ObjectIdentity required");
-
-        MutableAcl acl = getFromCache(objectIdentity);
-
-        if (acl != null) {
-            cache.remove(acl.getId());
-            cache.remove(acl.getObjectIdentity());
-        }
-    }
-
-    public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
-        Assert.notNull(objectIdentity, "ObjectIdentity required");
-
-        Element element = null;
-
-        try {
-            element = cache.get(objectIdentity);
-        } catch (CacheException ignored) {}
-
-        if (element == null) {
-            return null;
-        }
-
-        return initializeTransientFields((MutableAcl)element.getValue());
-    }
-
-    public MutableAcl getFromCache(Serializable pk) {
-        Assert.notNull(pk, "Primary key (identifier) required");
-
-        Element element = null;
-
-        try {
-            element = cache.get(pk);
-        } catch (CacheException ignored) {}
-
-        if (element == null) {
-            return null;
-        }
-
-        return initializeTransientFields((MutableAcl) element.getValue());
-    }
-
-    public void putInCache(MutableAcl acl) {
-        Assert.notNull(acl, "Acl required");
-        Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
-        Assert.notNull(acl.getId(), "ID required");
-
-        if (this.aclAuthorizationStrategy == null) {
-            if (acl instanceof AclImpl) {
-                this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils.getProtectedFieldValue("aclAuthorizationStrategy", acl);
-                this.permissionGrantingStrategy = (PermissionGrantingStrategy) FieldUtils.getProtectedFieldValue("permissionGrantingStrategy", acl);
-            }
-        }
-
-        if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
-            putInCache((MutableAcl) acl.getParentAcl());
-        }
-
-        cache.put(new Element(acl.getObjectIdentity(), acl));
-        cache.put(new Element(acl.getId(), acl));
-    }
-
-    private MutableAcl initializeTransientFields(MutableAcl value) {
-        if (value instanceof AclImpl) {
-            FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value, this.aclAuthorizationStrategy);
-            FieldUtils.setProtectedFieldValue("permissionGrantingStrategy", value, this.permissionGrantingStrategy);
-        }
-
-        if (value.getParentAcl() != null) {
-            initializeTransientFields((MutableAcl) value.getParentAcl());
-        }
-        return value;
-    }
-
-    public void clearCache() {
-        cache.removeAll();
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/GrantedAuthoritySid.java

@@ -1,71 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.GrantedAuthority;
-
-import org.springframework.util.Assert;
-
-
-/**
- * Represents a <code>GrantedAuthority</code> as a <code>Sid</code>.<p>This is a basic implementation that simply
- * uses the <code>String</code>-based principal for <code>Sid</code> comparison. More complex principal objects may
- * wish to provide an alternative <code>Sid</code> implementation that uses some other identifier.</p>
- *
- * @author Ben Alex
- */
-public class GrantedAuthoritySid implements Sid {
-    //~ Instance fields ================================================================================================
-
-    private final String grantedAuthority;
-
-    //~ Constructors ===================================================================================================
-
-    public GrantedAuthoritySid(String grantedAuthority) {
-        Assert.hasText(grantedAuthority, "GrantedAuthority required");
-        this.grantedAuthority = grantedAuthority;
-    }
-
-    public GrantedAuthoritySid(GrantedAuthority grantedAuthority) {
-        Assert.notNull(grantedAuthority, "GrantedAuthority required");
-        Assert.notNull(grantedAuthority.getAuthority(),
-            "This Sid is only compatible with GrantedAuthoritys that provide a non-null getAuthority()");
-        this.grantedAuthority = grantedAuthority.getAuthority();
-    }
-
-    //~ Methods ========================================================================================================
-
-    public boolean equals(Object object) {
-        if ((object == null) || !(object instanceof GrantedAuthoritySid)) {
-            return false;
-        }
-
-        // Delegate to getGrantedAuthority() to perform actual comparison (both should be identical)
-        return ((GrantedAuthoritySid) object).getGrantedAuthority().equals(this.getGrantedAuthority());
-    }
-
-    public int hashCode() {
-        return this.getGrantedAuthority().hashCode();
-    }
-
-    public String getGrantedAuthority() {
-        return grantedAuthority;
-    }
-
-    public String toString() {
-        return "GrantedAuthoritySid[" + this.grantedAuthority + "]";
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/IdentityUnavailableException.java

@@ -1,44 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-/**
- * Thrown if an ACL identity could not be extracted from an object.
- *
- * @author Ben Alex
- */
-public class IdentityUnavailableException extends RuntimeException {
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructs an <code>IdentityUnavailableException</code> with the specified message.
-     *
-     * @param msg the detail message
-     */
-    public IdentityUnavailableException(String msg) {
-        super(msg);
-    }
-
-    /**
-     * Constructs an <code>IdentityUnavailableException</code> with the specified message
-     * and root cause.
-     *
-     * @param msg the detail message
-     * @param t root cause
-     */
-    public IdentityUnavailableException(String msg, Throwable t) {
-        super(msg, t);
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/ObjectIdentityImpl.java

@@ -1,157 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-import java.lang.reflect.Method;
-
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.util.Assert;
-import org.springframework.util.ClassUtils;
-
-
-/**
- * Simple implementation of {@link ObjectIdentity}.
- * <p>
- * Uses <code>String</code>s to store the identity of the domain object instance. Also offers a constructor that uses
- * reflection to build the identity information.
- *
- * @author Ben Alex
- */
-public class ObjectIdentityImpl implements ObjectIdentity {
-    //~ Instance fields ================================================================================================
-
-    private final String type;
-    private Serializable identifier;
-
-    //~ Constructors ===================================================================================================
-
-    public ObjectIdentityImpl(String type, Serializable identifier) {
-        Assert.hasText(type, "Type required");
-        Assert.notNull(identifier, "identifier required");
-
-        this.identifier = identifier;
-        this.type = type;
-    }
-
-    /**
-     * Constructor which uses the name of the supplied class as the <tt>type</tt> property.
-     */
-    public ObjectIdentityImpl(Class<?> javaType, Serializable identifier) {
-        Assert.notNull(javaType, "Java Type required");
-        Assert.notNull(identifier, "identifier required");
-        this.type = javaType.getName();
-        this.identifier = identifier;
-    }
-
-    /**
-     * Creates the <code>ObjectIdentityImpl</code> based on the passed
-     * object instance. The passed object must provide a <code>getId()</code>
-     * method, otherwise an exception will be thrown.
-     * <p>
-     * The class name of the object passed will be considered the {@link #type}, so if more control is required,
-     * a different constructor should be used.
-     *
-     * @param object the domain object instance to create an identity for.
-     *
-     * @throws IdentityUnavailableException if identity could not be extracted
-     */
-    public ObjectIdentityImpl(Object object) throws IdentityUnavailableException {
-        Assert.notNull(object, "object cannot be null");
-
-        Class<?> typeClass = ClassUtils.getUserClass(object.getClass());
-        type = typeClass.getName();
-
-        Object result;
-
-        try {
-            Method method = typeClass.getMethod("getId", new Class[] {});
-            result = method.invoke(object);
-        } catch (Exception e) {
-            throw new IdentityUnavailableException("Could not extract identity from object " + object, e);
-        }
-
-        Assert.notNull(result, "getId() is required to return a non-null value");
-        Assert.isInstanceOf(Serializable.class, result, "Getter must provide a return value of type Serializable");
-        this.identifier = (Serializable) result;
-    }
-
-    //~ Methods ========================================================================================================
-
-    /**
-     * Important so caching operates properly.
-     * <p>
-     * Considers an object of the same class equal if it has the same <code>classname</code> and
-     * <code>id</code> properties.
-     * <p>
-     * Numeric identities (Integer and Long values) are considered equal if they are numerically equal. Other
-     * serializable types are evaluated using a simple equality.
-     *
-     * @param arg0 object to compare
-     *
-     * @return <code>true</code> if the presented object matches this object
-     */
-    public boolean equals(Object arg0) {
-        if (arg0 == null || !(arg0 instanceof ObjectIdentityImpl)) {
-            return false;
-        }
-
-        ObjectIdentityImpl other = (ObjectIdentityImpl) arg0;
-
-        if (identifier instanceof Number && other.identifier instanceof Number) {
-            // Integers and Longs with same value should be considered equal
-            if (((Number)identifier).longValue() != ((Number)other.identifier).longValue()) {
-                return false;
-            }
-        } else {
-            // Use plain equality for other serializable types
-            if (!identifier.equals(other.identifier)) {
-                return false;
-            }
-        }
-
-        return type.equals(other.type);
-    }
-
-    public Serializable getIdentifier() {
-        return identifier;
-    }
-
-    public String getType() {
-        return type;
-    }
-
-    /**
-     * Important so caching operates properly.
-     *
-     * @return the hash
-     */
-    public int hashCode() {
-        int code = 31;
-        code ^= this.type.hashCode();
-        code ^= this.identifier.hashCode();
-
-        return code;
-    }
-
-    public String toString() {
-        StringBuilder sb = new StringBuilder();
-        sb.append(this.getClass().getName()).append("[");
-        sb.append("Type: ").append(this.type);
-        sb.append("; Identifier: ").append(this.identifier).append("]");
-
-        return sb.toString();
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/ObjectIdentityRetrievalStrategyImpl.java

@@ -1,40 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-
-/**
- * Basic implementation of {@link ObjectIdentityRetrievalStrategy} and <tt>ObjectIdentityGenerator</tt>
- * that uses the constructors of {@link ObjectIdentityImpl} to create the {@link ObjectIdentity}.
- *
- * @author Ben Alex
- */
-public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy, ObjectIdentityGenerator {
-    //~ Methods ========================================================================================================
-
-    public ObjectIdentity getObjectIdentity(Object domainObject) {
-        return new ObjectIdentityImpl(domainObject);
-    }
-
-    public ObjectIdentity createObjectIdentity(Serializable id, String type) {
-        return new ObjectIdentityImpl(type, id);
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/PermissionFactory.java

@@ -1,31 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import java.util.List;
-
-import org.springframework.security.acls.model.Permission;
-
-/**
- * Provides a simple mechanism to retrieve {@link Permission} instances from integer masks.
- *
- * @author Ben Alex
- * @since 2.0.3
- *
- */
-public interface PermissionFactory {
-
-    /**
-     * Dynamically creates a <code>CumulativePermission</code> or <code>BasePermission</code> representing the
-     * active bits in the passed mask.
-     *
-     * @param mask to build
-     *
-     * @return a Permission representing the requested object
-     */
-    Permission buildFromMask(int mask);
-
-
-    Permission buildFromName(String name);
-
-
-    List<Permission> buildFromNames(List<String> names);
-}

acl/src/main/java/org/springframework/security/acls/domain/PrincipalSid.java

@@ -1,77 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.userdetails.UserDetails;
-
-import org.springframework.util.Assert;
-
-
-/**
- * Represents an <code>Authentication.getPrincipal()</code> as a <code>Sid</code>.<p>This is a basic implementation
- * that simply uses the <code>String</code>-based principal for <code>Sid</code> comparison. More complex principal
- * objects may wish to provide an alternative <code>Sid</code> implementation that uses some other identifier.</p>
- *
- * @author Ben Alex
- */
-public class PrincipalSid implements Sid {
-    //~ Instance fields ================================================================================================
-
-    private final String principal;
-
-    //~ Constructors ===================================================================================================
-
-    public PrincipalSid(String principal) {
-        Assert.hasText(principal, "Principal required");
-        this.principal = principal;
-    }
-
-    public PrincipalSid(Authentication authentication) {
-        Assert.notNull(authentication, "Authentication required");
-        Assert.notNull(authentication.getPrincipal(), "Principal required");
-
-        if (authentication.getPrincipal() instanceof UserDetails) {
-            this.principal = ((UserDetails) authentication.getPrincipal()).getUsername();
-        } else {
-            this.principal = authentication.getPrincipal().toString();
-        }
-    }
-
-    //~ Methods ========================================================================================================
-
-    public boolean equals(Object object) {
-        if ((object == null) || !(object instanceof PrincipalSid)) {
-            return false;
-        }
-
-        // Delegate to getPrincipal() to perform actual comparison (both should be identical)
-        return ((PrincipalSid) object).getPrincipal().equals(this.getPrincipal());
-    }
-
-    public int hashCode() {
-        return this.getPrincipal().hashCode();
-    }
-
-    public String getPrincipal() {
-        return principal;
-    }
-
-    public String toString() {
-        return "PrincipalSid[" + this.principal + "]";
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/SidRetrievalStrategyImpl.java

@@ -1,65 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
-import org.springframework.security.access.hierarchicalroles.NullRoleHierarchy;
-import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.util.Assert;
-
-/**
- * Basic implementation of {@link SidRetrievalStrategy} that creates a {@link Sid} for the principal, as well as
- * every granted authority the principal holds. Can optionally have a <tt>RoleHierarchy</tt> injected in order to
- * determine the extended list of authorities that the principal is assigned.
- * <p>
- * The returned array will always contain the {@link PrincipalSid} before any {@link GrantedAuthoritySid} elements.
- *
- * @author Ben Alex
- */
-public class SidRetrievalStrategyImpl implements SidRetrievalStrategy {
-
-    private RoleHierarchy roleHierarchy = new NullRoleHierarchy();
-
-    public SidRetrievalStrategyImpl() {
-    }
-
-    public SidRetrievalStrategyImpl(RoleHierarchy roleHierarchy) {
-        Assert.notNull(roleHierarchy, "RoleHierarchy must not be null");
-        this.roleHierarchy = roleHierarchy;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public List<Sid> getSids(Authentication authentication) {
-        Collection<? extends GrantedAuthority> authorities = roleHierarchy.getReachableGrantedAuthorities(authentication.getAuthorities());
-        List<Sid> sids = new ArrayList<Sid>(authorities.size() + 1);
-
-        sids.add(new PrincipalSid(authentication));
-
-        for (GrantedAuthority authority : authorities) {
-            sids.add(new GrantedAuthoritySid(authority));
-        }
-
-        return sids;
-    }
-}

acl/src/main/java/org/springframework/security/acls/domain/package-info.java

@@ -1,5 +0,0 @@
-/**
- * Basic implementation of access control lists (ACLs) interfaces.
- */
-package org.springframework.security.acls.domain;
-

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -1,645 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import java.io.Serializable;
-import java.lang.reflect.Field;
-import java.sql.PreparedStatement;
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
-import javax.sql.DataSource;
-
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.jdbc.core.PreparedStatementSetter;
-import org.springframework.jdbc.core.ResultSetExtractor;
-import org.springframework.security.acls.domain.AccessControlEntryImpl;
-import org.springframework.security.acls.domain.AclAuthorizationStrategy;
-import org.springframework.security.acls.domain.AclImpl;
-import org.springframework.security.acls.domain.AuditLogger;
-import org.springframework.security.acls.domain.DefaultPermissionFactory;
-import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PermissionFactory;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.UnloadedSidException;
-import org.springframework.security.util.FieldUtils;
-import org.springframework.util.Assert;
-
-
-/**
- * Performs lookups in a manner that is compatible with ANSI SQL.
- * <p>
- * NB: This implementation does attempt to provide reasonably optimised lookups - within the constraints of a normalised
- * database and standard ANSI SQL features. If you are willing to sacrifice either of these constraints
- * (e.g. use a particular database feature such as hierarchical queries or materalized views, or reduce normalisation)
- * you are likely to achieve better performance. In such situations you will need to provide your own custom
- * <code>LookupStrategy</code>. This class does not support subclassing, as it is likely to change in future releases
- * and therefore subclassing is unsupported.
- * <p>
- * There are two SQL queries executed, one in the <tt>lookupPrimaryKeys</tt> method and one in
- * <tt>lookupObjectIdentities</tt>. These are built from the same select and "order by" clause, using a different
- * where clause in each case. In order to use custom schema or column names, each of these SQL clauses can be
- * customized, but they must be consistent with each other and with the expected result set
- * generated by the the default values.
- *
- * @author Ben Alex
- */
-public final class BasicLookupStrategy implements LookupStrategy {
-
-    public final static String DEFAULT_SELECT_CLAUSE = "select acl_object_identity.object_id_identity, "
-        + "acl_entry.ace_order,  "
-        + "acl_object_identity.id as acl_id, "
-        + "acl_object_identity.parent_object, "
-        + "acl_object_identity.entries_inheriting, "
-        + "acl_entry.id as ace_id, "
-        + "acl_entry.mask,  "
-        + "acl_entry.granting,  "
-        + "acl_entry.audit_success, "
-        + "acl_entry.audit_failure,  "
-        + "acl_sid.principal as ace_principal, "
-        + "acl_sid.sid as ace_sid,  "
-        + "acli_sid.principal as acl_principal, "
-        + "acli_sid.sid as acl_sid, "
-        + "acl_class.class "
-        + "from acl_object_identity "
-        + "left join acl_sid acli_sid on acli_sid.id = acl_object_identity.owner_sid "
-        + "left join acl_class on acl_class.id = acl_object_identity.object_id_class   "
-        + "left join acl_entry on acl_object_identity.id = acl_entry.acl_object_identity "
-        + "left join acl_sid on acl_entry.sid = acl_sid.id  "
-        + "where ( ";
-
-    private final static String DEFAULT_LOOKUP_KEYS_WHERE_CLAUSE = "(acl_object_identity.id = ?)";
-
-    private final static String DEFAULT_LOOKUP_IDENTITIES_WHERE_CLAUSE = "(acl_object_identity.object_id_identity = ? and acl_class.class = ?)";
-
-    public final static String DEFAULT_ORDER_BY_CLAUSE = ") order by acl_object_identity.object_id_identity"
-        + " asc, acl_entry.ace_order asc";
-
-    //~ Instance fields ================================================================================================
-
-    private final AclAuthorizationStrategy aclAuthorizationStrategy;
-    private PermissionFactory permissionFactory = new DefaultPermissionFactory();
-    private final AclCache aclCache;
-    private final PermissionGrantingStrategy grantingStrategy;
-    private final JdbcTemplate jdbcTemplate;
-    private int batchSize = 50;
-
-    private final Field fieldAces = FieldUtils.getField(AclImpl.class, "aces");
-    private final Field fieldAcl = FieldUtils.getField(AccessControlEntryImpl.class, "acl");
-
-    // SQL Customization fields
-    private String selectClause = DEFAULT_SELECT_CLAUSE;
-    private String lookupPrimaryKeysWhereClause = DEFAULT_LOOKUP_KEYS_WHERE_CLAUSE;
-    private String lookupObjectIdentitiesWhereClause = DEFAULT_LOOKUP_IDENTITIES_WHERE_CLAUSE;
-    private String orderByClause = DEFAULT_ORDER_BY_CLAUSE;
-
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructor accepting mandatory arguments
-     *
-     * @param dataSource to access the database
-     * @param aclCache the cache where fully-loaded elements can be stored
-     * @param aclAuthorizationStrategy authorization strategy (required)
-     *
-     * @deprecated Use the version which takes a  {@code PermissionGrantingStrategy} argument instead.
-     */
-    @Deprecated
-    public BasicLookupStrategy(DataSource dataSource, AclCache aclCache,
-            AclAuthorizationStrategy aclAuthorizationStrategy, AuditLogger auditLogger) {
-        this(dataSource, aclCache, aclAuthorizationStrategy, new DefaultPermissionGrantingStrategy(auditLogger));
-    }
-
-    public BasicLookupStrategy(DataSource dataSource, AclCache aclCache,
-            AclAuthorizationStrategy aclAuthorizationStrategy, PermissionGrantingStrategy grantingStrategy) {
-        Assert.notNull(dataSource, "DataSource required");
-        Assert.notNull(aclCache, "AclCache required");
-        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-        Assert.notNull(grantingStrategy, "grantingStrategy required");
-        jdbcTemplate = new JdbcTemplate(dataSource);
-        this.aclCache = aclCache;
-        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-        this.grantingStrategy = grantingStrategy;
-        fieldAces.setAccessible(true);
-        fieldAcl.setAccessible(true);
-
-    }
-
-    //~ Methods ========================================================================================================
-
-    private String computeRepeatingSql(String repeatingSql, int requiredRepetitions) {
-        assert requiredRepetitions > 0 : "requiredRepetitions must be > 0";
-
-        final String startSql = selectClause;
-
-        final String endSql = orderByClause;
-
-        StringBuilder sqlStringBldr =
-            new StringBuilder(startSql.length() + endSql.length() + requiredRepetitions * (repeatingSql.length() + 4));
-        sqlStringBldr.append(startSql);
-
-        for (int i = 1; i <= requiredRepetitions; i++) {
-            sqlStringBldr.append(repeatingSql);
-
-            if (i != requiredRepetitions) {
-                sqlStringBldr.append(" or ");
-            }
-        }
-
-        sqlStringBldr.append(endSql);
-
-        return sqlStringBldr.toString();
-    }
-
-    @SuppressWarnings("unchecked")
-    private List<AccessControlEntryImpl> readAces(AclImpl acl) {
-        try {
-            return (List<AccessControlEntryImpl>) fieldAces.get(acl);
-        } catch (IllegalAccessException e) {
-            throw new IllegalStateException("Could not obtain AclImpl.aces field", e);
-        }
-    }
-
-    private void setAclOnAce(AccessControlEntryImpl ace, AclImpl acl) {
-        try {
-            fieldAcl.set(ace, acl);
-        } catch (IllegalAccessException e) {
-            throw new IllegalStateException("Could not or set AclImpl on AccessControlEntryImpl fields", e);
-        }
-    }
-
-    private void setAces(AclImpl acl, List<AccessControlEntryImpl> aces) {
-        try {
-            fieldAces.set(acl, aces);
-        } catch (IllegalAccessException e) {
-            throw new IllegalStateException("Could not set AclImpl entries", e);
-        }
-    }
-
-    /**
-     * Locates the primary key IDs specified in "findNow", adding AclImpl instances with StubAclParents to the
-     * "acls" Map.
-     *
-     * @param acls the AclImpls (with StubAclParents)
-     * @param findNow Long-based primary keys to retrieve
-     * @param sids
-     */
-    private void lookupPrimaryKeys(final Map<Serializable, Acl> acls, final Set<Long> findNow, final List<Sid> sids) {
-        Assert.notNull(acls, "ACLs are required");
-        Assert.notEmpty(findNow, "Items to find now required");
-
-        String sql = computeRepeatingSql(lookupPrimaryKeysWhereClause, findNow.size());
-
-        Set<Long> parentsToLookup = jdbcTemplate.query(sql,
-            new PreparedStatementSetter() {
-                public void setValues(PreparedStatement ps) throws SQLException {
-                    int i = 0;
-
-                    for (Long toFind : findNow) {
-                        i++;
-                        ps.setLong(i, toFind);
-                    }
-                }
-            }, new ProcessResultSet(acls, sids));
-
-        // Lookup the parents, now that our JdbcTemplate has released the database connection (SEC-547)
-        if (parentsToLookup.size() > 0) {
-            lookupPrimaryKeys(acls, parentsToLookup, sids);
-        }
-    }
-
-    /**
-     * The main method.
-     * <p>
-     * WARNING: This implementation completely disregards the "sids" argument! Every item in the cache is expected to
-     * contain all SIDs. If you have serious performance needs (e.g. a very large number of
-     * SIDs per object identity), you'll probably want to develop a custom {@link LookupStrategy} implementation
-     * instead.
-     * <p>
-     * The implementation works in batch sizes specified by {@link #batchSize}.
-     *
-     * @param objects the identities to lookup (required)
-     * @param sids the SIDs for which identities are required (ignored by this implementation)
-     *
-     * @return a <tt>Map</tt> where keys represent the {@link ObjectIdentity} of the located {@link Acl} and values
-     *         are the located {@link Acl} (never <tt>null</tt> although some entries may be missing; this method
-     *         should not throw {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used
-     *         to automatically create entries if required)
-     */
-    public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) {
-        Assert.isTrue(batchSize >= 1, "BatchSize must be >= 1");
-        Assert.notEmpty(objects, "Objects to lookup required");
-
-        // Map<ObjectIdentity,Acl>
-        Map<ObjectIdentity, Acl> result = new HashMap<ObjectIdentity, Acl>(); // contains FULLY loaded Acl objects
-
-        Set<ObjectIdentity> currentBatchToLoad = new HashSet<ObjectIdentity>();
-
-        for (int i = 0; i < objects.size(); i++) {
-            final ObjectIdentity oid = objects.get(i);
-            boolean aclFound = false;
-
-            // Check we don't already have this ACL in the results
-            if (result.containsKey(oid)) {
-                aclFound = true;
-            }
-
-            // Check cache for the present ACL entry
-            if (!aclFound) {
-                Acl acl = aclCache.getFromCache(oid);
-
-                // Ensure any cached element supports all the requested SIDs
-                // (they should always, as our base impl doesn't filter on SID)
-                if (acl != null) {
-                    if (acl.isSidLoaded(sids)) {
-                        result.put(acl.getObjectIdentity(), acl);
-                        aclFound = true;
-                    } else {
-                        throw new IllegalStateException(
-                            "Error: SID-filtered element detected when implementation does not perform SID filtering "
-                                    + "- have you added something to the cache manually?");
-                    }
-                }
-            }
-
-            // Load the ACL from the database
-            if (!aclFound) {
-                currentBatchToLoad.add(oid);
-            }
-
-            // Is it time to load from JDBC the currentBatchToLoad?
-            if ((currentBatchToLoad.size() == this.batchSize) || ((i + 1) == objects.size())) {
-                if (currentBatchToLoad.size() > 0) {
-                    Map<ObjectIdentity, Acl> loadedBatch = lookupObjectIdentities(currentBatchToLoad, sids);
-
-                    // Add loaded batch (all elements 100% initialized) to results
-                    result.putAll(loadedBatch);
-
-                    // Add the loaded batch to the cache
-
-                    for (Acl loadedAcl : loadedBatch.values()) {
-                        aclCache.putInCache((AclImpl) loadedAcl);
-                    }
-
-                    currentBatchToLoad.clear();
-                }
-            }
-        }
-
-        return result;
-    }
-
-    /**
-     * Looks up a batch of <code>ObjectIdentity</code>s directly from the database.
-     * <p>
-     * The caller is responsible for optimization issues, such as selecting the identities to lookup, ensuring the
-     * cache doesn't contain them already, and adding the returned elements to the cache etc.
-     * <p>
-     * This subclass is required to return fully valid <code>Acl</code>s, including properly-configured
-     * parent ACLs.
-     *
-     */
-    private Map<ObjectIdentity, Acl> lookupObjectIdentities(final Collection<ObjectIdentity> objectIdentities, List<Sid> sids) {
-        Assert.notEmpty(objectIdentities, "Must provide identities to lookup");
-
-        final Map<Serializable, Acl> acls = new HashMap<Serializable, Acl>(); // contains Acls with StubAclParents
-
-        // Make the "acls" map contain all requested objectIdentities
-        // (including markers to each parent in the hierarchy)
-        String sql = computeRepeatingSql(lookupObjectIdentitiesWhereClause, objectIdentities.size());
-
-        Set<Long> parentsToLookup = jdbcTemplate.query(sql,
-            new PreparedStatementSetter() {
-                public void setValues(PreparedStatement ps) throws SQLException {
-                    int i = 0;
-                    for (ObjectIdentity oid : objectIdentities) {
-                        // Determine prepared statement values for this iteration
-                        String type = oid.getType();
-
-                        // No need to check for nulls, as guaranteed non-null by ObjectIdentity.getIdentifier() interface contract
-                        String identifier = oid.getIdentifier().toString();
-                        long id = (Long.valueOf(identifier)).longValue();
-
-                        // Inject values
-                        ps.setLong((2 * i) + 1, id);
-                        ps.setString((2 * i) + 2, type);
-                        i++;
-                    }
-                }
-            }, new ProcessResultSet(acls, sids));
-
-        // Lookup the parents, now that our JdbcTemplate has released the database connection (SEC-547)
-        if (parentsToLookup.size() > 0) {
-            lookupPrimaryKeys(acls, parentsToLookup, sids);
-        }
-
-        // Finally, convert our "acls" containing StubAclParents into true Acls
-        Map<ObjectIdentity, Acl> resultMap = new HashMap<ObjectIdentity, Acl>();
-
-        for (Acl inputAcl : acls.values()) {
-            Assert.isInstanceOf(AclImpl.class, inputAcl, "Map should have contained an AclImpl");
-            Assert.isInstanceOf(Long.class, ((AclImpl) inputAcl).getId(), "Acl.getId() must be Long");
-
-            Acl result = convert(acls, (Long) ((AclImpl) inputAcl).getId());
-            resultMap.put(result.getObjectIdentity(), result);
-        }
-
-        return resultMap;
-    }
-
-    /**
-     * The final phase of converting the <code>Map</code> of <code>AclImpl</code> instances which contain
-     * <code>StubAclParent</code>s into proper, valid <code>AclImpl</code>s with correct ACL parents.
-     *
-     * @param inputMap the unconverted <code>AclImpl</code>s
-     * @param currentIdentity the current<code>Acl</code> that we wish to convert (this may be
-     *
-     */
-    private AclImpl convert(Map<Serializable, Acl> inputMap, Long currentIdentity) {
-        Assert.notEmpty(inputMap, "InputMap required");
-        Assert.notNull(currentIdentity, "CurrentIdentity required");
-
-        // Retrieve this Acl from the InputMap
-        Acl uncastAcl = inputMap.get(currentIdentity);
-        Assert.isInstanceOf(AclImpl.class, uncastAcl, "The inputMap contained a non-AclImpl");
-
-        AclImpl inputAcl = (AclImpl) uncastAcl;
-
-        Acl parent = inputAcl.getParentAcl();
-
-        if ((parent != null) && parent instanceof StubAclParent) {
-            // Lookup the parent
-            StubAclParent stubAclParent = (StubAclParent) parent;
-            parent = convert(inputMap, stubAclParent.getId());
-        }
-
-        // Now we have the parent (if there is one), create the true AclImpl
-        AclImpl result = new AclImpl(inputAcl.getObjectIdentity(), (Long) inputAcl.getId(), aclAuthorizationStrategy,
-                grantingStrategy, parent, null, inputAcl.isEntriesInheriting(), inputAcl.getOwner());
-
-        // Copy the "aces" from the input to the destination
-
-        // Obtain the "aces" from the input ACL
-        List<AccessControlEntryImpl> aces = readAces(inputAcl);
-
-        // Create a list in which to store the "aces" for the "result" AclImpl instance
-        List<AccessControlEntryImpl> acesNew = new ArrayList<AccessControlEntryImpl>();
-
-        // Iterate over the "aces" input and replace each nested AccessControlEntryImpl.getAcl() with the new "result" AclImpl instance
-        // This ensures StubAclParent instances are removed, as per SEC-951
-        for (AccessControlEntryImpl ace : aces) {
-            setAclOnAce(ace, result);
-            acesNew.add(ace);
-        }
-
-        // Finally, now that the "aces" have been converted to have the "result" AclImpl instance, modify the "result" AclImpl instance
-        setAces(result, acesNew);
-
-        return result;
-    }
-
-    /**
-     * Sets the {@code PermissionFactory} instance which will be used to convert loaded permission
-     * data values to {@code Permission}s. A {@code DefaultPermissionFactory} will be used by default.
-     *
-     * @param permissionFactory
-     */
-    public void setPermissionFactory(PermissionFactory permissionFactory) {
-        this.permissionFactory = permissionFactory;
-    }
-
-    public void setBatchSize(int batchSize) {
-        this.batchSize = batchSize;
-    }
-
-    /**
-     * The SQL for the select clause. If customizing in order to modify
-     * column names, schema etc, the other SQL customization fields must also be set to match.
-     *
-     * @param selectClause the select clause, which defaults to {@link #DEFAULT_SELECT_CLAUSE}.
-     */
-    public void setSelectClause(String selectClause) {
-        this.selectClause = selectClause;
-    }
-
-    /**
-     * The SQL for the where clause used in the <tt>lookupPrimaryKey</tt> method.
-     */
-    public void setLookupPrimaryKeysWhereClause(String lookupPrimaryKeysWhereClause) {
-        this.lookupPrimaryKeysWhereClause = lookupPrimaryKeysWhereClause;
-    }
-
-    /**
-     * The SQL for the where clause used in the <tt>lookupObjectIdentities</tt> method.
-     */
-    public void setLookupObjectIdentitiesWhereClause(String lookupObjectIdentitiesWhereClause) {
-        this.lookupObjectIdentitiesWhereClause = lookupObjectIdentitiesWhereClause;
-    }
-
-    /**
-     * The SQL for the "order by" clause used in both queries.
-     */
-    public void setOrderByClause(String orderByClause) {
-        this.orderByClause = orderByClause;
-    }
-
-    //~ Inner Classes ==================================================================================================
-
-    private class ProcessResultSet implements ResultSetExtractor<Set<Long>> {
-        private final Map<Serializable, Acl> acls;
-        private final List<Sid> sids;
-
-        public ProcessResultSet(Map<Serializable, Acl> acls, List<Sid> sids) {
-            Assert.notNull(acls, "ACLs cannot be null");
-            this.acls = acls;
-            this.sids = sids; // can be null
-        }
-
-        /**
-         * Implementation of {@link ResultSetExtractor#extractData(ResultSet)}.
-         * Creates an {@link Acl} for each row in the {@link ResultSet} and
-         * ensures it is in member field <tt>acls</tt>.  Any {@link Acl} with
-         * a parent will have the parents id returned in a set.  The returned
-         * set of ids may requires further processing.
-         * @param rs The {@link ResultSet} to be processed
-         * @return a list of parent IDs remaining to be looked up (may be empty, but never <tt>null</tt>)
-         * @throws SQLException
-         */
-        public Set<Long> extractData(ResultSet rs) throws SQLException {
-            Set<Long> parentIdsToLookup = new HashSet<Long>(); // Set of parent_id Longs
-
-            while (rs.next()) {
-                // Convert current row into an Acl (albeit with a StubAclParent)
-                convertCurrentResultIntoObject(acls, rs);
-
-                // Figure out if this row means we need to lookup another parent
-                long parentId = rs.getLong("parent_object");
-
-                if (parentId != 0) {
-                    // See if it's already in the "acls"
-                    if (acls.containsKey(new Long(parentId))) {
-                        continue; // skip this while iteration
-                    }
-
-                    // Now try to find it in the cache
-                    MutableAcl cached = aclCache.getFromCache(new Long(parentId));
-
-                    if ((cached == null) || !cached.isSidLoaded(sids)) {
-                        parentIdsToLookup.add(new Long(parentId));
-                    } else {
-                        // Pop into the acls map, so our convert method doesn't
-                        // need to deal with an unsynchronized AclCache
-                        acls.put(cached.getId(), cached);
-                    }
-                }
-            }
-
-            // Return the parents left to lookup to the caller
-            return parentIdsToLookup;
-        }
-
-        /**
-         * Accepts the current <code>ResultSet</code> row, and converts it into an <code>AclImpl</code> that
-         * contains a <code>StubAclParent</code>
-         *
-         * @param acls the Map we should add the converted Acl to
-         * @param rs the ResultSet focused on a current row
-         *
-         * @throws SQLException if something goes wrong converting values
-         */
-        private void convertCurrentResultIntoObject(Map<Serializable, Acl> acls, ResultSet rs) throws SQLException {
-            Long id = new Long(rs.getLong("acl_id"));
-
-            // If we already have an ACL for this ID, just create the ACE
-            Acl acl = acls.get(id);
-
-            if (acl == null) {
-                // Make an AclImpl and pop it into the Map
-                ObjectIdentity objectIdentity = new ObjectIdentityImpl(rs.getString("class"),
-                        Long.valueOf(rs.getLong("object_id_identity")));
-
-                Acl parentAcl = null;
-                long parentAclId = rs.getLong("parent_object");
-
-                if (parentAclId != 0) {
-                    parentAcl = new StubAclParent(Long.valueOf(parentAclId));
-                }
-
-                boolean entriesInheriting = rs.getBoolean("entries_inheriting");
-                Sid owner;
-
-                if (rs.getBoolean("acl_principal")) {
-                    owner = new PrincipalSid(rs.getString("acl_sid"));
-                } else {
-                    owner = new GrantedAuthoritySid(rs.getString("acl_sid"));
-                }
-
-                acl = new AclImpl(objectIdentity, id, aclAuthorizationStrategy, grantingStrategy, parentAcl, null,
-                        entriesInheriting, owner);
-
-                acls.put(id, acl);
-            }
-
-            // Add an extra ACE to the ACL (ORDER BY maintains the ACE list order)
-            // It is permissible to have no ACEs in an ACL (which is detected by a null ACE_SID)
-            if (rs.getString("ace_sid") != null) {
-                Long aceId = new Long(rs.getLong("ace_id"));
-                Sid recipient;
-
-                if (rs.getBoolean("ace_principal")) {
-                    recipient = new PrincipalSid(rs.getString("ace_sid"));
-                } else {
-                    recipient = new GrantedAuthoritySid(rs.getString("ace_sid"));
-                }
-
-                int mask = rs.getInt("mask");
-                Permission permission = permissionFactory.buildFromMask(mask);
-                boolean granting = rs.getBoolean("granting");
-                boolean auditSuccess = rs.getBoolean("audit_success");
-                boolean auditFailure = rs.getBoolean("audit_failure");
-
-                AccessControlEntryImpl ace = new AccessControlEntryImpl(aceId, acl, recipient, permission, granting,
-                        auditSuccess, auditFailure);
-
-                //Field acesField = FieldUtils.getField(AclImpl.class, "aces");
-                List<AccessControlEntryImpl> aces = readAces((AclImpl)acl);
-
-                // Add the ACE if it doesn't already exist in the ACL.aces field
-                if (!aces.contains(ace)) {
-                    aces.add(ace);
-                }
-            }
-        }
-    }
-
-    private class StubAclParent implements Acl {
-        private final Long id;
-
-        public StubAclParent(Long id) {
-            this.id = id;
-        }
-
-        public List<AccessControlEntry> getEntries() {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public Long getId() {
-            return id;
-        }
-
-        public ObjectIdentity getObjectIdentity() {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public Sid getOwner() {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public Acl getParentAcl() {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public boolean isEntriesInheriting() {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public boolean isGranted(List<Permission> permission, List<Sid> sids, boolean administrativeMode)
-            throws NotFoundException, UnloadedSidException {
-            throw new UnsupportedOperationException("Stub only");
-        }
-
-        public boolean isSidLoaded(List<Sid> sids) {
-            throw new UnsupportedOperationException("Stub only");
-        }
-    }
-}

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java

@@ -1,129 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import java.sql.ResultSet;
-import java.sql.SQLException;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import javax.sql.DataSource;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.jdbc.core.RowMapper;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.util.Assert;
-
-
-/**
- * Simple JDBC-based implementation of <code>AclService</code>.
- * <p>
- * Requires the "dirty" flags in {@link org.springframework.security.acls.domain.AclImpl} and
- * {@link org.springframework.security.acls.domain.AccessControlEntryImpl} to be set, so that the implementation can
- * detect changed parameters easily.
- *
- * @author Ben Alex
- */
-public class JdbcAclService implements AclService {
-    //~ Static fields/initializers =====================================================================================
-
-    protected static final Log log = LogFactory.getLog(JdbcAclService.class);
-    private static final String DEFAULT_SELECT_ACL_WITH_PARENT_SQL = "select obj.object_id_identity as obj_id, class.class as class "
-        + "from acl_object_identity obj, acl_object_identity parent, acl_class class "
-        + "where obj.parent_object = parent.id and obj.object_id_class = class.id "
-        + "and parent.object_id_identity = ? and parent.object_id_class = ("
-        + "select id FROM acl_class where acl_class.class = ?)";
-
-    //~ Instance fields ================================================================================================
-
-    protected final JdbcTemplate jdbcTemplate;
-    private final LookupStrategy lookupStrategy;
-    private String findChildrenSql = DEFAULT_SELECT_ACL_WITH_PARENT_SQL;
-
-    //~ Constructors ===================================================================================================
-
-    public JdbcAclService(DataSource dataSource, LookupStrategy lookupStrategy) {
-        Assert.notNull(dataSource, "DataSource required");
-        Assert.notNull(lookupStrategy, "LookupStrategy required");
-        this.jdbcTemplate = new JdbcTemplate(dataSource);
-        this.lookupStrategy = lookupStrategy;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity) {
-        Object[] args = {parentIdentity.getIdentifier(), parentIdentity.getType()};
-        List<ObjectIdentity> objects = jdbcTemplate.query(findChildrenSql, args,
-                new RowMapper<ObjectIdentity>() {
-                    public ObjectIdentity mapRow(ResultSet rs, int rowNum) throws SQLException {
-                        String javaType = rs.getString("class");
-                        Long identifier = new Long(rs.getLong("obj_id"));
-
-                        return new ObjectIdentityImpl(javaType, identifier);
-                    }
-                });
-
-        if (objects.size() == 0) {
-            return null;
-        }
-
-        return objects;
-    }
-
-    public Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException {
-        Map<ObjectIdentity, Acl> map = readAclsById(Arrays.asList(object), sids);
-        Assert.isTrue(map.containsKey(object), "There should have been an Acl entry for ObjectIdentity " + object);
-
-        return (Acl) map.get(object);
-    }
-
-    public Acl readAclById(ObjectIdentity object) throws NotFoundException {
-        return readAclById(object, null);
-    }
-
-    public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects) throws NotFoundException {
-        return readAclsById(objects, null);
-    }
-
-    public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) throws NotFoundException {
-        Map<ObjectIdentity, Acl> result = lookupStrategy.readAclsById(objects, sids);
-
-        // Check every requested object identity was found (throw NotFoundException if needed)
-        for (ObjectIdentity oid : objects) {
-            if (!result.containsKey(oid)) {
-                throw new NotFoundException("Unable to find ACL information for object identity '" + oid + "'");
-            }
-        }
-
-        return result;
-    }
-
-    /**
-     * Allows customization of the SQL query used to find child object identities.
-     *
-     * @param findChildrenSql
-     */
-    public void setFindChildrenQuery(String findChildrenSql) {
-        this.findChildrenSql = findChildrenSql;
-    }
-}

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -1,433 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import java.sql.PreparedStatement;
-import java.sql.SQLException;
-import java.util.List;
-
-import javax.sql.DataSource;
-
-import org.springframework.dao.DataAccessException;
-import org.springframework.jdbc.core.BatchPreparedStatementSetter;
-import org.springframework.security.acls.domain.AccessControlEntryImpl;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.AlreadyExistsException;
-import org.springframework.security.acls.model.ChildrenExistException;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.MutableAclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.transaction.support.TransactionSynchronizationManager;
-import org.springframework.util.Assert;
-
-
-/**
- * Provides a base JDBC implementation of {@link MutableAclService}.
- * <p>
- * The default settings are for HSQLDB. If you are using a different database you
- * will probably need to set the {@link #setSidIdentityQuery(String) sidIdentityQuery} and
- * {@link #setClassIdentityQuery(String) classIdentityQuery} properties appropriately. The other queries,
- * SQL inserts and updates can also be customized to accomodate schema variations, but must produce results
- * consistent with those expected by the defaults.
- * <p>
- * See the appendix of the Spring Security reference manual for more information on the expected schema
- * and how it is used. Information on using PostgreSQL is also included.
- *
- * @author Ben Alex
- * @author Johannes Zlattinger
- */
-public class JdbcMutableAclService extends JdbcAclService implements MutableAclService {
-    //~ Instance fields ================================================================================================
-
-    private boolean foreignKeysInDatabase = true;
-    private final AclCache aclCache;
-    private String deleteEntryByObjectIdentityForeignKey = "delete from acl_entry where acl_object_identity=?";
-    private String deleteObjectIdentityByPrimaryKey = "delete from acl_object_identity where id=?";
-    private String classIdentityQuery = "call identity()";
-    private String sidIdentityQuery = "call identity()";
-    private String insertClass = "insert into acl_class (class) values (?)";
-    private String insertEntry = "insert into acl_entry "
-        + "(acl_object_identity, ace_order, sid, mask, granting, audit_success, audit_failure)"
-        + "values (?, ?, ?, ?, ?, ?, ?)";
-    private String insertObjectIdentity = "insert into acl_object_identity "
-        + "(object_id_class, object_id_identity, owner_sid, entries_inheriting) " + "values (?, ?, ?, ?)";
-    private String insertSid = "insert into acl_sid (principal, sid) values (?, ?)";
-    private String selectClassPrimaryKey = "select id from acl_class where class=?";
-    private String selectObjectIdentityPrimaryKey = "select acl_object_identity.id from acl_object_identity, acl_class "
-        + "where acl_object_identity.object_id_class = acl_class.id and acl_class.class=? "
-        + "and acl_object_identity.object_id_identity = ?";
-    private String selectSidPrimaryKey = "select id from acl_sid where principal=? and sid=?";
-    private String updateObjectIdentity = "update acl_object_identity set "
-        + "parent_object = ?, owner_sid = ?, entries_inheriting = ?" + " where id = ?";
-
-    //~ Constructors ===================================================================================================
-
-    public JdbcMutableAclService(DataSource dataSource, LookupStrategy lookupStrategy, AclCache aclCache) {
-        super(dataSource, lookupStrategy);
-        Assert.notNull(aclCache, "AclCache required");
-        this.aclCache = aclCache;
-    }
-
-    //~ Methods ========================================================================================================
-
-    public MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException {
-        Assert.notNull(objectIdentity, "Object Identity required");
-
-        // Check this object identity hasn't already been persisted
-        if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
-            throw new AlreadyExistsException("Object identity '" + objectIdentity + "' already exists");
-        }
-
-        // Need to retrieve the current principal, in order to know who "owns" this ACL (can be changed later on)
-        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-        PrincipalSid sid = new PrincipalSid(auth);
-
-        // Create the acl_object_identity row
-        createObjectIdentity(objectIdentity, sid);
-
-        // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
-        Acl acl = readAclById(objectIdentity);
-        Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");
-
-        return (MutableAcl) acl;
-    }
-
-    /**
-     * Creates a new row in acl_entry for every ACE defined in the passed MutableAcl object.
-     *
-     * @param acl containing the ACEs to insert
-     */
-    protected void createEntries(final MutableAcl acl) {
-        jdbcTemplate.batchUpdate(insertEntry,
-            new BatchPreparedStatementSetter() {
-                public int getBatchSize() {
-                    return acl.getEntries().size();
-                }
-
-                public void setValues(PreparedStatement stmt, int i) throws SQLException {
-                    AccessControlEntry entry_ = acl.getEntries().get(i);
-                    Assert.isTrue(entry_ instanceof AccessControlEntryImpl, "Unknown ACE class");
-                    AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
-
-                    stmt.setLong(1, ((Long) acl.getId()).longValue());
-                    stmt.setInt(2, i);
-                    stmt.setLong(3, createOrRetrieveSidPrimaryKey(entry.getSid(), true).longValue());
-                    stmt.setInt(4, entry.getPermission().getMask());
-                    stmt.setBoolean(5, entry.isGranting());
-                    stmt.setBoolean(6, entry.isAuditSuccess());
-                    stmt.setBoolean(7, entry.isAuditFailure());
-                }
-            });
-    }
-
-    /**
-     * Creates an entry in the acl_object_identity table for the passed ObjectIdentity. The Sid is also
-     * necessary, as acl_object_identity has defined the sid column as non-null.
-     *
-     * @param object to represent an acl_object_identity for
-     * @param owner for the SID column (will be created if there is no acl_sid entry for this particular Sid already)
-     */
-    protected void createObjectIdentity(ObjectIdentity object, Sid owner) {
-        Long sidId = createOrRetrieveSidPrimaryKey(owner, true);
-        Long classId = createOrRetrieveClassPrimaryKey(object.getType(), true);
-        jdbcTemplate.update(insertObjectIdentity, classId, object.getIdentifier(), sidId, Boolean.TRUE);
-    }
-
-    /**
-     * Retrieves the primary key from {@code acl_class}, creating a new row if needed and the
-     * {@code allowCreate} property is {@code true}.
-     *
-     * @param type to find or create an entry for (often the fully-qualified class name)
-     * @param allowCreate true if creation is permitted if not found
-     *
-     * @return the primary key or null if not found
-     */
-    protected Long createOrRetrieveClassPrimaryKey(String type, boolean allowCreate) {
-        List<Long> classIds = jdbcTemplate.queryForList(selectClassPrimaryKey, new Object[] {type}, Long.class);
-
-        if (!classIds.isEmpty()) {
-            return classIds.get(0);
-        }
-
-        if (allowCreate) {
-            jdbcTemplate.update(insertClass, type);
-            Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
-                    "Transaction must be running");
-            return new Long(jdbcTemplate.queryForLong(classIdentityQuery));
-        }
-
-        return null;
-    }
-
-    /**
-     * Retrieves the primary key from acl_sid, creating a new row if needed and the allowCreate property is
-     * true.
-     *
-     * @param sid to find or create
-     * @param allowCreate true if creation is permitted if not found
-     *
-     * @return the primary key or null if not found
-     *
-     * @throws IllegalArgumentException if the <tt>Sid</tt> is not a recognized implementation.
-     */
-    protected Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
-        Assert.notNull(sid, "Sid required");
-
-        String sidName;
-        boolean sidIsPrincipal = true;
-
-        if (sid instanceof PrincipalSid) {
-            sidName = ((PrincipalSid) sid).getPrincipal();
-        } else if (sid instanceof GrantedAuthoritySid) {
-            sidName = ((GrantedAuthoritySid) sid).getGrantedAuthority();
-            sidIsPrincipal = false;
-        } else {
-            throw new IllegalArgumentException("Unsupported implementation of Sid");
-        }
-
-        List<Long> sidIds = jdbcTemplate.queryForList(selectSidPrimaryKey,
-                new Object[] {Boolean.valueOf(sidIsPrincipal), sidName},  Long.class);
-
-        if (!sidIds.isEmpty()) {
-            return sidIds.get(0);
-        }
-
-        if (allowCreate) {
-            jdbcTemplate.update(insertSid, Boolean.valueOf(sidIsPrincipal), sidName);
-            Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(), "Transaction must be running");
-            return new Long(jdbcTemplate.queryForLong(sidIdentityQuery));
-        }
-
-        return null;
-    }
-
-    public void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren) throws ChildrenExistException {
-        Assert.notNull(objectIdentity, "Object Identity required");
-        Assert.notNull(objectIdentity.getIdentifier(), "Object Identity doesn't provide an identifier");
-
-        if (deleteChildren) {
-            List<ObjectIdentity> children = findChildren(objectIdentity);
-            if (children != null) {
-                for (ObjectIdentity child : children) {
-                    deleteAcl(child, true);
-                }
-            }
-        } else {
-            if (!foreignKeysInDatabase) {
-                // We need to perform a manual verification for what a FK would normally do
-                // We generally don't do this, in the interests of deadlock management
-                List<ObjectIdentity> children = findChildren(objectIdentity);
-                if (children != null) {
-                    throw new ChildrenExistException("Cannot delete '" + objectIdentity + "' (has " + children.size()
-                            + " children)");
-                }
-            }
-        }
-
-        Long oidPrimaryKey = retrieveObjectIdentityPrimaryKey(objectIdentity);
-
-        // Delete this ACL's ACEs in the acl_entry table
-        deleteEntries(oidPrimaryKey);
-
-        // Delete this ACL's acl_object_identity row
-        deleteObjectIdentity(oidPrimaryKey);
-
-        // Clear the cache
-        aclCache.evictFromCache(objectIdentity);
-    }
-
-    /**
-     * Deletes all ACEs defined in the acl_entry table belonging to the presented ObjectIdentity primary key.
-     *
-     * @param oidPrimaryKey the rows in acl_entry to delete
-     */
-    protected void deleteEntries(Long oidPrimaryKey) {
-        jdbcTemplate.update(deleteEntryByObjectIdentityForeignKey, oidPrimaryKey);
-    }
-
-    /**
-     * Deletes a single row from acl_object_identity that is associated with the presented ObjectIdentity primary key.
-     * <p>
-     * We do not delete any entries from acl_class, even if no classes are using that class any longer. This is a
-     * deadlock avoidance approach.
-     *
-     * @param oidPrimaryKey to delete the acl_object_identity
-     */
-    protected void deleteObjectIdentity(Long oidPrimaryKey) {
-        // Delete the acl_object_identity row
-        jdbcTemplate.update(deleteObjectIdentityByPrimaryKey, oidPrimaryKey);
-    }
-
-    /**
-     * Retrieves the primary key from the acl_object_identity table for the passed ObjectIdentity. Unlike some
-     * other methods in this implementation, this method will NOT create a row (use {@link
-     * #createObjectIdentity(ObjectIdentity, Sid)} instead).
-     *
-     * @param oid to find
-     *
-     * @return the object identity or null if not found
-     */
-    protected Long retrieveObjectIdentityPrimaryKey(ObjectIdentity oid) {
-        try {
-            return new Long(jdbcTemplate.queryForLong(selectObjectIdentityPrimaryKey, oid.getType(), oid.getIdentifier()));
-        } catch (DataAccessException notFound) {
-            return null;
-        }
-    }
-
-    /**
-     * This implementation will simply delete all ACEs in the database and recreate them on each invocation of
-     * this method. A more comprehensive implementation might use dirty state checking, or more likely use ORM
-     * capabilities for create, update and delete operations of {@link MutableAcl}.
-     */
-    public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
-        Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");
-
-        // Delete this ACL's ACEs in the acl_entry table
-        deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));
-
-        // Create this ACL's ACEs in the acl_entry table
-        createEntries(acl);
-
-        // Change the mutable columns in acl_object_identity
-        updateObjectIdentity(acl);
-
-        // Clear the cache, including children
-        clearCacheIncludingChildren(acl.getObjectIdentity());
-
-        // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
-        return (MutableAcl) super.readAclById(acl.getObjectIdentity());
-    }
-
-    private void clearCacheIncludingChildren(ObjectIdentity objectIdentity) {
-        Assert.notNull(objectIdentity, "ObjectIdentity required");
-        List<ObjectIdentity> children = findChildren(objectIdentity);
-        if (children != null) {
-            for (ObjectIdentity child : children) {
-                clearCacheIncludingChildren(child);
-            }
-        }
-        aclCache.evictFromCache(objectIdentity);
-    }
-
-    /**
-     * Updates an existing acl_object_identity row, with new information presented in the passed MutableAcl
-     * object. Also will create an acl_sid entry if needed for the Sid that owns the MutableAcl.
-     *
-     * @param acl to modify (a row must already exist in acl_object_identity)
-     *
-     * @throws NotFoundException if the ACL could not be found to update.
-     */
-    protected void updateObjectIdentity(MutableAcl acl) {
-        Long parentId = null;
-
-        if (acl.getParentAcl() != null) {
-            Assert.isInstanceOf(ObjectIdentityImpl.class, acl.getParentAcl().getObjectIdentity(),
-                "Implementation only supports ObjectIdentityImpl");
-
-            ObjectIdentityImpl oii = (ObjectIdentityImpl) acl.getParentAcl().getObjectIdentity();
-            parentId = retrieveObjectIdentityPrimaryKey(oii);
-        }
-
-        Assert.notNull(acl.getOwner(), "Owner is required in this implementation");
-
-        Long ownerSid = createOrRetrieveSidPrimaryKey(acl.getOwner(), true);
-        int count = jdbcTemplate.update(updateObjectIdentity,
-                parentId, ownerSid, Boolean.valueOf(acl.isEntriesInheriting()), acl.getId());
-
-        if (count != 1) {
-            throw new NotFoundException("Unable to locate ACL to update");
-        }
-    }
-
-    /**
-     * Sets the query that will be used to retrieve the identity of a newly created row in the <tt>acl_class</tt>
-     * table.
-     *
-     * @param classIdentityQuery the query, which should return the identifier. Defaults to <tt>call identity()</tt>
-     */
-    public void setClassIdentityQuery(String classIdentityQuery) {
-        Assert.hasText(classIdentityQuery, "New classIdentityQuery query is required");
-        this.classIdentityQuery = classIdentityQuery;
-    }
-
-    /**
-     * Sets the query that will be used to retrieve the identity of a newly created row in the <tt>acl_sid</tt>
-     * table.
-     *
-     * @param sidIdentityQuery the query, which should return the identifier. Defaults to <tt>call identity()</tt>
-     */
-    public void setSidIdentityQuery(String sidIdentityQuery) {
-        Assert.hasText(sidIdentityQuery, "New sidIdentityQuery query is required");
-        this.sidIdentityQuery = sidIdentityQuery;
-    }
-
-    public void setDeleteEntryByObjectIdentityForeignKeySql(String deleteEntryByObjectIdentityForeignKey) {
-        this.deleteEntryByObjectIdentityForeignKey = deleteEntryByObjectIdentityForeignKey;
-    }
-
-    public void setDeleteObjectIdentityByPrimaryKeySql(String deleteObjectIdentityByPrimaryKey) {
-        this.deleteObjectIdentityByPrimaryKey = deleteObjectIdentityByPrimaryKey;
-    }
-
-    public void setInsertClassSql(String insertClass) {
-        this.insertClass = insertClass;
-    }
-
-    public void setInsertEntrySql(String insertEntry) {
-        this.insertEntry = insertEntry;
-    }
-
-    public void setInsertObjectIdentitySql(String insertObjectIdentity) {
-        this.insertObjectIdentity = insertObjectIdentity;
-    }
-
-    public void setInsertSidSql(String insertSid) {
-        this.insertSid = insertSid;
-    }
-
-    public void setClassPrimaryKeyQuery(String selectClassPrimaryKey) {
-        this.selectClassPrimaryKey = selectClassPrimaryKey;
-    }
-
-    public void setObjectIdentityPrimaryKeyQuery(String selectObjectIdentityPrimaryKey) {
-        this.selectObjectIdentityPrimaryKey = selectObjectIdentityPrimaryKey;
-    }
-
-    public void setSidPrimaryKeyQuery(String selectSidPrimaryKey) {
-        this.selectSidPrimaryKey = selectSidPrimaryKey;
-    }
-
-    public void setUpdateObjectIdentity(String updateObjectIdentity) {
-        this.updateObjectIdentity = updateObjectIdentity;
-    }
-
-    /**
-     * @param foreignKeysInDatabase if false this class will perform additional FK constrain checking, which may
-     * cause deadlocks (the default is true, so deadlocks are avoided but the database is expected to enforce FKs)
-     */
-    public void setForeignKeysInDatabase(boolean foreignKeysInDatabase) {
-        this.foreignKeysInDatabase = foreignKeysInDatabase;
-    }
-}

acl/src/main/java/org/springframework/security/acls/jdbc/LookupStrategy.java

@@ -1,47 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-
-import java.util.List;
-import java.util.Map;
-
-
-/**
- * Performs lookups for {@link org.springframework.security.acls.model.AclService}.
- *
- * @author Ben Alex
- */
-public interface LookupStrategy {
-    //~ Methods ========================================================================================================
-
-    /**
-     * Perform database-specific optimized lookup.
-     *
-     * @param objects the identities to lookup (required)
-     * @param sids the SIDs for which identities are required (may be <tt>null</tt> - implementations may elect not
-     *        to provide SID optimisations)
-     *
-     * @return a <tt>Map</tt> where keys represent the {@link ObjectIdentity} of the located {@link Acl} and values
-     *         are the located {@link Acl} (never <tt>null</tt> although some entries may be missing; this method
-     *         should not throw {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used
-     *         to automatically create entries if required)
-     */
-    Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids);
-}

acl/src/main/java/org/springframework/security/acls/jdbc/package-info.java

@@ -1,5 +0,0 @@
-/**
- * JDBC-based persistence of ACL information
- */
-package org.springframework.security.acls.jdbc;
-

acl/src/main/java/org/springframework/security/acls/model/AccessControlEntry.java

@@ -1,55 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-import java.io.Serializable;
-
-
-/**
- * Represents an individual permission assignment within an {@link Acl}.
- *
- * <p>
- * Instances MUST be immutable, as they are returned by <code>Acl</code>
- * and should not allow client modification.
- * </p>
- *
- * @author Ben Alex
- *
- */
-public interface AccessControlEntry extends Serializable {
-    //~ Methods ========================================================================================================
-
-    Acl getAcl();
-
-    /**
-     * Obtains an identifier that represents this ACE.
-     *
-     * @return the identifier, or <code>null</code> if unsaved
-     */
-    Serializable getId();
-
-    Permission getPermission();
-
-    Sid getSid();
-
-    /**
-     * Indicates the a Permission is being granted to the relevant Sid. If false, indicates the permission is
-     * being revoked/blocked.
-     *
-     * @return true if being granted, false otherwise
-     */
-    boolean isGranting();
-}

acl/src/main/java/org/springframework/security/acls/model/Acl.java

@@ -1,168 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-import java.io.Serializable;
-import java.util.List;
-
-
-/**
- * Represents an access control list (ACL) for a domain object.
- *
- * <p>
- * An <tt>Acl</tt> represents all ACL entries for a given domain object. In
- * order to avoid needing references to the domain object itself, this
- * interface handles indirection between a domain object and an ACL object
- * identity via the {@link
- * org.springframework.security.acls.model.ObjectIdentity} interface.
- * </p>
- *
- * <p>
- * Implementing classes may elect to return instances that represent
- * {@link org.springframework.security.acls.model.Permission} information for either
- * some OR all {@link org.springframework.security.acls.model.Sid}
- * instances. Therefore, an instance may NOT necessarily contain ALL <tt>Sid</tt>s
- * for a given domain object.
- * </p>
- *
- * @author Ben Alex
- */
-public interface Acl extends Serializable {
-
-    /**
-     * Returns all of the entries represented by the present <tt>Acl</tt>. Entries associated with
-     * the <tt>Acl</tt> parents are not returned.
-     *
-     * <p>This method is typically used for administrative purposes.</p>
-     *
-     * <p>The order that entries appear in the array is important for methods declared in the
-     * {@link MutableAcl} interface. Furthermore, some implementations MAY use ordering as
-     * part of advanced permission checking.</p>
-     *
-     * <p>Do <em>NOT</em> use this method for making authorization decisions. Instead use {@link
-     * #isGranted(List, List, boolean)}.</p>
-     *
-     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of
-     * <tt>Sid</tt>s. The caller is responsible for correctly handling the result if only a subset of
-     * <tt>Sid</tt>s is represented.</p>
-     *
-     * @return the list of entries represented by the <tt>Acl</tt>, or <tt>null</tt> if there are
-     * no entries presently associated with this <tt>Acl</tt>.
-     */
-    List<AccessControlEntry> getEntries();
-
-    /**
-     * Obtains the domain object this <tt>Acl</tt> provides entries for. This is immutable once an
-     * <tt>Acl</tt> is created.
-     *
-     * @return the object identity (never <tt>null</tt>)
-     */
-    ObjectIdentity getObjectIdentity();
-
-    /**
-     * Determines the owner of the <tt>Acl</tt>. The meaning of ownership varies by implementation and is
-     * unspecified.
-     *
-     * @return the owner (may be <tt>null</tt> if the implementation does not use ownership concepts)
-     */
-    Sid getOwner();
-
-    /**
-     * A domain object may have a parent for the purpose of ACL inheritance. If there is a parent, its ACL can
-     * be accessed via this method. In turn, the parent's parent (grandparent) can be accessed and so on.
-     *
-     * <p>This method solely represents the presence of a navigation hierarchy between the parent <tt>Acl</tt> and this
-     * <tt>Acl</tt>. For actual inheritance to take place, the {@link #isEntriesInheriting()} must also be
-     * <tt>true</tt>.</p>
-     *
-     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of
-     * <tt>Sid</tt>s. The caller is responsible for correctly handling the result if only a subset of
-     * <tt>Sid</tt>s is represented.</p>
-     *
-     * @return the parent <tt>Acl</tt> (may be <tt>null</tt> if this <tt>Acl</tt> does not have a parent)
-     */
-    Acl getParentAcl();
-
-    /**
-     * Indicates whether the ACL entries from the {@link #getParentAcl()} should flow down into the current
-     * <tt>Acl</tt>.<p>The mere link between an <tt>Acl</tt> and a parent <tt>Acl</tt> on its own
-     * is insufficient to cause ACL entries to inherit down. This is because a domain object may wish to have entirely
-     * independent entries, but maintain the link with the parent for navigation purposes. Thus, this method denotes
-     * whether or not the navigation relationship also extends to the actual inheritance of entries.</p>
-     *
-     * @return <tt>true</tt> if parent ACL entries inherit into the current <tt>Acl</tt>
-     */
-    boolean isEntriesInheriting();
-
-    /**
-     * This is the actual authorization logic method, and must be used whenever ACL authorization decisions are
-     * required.
-     *
-     * <p>An array of <tt>Sid</tt>s are presented, representing security identifies of the current
-     * principal. In addition, an array of <tt>Permission</tt>s is presented which will have one or more bits set
-     * in order to indicate the permissions needed for an affirmative authorization decision. An array is presented
-     * because holding <em>any</em> of the <tt>Permission</tt>s inside the array will be sufficient for an
-     * affirmative authorization.</p>
-     *
-     * <p>The actual approach used to make authorization decisions is left to the implementation and is not
-     * specified by this interface. For example, an implementation <em>MAY</em> search the current ACL in the order
-     * the ACL entries have been stored. If a single entry is found that has the same active bits as are shown in a
-     * passed <tt>Permission</tt>, that entry's grant or deny state may determine the authorization decision. If
-     * the case of a deny state, the deny decision will only be relevant if all other <tt>Permission</tt>s passed
-     * in the array have also been unsuccessfully searched. If no entry is found that match the bits in the current
-     * ACL, provided that {@link #isEntriesInheriting()} is <tt>true</tt>, the authorization decision may be
-     * passed to the parent ACL. If there is no matching entry, the implementation MAY throw an exception, or make a
-     * predefined authorization decision.</p>
-     *
-     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of <tt>Sid</tt>s,
-     * although the implementation is permitted to throw one of the signature-defined exceptions if the method
-     * is called requesting an authorization decision for a {@link Sid} that was never loaded in this <tt>Acl</tt>.
-     * </p>
-     *
-     * @param permission the permission or permissions required (at least one entry required)
-     * @param sids the security identities held by the principal (at least one entry required)
-     * @param administrativeMode if <tt>true</tt> denotes the query is for administrative purposes and no logging
-     *        or auditing (if supported by the implementation) should be undertaken
-     *
-     * @return <tt>true</tt> if authorization is granted
-     *
-     * @throws NotFoundException MUST be thrown if an implementation cannot make an authoritative authorization
-     *         decision, usually because there is no ACL information for this particular permission and/or SID
-     * @throws UnloadedSidException thrown if the <tt>Acl</tt> does not have details for one or more of the
-     *         <tt>Sid</tt>s passed as arguments
-     */
-    boolean isGranted(List<Permission> permission, List<Sid> sids, boolean administrativeMode)
-        throws NotFoundException, UnloadedSidException;
-
-    /**
-     * For efficiency reasons an <tt>Acl</tt> may be loaded and <em>not</em> contain entries for every
-     * <tt>Sid</tt> in the system. If an <tt>Acl</tt> has been loaded and does not represent every
-     * <tt>Sid</tt>, all methods of the <tt>Acl</tt> can only be used within the limited scope of the
-     * <tt>Sid</tt> instances it actually represents.
-     * <p>
-     * It is normal to load an <tt>Acl</tt> for only particular <tt>Sid</tt>s if read-only authorization
-     * decisions are being made. However, if user interface reporting or modification of <tt>Acl</tt>s are
-     * desired, an <tt>Acl</tt> should be loaded with all <tt>Sid</tt>s. This method denotes whether or
-     * not the specified <tt>Sid</tt>s have been loaded or not.
-     * </p>
-     *
-     * @param sids one or more security identities the caller is interest in knowing whether this <tt>Sid</tt>
-     *        supports
-     *
-     * @return <tt>true</tt> if every passed <tt>Sid</tt> is represented by this <tt>Acl</tt> instance
-     */
-    boolean isSidLoaded(List<Sid> sids);
-}

acl/src/main/java/org/springframework/security/acls/model/AclCache.java

@@ -1,42 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import org.springframework.security.acls.jdbc.JdbcAclService;
-
-import java.io.Serializable;
-
-
-/**
- * A caching layer for {@link JdbcAclService}.
- *
- * @author Ben Alex
- *
- */
-public interface AclCache {
-    //~ Methods ========================================================================================================
-
-    void evictFromCache(Serializable pk);
-
-    void evictFromCache(ObjectIdentity objectIdentity);
-
-    MutableAcl getFromCache(ObjectIdentity objectIdentity);
-
-    MutableAcl getFromCache(Serializable pk);
-
-    void putInCache(MutableAcl acl);
-
-    void clearCache();
-}

acl/src/main/java/org/springframework/security/acls/model/AclDataAccessException.java

@@ -1,31 +0,0 @@
-package org.springframework.security.acls.model;
-
-/**
- * Abstract base class for Acl data operations.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public abstract class AclDataAccessException extends RuntimeException {
-
-    /**
-     * Constructs an <code>AclDataAccessException</code> with the specified
-     * message and root cause.
-     *
-     * @param msg the detail message
-     * @param cause the root cause
-     */
-    public AclDataAccessException(String msg, Throwable cause) {
-        super(msg, cause);
-    }
-
-    /**
-     * Constructs an <code>AclDataAccessException</code> with the specified
-     * message and no root cause.
-     *
-     * @param msg the detail message
-     */
-    public AclDataAccessException(String msg) {
-        super(msg);
-    }
-}

acl/src/main/java/org/springframework/security/acls/model/AclService.java

@@ -1,98 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-import java.util.List;
-import java.util.Map;
-
-
-/**
- * Provides retrieval of {@link Acl} instances.
- *
- * @author Ben Alex
- */
-public interface AclService {
-    //~ Methods ========================================================================================================
-
-    /**
-     * Locates all object identities that use the specified parent.  This is useful for administration tools.
-     *
-     * @param parentIdentity to locate children of
-     *
-     * @return the children (or <tt>null</tt> if none were found)
-     */
-    List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity);
-
-    /**
-     * Same as {@link #readAclsById(List)} except it returns only a single Acl.
-     * <p>
-     * This method should not be called as it does not leverage the underlying implementation's potential ability to
-     * filter <tt>Acl</tt> entries based on a {@link Sid} parameter.</p>
-     *
-     * @param object to locate an {@link Acl} for
-     *
-     * @return the {@link Acl} for the requested {@link ObjectIdentity} (never <tt>null</tt>)
-     *
-     * @throws NotFoundException if an {@link Acl} was not found for the requested {@link ObjectIdentity}
-     */
-    Acl readAclById(ObjectIdentity object) throws NotFoundException;
-
-    /**
-     * Same as {@link #readAclsById(List, List)} except it returns only a single Acl.
-     *
-     * @param object to locate an {@link Acl} for
-     * @param sids the security identities for which  {@link Acl} information is required
-     *        (may be <tt>null</tt> to denote all entries)
-     *
-     * @return the {@link Acl} for the requested {@link ObjectIdentity} (never <tt>null</tt>)
-     *
-     * @throws NotFoundException if an {@link Acl} was not found for the requested {@link ObjectIdentity}
-     */
-    Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException;
-
-    /**
-     * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s.<p>The returned map is
-     * keyed on the passed objects, with the values being the <tt>Acl</tt> instances. Any unknown objects will not
-     * have a map key.</p>
-     *
-     * @param objects the objects to find {@link Acl} information for
-     *
-     * @return a map with exactly one element for each {@link ObjectIdentity} passed as an argument (never <tt>null</tt>)
-     *
-     * @throws NotFoundException if an {@link Acl} was not found for each requested {@link ObjectIdentity}
-     */
-    Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects) throws NotFoundException;
-
-    /**
-     * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s, but only for the
-     * security identifies passed.<p>Implementations <em>MAY</em> provide a subset of the ACLs via this method
-     * although this is NOT a requirement. This is intended to allow performance optimisations within implementations.
-     * Callers should therefore use this method in preference to the alternative overloaded version which does not
-     * have performance optimisation opportunities.</p>
-     *  <p>The returned map is keyed on the passed objects, with the values being the <tt>Acl</tt>
-     * instances. Any unknown objects (or objects for which the interested <tt>Sid</tt>s do not have entries) will
-     * not have a map key.</p>
-     *
-     * @param objects the objects to find {@link Acl} information for
-     * @param sids the security identities for which  {@link Acl} information is required
-     *        (may be <tt>null</tt> to denote all entries)
-     *
-     * @return a map with exactly one element for each {@link ObjectIdentity} passed as an argument (never <tt>null</tt>)
-     *
-     * @throws NotFoundException if an {@link Acl} was not found for each requested {@link ObjectIdentity}
-     */
-    Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/AlreadyExistsException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * Thrown if an <code>Acl</code> entry already exists for the object.
- *
- * @author Ben Alex
- */
-public class AlreadyExistsException extends AclDataAccessException {
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructs an <code>AlreadyExistsException</code> with the specified message.
-     *
-     * @param msg the detail message
-     */
-    public AlreadyExistsException(String msg) {
-        super(msg);
-    }
-
-    /**
-     * Constructs an <code>AlreadyExistsException</code> with the specified message
-     * and root cause.
-     *
-     * @param msg the detail message
-     * @param t root cause
-     */
-    public AlreadyExistsException(String msg, Throwable t) {
-        super(msg, t);
-    }
-}

acl/src/main/java/org/springframework/security/acls/model/AuditableAccessControlEntry.java

@@ -1,30 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * Represents an ACE that provides auditing information.
- *
- * @author Ben Alex
- *
- */
-public interface AuditableAccessControlEntry extends AccessControlEntry {
-    //~ Methods ========================================================================================================
-
-    boolean isAuditFailure();
-
-    boolean isAuditSuccess();
-}

acl/src/main/java/org/springframework/security/acls/model/AuditableAcl.java

@@ -1,28 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * A mutable ACL that provides audit capabilities.
- *
- * @author Ben Alex
- *
- */
-public interface AuditableAcl extends MutableAcl {
-    //~ Methods ========================================================================================================
-
-    void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure);
-}

acl/src/main/java/org/springframework/security/acls/model/ChildrenExistException.java

@@ -1,46 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * Thrown if an {@link Acl} cannot be deleted because children <code>Acl</code>s exist.
- *
- * @author Ben Alex
- */
-public class ChildrenExistException extends AclDataAccessException {
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructs an <code>ChildrenExistException</code> with the specified
-     * message.
-     *
-     * @param msg the detail message
-     */
-    public ChildrenExistException(String msg) {
-        super(msg);
-    }
-
-    /**
-     * Constructs an <code>ChildrenExistException</code> with the specified
-     * message and root cause.
-     *
-     * @param msg the detail message
-     * @param t root cause
-     */
-    public ChildrenExistException(String msg, Throwable t) {
-        super(msg, t);
-    }
-}

acl/src/main/java/org/springframework/security/acls/model/MutableAcl.java

@@ -1,67 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-
-
-/**
- * A mutable <tt>Acl</tt>.
- * <p>
- * A mutable ACL must ensure that appropriate security checks are performed
- * before allowing access to its methods.
- *
- * @author Ben Alex
- */
-public interface MutableAcl extends Acl {
-    //~ Methods ========================================================================================================
-
-    void deleteAce(int aceIndex) throws NotFoundException;
-
-    /**
-     * Obtains an identifier that represents this <tt>MutableAcl</tt>.
-     *
-     * @return the identifier, or <tt>null</tt> if unsaved
-     */
-    Serializable getId();
-
-    void insertAce(int atIndexLocation, Permission permission, Sid sid, boolean granting)
-        throws NotFoundException;
-
-    /**
-     * Changes the present owner to a different owner.
-     *
-     * @param newOwner the new owner (mandatory; cannot be null)
-     */
-    void setOwner(Sid newOwner);
-
-    /**
-     * Change the value returned by {@link Acl#isEntriesInheriting()}.
-     *
-     * @param entriesInheriting the new value
-     */
-    void setEntriesInheriting(boolean entriesInheriting);
-
-    /**
-     * Changes the parent of this ACL.
-     *
-     * @param newParent the new parent
-     */
-    void setParent(Acl newParent);
-
-    void updateAce(int aceIndex, Permission permission)
-        throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/MutableAclService.java

@@ -1,61 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-
-/**
- * Provides support for creating and storing <code>Acl</code> instances.
- *
- * @author Ben Alex
- */
-public interface MutableAclService extends AclService {
-    //~ Methods ========================================================================================================
-
-    /**
-     * Creates an empty <code>Acl</code> object in the database. It will have no entries. The returned object
-     * will then be used to add entries.
-     *
-     * @param objectIdentity the object identity to create
-     *
-     * @return an ACL object with its ID set
-     *
-     * @throws AlreadyExistsException if the passed object identity already has a record
-     */
-    MutableAcl createAcl(ObjectIdentity objectIdentity)
-        throws AlreadyExistsException;
-
-    /**
-     * Removes the specified entry from the database.
-     *
-     * @param objectIdentity the object identity to remove
-     * @param deleteChildren whether to cascade the delete to children
-     *
-     * @throws ChildrenExistException if the deleteChildren argument was <code>false</code> but children exist
-     */
-    void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren)
-        throws ChildrenExistException;
-
-    /**
-     * Changes an existing <code>Acl</code> in the database.
-     *
-     * @param acl to modify
-     *
-     * @throws NotFoundException if the relevant record could not be found (did you remember to use {@link
-     *         #createAcl(ObjectIdentity)} to create the object, rather than creating it with the <code>new</code>
-     *         keyword?)
-     */
-    MutableAcl updateAcl(MutableAcl acl) throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/NotFoundException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * Thrown if an ACL-related object cannot be found.
- *
- * @author Ben Alex
- */
-public class NotFoundException extends AclDataAccessException {
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructs an <code>NotFoundException</code> with the specified message.
-     *
-     * @param msg the detail message
-     */
-    public NotFoundException(String msg) {
-        super(msg);
-    }
-
-    /**
-     * Constructs an <code>NotFoundException</code> with the specified message
-     * and root cause.
-     *
-     * @param msg the detail message
-     * @param t root cause
-     */
-    public NotFoundException(String msg, Throwable t) {
-        super(msg, t);
-    }
-}

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java

@@ -1,71 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-
-/**
- * Represents the identity of an individual domain object instance.
- *
- * <p>
- * As implementations of <tt>ObjectIdentity</tt> are used as the key to represent
- * domain objects in the ACL subsystem, it is essential that implementations provide
- * methods so that object-equality rather than reference-equality can be relied upon
- * reliably. In other words, the ACL subsystem can consider two
- * <tt>ObjectIdentity</tt>s equal if <tt>identity1.equals(identity2)</tt>, rather than
- * reference-equality of <tt>identity1==identity2</tt>.
- * </p>
- *
- * @author Ben Alex
- */
-public interface ObjectIdentity extends Serializable {
-    //~ Methods ========================================================================================================
-
-    /**
-     * @param obj to be compared
-     *
-     * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
-     * @see Object#equals(Object)
-     */
-    boolean equals(Object obj);
-
-    /**
-     * Obtains the actual identifier. This identifier must not be reused to represent other domain objects with
-     * the same <tt>javaType</tt>.
-     *
-     * <p>Because ACLs are largely immutable, it is strongly recommended to use
-     * a synthetic identifier (such as a database sequence number for the primary key). Do not use an identifier with
-     * business meaning, as that business meaning may change in the future such change will cascade to the ACL
-     * subsystem data.</p>
-     *
-     * @return the identifier (unique within this <tt>type</tt>; never <tt>null</tt>)
-     */
-    Serializable getIdentifier();
-
-    /**
-     * Obtains the "type" metadata for the domain object. This will often be a Java type name (an interface or a class)
-     * &ndash; traditionally it is the name of the domain object implementation class.
-     *
-     * @return the "type" of the domain object (never <tt>null</tt>).
-     */
-    String getType();
-
-    /**
-     * @return a hash code representation of the <tt>ObjectIdentity</tt>
-     * @see Object#hashCode()
-     */
-    int hashCode();
-}

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentityGenerator.java

@@ -1,26 +0,0 @@
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-
-/**
- * Strategy which creates an {@link ObjectIdentity} from an object identifier (such as a primary key)
- * and type information.
- * <p>
- * Differs from {@link ObjectIdentityRetrievalStrategy} in that it is used in situations when the actual object
- * instance isn't available.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public interface ObjectIdentityGenerator {
-
-    /**
-     *
-     * @param id the identifier of the domain object, not null
-     * @param type the type of the object (often a class name), not null
-     * @return the identity constructed using the supplied identifier and type information.
-     */
-    ObjectIdentity createObjectIdentity(Serializable id, String type);
-
-}

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentityRetrievalStrategy.java

@@ -1,30 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.model;
-
-
-/**
- * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
- * will be returned for a particular domain object
- *
- * @author Ben Alex
- *
- */
-public interface ObjectIdentityRetrievalStrategy {
-    //~ Methods ========================================================================================================
-
-    ObjectIdentity getObjectIdentity(Object domainObject);
-}

acl/src/main/java/org/springframework/security/acls/model/OwnershipAcl.java

@@ -1,32 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-
-/**
- * A mutable ACL that provides ownership capabilities.
- *
- * <p>
- * Generally the owner of an ACL is able to call any ACL mutator method, as
- * well as assign a new owner.
- *
- * @author Ben Alex
- */
-public interface OwnershipAcl extends MutableAcl {
-    //~ Methods ========================================================================================================
-
-    void setOwner(Sid newOwner);
-}

acl/src/main/java/org/springframework/security/acls/model/Permission.java

@@ -1,57 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * Represents a permission granted to a <tt>Sid</tt> for a given domain object.
- *
- * @author Ben Alex
- */
-public interface Permission extends Serializable {
-    //~ Static fields/initializers =====================================================================================
-
-    char RESERVED_ON = '~';
-    char RESERVED_OFF = '.';
-    String THIRTY_TWO_RESERVED_OFF = "................................";
-
-    //~ Methods ========================================================================================================
-
-    /**
-     * Returns the bits that represents the permission.
-     *
-     * @return the bits that represent the permission
-     */
-    int getMask();
-
-    /**
-     * Returns a 32-character long bit pattern <code>String</code> representing this permission.
-     * <p>
-     * Implementations are free to format the pattern as they see fit, although under no circumstances may
-     * {@link #RESERVED_OFF} or {@link #RESERVED_ON} be used within the pattern. An exemption is in the case of
-     * {@link #RESERVED_OFF} which is used to denote a bit that is off (clear).
-     * Implementations may also elect to use {@link #RESERVED_ON} internally for computation purposes,
-     * although this method may not return any <code>String</code> containing {@link #RESERVED_ON}.
-     * <p>
-     * The returned String must be 32 characters in length.
-     * <p>
-     * This method is only used for user interface and logging purposes. It is not used in any permission
-     * calculations. Therefore, duplication of characters within the output is permitted.
-     *
-     * @return a 32-character bit pattern
-     */
-    String getPattern();
-}

acl/src/main/java/org/springframework/security/acls/model/PermissionGrantingStrategy.java

@@ -1,20 +0,0 @@
-package org.springframework.security.acls.model;
-
-import java.util.List;
-
-/**
- * Allow customization of the logic for determining whether a permission or permissions are granted to a particular
- * sid or sids by an {@link Acl}.
- *
- * @author Luke Taylor
- * @since 3.0.2
- */
-public interface PermissionGrantingStrategy {
-
-    /**
-     * Returns true if the the supplied strategy decides that the supplied {@code Acl} grants access
-     * based on the supplied list of permissions and sids.
-     */
-    boolean isGranted(Acl acl, List<Permission> permission, List<Sid> sids, boolean administrativeMode);
-
-}

acl/src/main/java/org/springframework/security/acls/model/Sid.java

@@ -1,51 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * A security identity recognised by the ACL system.
- *
- * <p>
- * This interface provides indirection between actual security objects (eg
- * principals, roles, groups etc) and what is stored inside an
- * <code>Acl</code>. This is because an <code>Acl</code> will not store an
- * entire security object, but only an abstraction of it. This interface
- * therefore provides a simple way to compare these abstracted security
- * identities with other security identities and actual security objects.
- * </p>
- *
- * @author Ben Alex
- */
-public interface Sid extends Serializable {
-    //~ Methods ========================================================================================================
-
-    /**
-     * Refer to the <code>java.lang.Object</code> documentation for the interface contract.
-     *
-     * @param obj to be compared
-     *
-     * @return <code>true</code> if the objects are equal, <code>false</code> otherwise
-     */
-    boolean equals(Object obj);
-
-    /**
-     * Refer to the <code>java.lang.Object</code> documentation for the interface contract.
-     *
-     * @return a hash code representation of this object
-     */
-    int hashCode();
-}

acl/src/main/java/org/springframework/security/acls/model/SidRetrievalStrategy.java

@@ -1,33 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.model;
-
-import java.util.List;
-
-import org.springframework.security.core.Authentication;
-
-
-/**
- * Strategy interface that provides an ability to determine the {@link Sid} instances applicable
- * for an {@link Authentication}.
- *
- * @author Ben Alex
- */
-public interface SidRetrievalStrategy {
-    //~ Methods ========================================================================================================
-
-    List<Sid> getSids(Authentication authentication);
-}

acl/src/main/java/org/springframework/security/acls/model/UnloadedSidException.java

@@ -1,46 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-
-/**
- * Thrown if an {@link Acl} cannot perform an operation because it only loaded a subset of <code>Sid</code>s and
- * the caller has requested details for an unloaded <code>Sid</code>.
- *
- * @author Ben Alex
- */
-public class UnloadedSidException extends AclDataAccessException {
-    //~ Constructors ===================================================================================================
-
-    /**
-     * Constructs an <code>NotFoundException</code> with the specified message.
-     *
-     * @param msg the detail message
-     */
-    public UnloadedSidException(String msg) {
-        super(msg);
-    }
-
-    /**
-     * Constructs an <code>NotFoundException</code> with the specified message
-     * and root cause.
-     *
-     * @param msg the detail message
-     * @param t root cause
-     */
-    public UnloadedSidException(String msg, Throwable t) {
-        super(msg, t);
-    }
-}

acl/src/main/java/org/springframework/security/acls/model/package-info.java

@@ -1,5 +0,0 @@
-/**
- * Interfaces and shared classes to manage access control lists (ACLs) for domain object instances.
- */
-package org.springframework.security.acls.model;
-

acl/src/main/java/org/springframework/security/acls/package-info.java

@@ -1,9 +0,0 @@
-/**
- * The Spring Security ACL package which implements instance-based security for domain objects.
- * <p>
- * Consider using the annotation based approach ({@code @PreAuthorize}, {@code @PostFilter} annotations) combined
- * with a {@link org.springframework.security.acls.AclPermissionEvaluator} in preference to the older and more verbose
- * attribute/voter/after-invocation approach from versions before Spring Security 3.0.
- */
-package org.springframework.security.acls;
-

acl/src/main/resources/createAclSchema.sql

@@ -1,46 +0,0 @@
--- ACL schema sql used in HSQLDB
-
--- drop table acl_entry;
--- drop table acl_object_identity;
--- drop table acl_class;
--- drop table acl_sid;
-
-
-create table acl_sid(
-    id bigint generated by default as identity(start with 100) not null primary key,
-    principal boolean not null,
-    sid varchar_ignorecase(100) not null,
-    constraint unique_uk_1 unique(sid,principal));
-
-create table acl_class(
-    id bigint generated by default as identity(start with 100) not null primary key,
-    class varchar_ignorecase(100) not null,
-    constraint unique_uk_2 unique(class)
-);
-
-create table acl_object_identity(
-    id bigint generated by default as identity(start with 100) not null primary key,
-    object_id_class bigint not null,
-    object_id_identity bigint not null,
-    parent_object bigint,
-    owner_sid bigint,
-    entries_inheriting boolean not null,
-    constraint unique_uk_3 unique(object_id_class,object_id_identity),
-    constraint foreign_fk_1 foreign key(parent_object)references acl_object_identity(id),
-    constraint foreign_fk_2 foreign key(object_id_class)references acl_class(id),
-    constraint foreign_fk_3 foreign key(owner_sid)references acl_sid(id)
-);
-
-create table acl_entry(
-    id bigint generated by default as identity(start with 100) not null primary key,
-    acl_object_identity bigint not null,
-    ace_order int not null,
-    sid bigint not null,
-    mask integer not null,
-    granting boolean not null,
-    audit_success boolean not null,
-    audit_failure boolean not null,
-    constraint unique_uk_4 unique(acl_object_identity,ace_order),
-    constraint foreign_fk_4 foreign key(acl_object_identity) references acl_object_identity(id),
-    constraint foreign_fk_5 foreign key(sid) references acl_sid(id)
-);

acl/src/main/resources/createAclSchemaPostgres.sql

@@ -1,46 +0,0 @@
--- ACL Schema SQL for PostgreSQL
-
--- drop table acl_entry;
--- drop table acl_object_identity;
--- drop table acl_class;
--- drop table acl_sid;
-
-create table acl_sid(
-    id bigserial not null primary key,
-    principal boolean not null,
-    sid varchar(100) not null,
-    constraint unique_uk_1 unique(sid,principal)
-);
-
-create table acl_class(
-    id bigserial not null primary key,
-    class varchar(100) not null,
-    constraint unique_uk_2 unique(class)
-);
-
-create table acl_object_identity(
-    id bigserial primary key,
-    object_id_class bigint not null,
-    object_id_identity bigint not null,
-    parent_object bigint,
-    owner_sid bigint,
-    entries_inheriting boolean not null,
-    constraint unique_uk_3 unique(object_id_class,object_id_identity),
-    constraint foreign_fk_1 foreign key(parent_object)references acl_object_identity(id),
-    constraint foreign_fk_2 foreign key(object_id_class)references acl_class(id),
-    constraint foreign_fk_3 foreign key(owner_sid)references acl_sid(id)
-);
-
-create table acl_entry(
-    id bigserial primary key,
-    acl_object_identity bigint not null,
-    ace_order int not null,
-    sid bigint not null,
-    mask integer not null,
-    granting boolean not null,
-    audit_success boolean not null,
-    audit_failure boolean not null,
-    constraint unique_uk_4 unique(acl_object_identity,ace_order),
-    constraint foreign_fk_4 foreign key(acl_object_identity) references acl_object_identity(id),
-    constraint foreign_fk_5 foreign key(sid) references acl_sid(id)
-);

acl/src/main/resources/select.sql

@@ -1,39 +0,0 @@
--- Not required. Just shows the sort of queries being sent to DB.
-
-
-select  acl_object_identity.object_id_identity,
-        acl_entry.ace_order,
-        acl_object_identity.id as acl_id,
-        acl_object_identity.parent_object,
-        acl_object_identity,
-        entries_inheriting,
-        acl_entry.id as ace_id,
-        acl_entry.mask,
-        acl_entry.granting,
-        acl_entry.audit_success,
-        acl_entry.audit_failure,
-        acl_sid.principal as ace_principal,
-        acl_sid.sid as ace_sid,
-        acli_sid.principal as acl_principal,
-        acli_sid.sid as acl_sid,
-        acl_class.class
-
-from    acl_object_identity,
-        acl_sid acli_sid,
-        acl_class
-
-left join acl_entry on acl_object_identity.id = acl_entry.acl_object_identity
-left join acl_sid on acl_entry.sid = acl_sid.id
-
-where
-    acli_sid.id = acl_object_identity.owner_sid
-
-and acl_class.id = acl_object_identity.object_id_class
-
-and (
-
-    (acl_object_identity.object_id_identity = 1 and acl_class.class = 'sample.contact.contact')
-or
-    (acl_object_identity.object_id_identity = 2000 and acl_class.class = 'sample.contact.contact')
-
-) order by acl_object_identity.object_id_identity asc, acl_entry.ace_order asc

acl/src/test/java/org/springframework/security/acls/AclFormattingUtilsTests.java

@@ -1,127 +0,0 @@
-package org.springframework.security.acls;
-
-import org.springframework.security.acls.domain.AclFormattingUtils;
-import org.springframework.security.acls.model.Permission;
-
-import junit.framework.Assert;
-import junit.framework.TestCase;
-
-/**
- * Tests for {@link AclFormattingUtils}.
- *
- * @author Andrei Stefan
- */
-public class AclFormattingUtilsTests extends TestCase {
-
-    //~ Methods ========================================================================================================
-
-    public final void testDemergePatternsParametersConstraints() throws Exception {
-        try {
-            AclFormattingUtils.demergePatterns(null, "SOME STRING");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.demergePatterns("SOME STRING", null);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.demergePatterns("SOME STRING", "LONGER SOME STRING");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.demergePatterns("SOME STRING", "SAME LENGTH");
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-    }
-
-    public final void testDemergePatterns() throws Exception {
-        String original = "...........................A...R";
-        String removeBits = "...............................R";
-        Assert.assertEquals("...........................A....", AclFormattingUtils
-                .demergePatterns(original, removeBits));
-
-        Assert.assertEquals("ABCDEF", AclFormattingUtils.demergePatterns("ABCDEF", "......"));
-        Assert.assertEquals("......", AclFormattingUtils.demergePatterns("ABCDEF", "GHIJKL"));
-    }
-
-    public final void testMergePatternsParametersConstraints() throws Exception {
-        try {
-            AclFormattingUtils.mergePatterns(null, "SOME STRING");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.mergePatterns("SOME STRING", null);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.mergePatterns("SOME STRING", "LONGER SOME STRING");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.mergePatterns("SOME STRING", "SAME LENGTH");
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-    }
-
-    public final void testMergePatterns() throws Exception {
-        String original = "...............................R";
-        String extraBits = "...........................A....";
-        Assert.assertEquals("...........................A...R", AclFormattingUtils
-                .mergePatterns(original, extraBits));
-
-        Assert.assertEquals("ABCDEF", AclFormattingUtils.mergePatterns("ABCDEF", "......"));
-        Assert.assertEquals("GHIJKL", AclFormattingUtils.mergePatterns("ABCDEF", "GHIJKL"));
-    }
-
-    public final void testBinaryPrints() throws Exception {
-        Assert.assertEquals("............................****", AclFormattingUtils.printBinary(15));
-
-        try {
-            AclFormattingUtils.printBinary(15, Permission.RESERVED_ON);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            AclFormattingUtils.printBinary(15, Permission.RESERVED_OFF);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.assertTrue(true);
-        }
-
-        Assert.assertEquals("............................xxxx", AclFormattingUtils.printBinary(15, 'x'));
-    }
-}

acl/src/test/java/org/springframework/security/acls/AclPermissionCacheOptimizerTests.java

@@ -1,56 +0,0 @@
-package org.springframework.security.acls;
-
-import static org.mockito.Mockito.*;
-
-import org.junit.Test;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * @author Luke Taylor
- */
-@SuppressWarnings({"unchecked"})
-public class AclPermissionCacheOptimizerTests {
-
-    @Test
-    public void eagerlyLoadsRequiredAcls() throws Exception {
-        AclService service = mock(AclService.class);
-        AclPermissionCacheOptimizer pco = new AclPermissionCacheOptimizer(service);
-        ObjectIdentityRetrievalStrategy oidStrat = mock(ObjectIdentityRetrievalStrategy.class);
-        SidRetrievalStrategy sidStrat = mock(SidRetrievalStrategy.class);
-        pco.setObjectIdentityRetrievalStrategy(oidStrat);
-        pco.setSidRetrievalStrategy(sidStrat);
-        Object[] dos = {new Object(), null, new Object()};
-        ObjectIdentity[] oids = {new ObjectIdentityImpl("A", "1"), new ObjectIdentityImpl("A", "2")};
-        when(oidStrat.getObjectIdentity(dos[0])).thenReturn(oids[0]);
-        when(oidStrat.getObjectIdentity(dos[2])).thenReturn(oids[1]);
-
-        pco.cachePermissionsFor(mock(Authentication.class), Arrays.asList(dos));
-
-        // AclService should be invoked with the list of required Oids
-        verify(service).readAclsById(eq(Arrays.asList(oids)), any(List.class));
-    }
-
-    @Test
-    public void ignoresEmptyCollection() {
-        AclService service = mock(AclService.class);
-        AclPermissionCacheOptimizer pco = new AclPermissionCacheOptimizer(service);
-        ObjectIdentityRetrievalStrategy oids = mock(ObjectIdentityRetrievalStrategy.class);
-        SidRetrievalStrategy sids = mock(SidRetrievalStrategy.class);
-        pco.setObjectIdentityRetrievalStrategy(oids);
-        pco.setSidRetrievalStrategy(sids);
-
-        pco.cachePermissionsFor(mock(Authentication.class), Collections.emptyList());
-
-        verifyZeroInteractions(service, sids, oids);
-    }
-
-}

acl/src/test/java/org/springframework/security/acls/AclPermissionEvaluatorTests.java

@@ -1,39 +0,0 @@
-package org.springframework.security.acls;
-
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Matchers.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.Test;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-/**
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public class AclPermissionEvaluatorTests {
-
-    @Test
-    @SuppressWarnings("unchecked")
-    public void hasPermissionReturnsTrueIfAclGrantsPermission() throws Exception {
-        AclService service = mock(AclService.class);
-        AclPermissionEvaluator pe = new AclPermissionEvaluator(service);
-        ObjectIdentity oid = mock(ObjectIdentity.class);
-        ObjectIdentityRetrievalStrategy oidStrategy = mock(ObjectIdentityRetrievalStrategy.class);
-        when(oidStrategy.getObjectIdentity(anyObject())).thenReturn(oid);
-        pe.setObjectIdentityRetrievalStrategy(oidStrategy);
-        pe.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
-        Acl acl = mock(Acl.class);
-
-        when(service.readAclById(any(ObjectIdentity.class), anyList())).thenReturn(acl);
-        when(acl.isGranted(anyList(), anyList(), eq(false))).thenReturn(true);
-
-        assertTrue(pe.hasPermission(mock(Authentication.class), new Object(), "READ"));
-    }
-}

acl/src/test/java/org/springframework/security/acls/TargetObject.java

@@ -1,10 +0,0 @@
-package org.springframework.security.acls;
-
-/**
- * Dummy domain object class
- *
- * @author Luke Taylor
- */
-public final class TargetObject {
-
-}

acl/src/test/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProviderTests.java

@@ -1,64 +0,0 @@
-package org.springframework.security.acls.afterinvocation;
-
-import static org.junit.Assert.assertNull;
-import static org.junit.Assert.assertSame;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Matchers.any;
-import static org.mockito.Matchers.anyBoolean;
-import static org.mockito.Mockito.*;
-import static org.mockito.Mockito.when;
-
-import org.junit.Test;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.SecurityConfig;
-import org.springframework.security.acls.model.*;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.SpringSecurityMessageSource;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * @author Luke Taylor
- */
-@SuppressWarnings({"unchecked"})
-public class AclEntryAfterInvocationCollectionFilteringProviderTests {
-    @Test
-    public void objectsAreRemovedIfPermissionDenied() throws Exception {
-        AclService service = mock(AclService.class);
-        Acl acl = mock(Acl.class);
-        when(acl.isGranted(any(List.class), any(List.class), anyBoolean())).thenReturn(false);
-        when(service.readAclById(any(ObjectIdentity.class), any(List.class))).thenReturn(acl);
-        AclEntryAfterInvocationCollectionFilteringProvider provider = new AclEntryAfterInvocationCollectionFilteringProvider(service, Arrays.asList(mock(Permission.class)));
-        provider.setObjectIdentityRetrievalStrategy(mock(ObjectIdentityRetrievalStrategy.class));
-        provider.setProcessDomainObjectClass(Object.class);
-        provider.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
-
-        Object returned = provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), new ArrayList(Arrays.asList(new Object(), new Object())));
-        assertTrue(returned instanceof List);
-        assertTrue(((List)returned).isEmpty());
-        returned = provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("UNSUPPORTED", "AFTER_ACL_COLLECTION_READ"), new Object[] {new Object(), new Object()});
-        assertTrue(returned instanceof Object[]);
-        assertTrue(((Object[])returned).length == 0);
-    }
-
-    @Test
-    public void accessIsGrantedIfNoAttributesDefined() throws Exception {
-        AclEntryAfterInvocationCollectionFilteringProvider provider = new AclEntryAfterInvocationCollectionFilteringProvider(mock(AclService.class), Arrays.asList(mock(Permission.class)));
-        Object returned = new Object();
-
-        assertSame(returned, provider.decide(mock(Authentication.class), new Object(), Collections.<ConfigAttribute>emptyList(), returned));
-    }
-
-    @Test
-    public void nullReturnObjectIsIgnored() throws Exception {
-        AclService service = mock(AclService.class);
-        AclEntryAfterInvocationCollectionFilteringProvider provider = new AclEntryAfterInvocationCollectionFilteringProvider(service, Arrays.asList(mock(Permission.class)));
-
-        assertNull(provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null));
-        verify(service, never()).readAclById(any(ObjectIdentity.class), any(List.class));
-    }
-
-}

acl/src/test/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProviderTests.java

@@ -1,101 +0,0 @@
-package org.springframework.security.acls.afterinvocation;
-
-import static org.junit.Assert.*;
-import static org.mockito.Matchers.any;
-import static org.mockito.Mockito.*;
-
-import org.junit.Test;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.SecurityConfig;
-import org.springframework.security.acls.model.*;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.SpringSecurityMessageSource;
-
-import java.util.Arrays;
-import java.util.Collections;
-import java.util.List;
-
-/**
- * @author Luke Taylor
- */
-@SuppressWarnings({"unchecked"})
-public class AclEntryAfterInvocationProviderTests {
-
-    @Test(expected=IllegalArgumentException.class)
-    public void rejectsMissingPermissions() throws Exception {
-        try {
-            new AclEntryAfterInvocationProvider(mock(AclService.class), null);
-            fail("Exception expected");
-        } catch (IllegalArgumentException expected) {
-        }
-        new AclEntryAfterInvocationProvider(mock(AclService.class), Collections.<Permission>emptyList());
-    }
-
-    @Test
-    public void accessIsAllowedIfPermissionIsGranted() {
-        AclService service = mock(AclService.class);
-        Acl acl = mock(Acl.class);
-        when(acl.isGranted(any(List.class), any(List.class), anyBoolean())).thenReturn(true);
-        when(service.readAclById(any(ObjectIdentity.class), any(List.class))).thenReturn(acl);
-        AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(service, Arrays.asList(mock(Permission.class)));
-        provider.setMessageSource(new SpringSecurityMessageSource());
-        provider.setObjectIdentityRetrievalStrategy(mock(ObjectIdentityRetrievalStrategy.class));
-        provider.setProcessDomainObjectClass(Object.class);
-        provider.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
-        Object returned = new Object();
-
-        assertSame(returned, provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("AFTER_ACL_READ"), returned));
-    }
-
-    @Test
-    public void accessIsGrantedIfNoAttributesDefined() throws Exception {
-        AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(mock(AclService.class), Arrays.asList(mock(Permission.class)));
-        Object returned = new Object();
-
-        assertSame(returned, provider.decide(mock(Authentication.class), new Object(), Collections.<ConfigAttribute>emptyList(), returned));
-    }
-
-    @Test
-    public void accessIsGrantedIfObjectTypeNotSupported() throws Exception {
-        AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(mock(AclService.class), Arrays.asList(mock(Permission.class)));
-        provider.setProcessDomainObjectClass(String.class);
-        // Not a String
-        Object returned = new Object();
-
-        assertSame(returned, provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("AFTER_ACL_READ"), returned));
-    }
-
-
-    @Test(expected= AccessDeniedException.class)
-    public void accessIsDeniedIfPermissionIsNotGranted() {
-        AclService service = mock(AclService.class);
-        Acl acl = mock(Acl.class);
-        when(acl.isGranted(any(List.class), any(List.class), anyBoolean())).thenReturn(false);
-        // Try a second time with no permissions found
-        when(acl.isGranted(any(List.class), any(List.class), anyBoolean())).thenThrow(new NotFoundException(""));
-        when(service.readAclById(any(ObjectIdentity.class), any(List.class))).thenReturn(acl);
-        AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(service, Arrays.asList(mock(Permission.class)));
-        provider.setProcessConfigAttribute("MY_ATTRIBUTE");
-        provider.setMessageSource(new SpringSecurityMessageSource());
-        provider.setObjectIdentityRetrievalStrategy(mock(ObjectIdentityRetrievalStrategy.class));
-        provider.setProcessDomainObjectClass(Object.class);
-        provider.setSidRetrievalStrategy(mock(SidRetrievalStrategy.class));
-        try {
-            provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object());
-            fail();
-        } catch (AccessDeniedException expected) {
-        }
-        // Second scenario with no acls found
-        provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("UNSUPPORTED", "MY_ATTRIBUTE"), new Object());
-    }
-
-    @Test
-    public void nullReturnObjectIsIgnored() throws Exception {
-        AclService service = mock(AclService.class);
-        AclEntryAfterInvocationProvider provider = new AclEntryAfterInvocationProvider(service, Arrays.asList(mock(Permission.class)));
-
-        assertNull(provider.decide(mock(Authentication.class), new Object(), SecurityConfig.createList("AFTER_ACL_COLLECTION_READ"), null));
-        verify(service, never()).readAclById(any(ObjectIdentity.class), any(List.class));
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/AccessControlImplEntryTests.java

@@ -1,100 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.Test;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-
-/**
- * Tests for {@link AccessControlEntryImpl}.
- *
- * @author Andrei Stefan
- */
-public class AccessControlImplEntryTests {
-
-    //~ Methods ========================================================================================================
-
-    @Test
-    public void testConstructorRequiredFields() {
-        // Check Acl field is present
-        try {
-            new AccessControlEntryImpl(null, null, new PrincipalSid("johndoe"),
-                    BasePermission.ADMINISTRATION, true, true, true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        // Check Sid field is present
-        try {
-            new AccessControlEntryImpl(null, mock(Acl.class), null,
-                    BasePermission.ADMINISTRATION, true, true, true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        // Check Permission field is present
-        try {
-            new AccessControlEntryImpl(null, mock(Acl.class), new PrincipalSid("johndoe"), null,
-                    true, true, true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    public void testAccessControlEntryImplGetters() {
-        Acl mockAcl = mock(Acl.class);
-        Sid sid = new PrincipalSid("johndoe");
-
-        // Create a sample entry
-        AccessControlEntry ace = new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid, BasePermission.ADMINISTRATION,
-                true, true, true);
-
-        // and check every get() method
-        assertEquals(new Long(1), ace.getId());
-        assertEquals(mockAcl, ace.getAcl());
-        assertEquals(sid, ace.getSid());
-        assertTrue(ace.isGranting());
-        assertEquals(BasePermission.ADMINISTRATION, ace.getPermission());
-        assertTrue(((AuditableAccessControlEntry) ace).isAuditFailure());
-        assertTrue(((AuditableAccessControlEntry) ace).isAuditSuccess());
-    }
-
-    @Test
-    public void testEquals() {
-        final Acl mockAcl = mock(Acl.class);
-        final ObjectIdentity oid = mock(ObjectIdentity.class);
-
-        when(mockAcl.getObjectIdentity()).thenReturn(oid);
-        Sid sid = new PrincipalSid("johndoe");
-
-        AccessControlEntry ace = new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid, BasePermission.ADMINISTRATION,
-                true, true, true);
-
-        assertFalse(ace.equals(null));
-        assertFalse(ace.equals(Long.valueOf(100)));
-        assertTrue(ace.equals(ace));
-        assertTrue(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid,
-                BasePermission.ADMINISTRATION, true, true, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(2), mockAcl, sid,
-                BasePermission.ADMINISTRATION, true, true, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, new PrincipalSid("scott"),
-                BasePermission.ADMINISTRATION, true, true, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid, BasePermission.WRITE, true,
-                true, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid,
-                BasePermission.ADMINISTRATION, false, true, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid,
-                BasePermission.ADMINISTRATION, true, false, true)));
-        assertFalse(ace.equals(new AccessControlEntryImpl(Long.valueOf(1), mockAcl, sid,
-                BasePermission.ADMINISTRATION, true, true, false)));
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/AclImplTests.java

@@ -1,532 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-import static org.mockito.Mockito.*;
-
-import org.junit.*;
-import org.springframework.security.acls.model.*;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.util.FieldUtils;
-
-import java.lang.reflect.Field;
-import java.util.*;
-
-
-/**
- * Tests for {@link AclImpl}.
- *
- * @author Andrei Stefan
- */
-public class AclImplTests {
-    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
-    private static final List<Permission> READ = Arrays.asList(BasePermission.READ );
-    private static final List<Permission> WRITE = Arrays.asList(BasePermission.WRITE);
-    private static final List<Permission> CREATE = Arrays.asList(BasePermission.CREATE );
-    private static final List<Permission> DELETE = Arrays.asList(BasePermission.DELETE );
-    private static final List<Sid> SCOTT = Arrays.asList((Sid)new PrincipalSid("scott"));
-    private static final List<Sid> BEN = Arrays.asList((Sid)new PrincipalSid("ben"));
-
-    Authentication auth = new TestingAuthenticationToken("joe", "ignored", "ROLE_ADMINISTRATOR");
-    AclAuthorizationStrategy authzStrategy;
-    PermissionGrantingStrategy pgs;
-    AuditLogger mockAuditLogger;
-    ObjectIdentity objectIdentity = new ObjectIdentityImpl(TARGET_CLASS, 100);
-
-    // ~ Methods ========================================================================================================
-
-    @Before
-    public void setUp() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        authzStrategy = mock(AclAuthorizationStrategy.class);
-        mockAuditLogger = mock(AuditLogger.class);
-        pgs = new DefaultPermissionGrantingStrategy(mockAuditLogger);
-        auth.setAuthenticated(true);
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        SecurityContextHolder.clearContext();
-    }
-
-    @Test(expected=IllegalArgumentException.class)
-    public void constructorsRejectNullObjectIdentity() throws Exception {
-        try {
-            new AclImpl(null, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-            fail("Should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-        new AclImpl(null, 1, authzStrategy, mockAuditLogger);
-    }
-
-    @Test(expected=IllegalArgumentException.class)
-    public void constructorsRejectNullId() throws Exception {
-        try {
-            new AclImpl(objectIdentity, null, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-            fail("Should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-        new AclImpl(objectIdentity, null, authzStrategy, mockAuditLogger);
-    }
-
-    @SuppressWarnings("deprecation")
-    @Test(expected=IllegalArgumentException.class)
-    public void constructorsRejectNullAclAuthzStrategy() throws Exception {
-        try {
-            new AclImpl(objectIdentity, 1, null, mockAuditLogger, null, null, true, new PrincipalSid("joe"));
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-        new AclImpl(objectIdentity, 1, null, mockAuditLogger);
-    }
-
-    @Test
-    public void insertAceRejectsNullParameters() throws Exception {
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid(
-                "joe"));
-        try {
-            acl.insertAce(0, null, new GrantedAuthoritySid("ROLE_IGNORED"), true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-        try {
-            acl.insertAce(0, BasePermission.READ, null, true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    public void insertAceAddsElementAtCorrectIndex() throws Exception {
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        MockAclService service = new MockAclService();
-
-        // Insert one permission
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
-        service.updateAcl(acl);
-        // Check it was successfully added
-        assertEquals(1, acl.getEntries().size());
-        assertEquals(acl.getEntries().get(0).getAcl(), acl);
-        assertEquals(acl.getEntries().get(0).getPermission(), BasePermission.READ);
-        assertEquals(acl.getEntries().get(0).getSid(), new GrantedAuthoritySid("ROLE_TEST1"));
-
-        // Add a second permission
-        acl.insertAce(1, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
-        service.updateAcl(acl);
-        // Check it was added on the last position
-        assertEquals(2, acl.getEntries().size());
-        assertEquals(acl.getEntries().get(1).getAcl(), acl);
-        assertEquals(acl.getEntries().get(1).getPermission(), BasePermission.READ);
-        assertEquals(acl.getEntries().get(1).getSid(), new GrantedAuthoritySid("ROLE_TEST2"));
-
-        // Add a third permission, after the first one
-        acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_TEST3"), false);
-        service.updateAcl(acl);
-        assertEquals(3, acl.getEntries().size());
-        // Check the third entry was added between the two existent ones
-        assertEquals(acl.getEntries().get(0).getPermission(), BasePermission.READ);
-        assertEquals(acl.getEntries().get(0).getSid(), new GrantedAuthoritySid("ROLE_TEST1"));
-        assertEquals(acl.getEntries().get(1).getPermission(), BasePermission.WRITE);
-        assertEquals(acl.getEntries().get(1).getSid(), new GrantedAuthoritySid("ROLE_TEST3"));
-        assertEquals(acl.getEntries().get(2).getPermission(), BasePermission.READ);
-        assertEquals(acl.getEntries().get(2).getSid(), new GrantedAuthoritySid("ROLE_TEST2"));
-    }
-
-    @Test(expected=NotFoundException.class)
-    public void insertAceFailsForNonExistentElement() throws Exception {
-        MutableAcl acl = new AclImpl(objectIdentity,1, authzStrategy, pgs, null, null, true, new PrincipalSid(
-                "joe"));
-        MockAclService service = new MockAclService();
-
-        // Insert one permission
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
-        service.updateAcl(acl);
-
-        acl.insertAce(55, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
-    }
-
-    @Test
-    public void deleteAceKeepsInitialOrdering() throws Exception {
-        MutableAcl acl = new AclImpl(objectIdentity,1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        MockAclService service = new MockAclService();
-
-        // Add several permissions
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST1"), true);
-        acl.insertAce(1, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST2"), true);
-        acl.insertAce(2, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST3"), true);
-        service.updateAcl(acl);
-
-        // Delete first permission and check the order of the remaining permissions is kept
-        acl.deleteAce(0);
-        assertEquals(2, acl.getEntries().size());
-        assertEquals(acl.getEntries().get(0).getSid(), new GrantedAuthoritySid("ROLE_TEST2"));
-        assertEquals(acl.getEntries().get(1).getSid(), new GrantedAuthoritySid("ROLE_TEST3"));
-
-        // Add one more permission and remove the permission in the middle
-        acl.insertAce(2, BasePermission.READ, new GrantedAuthoritySid("ROLE_TEST4"), true);
-        service.updateAcl(acl);
-        acl.deleteAce(1);
-        assertEquals(2, acl.getEntries().size());
-        assertEquals(acl.getEntries().get(0).getSid(), new GrantedAuthoritySid("ROLE_TEST2"));
-        assertEquals(acl.getEntries().get(1).getSid(), new GrantedAuthoritySid("ROLE_TEST4"));
-
-        // Remove remaining permissions
-        acl.deleteAce(1);
-        acl.deleteAce(0);
-        assertEquals(0, acl.getEntries().size());
-    }
-
-    @Test
-    public void deleteAceFailsForNonExistentElement() throws Exception {
-        AclAuthorizationStrategyImpl strategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(objectIdentity, (1), strategy, pgs, null, null, true, new PrincipalSid(
-                "joe"));
-        try {
-            acl.deleteAce(99);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-    }
-
-    @Test
-    public void isGrantingRejectsEmptyParameters() throws Exception {
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        Sid ben = new PrincipalSid("ben");
-        try {
-            acl.isGranted(new ArrayList<Permission>(0), Arrays.asList(ben) , false);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-        try {
-            acl.isGranted(READ, new ArrayList<Sid>(0), false);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    public void isGrantingGrantsAccessForAclWithNoParent() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored", "ROLE_GENERAL","ROLE_GUEST");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentity rootOid = new ObjectIdentityImpl(TARGET_CLASS, 100);
-
-        // Create an ACL which owner is not the authenticated principal
-        MutableAcl rootAcl = new AclImpl(rootOid, 1, authzStrategy, pgs, null, null, false, new PrincipalSid("joe"));
-
-        // Grant some permissions
-        rootAcl.insertAce(0, BasePermission.READ, new PrincipalSid("ben"), false);
-        rootAcl.insertAce(1, BasePermission.WRITE, new PrincipalSid("scott"), true);
-        rootAcl.insertAce(2, BasePermission.WRITE, new PrincipalSid("rod"), false);
-        rootAcl.insertAce(3, BasePermission.WRITE, new GrantedAuthoritySid("WRITE_ACCESS_ROLE"), true);
-
-        // Check permissions granting
-        List<Permission> permissions = Arrays.asList(BasePermission.READ, BasePermission.CREATE);
-        List<Sid> sids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_GUEST"));
-        assertFalse(rootAcl.isGranted(permissions, sids, false));
-        try {
-            rootAcl.isGranted(permissions, SCOTT, false);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-        assertTrue(rootAcl.isGranted(WRITE, SCOTT, false));
-        assertFalse(rootAcl.isGranted(WRITE,
-                Arrays.asList(new PrincipalSid("rod"), new GrantedAuthoritySid("WRITE_ACCESS_ROLE")), false));
-        assertTrue(rootAcl.isGranted(WRITE, Arrays.asList(new GrantedAuthoritySid("WRITE_ACCESS_ROLE"), new PrincipalSid("rod")), false));
-        try {
-            // Change the type of the Sid and check the granting process
-            rootAcl.isGranted(WRITE, Arrays.asList(new GrantedAuthoritySid("rod"), new PrincipalSid("WRITE_ACCESS_ROLE")), false);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-    }
-
-    @Test
-    public void isGrantingGrantsAccessForInheritableAcls() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored","ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentity grandParentOid = new ObjectIdentityImpl(TARGET_CLASS, 100);
-        ObjectIdentity parentOid1 = new ObjectIdentityImpl(TARGET_CLASS, 101);
-        ObjectIdentity parentOid2 = new ObjectIdentityImpl(TARGET_CLASS, 102);
-        ObjectIdentity childOid1 = new ObjectIdentityImpl(TARGET_CLASS, 103);
-        ObjectIdentity childOid2 = new ObjectIdentityImpl(TARGET_CLASS, 104);
-
-        // Create ACLs
-        PrincipalSid joe = new PrincipalSid("joe");
-        MutableAcl grandParentAcl = new AclImpl(grandParentOid, 1, authzStrategy, pgs, null, null, false, joe);
-        MutableAcl parentAcl1 = new AclImpl(parentOid1, 2, authzStrategy, pgs, null, null, true, joe);
-        MutableAcl parentAcl2 = new AclImpl(parentOid2, 3, authzStrategy, pgs, null, null, true, joe);
-        MutableAcl childAcl1 = new AclImpl(childOid1, 4, authzStrategy, pgs, null, null, true, joe);
-        MutableAcl childAcl2 = new AclImpl(childOid2, 4, authzStrategy, pgs, null, null, false, joe);
-
-        // Create hierarchies
-        childAcl2.setParent(childAcl1);
-        childAcl1.setParent(parentAcl1);
-        parentAcl2.setParent(grandParentAcl);
-        parentAcl1.setParent(grandParentAcl);
-
-        // Add some permissions
-        grandParentAcl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        grandParentAcl.insertAce(1, BasePermission.WRITE, new PrincipalSid("ben"), true);
-        grandParentAcl.insertAce(2, BasePermission.DELETE, new PrincipalSid("ben"), false);
-        grandParentAcl.insertAce(3, BasePermission.DELETE, new PrincipalSid("scott"), true);
-        parentAcl1.insertAce(0, BasePermission.READ, new PrincipalSid("scott"), true);
-        parentAcl1.insertAce(1, BasePermission.DELETE, new PrincipalSid("scott"), false);
-        parentAcl2.insertAce(0, BasePermission.CREATE, new PrincipalSid("ben"), true);
-        childAcl1.insertAce(0, BasePermission.CREATE, new PrincipalSid("scott"), true);
-
-        // Check granting process for parent1
-        assertTrue(parentAcl1.isGranted(READ, SCOTT, false));
-        assertTrue(parentAcl1.isGranted(READ, Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_USER_READ")), false));
-        assertTrue(parentAcl1.isGranted(WRITE, BEN, false));
-        assertFalse(parentAcl1.isGranted(DELETE, BEN, false));
-        assertFalse(parentAcl1.isGranted(DELETE, SCOTT, false));
-
-        // Check granting process for parent2
-        assertTrue(parentAcl2.isGranted(CREATE, BEN, false));
-        assertTrue(parentAcl2.isGranted(WRITE, BEN, false));
-        assertFalse(parentAcl2.isGranted(DELETE, BEN, false));
-
-        // Check granting process for child1
-        assertTrue(childAcl1.isGranted(CREATE, SCOTT,
-                false));
-        assertTrue(childAcl1.isGranted(READ, Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_USER_READ")), false));
-        assertFalse(childAcl1.isGranted(DELETE, BEN, false));
-
-        // Check granting process for child2 (doesn't inherit the permissions from its parent)
-        try {
-            assertTrue(childAcl2.isGranted(CREATE, SCOTT, false));
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-        try {
-            assertTrue(childAcl2.isGranted(CREATE, Arrays.asList((Sid)new PrincipalSid("joe")), false));
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-    }
-
-    @Test
-    public void updatedAceValuesAreCorrectlyReflectedInAcl() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored","ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, false, new PrincipalSid("joe"));
-        MockAclService service = new MockAclService();
-
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        acl.insertAce(2, BasePermission.CREATE, new PrincipalSid("ben"), true);
-        service.updateAcl(acl);
-
-        assertEquals(acl.getEntries().get(0).getPermission(), BasePermission.READ);
-        assertEquals(acl.getEntries().get(1).getPermission(), BasePermission.WRITE);
-        assertEquals(acl.getEntries().get(2).getPermission(), BasePermission.CREATE);
-
-        // Change each permission
-        acl.updateAce(0, BasePermission.CREATE);
-        acl.updateAce(1, BasePermission.DELETE);
-        acl.updateAce(2, BasePermission.READ);
-
-        // Check the change was successfully made
-        assertEquals(acl.getEntries().get(0).getPermission(), BasePermission.CREATE);
-        assertEquals(acl.getEntries().get(1).getPermission(), BasePermission.DELETE);
-        assertEquals(acl.getEntries().get(2).getPermission(), BasePermission.READ);
-    }
-
-    @Test
-    public void auditableEntryFlagsAreUpdatedCorrectly() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored", "ROLE_AUDITING", "ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, false, new PrincipalSid("joe"));
-        MockAclService service = new MockAclService();
-
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        service.updateAcl(acl);
-
-        assertFalse(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditFailure());
-        assertFalse(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditFailure());
-        assertFalse(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditSuccess());
-        assertFalse(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditSuccess());
-
-        // Change each permission
-        ((AuditableAcl) acl).updateAuditing(0, true, true);
-        ((AuditableAcl) acl).updateAuditing(1, true, true);
-
-        // Check the change was successfuly made
-        assertTrue(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditFailure());
-        assertTrue(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditFailure());
-        assertTrue(((AuditableAccessControlEntry) acl.getEntries().get(0)).isAuditSuccess());
-        assertTrue(((AuditableAccessControlEntry) acl.getEntries().get(1)).isAuditSuccess());
-    }
-
-    @Test
-    public void gettersAndSettersAreConsistent() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored", "ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, (100));
-        ObjectIdentity identity2 = new ObjectIdentityImpl(TARGET_CLASS, (101));
-        MutableAcl acl = new AclImpl(identity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        MutableAcl parentAcl = new AclImpl(identity2, 2, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        MockAclService service = new MockAclService();
-        acl.insertAce(0, BasePermission.READ, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        acl.insertAce(1, BasePermission.WRITE, new GrantedAuthoritySid("ROLE_USER_READ"), true);
-        service.updateAcl(acl);
-
-        assertEquals(acl.getId(), 1);
-        assertEquals(acl.getObjectIdentity(), identity);
-        assertEquals(acl.getOwner(), new PrincipalSid("joe"));
-        assertNull(acl.getParentAcl());
-        assertTrue(acl.isEntriesInheriting());
-        assertEquals(2, acl.getEntries().size());
-
-        acl.setParent(parentAcl);
-        assertEquals(acl.getParentAcl(), parentAcl);
-
-        acl.setEntriesInheriting(false);
-        assertFalse(acl.isEntriesInheriting());
-
-        acl.setOwner(new PrincipalSid("ben"));
-        assertEquals(acl.getOwner(), new PrincipalSid("ben"));
-    }
-
-    @Test
-    public void isSidLoadedBehavesAsExpected() throws Exception {
-        List<Sid> loadedSids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_IGNORED"));
-        MutableAcl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, loadedSids, true,
-                new PrincipalSid("joe"));
-
-        assertTrue(acl.isSidLoaded(loadedSids));
-        assertTrue(acl.isSidLoaded(Arrays.asList(new GrantedAuthoritySid("ROLE_IGNORED"), new PrincipalSid("ben"))));
-        assertTrue(acl.isSidLoaded(Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_IGNORED"))));
-        assertTrue(acl.isSidLoaded(BEN));
-        assertTrue(acl.isSidLoaded(null));
-        assertTrue(acl.isSidLoaded(new ArrayList<Sid>(0)));
-        assertTrue(acl.isSidLoaded(Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_IGNORED"), new GrantedAuthoritySid("ROLE_IGNORED"))));
-        assertFalse(acl.isSidLoaded(Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_GENERAL"), new GrantedAuthoritySid("ROLE_IGNORED"))));
-        assertFalse(acl.isSidLoaded(Arrays.asList((Sid)new GrantedAuthoritySid("ROLE_IGNORED"), new GrantedAuthoritySid("ROLE_GENERAL"))));
-    }
-
-    @Test(expected=NotFoundException.class)
-    public void insertAceRaisesNotFoundExceptionForIndexLessThanZero() throws Exception {
-        AclImpl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        acl.insertAce(-1, mock(Permission.class), mock(Sid.class), true);
-    }
-
-    @Test(expected=NotFoundException.class)
-    public void deleteAceRaisesNotFoundExceptionForIndexLessThanZero() throws Exception {
-        AclImpl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        acl.deleteAce(-1);
-    }
-
-    @Test(expected=NotFoundException.class)
-    public void insertAceRaisesNotFoundExceptionForIndexGreaterThanSize() throws Exception {
-        AclImpl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        // Insert at zero, OK.
-        acl.insertAce(0, mock(Permission.class), mock(Sid.class), true);
-        // Size is now 1
-        acl.insertAce(2, mock(Permission.class), mock(Sid.class), true);
-    }
-
-    // SEC-1151
-    @Test(expected=NotFoundException.class)
-    public void deleteAceRaisesNotFoundExceptionForIndexEqualToSize() throws Exception {
-        AclImpl acl = new AclImpl(objectIdentity, 1, authzStrategy, pgs, null, null, true, new PrincipalSid("joe"));
-        acl.insertAce(0, mock(Permission.class), mock(Sid.class), true);
-        // Size is now 1
-        acl.deleteAce(1);
-    }
-
-    // SEC-1795
-    @Test
-    public void changingParentIsSuccessful() throws Exception {
-        AclImpl parentAcl = new AclImpl(objectIdentity, 1L, authzStrategy, mockAuditLogger);
-        AclImpl childAcl = new AclImpl(objectIdentity, 2L, authzStrategy, mockAuditLogger);
-        AclImpl changeParentAcl = new AclImpl(objectIdentity, 3L, authzStrategy, mockAuditLogger);
-
-        childAcl.setParent(parentAcl);
-        childAcl.setParent(changeParentAcl);
-    }
-
-    //~ Inner Classes ==================================================================================================
-
-    private class MockAclService implements MutableAclService {
-        public MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException {
-            return null;
-        }
-
-        public void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren) throws ChildrenExistException {
-        }
-
-        /*
-         * Mock implementation that populates the aces list with fully initialized AccessControlEntries
-         * @see org.springframework.security.acls.MutableAclService#updateAcl(org.springframework.security.acls.MutableAcl)
-         */
-        @SuppressWarnings("unchecked")
-        public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
-            List<AccessControlEntry> oldAces = acl.getEntries();
-            Field acesField = FieldUtils.getField(AclImpl.class, "aces");
-            acesField.setAccessible(true);
-            List newAces;
-            try {
-                newAces = (List) acesField.get(acl);
-                newAces.clear();
-
-                for (int i = 0; i < oldAces.size(); i++) {
-                    AccessControlEntry ac = oldAces.get(i);
-                    // Just give an ID to all this acl's aces, rest of the fields are just copied
-                    newAces.add(new AccessControlEntryImpl((i + 1), ac.getAcl(), ac.getSid(), ac.getPermission(), ac
-                            .isGranting(), ((AuditableAccessControlEntry) ac).isAuditSuccess(),
-                            ((AuditableAccessControlEntry) ac).isAuditFailure()));
-                }
-            }
-            catch (IllegalAccessException e) {
-                e.printStackTrace();
-            }
-
-            return acl;
-        }
-
-        public List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity) {
-            return null;
-        }
-
-        public Acl readAclById(ObjectIdentity object) throws NotFoundException {
-            return null;
-        }
-
-        public Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException {
-            return null;
-        }
-
-        public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects) throws NotFoundException {
-            return null;
-        }
-
-        public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) throws NotFoundException {
-            return null;
-        }
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/AclImplementationSecurityCheckTests.java

@@ -1,259 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-
-import org.junit.*;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-
-/**
- * Test class for {@link AclAuthorizationStrategyImpl} and {@link AclImpl}
- * security checks.
- *
- * @author Andrei Stefan
- */
-public class AclImplementationSecurityCheckTests {
-    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
-
-    //~ Methods ========================================================================================================
-
-    @Before
-    public void setUp() throws Exception {
-        SecurityContextHolder.clearContext();
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        SecurityContextHolder.clearContext();
-    }
-
-    @Test
-    public void testSecurityCheckNoACEs() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("user", "password","ROLE_GENERAL","ROLE_AUDITING","ROLE_OWNERSHIP");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, new Long(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        Acl acl = new AclImpl(identity, new Long(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_GENERAL);
-        aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_AUDITING);
-        aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-
-        // Create another authorization strategy
-        AclAuthorizationStrategy aclAuthorizationStrategy2 = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_ONE"), new SimpleGrantedAuthority("ROLE_TWO"),
-                new SimpleGrantedAuthority("ROLE_THREE"));
-        Acl acl2 = new AclImpl(identity, new Long(1), aclAuthorizationStrategy2, new ConsoleAuditLogger());
-        // Check access in case the principal has no authorization rights
-        try {
-            aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_GENERAL);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-        try {
-            aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_AUDITING);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-        try {
-            aclAuthorizationStrategy2.securityCheck(acl2, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-        }
-    }
-
-    @Test
-    public void testSecurityCheckWithMultipleACEs() throws Exception {
-        // Create a simple authentication with ROLE_GENERAL
-        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, new Long(100));
-        // Authorization strategy will require a different role for each access
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        // Let's give the principal the ADMINISTRATION permission, without
-        // granting access
-        MutableAcl aclFirstDeny = new AclImpl(identity, new Long(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-        aclFirstDeny.insertAce(0, BasePermission.ADMINISTRATION, new PrincipalSid(auth), false);
-
-        // The CHANGE_GENERAL test should pass as the principal has ROLE_GENERAL
-        aclAuthorizationStrategy.securityCheck(aclFirstDeny, AclAuthorizationStrategy.CHANGE_GENERAL);
-
-        // The CHANGE_AUDITING and CHANGE_OWNERSHIP should fail since the
-        // principal doesn't have these authorities,
-        // nor granting access
-        try {
-            aclAuthorizationStrategy.securityCheck(aclFirstDeny, AclAuthorizationStrategy.CHANGE_AUDITING);
-            fail("It should have thrown AccessDeniedException");
-        }
-        catch (AccessDeniedException expected) {
-        }
-        try {
-            aclAuthorizationStrategy.securityCheck(aclFirstDeny, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-            fail("It should have thrown AccessDeniedException");
-        }
-        catch (AccessDeniedException expected) {
-        }
-
-        // Add granting access to this principal
-        aclFirstDeny.insertAce(1, BasePermission.ADMINISTRATION, new PrincipalSid(auth), true);
-        // and try again for CHANGE_AUDITING - the first ACE's granting flag
-        // (false) will deny this access
-        try {
-            aclAuthorizationStrategy.securityCheck(aclFirstDeny, AclAuthorizationStrategy.CHANGE_AUDITING);
-            fail("It should have thrown AccessDeniedException");
-        }
-        catch (AccessDeniedException expected) {
-        }
-
-        // Create another ACL and give the principal the ADMINISTRATION
-        // permission, with granting access
-        MutableAcl aclFirstAllow = new AclImpl(identity, new Long(1), aclAuthorizationStrategy,
-                new ConsoleAuditLogger());
-        aclFirstAllow.insertAce(0, BasePermission.ADMINISTRATION, new PrincipalSid(auth), true);
-
-        // The CHANGE_AUDITING test should pass as there is one ACE with
-        // granting access
-
-        aclAuthorizationStrategy.securityCheck(aclFirstAllow, AclAuthorizationStrategy.CHANGE_AUDITING);
-
-        // Add a deny ACE and test again for CHANGE_AUDITING
-        aclFirstAllow.insertAce(1, BasePermission.ADMINISTRATION, new PrincipalSid(auth), false);
-        try {
-            aclAuthorizationStrategy.securityCheck(aclFirstAllow, AclAuthorizationStrategy.CHANGE_AUDITING);
-            assertTrue(true);
-        }
-        catch (AccessDeniedException notExpected) {
-            fail("It shouldn't have thrown AccessDeniedException");
-        }
-
-        // Create an ACL with no ACE
-        MutableAcl aclNoACE = new AclImpl(identity, new Long(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-        try {
-            aclAuthorizationStrategy.securityCheck(aclNoACE, AclAuthorizationStrategy.CHANGE_AUDITING);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-        // and still grant access for CHANGE_GENERAL
-        try {
-            aclAuthorizationStrategy.securityCheck(aclNoACE, AclAuthorizationStrategy.CHANGE_GENERAL);
-            assertTrue(true);
-        }
-        catch (NotFoundException expected) {
-            fail("It shouldn't have thrown NotFoundException");
-        }
-    }
-
-    @Test
-    public void testSecurityCheckWithInheritableACEs() throws Exception {
-        // Create a simple authentication with ROLE_GENERAL
-        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, 100);
-        // Authorization strategy will require a different role for each access
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_ONE"), new SimpleGrantedAuthority("ROLE_TWO"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        // Let's give the principal an ADMINISTRATION permission, with granting
-        // access
-        MutableAcl parentAcl = new AclImpl(identity, 1, aclAuthorizationStrategy, new ConsoleAuditLogger());
-        parentAcl.insertAce(0, BasePermission.ADMINISTRATION, new PrincipalSid(auth), true);
-        MutableAcl childAcl = new AclImpl(identity, 2, aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        // Check against the 'child' acl, which doesn't offer any authorization
-        // rights on CHANGE_OWNERSHIP
-        try {
-            aclAuthorizationStrategy.securityCheck(childAcl, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-
-        // Link the child with its parent and test again against the
-        // CHANGE_OWNERSHIP right
-        childAcl.setParent(parentAcl);
-        childAcl.setEntriesInheriting(true);
-        try {
-            aclAuthorizationStrategy.securityCheck(childAcl, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-            assertTrue(true);
-        }
-        catch (NotFoundException expected) {
-            fail("It shouldn't have thrown NotFoundException");
-        }
-
-        // Create a root parent and link it to the middle parent
-        MutableAcl rootParentAcl = new AclImpl(identity, 1, aclAuthorizationStrategy,
-                new ConsoleAuditLogger());
-        parentAcl = new AclImpl(identity, 1, aclAuthorizationStrategy, new ConsoleAuditLogger());
-        rootParentAcl.insertAce(0, BasePermission.ADMINISTRATION, new PrincipalSid(auth), true);
-        parentAcl.setEntriesInheriting(true);
-        parentAcl.setParent(rootParentAcl);
-        childAcl.setParent(parentAcl);
-        try {
-            aclAuthorizationStrategy.securityCheck(childAcl, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-            assertTrue(true);
-        }
-        catch (NotFoundException expected) {
-            fail("It shouldn't have thrown NotFoundException");
-        }
-    }
-
-    @SuppressWarnings("deprecation")
-    @Test
-    public void testSecurityCheckPrincipalOwner() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_ONE");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, 100);
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-
-        Acl acl = new AclImpl(identity, 1, aclAuthorizationStrategy, new ConsoleAuditLogger(), null, null,
-                false, new PrincipalSid(auth));
-        try {
-            aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_GENERAL);
-        }
-        catch (AccessDeniedException notExpected) {
-            fail("It shouldn't have thrown AccessDeniedException");
-        }
-        try {
-            aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_AUDITING);
-            fail("It shouldn't have thrown AccessDeniedException");
-        }
-        catch (NotFoundException expected) {
-        }
-        try {
-            aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-        }
-        catch (AccessDeniedException notExpected) {
-            fail("It shouldn't have thrown AccessDeniedException");
-        }
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/AuditLoggerTests.java

@@ -1,78 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-import static org.mockito.Mockito.*;
-
-import java.io.ByteArrayOutputStream;
-import java.io.PrintStream;
-
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-
-/**
- * Test class for {@link ConsoleAuditLogger}.
- *
- * @author Andrei Stefan
- */
-public class AuditLoggerTests {
-    //~ Instance fields ================================================================================================
-    private PrintStream console;
-    private ByteArrayOutputStream bytes = new ByteArrayOutputStream();
-    private ConsoleAuditLogger logger;
-    private AuditableAccessControlEntry ace;
-
-    //~ Methods ========================================================================================================
-
-    @Before
-    public void setUp() throws Exception {
-        logger = new ConsoleAuditLogger();
-        ace = mock(AuditableAccessControlEntry.class);
-        console = System.out;
-        System.setOut(new PrintStream(bytes));
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        System.setOut(console);
-        bytes.reset();
-    }
-
-    @Test
-    public void nonAuditableAceIsIgnored() {
-        AccessControlEntry ace = mock(AccessControlEntry.class);
-        logger.logIfNeeded(true, ace);
-        assertEquals(0, bytes.size());
-    }
-
-    @Test
-    public void successIsNotLoggedIfAceDoesntRequireSuccessAudit() throws Exception {
-        when(ace.isAuditSuccess()).thenReturn(false);
-        logger.logIfNeeded(true, ace);
-        assertEquals(0, bytes.size());
-    }
-
-    @Test
-    public void successIsLoggedIfAceRequiresSuccessAudit() throws Exception {
-        when(ace.isAuditSuccess()).thenReturn(true);
-
-        logger.logIfNeeded(true, ace);
-        assertTrue(bytes.toString().startsWith("GRANTED due to ACE"));
-    }
-
-    @Test
-    public void failureIsntLoggedIfAceDoesntRequireFailureAudit() throws Exception {
-        when(ace.isAuditFailure()).thenReturn(false);
-        logger.logIfNeeded(false, ace);
-        assertEquals(0, bytes.size());
-    }
-
-    @Test
-    public void failureIsLoggedIfAceRequiresFailureAudit() throws Exception {
-        when(ace.isAuditFailure()).thenReturn(true);
-        logger.logIfNeeded(false, ace);
-        assertTrue(bytes.toString().startsWith("DENIED due to ACE"));
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/ObjectIdentityImplTests.java

@@ -1,189 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-
-import org.junit.Test;
-import org.springframework.security.acls.domain.IdentityUnavailableException;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.model.ObjectIdentity;
-
-/**
- * Tests for {@link ObjectIdentityImpl}.
- *
- * @author Andrei Stefan
- */
-@SuppressWarnings("unused")
-public class ObjectIdentityImplTests {
-
-    private static final String DOMAIN_CLASS =
-        "org.springframework.security.acls.domain.ObjectIdentityImplTests$MockIdDomainObject";
-
-    //~ Methods ========================================================================================================
-
-    @Test
-    public void constructorsRespectRequiredFields() throws Exception {
-        // Check one-argument constructor required field
-        try {
-            new ObjectIdentityImpl(null);
-            fail("It should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
-        }
-
-        // Check String-Serializable constructor required field
-        try {
-            new ObjectIdentityImpl("", Long.valueOf(1));
-            fail("It should have thrown IllegalArgumentException");
-        } catch (IllegalArgumentException expected) {
-        }
-
-        // Check Serializable parameter is not null
-        try {
-            new ObjectIdentityImpl(DOMAIN_CLASS, null);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        // The correct way of using String-Serializable constructor
-        try {
-            new ObjectIdentityImpl(DOMAIN_CLASS, Long.valueOf(1));
-        }
-        catch (IllegalArgumentException notExpected) {
-            fail("It shouldn't have thrown IllegalArgumentException");
-        }
-
-        // Check the Class-Serializable constructor
-        try {
-            new ObjectIdentityImpl(MockIdDomainObject.class, null);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    public void gettersReturnExpectedValues() throws Exception {
-        ObjectIdentity obj = new ObjectIdentityImpl(DOMAIN_CLASS, Long.valueOf(1));
-        assertEquals(Long.valueOf(1), obj.getIdentifier());
-        assertEquals(MockIdDomainObject.class.getName(), obj.getType());
-    }
-
-    @Test
-    public void testGetIdMethodConstraints() throws Exception {
-        // Check the getId() method is present
-        try {
-            new ObjectIdentityImpl("A_STRING_OBJECT");
-            fail("It should have thrown IdentityUnavailableException");
-        }
-        catch (IdentityUnavailableException expected) {
-
-        }
-
-        // getId() should return a non-null value
-        MockIdDomainObject mockId = new MockIdDomainObject();
-        try {
-            new ObjectIdentityImpl(mockId);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-
-        }
-
-        // getId() should return a Serializable object
-        mockId.setId(new MockIdDomainObject());
-        try {
-            new ObjectIdentityImpl(mockId);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        // getId() should return a Serializable object
-        mockId.setId(new Long(100));
-        try {
-            new ObjectIdentityImpl(mockId);
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test(expected=IllegalArgumentException.class)
-    public void constructorRejectsInvalidTypeParameter() throws Exception {
-        new ObjectIdentityImpl("", Long.valueOf(1));
-    }
-
-    @Test
-    public void testEquals() throws Exception {
-        ObjectIdentity obj = new ObjectIdentityImpl(DOMAIN_CLASS, Long.valueOf(1));
-        MockIdDomainObject mockObj = new MockIdDomainObject();
-        mockObj.setId(Long.valueOf(1));
-
-        String string = "SOME_STRING";
-        assertNotSame(obj, string);
-        assertFalse(obj.equals(null));
-        assertFalse(obj.equals("DIFFERENT_OBJECT_TYPE"));
-        assertFalse(obj.equals(new ObjectIdentityImpl(DOMAIN_CLASS, Long.valueOf(2))));
-        assertFalse(obj.equals(new ObjectIdentityImpl(
-                "org.springframework.security.acls.domain.ObjectIdentityImplTests$MockOtherIdDomainObject",
-                Long.valueOf(1))));
-        assertEquals(new ObjectIdentityImpl(DOMAIN_CLASS,Long.valueOf(1)), obj);
-        assertEquals(obj, new ObjectIdentityImpl(mockObj));
-    }
-
-    @Test
-    public void hashcodeIsDifferentForDifferentJavaTypes() throws Exception {
-        ObjectIdentity obj = new ObjectIdentityImpl(Object.class, Long.valueOf(1));
-        ObjectIdentity obj2 = new ObjectIdentityImpl(String.class, Long.valueOf(1));
-        assertFalse(obj.hashCode() == obj2.hashCode());
-    }
-
-    @Test
-    public void longAndIntegerIdsWithSameValueAreEqualAndHaveSameHashcode() {
-        ObjectIdentity obj = new ObjectIdentityImpl(Object.class, new Long(5));
-        ObjectIdentity obj2 = new ObjectIdentityImpl(Object.class, Integer.valueOf(5));
-
-        assertEquals(obj, obj2);
-        assertEquals(obj.hashCode(), obj2.hashCode());
-    }
-
-    @Test
-    public void equalStringIdsAreEqualAndHaveSameHashcode() throws Exception {
-        ObjectIdentity obj = new ObjectIdentityImpl(Object.class, "1000");
-        ObjectIdentity obj2 = new ObjectIdentityImpl(Object.class, "1000");
-        assertEquals(obj, obj2);
-        assertEquals(obj.hashCode(), obj2.hashCode());
-    }
-
-    @Test
-    public void stringAndNumericIdsAreNotEqual() throws Exception {
-        ObjectIdentity obj = new ObjectIdentityImpl(Object.class, "1000");
-        ObjectIdentity obj2 = new ObjectIdentityImpl(Object.class, Long.valueOf(1000));
-        assertFalse(obj.equals(obj2));
-    }
-
-    //~ Inner Classes ==================================================================================================
-
-    private class MockIdDomainObject {
-        private Object id;
-
-        public Object getId() {
-            return id;
-        }
-
-        public void setId(Object id) {
-            this.id = id;
-        }
-    }
-
-    private class MockOtherIdDomainObject {
-        private Object id;
-
-        public Object getId() {
-            return id;
-        }
-
-        public void setId(Object id) {
-            this.id = id;
-        }
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/ObjectIdentityRetrievalStrategyImplTests.java

@@ -1,42 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-
-import junit.framework.TestCase;
-
-/**
- * Tests for {@link ObjectIdentityRetrievalStrategyImpl}
- *
- * @author Andrei Stefan
- */
-public class ObjectIdentityRetrievalStrategyImplTests extends TestCase {
-    //~ Methods ========================================================================================================
-
-    public void testObjectIdentityCreation() throws Exception {
-        MockIdDomainObject domain = new MockIdDomainObject();
-        domain.setId(Integer.valueOf(1));
-
-        ObjectIdentityRetrievalStrategy retStrategy = new ObjectIdentityRetrievalStrategyImpl();
-        ObjectIdentity identity = retStrategy.getObjectIdentity(domain);
-
-        assertNotNull(identity);
-        assertEquals(identity, new ObjectIdentityImpl(domain));
-    }
-
-    //~ Inner Classes ==================================================================================================
-    @SuppressWarnings("unused")
-    private class MockIdDomainObject {
-        private Object id;
-
-        public Object getId() {
-            return id;
-        }
-
-        public void setId(Object id) {
-            this.id = id;
-        }
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/PermissionTests.java

@@ -1,100 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import static org.junit.Assert.*;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.springframework.security.acls.model.Permission;
-
-
-/**
- * Tests classes associated with Permission.
- *
- * @author Ben Alex
- */
-public class PermissionTests {
-
-    private DefaultPermissionFactory permissionFactory;
-
-    @Before
-    public void createPermissionfactory() {
-        permissionFactory = new DefaultPermissionFactory();
-    }
-
-    @Test
-    public void basePermissionTest() {
-        Permission p = permissionFactory.buildFromName("WRITE");
-        assertNotNull(p);
-    }
-
-    @Test
-    public void expectedIntegerValues() {
-        assertEquals(1, BasePermission.READ.getMask());
-        assertEquals(16, BasePermission.ADMINISTRATION.getMask());
-        assertEquals(7,
-                new CumulativePermission().set(BasePermission.READ).set(BasePermission.WRITE).set(BasePermission.CREATE)
-                        .getMask());
-        assertEquals(17,
-                new CumulativePermission().set(BasePermission.READ).set(BasePermission.ADMINISTRATION).getMask());
-    }
-
-    @Test
-    public void fromInteger() {
-        Permission permission = permissionFactory.buildFromMask(7);
-        System.out.println("7 =  " + permission.toString());
-        permission = permissionFactory.buildFromMask(4);
-        System.out.println("4 =  " + permission.toString());
-    }
-
-    @Test
-    public void stringConversion() {
-        permissionFactory.registerPublicPermissions(SpecialPermission.class);
-
-        System.out.println("R =  " + BasePermission.READ.toString());
-        assertEquals("BasePermission[...............................R=1]", BasePermission.READ.toString());
-
-        System.out.println("A =  " + BasePermission.ADMINISTRATION.toString());
-        assertEquals("BasePermission[...........................A....=16]", BasePermission.ADMINISTRATION.toString());
-
-        System.out.println("R =  " + new CumulativePermission().set(BasePermission.READ).toString());
-        assertEquals("CumulativePermission[...............................R=1]",
-                new CumulativePermission().set(BasePermission.READ).toString());
-
-        System.out.println("A =  " + new CumulativePermission().set(SpecialPermission.ENTER).set(BasePermission.ADMINISTRATION).toString());
-        assertEquals("CumulativePermission[..........................EA....=48]",
-                new CumulativePermission().set(SpecialPermission.ENTER).set(BasePermission.ADMINISTRATION).toString());
-
-        System.out.println("RA = "
-                + new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ).toString());
-        assertEquals("CumulativePermission[...........................A...R=17]",
-                new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ).toString());
-
-        System.out.println("R =  "
-                + new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
-                .clear(BasePermission.ADMINISTRATION).toString());
-        assertEquals("CumulativePermission[...............................R=1]",
-                new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
-                        .clear(BasePermission.ADMINISTRATION).toString());
-
-        System.out.println("0 =  "
-                + new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
-                .clear(BasePermission.ADMINISTRATION).clear(BasePermission.READ).toString());
-        assertEquals("CumulativePermission[................................=0]",
-                new CumulativePermission().set(BasePermission.ADMINISTRATION).set(BasePermission.READ)
-                        .clear(BasePermission.ADMINISTRATION).clear(BasePermission.READ).toString());
-    }
-}

acl/src/test/java/org/springframework/security/acls/domain/SpecialPermission.java

@@ -1,32 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-
-
-/**
- * A test permission.
- *
- * @author Ben Alex
- */
-public class SpecialPermission extends BasePermission {
-    public static final Permission ENTER = new SpecialPermission(1 << 5, 'E'); // 32
-    public static final Permission LEAVE = new SpecialPermission(1 << 6, 'L');
-
-    protected SpecialPermission(int mask, char code) {
-        super(mask, code);
-    }
-}

acl/src/test/java/org/springframework/security/acls/jdbc/BasicLookupStrategyTests.java

@@ -1,304 +0,0 @@
-package org.springframework.security.acls.jdbc;
-
-import junit.framework.Assert;
-import net.sf.ehcache.Cache;
-import net.sf.ehcache.CacheManager;
-import net.sf.ehcache.Ehcache;
-import org.junit.*;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.core.io.Resource;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.jdbc.datasource.SingleConnectionDataSource;
-import org.springframework.security.acls.domain.AclAuthorizationStrategy;
-import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
-import org.springframework.security.acls.domain.BasePermission;
-import org.springframework.security.acls.domain.ConsoleAuditLogger;
-import org.springframework.security.acls.domain.DefaultPermissionFactory;
-import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
-import org.springframework.security.acls.domain.EhCacheBasedAclCache;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.util.FileCopyUtils;
-
-import java.util.*;
-
-/**
- * Tests {@link BasicLookupStrategy}
- *
- * @author Andrei Stefan
- */
-public class BasicLookupStrategyTests {
-
-    private static final Sid BEN_SID = new PrincipalSid("ben");
-    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
-
-    //~ Instance fields ================================================================================================
-
-    private static JdbcTemplate jdbcTemplate;
-    private BasicLookupStrategy strategy;
-    private static SingleConnectionDataSource dataSource;
-    private static CacheManager cacheManager;
-
-    //~ Methods ========================================================================================================
-    @BeforeClass
-    public static void initCacheManaer() {
-        cacheManager = new CacheManager();
-        cacheManager.addCache(new Cache("basiclookuptestcache", 500, false, false, 30, 30));
-    }
-
-    @BeforeClass
-    public static void createDatabase() throws Exception {
-        dataSource = new SingleConnectionDataSource("jdbc:hsqldb:mem:lookupstrategytest", "sa", "", true);
-        dataSource.setDriverClassName("org.hsqldb.jdbcDriver");
-        jdbcTemplate = new JdbcTemplate(dataSource);
-
-        Resource resource = new ClassPathResource("createAclSchema.sql");
-        String sql = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
-        jdbcTemplate.execute(sql);
-    }
-
-    @AfterClass
-    public static void dropDatabase() throws Exception {
-        dataSource.destroy();
-    }
-
-    @AfterClass
-    public static void shutdownCacheManager() {
-        cacheManager.removalAll();
-        cacheManager.shutdown();
-    }
-
-    @Before
-    public void populateDatabase() {
-        String query = "INSERT INTO acl_sid(ID,PRINCIPAL,SID) VALUES (1,1,'ben');"
-                + "INSERT INTO acl_class(ID,CLASS) VALUES (2,'" + TARGET_CLASS + "');"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (1,2,100,null,1,1);"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (2,2,101,1,1,1);"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (3,2,102,2,1,1);"
-                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (1,1,0,1,1,1,0,0);"
-                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (2,1,1,1,2,0,0,0);"
-                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (3,2,0,1,8,1,0,0);"
-                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (4,3,0,1,8,0,0,0);";
-        jdbcTemplate.execute(query);
-    }
-
-    @Before
-    public void initializeBeans() {
-        EhCacheBasedAclCache cache = new EhCacheBasedAclCache(getCache());
-        AclAuthorizationStrategy authorizationStrategy = new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_ADMINISTRATOR"));
-        strategy = new BasicLookupStrategy(dataSource, cache, authorizationStrategy,
-                new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()));
-        strategy.setPermissionFactory(new DefaultPermissionFactory());
-    }
-
-    @After
-    public void emptyDatabase() {
-        String query = "DELETE FROM acl_entry;" + "DELETE FROM acl_object_identity WHERE ID = 7;"
-                + "DELETE FROM acl_object_identity WHERE ID = 6;" + "DELETE FROM acl_object_identity WHERE ID = 5;"
-                + "DELETE FROM acl_object_identity WHERE ID = 4;" + "DELETE FROM acl_object_identity WHERE ID = 3;"
-                + "DELETE FROM acl_object_identity WHERE ID = 2;" + "DELETE FROM acl_object_identity WHERE ID = 1;"
-                + "DELETE FROM acl_class;" + "DELETE FROM acl_sid;";
-        jdbcTemplate.execute(query);
-    }
-
-    private Ehcache getCache() {
-        Ehcache cache = cacheManager.getCache("basiclookuptestcache");
-        cache.removeAll();
-        return cache;
-    }
-
-    @Test
-    public void testAclsRetrievalWithDefaultBatchSize() throws Exception {
-        ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(101));
-        // Deliberately use an integer for the child, to reproduce bug report in SEC-819
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(102));
-
-        Map<ObjectIdentity, Acl> map = this.strategy.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
-        checkEntries(topParentOid, middleParentOid, childOid, map);
-    }
-
-    @Test
-    public void testAclsRetrievalFromCacheOnly() throws Exception {
-        ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(101));
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(102));
-
-        // Objects were put in cache
-        strategy.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
-
-        // Let's empty the database to force acls retrieval from cache
-        emptyDatabase();
-        Map<ObjectIdentity, Acl> map = this.strategy.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
-
-        checkEntries(topParentOid, middleParentOid, childOid, map);
-    }
-
-    @Test
-    public void testAclsRetrievalWithCustomBatchSize() throws Exception {
-        ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(101));
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(102));
-
-        // Set a batch size to allow multiple database queries in order to retrieve all acls
-        this.strategy.setBatchSize(1);
-        Map<ObjectIdentity, Acl> map = this.strategy.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid), null);
-        checkEntries(topParentOid, middleParentOid, childOid, map);
-    }
-
-    private void checkEntries(ObjectIdentity topParentOid, ObjectIdentity middleParentOid, ObjectIdentity childOid,
-            Map<ObjectIdentity, Acl> map) throws Exception {
-        Assert.assertEquals(3, map.size());
-
-        MutableAcl topParent = (MutableAcl) map.get(topParentOid);
-        MutableAcl middleParent = (MutableAcl) map.get(middleParentOid);
-        MutableAcl child = (MutableAcl) map.get(childOid);
-
-        // Check the retrieved versions has IDs
-        Assert.assertNotNull(topParent.getId());
-        Assert.assertNotNull(middleParent.getId());
-        Assert.assertNotNull(child.getId());
-
-        // Check their parents were correctly retrieved
-        Assert.assertNull(topParent.getParentAcl());
-        Assert.assertEquals(topParentOid, middleParent.getParentAcl().getObjectIdentity());
-        Assert.assertEquals(middleParentOid, child.getParentAcl().getObjectIdentity());
-
-        // Check their ACEs were correctly retrieved
-        Assert.assertEquals(2, topParent.getEntries().size());
-        Assert.assertEquals(1, middleParent.getEntries().size());
-        Assert.assertEquals(1, child.getEntries().size());
-
-        // Check object identities were correctly retrieved
-        Assert.assertEquals(topParentOid, topParent.getObjectIdentity());
-        Assert.assertEquals(middleParentOid, middleParent.getObjectIdentity());
-        Assert.assertEquals(childOid, child.getObjectIdentity());
-
-        // Check each entry
-        Assert.assertTrue(topParent.isEntriesInheriting());
-        Assert.assertEquals(topParent.getId(), Long.valueOf(1));
-        Assert.assertEquals(topParent.getOwner(), new PrincipalSid("ben"));
-        Assert.assertEquals(topParent.getEntries().get(0).getId(), Long.valueOf(1));
-        Assert.assertEquals(topParent.getEntries().get(0).getPermission(), BasePermission.READ);
-        Assert.assertEquals(topParent.getEntries().get(0).getSid(), new PrincipalSid("ben"));
-        Assert.assertFalse(((AuditableAccessControlEntry) topParent.getEntries().get(0)).isAuditFailure());
-        Assert.assertFalse(((AuditableAccessControlEntry) topParent.getEntries().get(0)).isAuditSuccess());
-        Assert.assertTrue((topParent.getEntries().get(0)).isGranting());
-
-        Assert.assertEquals(topParent.getEntries().get(1).getId(), Long.valueOf(2));
-        Assert.assertEquals(topParent.getEntries().get(1).getPermission(), BasePermission.WRITE);
-        Assert.assertEquals(topParent.getEntries().get(1).getSid(), new PrincipalSid("ben"));
-        Assert.assertFalse(((AuditableAccessControlEntry) topParent.getEntries().get(1)).isAuditFailure());
-        Assert.assertFalse(((AuditableAccessControlEntry) topParent.getEntries().get(1)).isAuditSuccess());
-        Assert.assertFalse(topParent.getEntries().get(1).isGranting());
-
-        Assert.assertTrue(middleParent.isEntriesInheriting());
-        Assert.assertEquals(middleParent.getId(), Long.valueOf(2));
-        Assert.assertEquals(middleParent.getOwner(), new PrincipalSid("ben"));
-        Assert.assertEquals(middleParent.getEntries().get(0).getId(), Long.valueOf(3));
-        Assert.assertEquals(middleParent.getEntries().get(0).getPermission(), BasePermission.DELETE);
-        Assert.assertEquals(middleParent.getEntries().get(0).getSid(), new PrincipalSid("ben"));
-        Assert.assertFalse(((AuditableAccessControlEntry) middleParent.getEntries().get(0)).isAuditFailure());
-        Assert.assertFalse(((AuditableAccessControlEntry) middleParent.getEntries().get(0)).isAuditSuccess());
-        Assert.assertTrue(middleParent.getEntries().get(0).isGranting());
-
-        Assert.assertTrue(child.isEntriesInheriting());
-        Assert.assertEquals(child.getId(), Long.valueOf(3));
-        Assert.assertEquals(child.getOwner(), new PrincipalSid("ben"));
-        Assert.assertEquals(child.getEntries().get(0).getId(), Long.valueOf(4));
-        Assert.assertEquals(child.getEntries().get(0).getPermission(), BasePermission.DELETE);
-        Assert.assertEquals(child.getEntries().get(0).getSid(), new PrincipalSid("ben"));
-        Assert.assertFalse(((AuditableAccessControlEntry) child.getEntries().get(0)).isAuditFailure());
-        Assert.assertFalse(((AuditableAccessControlEntry) child.getEntries().get(0)).isAuditSuccess());
-        Assert.assertFalse((child.getEntries().get(0)).isGranting());
-    }
-
-    @Test
-    public void testAllParentsAreRetrievedWhenChildIsLoaded() throws Exception {
-        String query = "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (4,2,103,1,1,1);";
-        jdbcTemplate.execute(query);
-
-        ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        ObjectIdentity middleParentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102));
-        ObjectIdentity middleParent2Oid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(103));
-
-        // Retrieve the child
-        Map<ObjectIdentity, Acl> map = this.strategy.readAclsById(Arrays.asList(childOid), null);
-
-        // Check that the child and all its parents were retrieved
-        Assert.assertNotNull(map.get(childOid));
-        Assert.assertEquals(childOid, map.get(childOid).getObjectIdentity());
-        Assert.assertNotNull(map.get(middleParentOid));
-        Assert.assertEquals(middleParentOid, map.get(middleParentOid).getObjectIdentity());
-        Assert.assertNotNull(map.get(topParentOid));
-        Assert.assertEquals(topParentOid, map.get(topParentOid).getObjectIdentity());
-
-        // The second parent shouldn't have been retrieved
-        Assert.assertNull(map.get(middleParent2Oid));
-    }
-
-    /**
-     * Test created from SEC-590.
-     */
-    @Test
-    public void testReadAllObjectIdentitiesWhenLastElementIsAlreadyCached() throws Exception {
-        String query = "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (4,2,104,null,1,1);"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (5,2,105,4,1,1);"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (6,2,106,4,1,1);"
-                + "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (7,2,107,5,1,1);"
-                + "INSERT INTO acl_entry(ID,ACL_OBJECT_IDENTITY,ACE_ORDER,SID,MASK,GRANTING,AUDIT_SUCCESS,AUDIT_FAILURE) VALUES (5,4,0,1,1,1,0,0)";
-        jdbcTemplate.execute(query);
-
-        ObjectIdentity grandParentOid = new ObjectIdentityImpl(TARGET_CLASS, new Long(104));
-        ObjectIdentity parent1Oid = new ObjectIdentityImpl(TARGET_CLASS, new Long(105));
-        ObjectIdentity parent2Oid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(106));
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(107));
-
-        // First lookup only child, thus populating the cache with grandParent, parent1 and child
-        List<Permission> checkPermission = Arrays.asList(BasePermission.READ);
-        List<Sid> sids = Arrays.asList(BEN_SID);
-        List<ObjectIdentity> childOids = Arrays.asList(childOid);
-
-        strategy.setBatchSize(6);
-        Map<ObjectIdentity, Acl> foundAcls = strategy.readAclsById(childOids, sids);
-
-        Acl foundChildAcl = foundAcls.get(childOid);
-        Assert.assertNotNull(foundChildAcl);
-        Assert.assertTrue(foundChildAcl.isGranted(checkPermission, sids, false));
-
-        // Search for object identities has to be done in the following order: last element have to be one which
-        // is already in cache and the element before it must not be stored in cache
-        List<ObjectIdentity> allOids = Arrays.asList(grandParentOid, parent1Oid, parent2Oid, childOid);
-        try {
-            foundAcls = strategy.readAclsById(allOids, sids);
-            Assert.assertTrue(true);
-        } catch (NotFoundException notExpected) {
-            Assert.fail("It shouldn't have thrown NotFoundException");
-        }
-
-        Acl foundParent2Acl = foundAcls.get(parent2Oid);
-        Assert.assertNotNull(foundParent2Acl);
-        Assert.assertTrue(foundParent2Acl.isGranted(checkPermission, sids, false));
-    }
-
-    @Test(expected=IllegalArgumentException.class)
-    public void nullOwnerIsNotSupported() {
-        String query = "INSERT INTO acl_object_identity(ID,OBJECT_ID_CLASS,OBJECT_ID_IDENTITY,PARENT_OBJECT,OWNER_SID,ENTRIES_INHERITING) VALUES (4,2,104,null,null,1);";
-
-        jdbcTemplate.execute(query);
-
-        ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS, new Long(104));
-
-        strategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID));
-    }
-
-}

acl/src/test/java/org/springframework/security/acls/jdbc/DatabaseSeeder.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import org.springframework.core.io.Resource;
-
-import org.springframework.jdbc.core.JdbcTemplate;
-
-import org.springframework.util.Assert;
-import org.springframework.util.FileCopyUtils;
-
-import java.io.IOException;
-
-import javax.sql.DataSource;
-
-
-/**
- * Seeds the database for {@link JdbcMutableAclServiceTests}.
- *
- * @author Ben Alex
- */
-public class DatabaseSeeder {
-    //~ Constructors ===================================================================================================
-
-    public DatabaseSeeder(DataSource dataSource, Resource resource) throws IOException {
-        Assert.notNull(dataSource, "dataSource required");
-        Assert.notNull(resource, "resource required");
-
-        JdbcTemplate template = new JdbcTemplate(dataSource);
-        String sql = new String(FileCopyUtils.copyToByteArray(resource.getInputStream()));
-        template.execute(sql);
-    }
-}

acl/src/test/java/org/springframework/security/acls/jdbc/EhCacheBasedAclCacheTests.java

@@ -1,260 +0,0 @@
-package org.springframework.security.acls.jdbc;
-
-import static org.junit.Assert.*;
-
-import net.sf.ehcache.Cache;
-import net.sf.ehcache.CacheManager;
-import net.sf.ehcache.Ehcache;
-import org.junit.*;
-import org.springframework.security.acls.domain.AclAuthorizationStrategy;
-import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
-import org.springframework.security.acls.domain.AclImpl;
-import org.springframework.security.acls.domain.ConsoleAuditLogger;
-import org.springframework.security.acls.domain.EhCacheBasedAclCache;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.util.FieldUtils;
-
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.FileOutputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
-import java.io.Serializable;
-import java.util.*;
-
-/**
- * Tests {@link EhCacheBasedAclCache}
- *
- * @author Andrei Stefan
- */
-public class EhCacheBasedAclCacheTests {
-    private static final String TARGET_CLASS = "org.springframework.security.acls.TargetObject";
-
-    private static CacheManager cacheManager;
-
-    @BeforeClass
-    public static void initCacheManaer() {
-        cacheManager = new CacheManager();
-        // Use disk caching immediately (to test for serialization issue reported in SEC-527)
-        cacheManager.addCache(new Cache("ehcachebasedacltests", 0, true, false, 600, 300));
-    }
-
-    @AfterClass
-    public static void shutdownCacheManager() {
-        cacheManager.removalAll();
-        cacheManager.shutdown();
-    }
-
-    @After
-    public void clearContext() {
-        SecurityContextHolder.clearContext();
-    }
-
-    private Ehcache getCache() {
-        Ehcache cache = cacheManager.getCache("ehcachebasedacltests");
-        cache.removeAll();
-
-        return cache;
-    }
-
-    @Test(expected=IllegalArgumentException.class)
-    public void constructorRejectsNullParameters() throws Exception {
-        new EhCacheBasedAclCache(null);
-    }
-
-    @Test
-    public void methodsRejectNullParameters() throws Exception {
-        Ehcache cache = new MockEhcache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
-
-        try {
-            Serializable id = null;
-            myCache.evictFromCache(id);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            assertTrue(true);
-        }
-
-        try {
-            ObjectIdentity obj = null;
-            myCache.evictFromCache(obj);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            assertTrue(true);
-        }
-
-        try {
-            Serializable id = null;
-            myCache.getFromCache(id);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            assertTrue(true);
-        }
-
-        try {
-            ObjectIdentity obj = null;
-            myCache.getFromCache(obj);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            assertTrue(true);
-        }
-
-        try {
-            MutableAcl acl = null;
-            myCache.putInCache(acl);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            assertTrue(true);
-        }
-    }
-
-    // SEC-527
-    @Test
-    public void testDiskSerializationOfMutableAclObjectInstance() throws Exception {
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        // Serialization test
-        File file = File.createTempFile("SEC_TEST", ".object");
-        FileOutputStream fos = new FileOutputStream(file);
-        ObjectOutputStream oos = new ObjectOutputStream(fos);
-        oos.writeObject(acl);
-        oos.close();
-
-        FileInputStream fis = new FileInputStream(file);
-        ObjectInputStream ois = new ObjectInputStream(fis);
-        MutableAcl retrieved = (MutableAcl) ois.readObject();
-        ois.close();
-
-        assertEquals(acl, retrieved);
-
-        Object retrieved1 = FieldUtils.getProtectedFieldValue("aclAuthorizationStrategy", retrieved);
-        assertEquals(null, retrieved1);
-
-        Object retrieved2 = FieldUtils.getProtectedFieldValue("permissionGrantingStrategy", retrieved);
-        assertEquals(null, retrieved2);
-    }
-
-    @Test
-    public void cacheOperationsAclWithoutParent() throws Exception {
-        Ehcache cache = getCache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        assertEquals(0, cache.getDiskStoreSize());
-        myCache.putInCache(acl);
-        assertEquals(cache.getSize(), 2);
-        assertEquals(2, cache.getDiskStoreSize());
-        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
-        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
-
-        // Check we can get from cache the same objects we put in
-        assertEquals(myCache.getFromCache(Long.valueOf(1)), acl);
-        assertEquals(myCache.getFromCache(identity), acl);
-
-        // Put another object in cache
-        ObjectIdentity identity2 = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
-        MutableAcl acl2 = new AclImpl(identity2, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        myCache.putInCache(acl2);
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-
-        // Try to evict an entry that doesn't exist
-        myCache.evictFromCache(Long.valueOf(3));
-        myCache.evictFromCache(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102)));
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-
-        myCache.evictFromCache(Long.valueOf(1));
-        assertEquals(cache.getSize(), 2);
-        assertEquals(2, cache.getDiskStoreSize());
-
-        // Check the second object inserted
-        assertEquals(myCache.getFromCache(Long.valueOf(2)), acl2);
-        assertEquals(myCache.getFromCache(identity2), acl2);
-
-        myCache.evictFromCache(identity2);
-        assertEquals(cache.getSize(), 0);
-    }
-
-    @SuppressWarnings("unchecked")
-    @Test
-    public void cacheOperationsAclWithParent() throws Exception {
-        Ehcache cache = getCache();
-        EhCacheBasedAclCache myCache = new EhCacheBasedAclCache(cache);
-
-        Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_GENERAL");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(1));
-        ObjectIdentity identityParent = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2));
-        AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
-                new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
-                new SimpleGrantedAuthority("ROLE_GENERAL"));
-        MutableAcl acl = new AclImpl(identity, Long.valueOf(1), aclAuthorizationStrategy, new ConsoleAuditLogger());
-        MutableAcl parentAcl = new AclImpl(identityParent, Long.valueOf(2), aclAuthorizationStrategy, new ConsoleAuditLogger());
-
-        acl.setParent(parentAcl);
-
-        assertEquals(0, cache.getDiskStoreSize());
-        myCache.putInCache(acl);
-        assertEquals(cache.getSize(), 4);
-        assertEquals(4, cache.getDiskStoreSize());
-        assertTrue(cache.isElementOnDisk(acl.getObjectIdentity()));
-        assertTrue(cache.isElementOnDisk(Long.valueOf(1)));
-        assertFalse(cache.isElementInMemory(acl.getObjectIdentity()));
-        assertFalse(cache.isElementInMemory(Long.valueOf(1)));
-        cache.flush();
-        // Wait for the spool to be written to disk (it's asynchronous)
-        Map spool = (Map) FieldUtils.getFieldValue(cache, "diskStore.spool");
-
-        while(spool.size() > 0) {
-            Thread.sleep(50);
-        }
-
-        // Check we can get from cache the same objects we put in
-        AclImpl aclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(1));
-        // For the checks on transient fields, we need to be sure that the object is being loaded from the cache,
-        // not from the ehcache spool or elsewhere...
-        assertFalse(acl == aclFromCache);
-        assertEquals(acl, aclFromCache);
-        // SEC-951 check transient fields are set on parent
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "aclAuthorizationStrategy"));
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache.getParentAcl(), "permissionGrantingStrategy"));
-        assertEquals(acl, myCache.getFromCache(identity));
-        assertNotNull(FieldUtils.getFieldValue(aclFromCache, "aclAuthorizationStrategy"));
-        AclImpl parentAclFromCache = (AclImpl) myCache.getFromCache(Long.valueOf(2));
-        assertEquals(parentAcl, parentAclFromCache);
-        assertNotNull(FieldUtils.getFieldValue(parentAclFromCache, "aclAuthorizationStrategy"));
-        assertEquals(parentAcl, myCache.getFromCache(identityParent));
-    }
-
-    //~ Inner Classes ==================================================================================================
-
-    private class MockEhcache extends Cache {
-        public MockEhcache() {
-            super("cache", 0, true, true, 0, 0);
-        }
-    }
-}

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcAclServiceTests.java

@@ -1,50 +0,0 @@
-package org.springframework.security.acls.jdbc;
-
-import static org.mockito.Matchers.anyListOf;
-import static org.mockito.Mockito.when;
-
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-import javax.sql.DataSource;
-
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.Mock;
-import org.mockito.runners.MockitoJUnitRunner;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-
-@RunWith(MockitoJUnitRunner.class)
-public class JdbcAclServiceTests {
-    @Mock
-    private DataSource dataSource;
-
-    @Mock
-    private LookupStrategy lookupStrategy;
-
-    private JdbcAclService aclService;
-
-    @Before
-    public void setUp() {
-        aclService = new JdbcAclService(dataSource, lookupStrategy);
-    }
-
-    // SEC-1898
-    @Test(expected = NotFoundException.class)
-    public void readAclByIdMissingAcl() {
-        Map<ObjectIdentity, Acl> result = new HashMap<ObjectIdentity, Acl>();
-        when(lookupStrategy.readAclsById(anyListOf(ObjectIdentity.class), anyListOf(Sid.class))).thenReturn(result);
-        ObjectIdentity objectIdentity = new ObjectIdentityImpl(Object.class, 1);
-        List<Sid> sids = Arrays.<Sid> asList(new PrincipalSid("user"));
-
-        aclService.readAclById(objectIdentity, sids);
-    }
-}

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTests.java

@@ -1,493 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.jdbc;
-
-import static org.junit.Assert.*;
-
-import java.util.Arrays;
-import java.util.List;
-import java.util.Map;
-
-import javax.sql.DataSource;
-
-import org.junit.Test;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.core.io.ClassPathResource;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.security.acls.TargetObject;
-import org.springframework.security.acls.domain.AclImpl;
-import org.springframework.security.acls.domain.BasePermission;
-import org.springframework.security.acls.domain.CumulativePermission;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.AlreadyExistsException;
-import org.springframework.security.acls.model.ChildrenExistException;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.test.context.ContextConfiguration;
-import org.springframework.test.context.junit4.AbstractTransactionalJUnit4SpringContextTests;
-import org.springframework.test.context.transaction.AfterTransaction;
-import org.springframework.test.context.transaction.BeforeTransaction;
-import org.springframework.transaction.annotation.Transactional;
-
-/**
- * Integration tests the ACL system using an in-memory database.
- *
- * @author Ben Alex
- * @author Andrei Stefan
- */
-@ContextConfiguration(locations={"/jdbcMutableAclServiceTests-context.xml"})
-public class JdbcMutableAclServiceTests extends AbstractTransactionalJUnit4SpringContextTests {
-    //~ Constant fields ================================================================================================
-
-    private static final String TARGET_CLASS = TargetObject.class.getName();
-
-    private final Authentication auth = new TestingAuthenticationToken("ben", "ignored","ROLE_ADMINISTRATOR");
-
-    public static final String SELECT_ALL_CLASSES = "SELECT * FROM acl_class WHERE class = ?";
-
-    //~ Instance fields ================================================================================================
-
-    private final ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-    private final ObjectIdentity middleParentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101));
-    private final ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(102));
-
-    @Autowired
-    private JdbcMutableAclService jdbcMutableAclService;
-    @Autowired
-    private AclCache aclCache;
-    @Autowired
-    private LookupStrategy lookupStrategy;
-    @Autowired
-    private DataSource dataSource;
-    @Autowired
-    private JdbcTemplate jdbcTemplate;
-
-    //~ Methods ========================================================================================================
-
-    @BeforeTransaction
-    public void createTables() throws Exception {
-        try {
-            new DatabaseSeeder(dataSource, new ClassPathResource("createAclSchema.sql"));
-//            new DatabaseSeeder(dataSource, new ClassPathResource("createAclSchemaPostgres.sql"));
-        } catch (Exception e) {
-            e.printStackTrace();
-            throw e;
-        }
-    }
-
-    @AfterTransaction
-    public void clearContextAndData() throws Exception {
-        SecurityContextHolder.clearContext();
-        jdbcTemplate.execute("drop table acl_entry");
-        jdbcTemplate.execute("drop table acl_object_identity");
-        jdbcTemplate.execute("drop table acl_class");
-        jdbcTemplate.execute("drop table acl_sid");
-    }
-
-    @Test
-    @Transactional
-    public void testLifecycle() {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        MutableAcl topParent = jdbcMutableAclService.createAcl(topParentOid);
-        MutableAcl middleParent = jdbcMutableAclService.createAcl(middleParentOid);
-        MutableAcl child = jdbcMutableAclService.createAcl(childOid);
-
-        // Specify the inheritance hierarchy
-        middleParent.setParent(topParent);
-        child.setParent(middleParent);
-
-        // Now let's add a couple of permissions
-        topParent.insertAce(0, BasePermission.READ, new PrincipalSid(auth), true);
-        topParent.insertAce(1, BasePermission.WRITE, new PrincipalSid(auth), false);
-        middleParent.insertAce(0, BasePermission.DELETE, new PrincipalSid(auth), true);
-        child.insertAce(0, BasePermission.DELETE, new PrincipalSid(auth), false);
-
-        // Explicitly save the changed ACL
-        jdbcMutableAclService.updateAcl(topParent);
-        jdbcMutableAclService.updateAcl(middleParent);
-        jdbcMutableAclService.updateAcl(child);
-
-        // Let's check if we can read them back correctly
-        Map<ObjectIdentity, Acl> map = jdbcMutableAclService.readAclsById(Arrays.asList(topParentOid, middleParentOid, childOid));
-        assertEquals(3, map.size());
-
-        // Replace our current objects with their retrieved versions
-        topParent = (MutableAcl) map.get(topParentOid);
-        middleParent = (MutableAcl) map.get(middleParentOid);
-        child = (MutableAcl) map.get(childOid);
-
-        // Check the retrieved versions has IDs
-        assertNotNull(topParent.getId());
-        assertNotNull(middleParent.getId());
-        assertNotNull(child.getId());
-
-        // Check their parents were correctly persisted
-        assertNull(topParent.getParentAcl());
-        assertEquals(topParentOid, middleParent.getParentAcl().getObjectIdentity());
-        assertEquals(middleParentOid, child.getParentAcl().getObjectIdentity());
-
-        // Check their ACEs were correctly persisted
-        assertEquals(2, topParent.getEntries().size());
-        assertEquals(1, middleParent.getEntries().size());
-        assertEquals(1, child.getEntries().size());
-
-        // Check the retrieved rights are correct
-        List<Permission> read = Arrays.asList(BasePermission.READ);
-        List<Permission> write = Arrays.asList(BasePermission.WRITE);
-        List<Permission> delete = Arrays.asList(BasePermission.DELETE);
-        List<Sid> pSid = Arrays.asList((Sid)new PrincipalSid(auth));
-
-
-        assertTrue(topParent.isGranted(read, pSid, false));
-        assertFalse(topParent.isGranted(write, pSid, false));
-        assertTrue(middleParent.isGranted(delete, pSid, false));
-        assertFalse(child.isGranted(delete, pSid, false));
-
-        try {
-            child.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), pSid, false);
-            fail("Should have thrown NotFoundException");
-        } catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-
-        // Now check the inherited rights (when not explicitly overridden) also look OK
-        assertTrue(child.isGranted(read, pSid, false));
-        assertFalse(child.isGranted(write, pSid, false));
-        assertFalse(child.isGranted(delete, pSid, false));
-
-        // Next change the child so it doesn't inherit permissions from above
-        child.setEntriesInheriting(false);
-        jdbcMutableAclService.updateAcl(child);
-        child = (MutableAcl) jdbcMutableAclService.readAclById(childOid);
-        assertFalse(child.isEntriesInheriting());
-
-        // Check the child permissions no longer inherit
-        assertFalse(child.isGranted(delete, pSid, true));
-
-        try {
-            child.isGranted(read, pSid, true);
-            fail("Should have thrown NotFoundException");
-        } catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-
-        try {
-            child.isGranted(write, pSid, true);
-            fail("Should have thrown NotFoundException");
-        } catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-
-        // Let's add an identical permission to the child, but it'll appear AFTER the current permission, so has no impact
-        child.insertAce(1, BasePermission.DELETE, new PrincipalSid(auth), true);
-
-        // Let's also add another permission to the child
-        child.insertAce(2, BasePermission.CREATE, new PrincipalSid(auth), true);
-
-        // Save the changed child
-        jdbcMutableAclService.updateAcl(child);
-        child = (MutableAcl) jdbcMutableAclService.readAclById(childOid);
-        assertEquals(3, child.getEntries().size());
-
-        // Output permissions
-        for (int i = 0; i < child.getEntries().size(); i++) {
-            System.out.println(child.getEntries().get(i));
-        }
-
-        // Check the permissions are as they should be
-        assertFalse(child.isGranted(delete, pSid, true)); // as earlier permission overrode
-        assertTrue(child.isGranted(Arrays.asList(BasePermission.CREATE), pSid, true));
-
-        // Now check the first ACE (index 0) really is DELETE for our Sid and is non-granting
-        AccessControlEntry entry = child.getEntries().get(0);
-        assertEquals(BasePermission.DELETE.getMask(), entry.getPermission().getMask());
-        assertEquals(new PrincipalSid(auth), entry.getSid());
-        assertFalse(entry.isGranting());
-        assertNotNull(entry.getId());
-
-        // Now delete that first ACE
-        child.deleteAce(0);
-
-        // Save and check it worked
-        child = jdbcMutableAclService.updateAcl(child);
-        assertEquals(2, child.getEntries().size());
-        assertTrue(child.isGranted(delete, pSid, false));
-
-        SecurityContextHolder.clearContext();
-    }
-
-    /**
-     * Test method that demonstrates eviction failure from cache - SEC-676
-     */
-    @Test
-    @Transactional
-    public void deleteAclAlsoDeletesChildren() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        jdbcMutableAclService.createAcl(topParentOid);
-        MutableAcl middleParent = jdbcMutableAclService.createAcl(middleParentOid);
-        MutableAcl child = jdbcMutableAclService.createAcl(childOid);
-        child.setParent(middleParent);
-        jdbcMutableAclService.updateAcl(middleParent);
-        jdbcMutableAclService.updateAcl(child);
-        // Check the childOid really is a child of middleParentOid
-        Acl childAcl = jdbcMutableAclService.readAclById(childOid);
-
-        assertEquals(middleParentOid, childAcl.getParentAcl().getObjectIdentity());
-
-        // Delete the mid-parent and test if the child was deleted, as well
-        jdbcMutableAclService.deleteAcl(middleParentOid, true);
-
-        try {
-            jdbcMutableAclService.readAclById(middleParentOid);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-        try {
-            jdbcMutableAclService.readAclById(childOid);
-            fail("It should have thrown NotFoundException");
-        }
-        catch (NotFoundException expected) {
-            assertTrue(true);
-        }
-
-        Acl acl = jdbcMutableAclService.readAclById(topParentOid);
-        assertNotNull(acl);
-        assertEquals(((MutableAcl) acl).getObjectIdentity(), topParentOid);
-    }
-
-    @Test
-    public void constructorRejectsNullParameters() throws Exception {
-        try {
-            new JdbcMutableAclService(null, lookupStrategy, aclCache);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        try {
-            new JdbcMutableAclService(dataSource, null, aclCache);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-
-        try {
-            new JdbcMutableAclService(dataSource, lookupStrategy, null);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    public void createAclRejectsNullParameter() throws Exception {
-        try {
-            jdbcMutableAclService.createAcl(null);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    @Transactional
-    public void createAclForADuplicateDomainObject() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentity duplicateOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
-        jdbcMutableAclService.createAcl(duplicateOid);
-        // Try to add the same object second time
-        try {
-            jdbcMutableAclService.createAcl(duplicateOid);
-            fail("It should have thrown AlreadyExistsException");
-        }
-        catch (AlreadyExistsException expected) {
-        }
-    }
-
-    @Test
-    @Transactional
-    public void deleteAclRejectsNullParameters() throws Exception {
-        try {
-            jdbcMutableAclService.deleteAcl(null, true);
-            fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-        }
-    }
-
-    @Test
-    @Transactional
-    public void deleteAclWithChildrenThrowsException() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        MutableAcl parent = jdbcMutableAclService.createAcl(topParentOid);
-        MutableAcl child = jdbcMutableAclService.createAcl(middleParentOid);
-
-        // Specify the inheritance hierarchy
-        child.setParent(parent);
-        jdbcMutableAclService.updateAcl(child);
-
-        try {
-            jdbcMutableAclService.setForeignKeysInDatabase(false); // switch on FK checking in the class, not database
-            jdbcMutableAclService.deleteAcl(topParentOid, false);
-            fail("It should have thrown ChildrenExistException");
-        }
-        catch (ChildrenExistException expected) {
-        } finally {
-            jdbcMutableAclService.setForeignKeysInDatabase(true); // restore to the default
-        }
-    }
-
-    @Test
-    @Transactional
-    public void deleteAclRemovesRowsFromDatabase() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        MutableAcl child = jdbcMutableAclService.createAcl(childOid);
-        child.insertAce(0, BasePermission.DELETE, new PrincipalSid(auth), false);
-        jdbcMutableAclService.updateAcl(child);
-
-        // Remove the child and check all related database rows were removed accordingly
-        jdbcMutableAclService.deleteAcl(childOid, false);
-        assertEquals(1, jdbcTemplate.queryForList(SELECT_ALL_CLASSES, new Object[] {TARGET_CLASS} ).size());
-        assertEquals(0, jdbcTemplate.queryForList("select * from acl_object_identity").size());
-        assertEquals(0, jdbcTemplate.queryForList("select * from acl_entry").size());
-
-        // Check the cache
-        assertNull(aclCache.getFromCache(childOid));
-        assertNull(aclCache.getFromCache(Long.valueOf(102)));
-    }
-
-    /** SEC-1107 */
-    @Test
-    @Transactional
-    public void identityWithIntegerIdIsSupportedByCreateAcl() throws Exception {
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentity oid = new ObjectIdentityImpl(TARGET_CLASS, Integer.valueOf(101));
-        jdbcMutableAclService.createAcl(oid);
-
-        assertNotNull(jdbcMutableAclService.readAclById(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(101))));
-    }
-
-    /**
-     * SEC-655
-     */
-    @Test
-    @Transactional
-    public void childrenAreClearedFromCacheWhenParentIsUpdated() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("ben", "ignored","ROLE_ADMINISTRATOR");
-        auth.setAuthenticated(true);
-        SecurityContextHolder.getContext().setAuthentication(auth);
-
-        ObjectIdentity parentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(104));
-        ObjectIdentity childOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(105));
-
-        MutableAcl parent = jdbcMutableAclService.createAcl(parentOid);
-        MutableAcl child = jdbcMutableAclService.createAcl(childOid);
-
-        child.setParent(parent);
-        jdbcMutableAclService.updateAcl(child);
-
-        parent = (AclImpl) jdbcMutableAclService.readAclById(parentOid);
-        parent.insertAce(0, BasePermission.READ, new PrincipalSid("ben"), true);
-        jdbcMutableAclService.updateAcl(parent);
-
-        parent = (AclImpl) jdbcMutableAclService.readAclById(parentOid);
-        parent.insertAce(1, BasePermission.READ, new PrincipalSid("scott"), true);
-        jdbcMutableAclService.updateAcl(parent);
-
-        child = (MutableAcl) jdbcMutableAclService.readAclById(childOid);
-        parent = (MutableAcl) child.getParentAcl();
-
-        assertEquals("Fails because child has a stale reference to its parent", 2, parent.getEntries().size());
-        assertEquals(1, parent.getEntries().get(0).getPermission().getMask());
-        assertEquals(new PrincipalSid("ben"), parent.getEntries().get(0).getSid());
-        assertEquals(1, parent.getEntries().get(1).getPermission().getMask());
-        assertEquals(new PrincipalSid("scott"), parent.getEntries().get(1).getSid());
-    }
-
-    /**
-     * SEC-655
-     */
-    @Test
-    @Transactional
-    public void childrenAreClearedFromCacheWhenParentisUpdated2() throws Exception {
-        Authentication auth = new TestingAuthenticationToken("system", "secret","ROLE_IGNORED");
-        SecurityContextHolder.getContext().setAuthentication(auth);
-        ObjectIdentityImpl rootObject = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(1));
-
-        MutableAcl parent = jdbcMutableAclService.createAcl(rootObject);
-        MutableAcl child = jdbcMutableAclService.createAcl(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2)));
-        child.setParent(parent);
-        jdbcMutableAclService.updateAcl(child);
-
-        parent.insertAce(0, BasePermission.ADMINISTRATION, new GrantedAuthoritySid("ROLE_ADMINISTRATOR"), true);
-        jdbcMutableAclService.updateAcl(parent);
-
-        parent.insertAce(1, BasePermission.DELETE, new PrincipalSid("terry"), true);
-        jdbcMutableAclService.updateAcl(parent);
-
-        child = (MutableAcl) jdbcMutableAclService.readAclById(new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(2)));
-
-        parent = (MutableAcl) child.getParentAcl();
-
-        assertEquals(2, parent.getEntries().size());
-        assertEquals(16, parent.getEntries().get(0).getPermission().getMask());
-        assertEquals(new GrantedAuthoritySid("ROLE_ADMINISTRATOR"), parent.getEntries().get(0).getSid());
-        assertEquals(8, parent.getEntries().get(1).getPermission().getMask());
-        assertEquals(new PrincipalSid("terry"), parent.getEntries().get(1).getSid());
-    }
-
-    @Test
-    @Transactional
-    public void cumulativePermissions() {
-       Authentication auth = new TestingAuthenticationToken("ben", "ignored", "ROLE_ADMINISTRATOR");
-       auth.setAuthenticated(true);
-       SecurityContextHolder.getContext().setAuthentication(auth);
-
-       ObjectIdentity topParentOid = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(110));
-       MutableAcl topParent = jdbcMutableAclService.createAcl(topParentOid);
-
-       // Add an ACE permission entry
-       Permission cm = new CumulativePermission().set(BasePermission.READ).set(BasePermission.ADMINISTRATION);
-       assertEquals(17, cm.getMask());
-       Sid benSid = new PrincipalSid(auth);
-       topParent.insertAce(0, cm, benSid, true);
-       assertEquals(1, topParent.getEntries().size());
-
-       // Explicitly save the changed ACL
-       topParent = jdbcMutableAclService.updateAcl(topParent);
-
-       // Check the mask was retrieved correctly
-       assertEquals(17, topParent.getEntries().get(0).getPermission().getMask());
-       assertTrue(topParent.isGranted(Arrays.asList(cm), Arrays.asList(benSid), true));
-
-       SecurityContextHolder.clearContext();
-   }
-
-}

acl/src/test/java/org/springframework/security/acls/sid/SidRetrievalStrategyTests.java

@@ -1,67 +0,0 @@
-package org.springframework.security.acls.sid;
-
-import static org.junit.Assert.*;
-import static org.mockito.Matchers.*;
-import static org.mockito.Mockito.*;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.junit.Test;
-import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.AuthorityUtils;
-
-/**
- * Tests for {@link SidRetrievalStrategyImpl}
- *
- * @author Andrei Stefan
- * @author Luke Taylor
- */
-@SuppressWarnings("unchecked")
-public class SidRetrievalStrategyTests {
-    Authentication authentication = new TestingAuthenticationToken("scott", "password", "A", "B", "C");
-
-    //~ Methods ========================================================================================================
-
-    @Test
-    public void correctSidsAreRetrieved() throws Exception {
-        SidRetrievalStrategy retrStrategy = new SidRetrievalStrategyImpl();
-        List<Sid> sids = retrStrategy.getSids(authentication);
-
-        assertNotNull(sids);
-        assertEquals(4, sids.size());
-        assertNotNull(sids.get(0));
-        assertTrue(sids.get(0) instanceof PrincipalSid);
-
-        for (int i = 1; i < sids.size(); i++) {
-            assertTrue(sids.get(i) instanceof GrantedAuthoritySid);
-        }
-
-        assertEquals("scott", ((PrincipalSid) sids.get(0)).getPrincipal());
-        assertEquals("A", ((GrantedAuthoritySid) sids.get(1)).getGrantedAuthority());
-        assertEquals("B", ((GrantedAuthoritySid) sids.get(2)).getGrantedAuthority());
-        assertEquals("C", ((GrantedAuthoritySid) sids.get(3)).getGrantedAuthority());
-    }
-
-    @Test
-    public void roleHierarchyIsUsedWhenSet() throws Exception {
-        RoleHierarchy rh =  mock(RoleHierarchy.class);
-        List rhAuthorities = AuthorityUtils.createAuthorityList("D");
-        when(rh.getReachableGrantedAuthorities(anyCollection())).thenReturn(rhAuthorities);
-        SidRetrievalStrategy strat = new SidRetrievalStrategyImpl(rh);
-
-        List<Sid> sids = strat.getSids(authentication);
-        assertEquals(2, sids.size());
-        assertNotNull(sids.get(0));
-        assertTrue(sids.get(0) instanceof PrincipalSid);
-        assertEquals("D", ((GrantedAuthoritySid) sids.get(1)).getGrantedAuthority());
-    }
-}

acl/src/test/java/org/springframework/security/acls/sid/SidTests.java

@@ -1,189 +0,0 @@
-package org.springframework.security.acls.sid;
-
-import junit.framework.Assert;
-import junit.framework.TestCase;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.authority.SimpleGrantedAuthority;
-
-public class SidTests extends TestCase {
-
-    //~ Methods ========================================================================================================
-
-    public void testPrincipalSidConstructorsRequiredFields() throws Exception {
-        // Check one String-argument constructor
-        try {
-            String string = null;
-            new PrincipalSid(string);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            new PrincipalSid("");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            new PrincipalSid("johndoe");
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-
-        // Check one Authentication-argument constructor
-        try {
-            Authentication authentication = null;
-            new PrincipalSid(authentication);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            Authentication authentication = new TestingAuthenticationToken(null, "password");
-            new PrincipalSid(authentication);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
-            new PrincipalSid(authentication);
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-    }
-
-    public void testGrantedAuthoritySidConstructorsRequiredFields() throws Exception {
-        // Check one String-argument constructor
-        try {
-            String string = null;
-            new GrantedAuthoritySid(string);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            new GrantedAuthoritySid("");
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            new GrantedAuthoritySid("ROLE_TEST");
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-
-        // Check one GrantedAuthority-argument constructor
-        try {
-            GrantedAuthority ga = null;
-            new GrantedAuthoritySid(ga);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            GrantedAuthority ga = new SimpleGrantedAuthority(null);
-            new GrantedAuthoritySid(ga);
-            Assert.fail("It should have thrown IllegalArgumentException");
-        }
-        catch (IllegalArgumentException expected) {
-            Assert.assertTrue(true);
-        }
-
-        try {
-            GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_TEST");
-            new GrantedAuthoritySid(ga);
-            Assert.assertTrue(true);
-        }
-        catch (IllegalArgumentException notExpected) {
-            Assert.fail("It shouldn't have thrown IllegalArgumentException");
-        }
-    }
-
-    public void testPrincipalSidEquals() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
-        Sid principalSid = new PrincipalSid(authentication);
-
-        Assert.assertFalse(principalSid.equals(null));
-        Assert.assertFalse(principalSid.equals("DIFFERENT_TYPE_OBJECT"));
-        Assert.assertTrue(principalSid.equals(principalSid));
-        Assert.assertTrue(principalSid.equals(new PrincipalSid(authentication)));
-        Assert.assertTrue(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("johndoe", null))));
-        Assert.assertFalse(principalSid.equals(new PrincipalSid(new TestingAuthenticationToken("scott", null))));
-        Assert.assertTrue(principalSid.equals(new PrincipalSid("johndoe")));
-        Assert.assertFalse(principalSid.equals(new PrincipalSid("scott")));
-    }
-
-    public void testGrantedAuthoritySidEquals() throws Exception {
-        GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_TEST");
-        Sid gaSid = new GrantedAuthoritySid(ga);
-
-        Assert.assertFalse(gaSid.equals(null));
-        Assert.assertFalse(gaSid.equals("DIFFERENT_TYPE_OBJECT"));
-        Assert.assertTrue(gaSid.equals(gaSid));
-        Assert.assertTrue(gaSid.equals(new GrantedAuthoritySid(ga)));
-        Assert.assertTrue(gaSid.equals(new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_TEST"))));
-        Assert.assertFalse(gaSid.equals(new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_NOT_EQUAL"))));
-        Assert.assertTrue(gaSid.equals(new GrantedAuthoritySid("ROLE_TEST")));
-        Assert.assertFalse(gaSid.equals(new GrantedAuthoritySid("ROLE_NOT_EQUAL")));
-    }
-
-    public void testPrincipalSidHashCode() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
-        Sid principalSid = new PrincipalSid(authentication);
-
-        Assert.assertTrue(principalSid.hashCode() == "johndoe".hashCode());
-        Assert.assertTrue(principalSid.hashCode() == new PrincipalSid("johndoe").hashCode());
-        Assert.assertTrue(principalSid.hashCode() != new PrincipalSid("scott").hashCode());
-        Assert.assertTrue(principalSid.hashCode() != new PrincipalSid(new TestingAuthenticationToken("scott", "password")).hashCode());
-    }
-
-    public void testGrantedAuthoritySidHashCode() throws Exception {
-        GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_TEST");
-        Sid gaSid = new GrantedAuthoritySid(ga);
-
-        Assert.assertTrue(gaSid.hashCode() == "ROLE_TEST".hashCode());
-        Assert.assertTrue(gaSid.hashCode() == new GrantedAuthoritySid("ROLE_TEST").hashCode());
-        Assert.assertTrue(gaSid.hashCode() != new GrantedAuthoritySid("ROLE_TEST_2").hashCode());
-        Assert.assertTrue(gaSid.hashCode() != new GrantedAuthoritySid(new SimpleGrantedAuthority("ROLE_TEST_2")).hashCode());
-    }
-
-    public void testGetters() throws Exception {
-        Authentication authentication = new TestingAuthenticationToken("johndoe", "password");
-        PrincipalSid principalSid = new PrincipalSid(authentication);
-        GrantedAuthority ga = new SimpleGrantedAuthority("ROLE_TEST");
-        GrantedAuthoritySid gaSid = new GrantedAuthoritySid(ga);
-
-        Assert.assertTrue("johndoe".equals(principalSid.getPrincipal()));
-        Assert.assertFalse("scott".equals(principalSid.getPrincipal()));
-
-        Assert.assertTrue("ROLE_TEST".equals(gaSid.getGrantedAuthority()));
-        Assert.assertFalse("ROLE_TEST2".equals(gaSid.getGrantedAuthority()));
-    }
-}

acl/src/test/resources/jdbcMutableAclServiceTests-context.xml

@@ -1,83 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
-
-<!--
-  - Application context containing business beans.
-  -
-  - Used by all artifacts.
-  -
-  -->
-
-<beans>
-    <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
-        <property name="dataSource" ref="dataSource"/>
-    </bean>
-
-    <bean id="aclCache" class="org.springframework.security.acls.domain.EhCacheBasedAclCache">
-        <constructor-arg>
-           <bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
-              <property name="cacheManager">
-                <bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
-              </property>
-              <property name="cacheName" value="aclCache"/>
-           </bean>
-        </constructor-arg>
-    </bean>
-
-    <bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">
-        <constructor-arg ref="dataSource"/>
-        <constructor-arg ref="aclCache"/>
-        <constructor-arg ref="aclAuthorizationStrategy"/>
-        <constructor-arg>
-            <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
-        </constructor-arg>
-    </bean>
-
-    <bean id="aclAuthorizationStrategy" class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
-        <constructor-arg>
-            <list>
-                <bean class="org.springframework.security.core.authority.SimpleGrantedAuthority">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.SimpleGrantedAuthority">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-                <bean class="org.springframework.security.core.authority.SimpleGrantedAuthority">
-                    <constructor-arg value="ROLE_ADMINISTRATOR"/>
-                </bean>
-            </list>
-        </constructor-arg>
-    </bean>
-
-    <bean id="aclService" class="org.springframework.security.acls.jdbc.JdbcMutableAclService">
-        <constructor-arg ref="dataSource"/>
-        <constructor-arg ref="lookupStrategy"/>
-        <constructor-arg ref="aclCache"/>
-
-<!-- Uncomment to use PostgreSQL
-        <property name="classIdentityQuery" value="select currval(pg_get_serial_sequence('acl_class', 'id'))"/>
-        <property name="sidIdentityQuery" value="select currval(pg_get_serial_sequence('acl_sid', 'id'))"/>
- -->
-    </bean>
-
-<!-- PostgreSQL DataSource configuration
-
-    <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
-        <property name="driverClassName" value="org.postgresql.Driver"/>
-        <property name="url" value="jdbc:postgresql://localhost:5432/acltest"/>
-        <property name="username" value="acltest"/>
-        <property name="password" value="acltest"/>
-    </bean>
- -->
-    <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
-        <property name="driverClassName" value="org.hsqldb.jdbcDriver"/>
-        <property name="url" value="jdbc:hsqldb:mem:acltest"/>
-        <property name="username" value="sa"/>
-        <property name="password" value=""/>
-    </bean>
-
-    <bean id="jdbcTemplate" class="org.springframework.jdbc.core.JdbcTemplate">
-        <property name="dataSource" ref="dataSource"/>
-    </bean>
-
-</beans>

acl/src/test/resources/logback-test.xml

@@ -1,14 +0,0 @@
-<configuration>
-  <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
-    <encoder>
-      <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
-    </encoder>
-  </appender>
-
-  <logger name="org.springframework.security" level="${sec.log.level}:-WARN"/>
-
-  <root level="${root.level}:-WARN">
-    <appender-ref ref="STDOUT" />
-  </root>
-
-</configuration>

acl/template.mf

@@ -1,23 +0,0 @@
-Implementation-Title: org.springframework.security.acls
-Implementation-Version: ${version}
-Bundle-SymbolicName: org.springframework.security.acls
-Bundle-Name: Spring Security Acls
-Bundle-Vendor: SpringSource
-Bundle-Version: ${version}
-Bundle-ManifestVersion: 2
-Ignored-Existing-Headers:
- Import-Package,
- Export-Package
-Import-Template:
- org.aopalliance.*;version="${aopAllianceRange}",
- org.apache.commons.logging.*;version="${cloggingRange}",
- org.springframework.security.core.*;version="${secRange}",
- org.springframework.security.access.*;version="${secRange}",
- org.springframework.security.util.*;version="${secRange}",
- org.springframework.context.*;version="${secRange}";resolution:=optional,
- org.springframework.dao.*;version="${springRange}";resolution:=optional,
- org.springframework.jdbc.core.*;version="${springRange}";resolution:=optional,
- org.springframework.transaction.support.*;version="${springRange}";resolution:=optional,
- org.springframework.util.*;version="${springRange}";resolution:=optional,
- net.sf.ehcache.*;version="${ehcacheRange}";resolution:=optional,
- javax.sql.*;version="0";resolution:=optional

antora-playbook.yml

@@ -0,0 +1,38 @@
+antora:
+  extensions:
+  - require: '@springio/antora-extensions'
+    root_component_name: 'security'
+site:
+  title: Spring Security
+  url: https://docs.spring.io/spring-security/reference
+  robots: allow
+git:
+  ensure_git_suffix: false
+content:
+  sources:
+  - url: https://github.com/spring-projects/spring-security
+    branches: [main, '6.5.x', '{7..99}.*.x']
+    tags: ['6.5.*','{7..99}.*']
+    start_path: docs
+asciidoc:
+  attributes:
+    page-stackoverflow-url: https://stackoverflow.com/tags/spring-security
+    page-related-doc-categories: security
+    page-related-doc-projects: framework,graphql
+    hide-uri-scheme: '@'
+    tabs-sync-option: '@'
+  extensions:
+  - '@asciidoctor/tabs'
+  - '@springio/asciidoctor-extensions'
+  - '@springio/asciidoctor-extensions/javadoc-extension'
+urls:
+  latest_version_segment_strategy: redirect:to
+  latest_version_segment: ''
+  redirect_facility: httpd
+ui:
+  bundle:
+    url: https://github.com/spring-io/antora-ui-spring/releases/download/v0.4.26/ui-bundle.zip
+    snapshot: true
+runtime:
+  log:
+    failure_level: warn

aspects/aspects.gradle

@@ -1,8 +0,0 @@
-
-dependencies {
-    compile project(':spring-security-core'),
-            "org.springframework:spring-beans:$springVersion",
-            "org.springframework:spring-context:$springVersion"
-
-    testCompile 'aopalliance:aopalliance:1.0'
-}

aspects/src/main/java/org/springframework/security/access/intercept/aspectj/aspect/AnnotationSecurityAspect.aj

@@ -1,76 +0,0 @@
-package org.springframework.security.access.intercept.aspectj.aspect;
-
-import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.access.annotation.Secured;
-import org.springframework.security.access.prepost.*;
-import org.springframework.security.access.intercept.aspectj.AspectJCallback;
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor;
-
-/**
- * Concrete AspectJ aspect using Spring Security @Secured annotation
- * for JDK 1.5+.
- *
- * <p>
- * When using this aspect, you <i>must</i> annotate the implementation class
- * (and/or methods within that class), <i>not</i> the interface (if any) that
- * the class implements. AspectJ follows Java's rule that annotations on
- * interfaces are <i>not</i> inherited. This will vary from Spring AOP.
- *
- * @author Mike Wiesner
- * @author Luke Taylor
- * @since 3.1
- */
-public aspect AnnotationSecurityAspect implements InitializingBean {
-
-    /**
-     * Matches the execution of any public method in a type with the Secured
-     * annotation, or any subtype of a type with the Secured annotation.
-     */
-    private pointcut executionOfAnyPublicMethodInAtSecuredType() :
-        execution(public * ((@Secured *)+).*(..)) && @this(Secured);
-
-    /**
-     * Matches the execution of any method with the Secured annotation.
-     */
-    private pointcut executionOfSecuredMethod() :
-        execution(* *(..)) && @annotation(Secured);
-
-    /**
-     * Matches the execution of any method with Pre/Post annotations.
-     */
-    private pointcut executionOfPrePostAnnotatedMethod() :
-        execution(* *(..)) && (@annotation(PreAuthorize) || @annotation(PreFilter)
-                || @annotation(PostAuthorize) || @annotation(PostFilter));
-
-    private pointcut securedMethodExecution() :
-        executionOfAnyPublicMethodInAtSecuredType() ||
-        executionOfSecuredMethod() ||
-        executionOfPrePostAnnotatedMethod();
-
-    private AspectJMethodSecurityInterceptor securityInterceptor;
-
-    Object around(): securedMethodExecution() {
-        if (this.securityInterceptor == null) {
-            return proceed();
-        }
-
-        AspectJCallback callback = new AspectJCallback() {
-            public Object proceedWithObject() {
-                return proceed();
-            }
-        };
-
-        return this.securityInterceptor.invoke(thisJoinPoint, callback);
-    }
-
-    public void setSecurityInterceptor(AspectJMethodSecurityInterceptor securityInterceptor) {
-        this.securityInterceptor = securityInterceptor;
-    }
-
-    public void afterPropertiesSet() throws Exception {
-        if (this.securityInterceptor == null) {
-            throw new IllegalArgumentException("securityInterceptor required");
-        }
-    }
-
-}