Added appendices to end of doc. Corrected minor typo.

.cvsignore

@@ -0,0 +1,7 @@
+dist
+target
+build.properties
+*.log
+.clover
+*.keystore
+server-work

.gitignore

@@ -1,21 +0,0 @@
-target/
-*/src/*/java/META-INF
-*/src/META-INF/
-*/src/*/java/META-INF/
-.classpath
-.springBeans
-.project
-.DS_Store
-.settings/
-.idea/
-out/
-bin/
-intellij/
-build/
-*.log
-*.log.*
-*.iml
-*.ipr
-*.iws
-.gradle/
-atlassian-ide-plugin.xml

CONTRIBUTING.md

@@ -1,198 +0,0 @@
-_Have something you'd like to contribute to the framework? We welcome pull requests, but ask that you carefully read this document first to understand how best to submit them; what kind of changes are likely to be accepted; and what to expect from the Spring Security team when evaluating your submission._
-
-_Please refer back to this document as a checklist before issuing any pull request; this will save time for everyone!_
-
-# Similar but different
-
-Each Spring module is slightly different than another in terms of team size, number of issues, etc. Therefore each project is managed slightly different. You will notice that this document is very similar to the [Spring Framework Contributor guidelines](https://github.com/SpringSource/spring-framework/wiki/Contributor-guidelines). However, there are some subtle differences between the two documents, so please be sure to read this document thoroughly.
-
-# Importing into IDE
-
-The following provides information on setting up a development environment that can run the sample in [Spring Tool Suite 3.6.0+](http://www.springsource.org/sts). Other IDE's should work using Gradle's IDE support, but have not been tested.
-
-* IDE Setup
-  * Install Spring Tool Suite 3.6.0+
-  * You will need the following plugins installed (can be found on the Extensions Page)
-   	* Gradle Eclipse
-   	* Groovy Eclipse
-* Importing the project into Spring Tool Suite
-  * File->Import...->Gradle Project
-
-# Understand the basics 
-Not sure what a pull request is, or how to submit one? Take a look at GitHub's excellent [help documentation first](https://help.github.com/articles/using-pull-requests).
-
-# Search JIRA first; create an issue if necessary
-Is there already an issue that addresses your concern? Do a bit of searching in our [JIRA issue tracker](https://jira.springsource.org/browse/SEC) to see if you can find something similar. If not, please create a new issue before submitting a pull request unless the change is not a user facing issue.
-
-# Discuss non-trivial contribution ideas with committers
-If you're considering anything more than correcting a typo or fixing a minor bug , please discuss it on the [Spring Security forums](http://forum.springsource.org/forumdisplay.php?33-Security) before submitting a pull request. We're happy to provide guidance but please spend an hour or two researching the subject on your own including searching the forums for prior discussions.
-
-# Sign the Contributor License Agreement
-If you have not previously done so, please fill out and submit the [SpringSource CLA form](https://support.springsource.com/spring_committer_signup). You'll receive a token when this process is complete. Keep track of this, you may be asked for it later!
-
-* For **Project** select _Spring Security_
-* For **Project Lead** enter _Rob Winch_
-* Note that emailing/postal mailing a signed copy is not necessary. Submission of the web form is all that is required.
-
-When you've completed the web form, simply add the following in a comment on your pull request:
-
-> I have signed and agree to the terms of the SpringSource Individual Contributor License Agreement.
-
-You do not need to include your token/id. Please add the statement above to all future pull requests as well, simply so the Spring Security team knows immediately that this process is complete.
-
-# Create your branch from master
-Create your topic branch to be submitted as a pull request from master. The Spring team will consider your pull request for backporting on a case-by-case basis; you don't need to worry about submitting anything for backporting.
-
-# Use short branch names
-Branches used when submitting pull requests should preferably be named according to JIRA issues, e.g. 'SEC-1234'. Otherwise, use succinct, lower-case, dash (-) delimited names, such as 'fix-warnings', 'fix-typo', etc. This is important, because branch names show up in the merge commits that result from accepting pull requests, and should be as expressive and concise as possible.
-
-#Keep commits focused
-
-Remember each JIRA should be focused on a single item of interest since the JIRA tickets are used to produce the changelog. Since each commit should be tied to a JIRA, ensure that your commits are focused. For example, do not include an update to a transitive library in your commit unless the JIRA is to update the library. Reviewing your commits is essential before sending a pull request.
-
-# Mind the whitespace
-Please carefully follow the whitespace and formatting conventions already present in the framework. 
-
-1. Spaces, not tabs
-1. Unix (LF), not dos (CRLF) line endings
-1. Eliminate all trailing whitespace
-1. Aim to wrap code at 120 characters, but favor readability over wrapping
-1. Preserve existing formatting; i.e. do not reformat code for its own sake
-1. Search the codebase using git grep and other tools to discover common naming conventions, etc.
-1. Latin-1 (ISO-8859-1) encoding for Java sources; use native2ascii to convert if necessary
-
-Whitespace management tips
-
-1. You can use the [AnyEdit Eclipse plugin](http://marketplace.eclipse.org/content/anyedit-tools) to ensure spaces are used and to clean up trailing whitespaces.
-1. Use git's pre-commit.sample hook to prevent invalid whitespace from being pushed out. You can enable it by moving ~/spring-security/.git/hooks/pre-commit.sample to ~/spring-security/.git/hooks/pre-commit and ensuring it is executable. For more information on hooks refer to [Pro Git's Pre-Commit Hook's section](http://git-scm.com/book/cs/ch7-3.html)
-
-# Add Apache license header to all new classes
-
-<pre>
-/*
- * Copyright 2002-2012 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package ...;
-</pre>
-# Update Apache license header to modified files as necessary
-Always check the date range in the license header. For example, if you've modified a file in 2012 whose header still reads
-<pre>
- * Copyright 2002-2011 the original author or authors.
-</pre>
-then be sure to update it to 2012 appropriately
-<pre>
- * Copyright 2002-2012 the original author or authors.
-</pre>
-# Use @since tags for newly-added public API types and methods
-e.g.
-<pre>
-/**
- * ...
- *
- * @author First Last
- * @since 3.2
- * @see ...
- */
-</pre>
-
-#Submit JUnit test cases for all behavior changes
-Search the codebase to find related unit tests and add additional `@Test` methods within. 
-
-1. Any new tests should end in the name Tests (note this is plural). For example, a valid name would be `FilterChainProxyTests`. An invalid name would be `FilterChainProxyTest`.
-2. New test methods should not start with test. This is an old JUnit3 convention and is not necessary since the method is annotated with @Test.
-
-# Squash commits
-Use git rebase --interactive, git add --patch and other tools to "squash" multiple commits into atomic changes. In addition to the man pages for git, there are many resources online to help you understand how these tools work. Here is one: http://book.git-scm.com/4_interactive_rebasing.html.
-
-# Use real name in git commits
-Please configure git to use your real first and last name for any commits you intend to submit as pull requests. For example, this is not acceptable:
-
-<pre>
-Author: Nickname &lt;user@mail.com&gt;
-</pre>
-Rather, please include your first and last name, properly capitalized, as submitted against the SpringSource contributor license agreement:
-<pre>
-Author: First Last &lt;user@mail.com&gt;
-</pre>
-This helps ensure traceability against the CLA, and also goes a long way to ensuring useful output from tools like git shortlog and others.
-
-You can configure this globally via the account admin area GitHub (useful for fork-and-edit cases); globally with
-
-<pre>
-git config --global user.name "First Last"
-git config --global user.email user@mail.com
-</pre>
-
-or locally for the spring-security repository only by omitting the '--global' flag:
-<pre>
-cd spring-security
-git config user.name "First Last"
-git config user.email user@mail.com
-</pre>
-
-# Format commit messages
-
-<pre>
-SEC-1234: Short (50 chars or less) summary of changes
-
-More detailed explanatory text, if necessary.  Wrap it to about 72
-characters or so.  In some contexts, the first line is treated as the
-subject of an email and the rest of the text as the body.  The blank
-line separating the summary from the body is critical (unless you omit
-the body entirely); tools like rebase can get confused if you run the
-two together.
-
-Further paragraphs come after blank lines.
-
- - Bullet points are okay, too
-
- - Typically a hyphen or asterisk is used for the bullet, preceded by a
-   single space, with blank lines in between, but conventions vary here
-</pre>
-
-
-1. The commit subject should start with the associated jira issue followed by a : as shown in the example above
-2. Keep the subject line to 50 characters or less if possible
-3. Do not end the subject line with a period
-4. In the body of the commit message, explain how things worked before this commit, what has changed, and how things work now
-
-# Run all tests prior to submission
-
-<pre>
-cd spring-security
-./gradlew clean build integrationTest
-</pre>
-
-# Submit your pull request
-Subject line:
-
-Follow the same conventions for pull request subject lines as mentioned above for commit message subject lines.
-
-In the body:
-
-1. Explain your use case. What led you to submit this change? Why were existing mechanisms in the framework insufficient? Make a case that this is a general-purpose problem and that yours is a general-purpose solution, etc
-2. Add any additional information and ask questions; start a conversation, or continue one from JIRA
-3. Mention the JIRA issue ID
-4. Also mention that you have submitted the CLA as described above
-Note that for pull requests containing a single commit, GitHub will default the subject line and body of the pull request to match the subject line and body of the commit message. This is fine, but please also include the items above in the body of the request.
-
-# Mention your pull request on the associated JIRA issue
-Add a comment to the associated JIRA issue(s) linking to your new pull request.
-
-# Expect discussion and rework
-The Spring team takes a very conservative approach to accepting contributions to the framework. This is to keep code quality and stability as high as possible, and to keep complexity at a minimum. Your changes, if accepted, may be heavily modified prior to merging. You will retain "Author:" attribution for your Git commits granted that the bulk of your changes remain intact. You may be asked to rework the submission for style (as explained above) and/or substance. Again, we strongly recommend discussing any serious submissions with the Spring Framework team prior to engaging in serious development work.
-
-Note that you can always force push (git push -f) reworked / rebased commits against the branch used to submit your pull request. i.e. you do not need to issue a new pull request when asked to make changes.

README.adoc

@@ -1,60 +0,0 @@
-image::https://badges.gitter.im/Join%20Chat.svg[Gitter,link=https://gitter.im/spring-projects/spring-security?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge]
-
-= Spring Security
-
-Spring Security provides security services for the http://docs.spring.io[Spring IO Platform]. Spring Security 3.1 requires Spring 3.0.3 as
-a minimum and also requires Java 5.
-
-For a detailed list of features and access to the latest release, please visit http://spring.io/projects[Spring projects].
-
-== Downloading Artifacts
-See https://github.com/spring-projects/spring-framework/wiki/Downloading-Spring-artifacts[downloading Spring artifacts] for Maven repository information.
-
-== Documentation
-Be sure to read the http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference].
-Extensive JavaDoc for the Spring Security code is also available in the http://docs.spring.io/spring-security/site/docs/current/apidocs/[Spring Security API Documentation].
-
-== Quick Start
-We recommend you visit http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference] and read the "Getting Started" page.
-
-== Building from Source
-Spring Security uses a http://gradle.org[Gradle]-based build system.
-In the instructions below, http://vimeo.com/34436402[`./gradlew`] is invoked from the root of the source tree and serves as
-a cross-platform, self-contained bootstrap mechanism for the build.
-
-=== Prerequisites
-http://help.github.com/set-up-git-redirect[Git] and the http://www.oracle.com/technetwork/java/javase/downloads[JDK7 build].
-
-Be sure that your `JAVA_HOME` environment variable points to the `jdk1.7.0` folder extracted from the JDK download.
-
-=== Check out sources
-[indent=0]
-----
-git clone git@github.com:spring-projects/spring-security.git
-----
-
-=== Install all spring-\* jars into your local Maven cache
-[indent=0]
-----
-./gradlew install
-----
-
-=== Compile and test; build all jars, distribution zips, and docs
-[indent=0]
-----
-./gradlew build
-----
-
-Discover more commands with `./gradlew tasks`.
-See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].
-
-== Getting Support
-Check out the http://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
-http://spring.io/services[Commercial support] is available too.
-
-== Contributing
-http://help.github.com/send-pull-requests[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/master/CONTRIBUTING.md[contributor guidelines] for details.
-
-== License
-Spring Security is Open Source software released under the
-http://www.apache.org/licenses/LICENSE-2.0.html[Apache 2.0 license].

acegi_checkstyle.xml

@@ -0,0 +1,205 @@
+<?xml version="1.0"?>
+<!--
+/*
+ * Copyright 2001-2004 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+ -->
+
+<!DOCTYPE module PUBLIC
+    "-//Puppy Crawl//DTD Check Configuration 1.2//EN"
+    "http://www.puppycrawl.com/dtds/configuration_1_2.dtd">
+
+<!--
+
+  Checkstyle is very configurable. Be sure to read the documentation at
+  http://checkstyle.sf.net (or in your downloaded distribution).
+
+  Most Checks are configurable, be sure to consult the documentation.
+
+  To completely disable a check, just comment it out or delete it from the file.
+
+  Finally, it is worth reading the documentation.
+
+-->
+
+<module name="Checker">
+
+    <!-- Checks that a package.html file exists for each package.     -->
+    <!-- See http://checkstyle.sf.net/config_javadoc.html#PackageHtml -->
+    <!-- module name="PackageHtml"/ -->
+
+    <!-- Checks whether files end with a new line.                        -->
+    <!-- See http://checkstyle.sf.net/config_misc.html#NewlineAtEndOfFile -->
+    <module name="NewlineAtEndOfFile"/>
+
+    <!-- Checks that property files contain the same keys.         -->
+    <!-- See http://checkstyle.sf.net/config_misc.html#Translation -->
+    <module name="Translation"/>
+
+
+    <module name="TreeWalker">
+
+        <property name="cacheFile" value="${checkstyle.cache.file}"/>
+
+        <!-- Checks for Javadoc comments.                     -->
+        <!-- See http://checkstyle.sf.net/config_javadoc.html -->
+<!--
+        <module name="JavadocMethod"/>
+        <module name="JavadocType"/>
+        <module name="JavadocVariable"/>
+        <module name="JavadocStyle"/>
+-->
+
+        <!-- Checks for Naming Conventions.                  -->
+        <!-- See http://checkstyle.sf.net/config_naming.html -->
+        <module name="ConstantName">
+            <!-- logger variables break normal constant syntax. We need to allow lower case too -->
+            <property name="format" value="^[a-zA-Z][a-zA-Z0-9]*(_[A-Z0-9]+)*$"/>
+        </module>
+        <module name="LocalFinalVariableName"/>
+        <module name="LocalVariableName"/>
+        <module name="MemberName"/>
+        <module name="MethodName"/>
+        <module name="PackageName"/>
+        <module name="ParameterName"/>
+        <module name="StaticVariableName"/>
+        <module name="TypeName"/>
+
+
+        <!-- Checks for Headers                                -->
+        <!-- See http://checkstyle.sf.net/config_header.html   -->
+        <!-- <module name="Header">                            -->
+            <!-- The follow property value demonstrates the ability     -->
+            <!-- to have access to ANT properties. In this case it uses -->
+            <!-- the ${basedir} property to allow Checkstyle to be run  -->
+            <!-- from any directory within a project. See property      -->
+            <!-- expansion,                                             -->
+            <!-- http://checkstyle.sf.net/config.html#properties        -->
+            <!-- <property                                              -->
+            <!--     name="headerFile"                                  -->
+            <!--     value="${basedir}/java.header"/>                   -->
+        <!-- </module> -->
+
+        <!-- Following interprets the header file as regular expressions. -->
+        <!-- <module name="RegexpHeader"/>                                -->
+
+
+        <!-- Checks for imports                              -->
+        <!-- See http://checkstyle.sf.net/config_imports.html -->
+        <module name="AvoidStarImport">
+            <property name="excludes" value="javax.servlet,java.util"/>
+        </module>
+        <module name="IllegalImport"/> <!-- defaults to sun.* packages -->
+        <module name="RedundantImport"/>
+        <!--module name="UnusedImports"/ -->
+
+
+        <!-- Checks for Size Violations.                    -->
+        <!-- See http://checkstyle.sf.net/config_sizes.html -->
+        <module name="FileLength"/>
+        <module name="LineLength">
+            <property name="max" value="125"/>
+        </module>
+        <module name="MethodLength"/>
+        <module name="ParameterNumber"/>
+
+
+        <!-- Checks for whitespace                               -->
+        <!-- See http://checkstyle.sf.net/config_whitespace.html -->
+        <module name="EmptyForIteratorPad"/>
+        <module name="MethodParamPad"/>
+        <module name="NoWhitespaceAfter"/>
+        <module name="NoWhitespaceBefore"/>
+        <module name="OperatorWrap"/>
+        <module name="ParenPad"/>
+        <module name="TypecastParenPad"/>
+        <module name="TabCharacter"/>
+        <module name="WhitespaceAfter"/>
+      <!--
+        <module name="WhitespaceAround">
+            <property name="allowEmptyMethods" value="true"/>
+            <property name="allowEmptyConstructors" value="true"/>
+        </module>
+        -->
+
+        <!-- Modifier Checks                                    -->
+        <!-- See http://checkstyle.sf.net/config_modifiers.html -->
+        <module name="ModifierOrder"/>
+        <module name="RedundantModifier"/>
+
+
+        <!-- Checks for blocks. You know, those {}'s         -->
+        <!-- See http://checkstyle.sf.net/config_blocks.html -->
+        <module name="AvoidNestedBlocks"/>
+        <!-- module name="EmptyBlock"/ -->
+        <module name="LeftCurly"/>
+        <module name="NeedBraces"/>
+        <module name="RightCurly"/>
+
+
+        <!-- Checks for common coding problems               -->
+        <!-- See http://checkstyle.sf.net/config_coding.html -->
+        <!-- module name="AvoidInlineConditionals"/ -->
+        <module name="DoubleCheckedLocking"/>    <!-- MY FAVOURITE -->
+        <module name="EmptyStatement"/>
+        <!-- module name="EqualsHashCode"/ -->
+      <!--
+        <module name="HiddenField">
+            <property name="ignoreConstructorParameter" value="true"/>
+            <property name="ignoreSetter" value="true"/>
+        </module>
+        -->
+        <module name="IllegalInstantiation"/>
+        <module name="InnerAssignment"/>
+        <!-- module name="MagicNumber"/ -->
+        <module name="MissingSwitchDefault"/>
+      <!--
+        <module name="RedundantThrows">
+            <property name="allowUnchecked" value="true"/>
+        </module>
+       -->
+      <!--
+        <module name="SimplifyBooleanExpression"/>
+        <module name="SimplifyBooleanReturn"/>
+      -->
+        <!-- Checks for class design                         -->
+        <!-- See http://checkstyle.sf.net/config_design.html -->
+        <!-- module name="DesignForExtension"/ -->
+        <module name="FinalClass"/>
+        <module name="HideUtilityClassConstructor"/>
+        <module name="InterfaceIsType"/>
+        <module name="VisibilityModifier">
+            <!-- logger variables are often protected -->
+            <property name="protectedAllowed" value="true"/>
+        </module>
+
+
+        <!-- Miscellaneous other checks.                   -->
+        <!-- See http://checkstyle.sf.net/config_misc.html -->
+        <module name="ArrayTypeStyle"/>
+        <!-- module name="FinalParameters"/ -->
+        <!--
+        <module name="GenericIllegalRegexp">
+            <property name="format" value="\s+$"/>
+            <property name="message" value="Line has trailing spaces."/>
+        </module>
+        -->
+        <!-- module name="TrailingComment"/ -->
+        <!-- module name="TodoComment"/ -->
+        <module name="UpperEll"/>
+
+    </module>
+
+</module>

acl/acl.gradle

@@ -1,19 +0,0 @@
-// Acl Module build file
-
-dependencies {
-	compile project(':spring-security-core'),
-			springCoreDependency,
-			'aopalliance:aopalliance:1.0',
-			"org.springframework:spring-aop:$springVersion",
-			"org.springframework:spring-context:$springVersion",
-			"org.springframework:spring-tx:$springVersion",
-			"org.springframework:spring-jdbc:$springVersion"
-
-	optional "net.sf.ehcache:ehcache:$ehcacheVersion"
-
-	testCompile "org.springframework:spring-beans:$springVersion",
-				"org.springframework:spring-context-support:$springVersion",
-				"org.springframework:spring-test:$springVersion"
-
-	testRuntime "org.hsqldb:hsqldb:$hsqlVersion"
-}

acl/pom.xml

@@ -1,165 +1,79 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
-  <modelVersion>4.0.0</modelVersion>
-  <groupId>org.springframework.security</groupId>
-  <artifactId>spring-security-acl</artifactId>
-  <version>4.0.4.RELEASE</version>
-  <name>spring-security-acl</name>
-  <description>spring-security-acl</description>
-  <url>http://spring.io/spring-security</url>
-  <organization>
-    <name>spring.io</name>
-    <url>http://spring.io/</url>
-  </organization>
-  <licenses>
-    <license>
-      <name>The Apache Software License, Version 2.0</name>
-      <url>http://www.apache.org/licenses/LICENSE-2.0.txt</url>
-      <distribution>repo</distribution>
-    </license>
-  </licenses>
-  <developers>
-    <developer>
-      <id>rwinch</id>
-      <name>Rob Winch</name>
-      <email>rwinch@gopivotal.com</email>
-    </developer>
-  </developers>
-  <scm>
-    <connection>scm:git:git://github.com/spring-projects/spring-security</connection>
-    <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
-    <url>https://github.com/spring-projects/spring-security</url>
-  </scm>
-  <dependencies>
-    <dependency>
-      <groupId>aopalliance</groupId>
-      <artifactId>aopalliance</artifactId>
-      <version>1.0</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-core</artifactId>
-      <version>4.0.4.RELEASE</version>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-aop</artifactId>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-context</artifactId>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-core</artifactId>
-      <scope>compile</scope>
-      <exclusions>
-        <exclusion>
-          <artifactId>commons-logging</artifactId>
-          <groupId>commons-logging</groupId>
-        </exclusion>
-      </exclusions>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-jdbc</artifactId>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-tx</artifactId>
-      <scope>compile</scope>
-    </dependency>
-    <dependency>
-      <groupId>commons-logging</groupId>
-      <artifactId>commons-logging</artifactId>
-      <version>1.2</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>2.9.0</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>ch.qos.logback</groupId>
-      <artifactId>logback-classic</artifactId>
-      <version>1.1.2</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>junit</groupId>
-      <artifactId>junit</artifactId>
-      <version>4.11</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.easytesting</groupId>
-      <artifactId>fest-assert</artifactId>
-      <version>1.4</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.hsqldb</groupId>
-      <artifactId>hsqldb</artifactId>
-      <version>2.3.2</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.mockito</groupId>
-      <artifactId>mockito-core</artifactId>
-      <version>1.10.19</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.7</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-beans</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-context-support</artifactId>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-test</artifactId>
-      <scope>test</scope>
-    </dependency>
-  </dependencies>
-  <dependencyManagement>
+<?xml version="1.0"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <parent>
+        <artifactId>spring-security-parent</artifactId>
+        <groupId>org.springframework.security</groupId>
+        <version>2.0.4</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-acl</artifactId>
+    <name>Spring Security - ACL module</name>
+    <packaging>bundle</packaging>
+
     <dependencies>
-      <dependency>
-        <groupId>org.springframework</groupId>
-        <artifactId>spring-framework-bom</artifactId>
-        <version>4.2.5.RELEASE</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>${project.version}</version>
+            <classifier>tests</classifier>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>${project.version}</version>
+            <classifier>tests</classifier>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-jdbc</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework</groupId>
+            <artifactId>spring-mock</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>net.sf.ehcache</groupId>
+            <artifactId>ehcache</artifactId>
+            <optional>true</optional>
+        </dependency>
+        <dependency>
+            <groupId>hsqldb</groupId>
+            <artifactId>hsqldb</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
-  </dependencyManagement>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
-</project>
+    
+    <properties>
+        <spring.osgi.export>
+            org.springframework.security.*;version=${pom.version.osgi}
+        </spring.osgi.export>
+            
+        <spring.osgi.import>
+            net.sf.ehcache.*;version="[1.4.1, 2.0.0)";resolution:=optional,
+            org.springframework.security.*;version="[${pom.version.osgi},${pom.version.osgi}]",
+            org.springframework.context.*;version="${spring.version.osgi}",
+            org.springframework.dao.*;version="${spring.version.osgi}";resolution:=optional,
+            org.springframework.jdbc.*;version="${spring.version.osgi}";resolution:=optional,
+            org.springframework.transaction.support.*;version="${spring.version.osgi}";resolution:=optional,
+            org.springframework.util.*;version="${spring.version.osgi}",
+            org.apache.commons.logging.*;version="[1.1.1, 2.0.0)",
+            javax.sql.*
+        </spring.osgi.import>
+
+        <spring.osgi.private.pkg>
+            !org.springframework.security.*
+        </spring.osgi.private.pkg>
+
+        <spring.osgi.symbolic.name>org.springframework.security.acls</spring.osgi.symbolic.name>        
+    </properties>    
+    
+</project>

acl/src/main/java/org/springframework/security/acls/AccessControlEntry.java

@@ -0,0 +1,57 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.acls.sid.Sid;
+
+import java.io.Serializable;
+
+
+/**
+ * Represents an individual permission assignment within an {@link Acl}.
+ *
+ * <p>
+ * Instances MUST be immutable, as they are returned by <code>Acl</code>
+ * and should not allow client modification.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ *
+ */
+public interface AccessControlEntry extends Serializable {
+    //~ Methods ========================================================================================================
+
+    Acl getAcl();
+
+    /**
+     * Obtains an identifier that represents this ACE.
+     *
+     * @return the identifier, or <code>null</code> if unsaved
+     */
+    Serializable getId();
+
+    Permission getPermission();
+
+    Sid getSid();
+
+    /**
+     * Indicates the a Permission is being granted to the relevant Sid. If false, indicates the permission is
+     * being revoked/blocked.
+     *
+     * @return true if being granted, false otherwise
+     */
+    boolean isGranting();
+}

acl/src/main/java/org/springframework/security/acls/Acl.java

@@ -0,0 +1,170 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.sid.Sid;
+
+import java.io.Serializable;
+
+
+/**
+ * Represents an access control list (ACL) for a domain object.
+ *
+ * <p>
+ * An <tt>Acl</tt> represents all ACL entries for a given domain object. In
+ * order to avoid needing references to the domain object itself, this
+ * interface handles indirection between a domain object and an ACL object
+ * identity via the {@link
+ * org.springframework.security.acls.objectidentity.ObjectIdentity} interface.
+ * </p>
+ *
+ * <p>
+ * Implementing classes may elect to return instances that represent 
+ * {@link org.springframework.security.acls.Permission} information for either
+ * some OR all {@link org.springframework.security.acls.sid.Sid}
+ * instances. Therefore, an instance may NOT necessarily contain ALL <tt>Sid</tt>s
+ * for a given domain object.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface Acl extends Serializable {
+
+	/**
+     * Returns all of the entries represented by the present <tt>Acl</tt>. Entries associated with
+     * the <tt>Acl</tt> parents are not returned.
+     * 
+     * <p>This method is typically used for administrative purposes.</p>
+     * 
+     * <p>The order that entries appear in the array is important for methods declared in the
+     * {@link MutableAcl} interface. Furthermore, some implementations MAY use ordering as
+     * part of advanced permission checking.</p>
+     * 
+     * <p>Do <em>NOT</em> use this method for making authorization decisions. Instead use {@link
+     * #isGranted(Permission[], Sid[], boolean)}.</p>
+     * 
+     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of
+     * <tt>Sid</tt>s. The caller is responsible for correctly handling the result if only a subset of
+     * <tt>Sid</tt>s is represented.</p>
+     *
+     * @return the list of entries represented by the <tt>Acl</tt>, or <tt>null</tt> if there are
+     * no entries presently associated with this <tt>Acl</tt>.
+     */
+    AccessControlEntry[] getEntries();
+
+    /**
+     * Obtains the domain object this <tt>Acl</tt> provides entries for. This is immutable once an
+     * <tt>Acl</tt> is created.
+     *
+     * @return the object identity (never <tt>null</tt>)
+     */
+    ObjectIdentity getObjectIdentity();
+
+    /**
+     * Determines the owner of the <tt>Acl</tt>. The meaning of ownership varies by implementation and is
+     * unspecified.
+     *
+     * @return the owner (may be <tt>null</tt> if the implementation does not use ownership concepts)
+     */
+    Sid getOwner();
+
+    /**
+     * A domain object may have a parent for the purpose of ACL inheritance. If there is a parent, its ACL can
+     * be accessed via this method. In turn, the parent's parent (grandparent) can be accessed and so on.
+     * 
+     * <p>This method solely represents the presence of a navigation hierarchy between the parent <tt>Acl</tt> and this
+     * <tt>Acl</tt>. For actual inheritance to take place, the {@link #isEntriesInheriting()} must also be
+     * <tt>true</tt>.</p>
+     * 
+     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of
+     * <tt>Sid</tt>s. The caller is responsible for correctly handling the result if only a subset of
+     * <tt>Sid</tt>s is represented.</p>
+     *
+     * @return the parent <tt>Acl</tt> (may be <tt>null</tt> if this <tt>Acl</tt> does not have a parent)
+     */
+    Acl getParentAcl();
+
+    /**
+     * Indicates whether the ACL entries from the {@link #getParentAcl()} should flow down into the current
+     * <tt>Acl</tt>.<p>The mere link between an <tt>Acl</tt> and a parent <tt>Acl</tt> on its own
+     * is insufficient to cause ACL entries to inherit down. This is because a domain object may wish to have entirely
+     * independent entries, but maintain the link with the parent for navigation purposes. Thus, this method denotes
+     * whether or not the navigation relationship also extends to the actual inheritance of entries.</p>
+     *
+     * @return <tt>true</tt> if parent ACL entries inherit into the current <tt>Acl</tt>
+     */
+    boolean isEntriesInheriting();
+
+    /**
+     * This is the actual authorization logic method, and must be used whenever ACL authorization decisions are
+     * required.
+     * 
+     * <p>An array of <tt>Sid</tt>s are presented, representing security identifies of the current
+     * principal. In addition, an array of <tt>Permission</tt>s is presented which will have one or more bits set
+     * in order to indicate the permissions needed for an affirmative authorization decision. An array is presented
+     * because holding <em>any</em> of the <tt>Permission</tt>s inside the array will be sufficient for an
+     * affirmative authorization.</p>
+     * 
+     * <p>The actual approach used to make authorization decisions is left to the implementation and is not
+     * specified by this interface. For example, an implementation <em>MAY</em> search the current ACL in the order
+     * the ACL entries have been stored. If a single entry is found that has the same active bits as are shown in a
+     * passed <tt>Permission</tt>, that entry's grant or deny state may determine the authorization decision. If
+     * the case of a deny state, the deny decision will only be relevant if all other <tt>Permission</tt>s passed
+     * in the array have also been unsuccessfully searched. If no entry is found that match the bits in the current
+     * ACL, provided that {@link #isEntriesInheriting()} is <tt>true</tt>, the authorization decision may be
+     * passed to the parent ACL. If there is no matching entry, the implementation MAY throw an exception, or make a
+     * predefined authorization decision.</p>
+     * 
+     * <p>This method must operate correctly even if the <tt>Acl</tt> only represents a subset of <tt>Sid</tt>s,
+     * although the implementation is permitted to throw one of the signature-defined exceptions if the method 
+     * is called requesting an authorization decision for a {@link Sid} that was never loaded in this <tt>Acl</tt>.
+     * </p>
+     *
+     * @param permission the permission or permissions required (at least one entry required)
+     * @param sids the security identities held by the principal (at least one entry required)
+     * @param administrativeMode if <tt>true</tt> denotes the query is for administrative purposes and no logging
+     *        or auditing (if supported by the implementation) should be undertaken
+     *
+     * @return <tt>true</tt> if authorization is granted
+     *
+     * @throws NotFoundException MUST be thrown if an implementation cannot make an authoritative authorization
+     *         decision, usually because there is no ACL information for this particular permission and/or SID
+     * @throws UnloadedSidException thrown if the <tt>Acl</tt> does not have details for one or more of the
+     *         <tt>Sid</tt>s passed as arguments
+     */
+    boolean isGranted(Permission[] permission, Sid[] sids, boolean administrativeMode)
+        throws NotFoundException, UnloadedSidException;
+
+    /**
+     * For efficiency reasons an <tt>Acl</tt> may be loaded and <em>not</em> contain entries for every
+     * <tt>Sid</tt> in the system. If an <tt>Acl</tt> has been loaded and does not represent every
+     * <tt>Sid</tt>, all methods of the <tt>Acl</tt> can only be used within the limited scope of the
+     * <tt>Sid</tt> instances it actually represents.
+     * <p>
+     * It is normal to load an <tt>Acl</tt> for only particular <tt>Sid</tt>s if read-only authorization
+     * decisions are being made. However, if user interface reporting or modification of <tt>Acl</tt>s are
+     * desired, an <tt>Acl</tt> should be loaded with all <tt>Sid</tt>s. This method denotes whether or
+     * not the specified <tt>Sid</tt>s have been loaded or not.
+     * </p>
+     *
+     * @param sids one or more security identities the caller is interest in knowing whether this <tt>Sid</tt>
+     *        supports
+     *
+     * @return <tt>true</tt> if every passed <tt>Sid</tt> is represented by this <tt>Acl</tt> instance
+     */
+    boolean isSidLoaded(Sid[] sids);
+}

acl/src/main/java/org/springframework/security/acls/AclEntryVoter.java

@@ -1,273 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls;
-
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.List;
-
-import org.aopalliance.intercept.MethodInvocation;
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.AuthorizationServiceException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.access.vote.AbstractAclVoter;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.util.Assert;
-import org.springframework.util.StringUtils;
-
-/**
- * <p>
- * Given a domain object instance passed as a method argument, ensures the principal has
- * appropriate permission as indicated by the {@link AclService}.
- * <p>
- * The <tt>AclService</tt> is used to retrieve the access control list (ACL) permissions
- * associated with a domain object instance for the current <tt>Authentication</tt>
- * object.
- * <p>
- * The voter will vote if any {@link ConfigAttribute#getAttribute()} matches the
- * {@link #processConfigAttribute}. The provider will then locate the first method
- * argument of type {@link #processDomainObjectClass}. Assuming that method argument is
- * non-null, the provider will then lookup the ACLs from the <code>AclManager</code> and
- * ensure the principal is {@link Acl#isGranted(List, List, boolean)} when presenting the
- * {@link #requirePermission} array to that method.
- * <p>
- * If the method argument is <tt>null</tt>, the voter will abstain from voting. If the
- * method argument could not be found, an {@link AuthorizationServiceException} will be
- * thrown.
- * <p>
- * In practical terms users will typically setup a number of <tt>AclEntryVoter</tt>s. Each
- * will have a different {@link #setProcessDomainObjectClass processDomainObjectClass},
- * {@link #processConfigAttribute} and {@link #requirePermission} combination. For
- * example, a small application might employ the following instances of
- * <tt>AclEntryVoter</tt>:
- * <ul>
- * <li>Process domain object class <code>BankAccount</code>, configuration attribute
- * <code>VOTE_ACL_BANK_ACCONT_READ</code>, require permission
- * <code>BasePermission.READ</code></li>
- * <li>Process domain object class <code>BankAccount</code>, configuration attribute
- * <code>VOTE_ACL_BANK_ACCOUNT_WRITE</code>, require permission list
- * <code>BasePermission.WRITE</code> and <code>BasePermission.CREATE</code> (allowing the
- * principal to have <b>either</b> of these two permissions)</li>
- * <li>Process domain object class <code>Customer</code>, configuration attribute
- * <code>VOTE_ACL_CUSTOMER_READ</code>, require permission
- * <code>BasePermission.READ</code></li>
- * <li>Process domain object class <code>Customer</code>, configuration attribute
- * <code>VOTE_ACL_CUSTOMER_WRITE</code>, require permission list
- * <code>BasePermission.WRITE</code> and <code>BasePermission.CREATE</code></li>
- * </ul>
- * Alternatively, you could have used a common superclass or interface for the
- * {@link #processDomainObjectClass} if both <code>BankAccount</code> and
- * <code>Customer</code> had common parents.
- *
- * <p>
- * If the principal does not have sufficient permissions, the voter will vote to deny
- * access.
- *
- * <p>
- * All comparisons and prefixes are case sensitive.
- *
- *
- * @author Ben Alex
- */
-public class AclEntryVoter extends AbstractAclVoter {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	private static final Log logger = LogFactory.getLog(AclEntryVoter.class);
-
-	// ~ Instance fields
-	// ================================================================================================
-
-	private AclService aclService;
-	private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-	private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-	private String internalMethod;
-	private String processConfigAttribute;
-	private List<Permission> requirePermission;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public AclEntryVoter(AclService aclService, String processConfigAttribute,
-			Permission[] requirePermission) {
-		Assert.notNull(processConfigAttribute, "A processConfigAttribute is mandatory");
-		Assert.notNull(aclService, "An AclService is mandatory");
-
-		if ((requirePermission == null) || (requirePermission.length == 0)) {
-			throw new IllegalArgumentException(
-					"One or more requirePermission entries is mandatory");
-		}
-
-		this.aclService = aclService;
-		this.processConfigAttribute = processConfigAttribute;
-		this.requirePermission = Arrays.asList(requirePermission);
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Optionally specifies a method of the domain object that will be used to obtain a
-	 * contained domain object. That contained domain object will be used for the ACL
-	 * evaluation. This is useful if a domain object contains a parent that an ACL
-	 * evaluation should be targeted for, instead of the child domain object (which
-	 * perhaps is being created and as such does not yet have any ACL permissions)
-	 *
-	 * @return <code>null</code> to use the domain object, or the name of a method (that
-	 * requires no arguments) that should be invoked to obtain an <code>Object</code>
-	 * which will be the domain object used for ACL evaluation
-	 */
-	protected String getInternalMethod() {
-		return internalMethod;
-	}
-
-	public void setInternalMethod(String internalMethod) {
-		this.internalMethod = internalMethod;
-	}
-
-	protected String getProcessConfigAttribute() {
-		return processConfigAttribute;
-	}
-
-	public void setObjectIdentityRetrievalStrategy(
-			ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-		Assert.notNull(objectIdentityRetrievalStrategy,
-				"ObjectIdentityRetrievalStrategy required");
-		this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-	}
-
-	public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-		Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-		this.sidRetrievalStrategy = sidRetrievalStrategy;
-	}
-
-	public boolean supports(ConfigAttribute attribute) {
-		return (attribute.getAttribute() != null)
-				&& attribute.getAttribute().equals(getProcessConfigAttribute());
-	}
-
-	public int vote(Authentication authentication, MethodInvocation object,
-			Collection<ConfigAttribute> attributes) {
-
-		for (ConfigAttribute attr : attributes) {
-
-			if (!this.supports(attr)) {
-				continue;
-			}
-			// Need to make an access decision on this invocation
-			// Attempt to locate the domain object instance to process
-			Object domainObject = getDomainObjectInstance(object);
-
-			// If domain object is null, vote to abstain
-			if (domainObject == null) {
-				if (logger.isDebugEnabled()) {
-					logger.debug("Voting to abstain - domainObject is null");
-				}
-
-				return ACCESS_ABSTAIN;
-			}
-
-			// Evaluate if we are required to use an inner domain object
-			if (StringUtils.hasText(internalMethod)) {
-				try {
-					Class<?> clazz = domainObject.getClass();
-					Method method = clazz.getMethod(internalMethod, new Class[0]);
-					domainObject = method.invoke(domainObject);
-				}
-				catch (NoSuchMethodException nsme) {
-					throw new AuthorizationServiceException("Object of class '"
-							+ domainObject.getClass()
-							+ "' does not provide the requested internalMethod: "
-							+ internalMethod);
-				}
-				catch (IllegalAccessException iae) {
-					logger.debug("IllegalAccessException", iae);
-
-					throw new AuthorizationServiceException(
-							"Problem invoking internalMethod: " + internalMethod
-									+ " for object: " + domainObject);
-				}
-				catch (InvocationTargetException ite) {
-					logger.debug("InvocationTargetException", ite);
-
-					throw new AuthorizationServiceException(
-							"Problem invoking internalMethod: " + internalMethod
-									+ " for object: " + domainObject);
-				}
-			}
-
-			// Obtain the OID applicable to the domain object
-			ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy
-					.getObjectIdentity(domainObject);
-
-			// Obtain the SIDs applicable to the principal
-			List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-			Acl acl;
-
-			try {
-				// Lookup only ACLs for SIDs we're interested in
-				acl = aclService.readAclById(objectIdentity, sids);
-			}
-			catch (NotFoundException nfe) {
-				if (logger.isDebugEnabled()) {
-					logger.debug("Voting to deny access - no ACLs apply for this principal");
-				}
-
-				return ACCESS_DENIED;
-			}
-
-			try {
-				if (acl.isGranted(requirePermission, sids, false)) {
-					if (logger.isDebugEnabled()) {
-						logger.debug("Voting to grant access");
-					}
-
-					return ACCESS_GRANTED;
-				}
-				else {
-					if (logger.isDebugEnabled()) {
-						logger.debug("Voting to deny access - ACLs returned, but insufficient permissions for this principal");
-					}
-
-					return ACCESS_DENIED;
-				}
-			}
-			catch (NotFoundException nfe) {
-				if (logger.isDebugEnabled()) {
-					logger.debug("Voting to deny access - no ACLs apply for this principal");
-				}
-
-				return ACCESS_DENIED;
-			}
-		}
-
-		// No configuration attribute matched, so abstain
-		return ACCESS_ABSTAIN;
-	}
-}

acl/src/main/java/org/springframework/security/acls/AclFormattingUtils.java

@@ -0,0 +1,105 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.util.Assert;
+
+
+/**
+ * Utility methods for displaying ACL information.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public abstract class AclFormattingUtils {
+
+    public static String demergePatterns(String original, String removeBits) {
+        Assert.notNull(original, "Original string required");
+        Assert.notNull(removeBits, "Bits To Remove string required");
+        Assert.isTrue(original.length() == removeBits.length(),
+            "Original and Bits To Remove strings must be identical length");
+
+        char[] replacement = new char[original.length()];
+
+        for (int i = 0; i < original.length(); i++) {
+            if (removeBits.charAt(i) == Permission.RESERVED_OFF) {
+                replacement[i] = original.charAt(i);
+            } else {
+                replacement[i] = Permission.RESERVED_OFF;
+            }
+        }
+
+        return new String(replacement);
+    }
+
+    public static String mergePatterns(String original, String extraBits) {
+        Assert.notNull(original, "Original string required");
+        Assert.notNull(extraBits, "Extra Bits string required");
+        Assert.isTrue(original.length() == extraBits.length(),
+            "Original and Extra Bits strings must be identical length");
+
+        char[] replacement = new char[extraBits.length()];
+
+        for (int i = 0; i < extraBits.length(); i++) {
+            if (extraBits.charAt(i) == Permission.RESERVED_OFF) {
+                replacement[i] = original.charAt(i);
+            } else {
+                replacement[i] = extraBits.charAt(i);
+            }
+        }
+
+        return new String(replacement);
+    }
+
+    private static String printBinary(int i, char on, char off) {
+        String s = Integer.toString(i, 2);
+        String pattern = Permission.THIRTY_TWO_RESERVED_OFF;
+        String temp2 = pattern.substring(0, pattern.length() - s.length()) + s;
+
+        return temp2.replace('0', off).replace('1', on);
+    }
+
+    /**
+     * Returns a representation of the active bits in the presented mask, with each active bit being denoted by
+     * character "".<p>Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.</p>
+     *
+     * @param i the integer bit mask to print the active bits for
+     *
+     * @return a 32-character representation of the bit mask
+     */
+    public static String printBinary(int i) {
+        return printBinary(i, '*', Permission.RESERVED_OFF);
+    }
+
+    /**
+     * Returns a representation of the active bits in the presented mask, with each active bit being denoted by
+     * the passed character.
+     * <p>
+     * Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.
+     *
+     * @param mask the integer bit mask to print the active bits for
+     * @param code the character to print when an active bit is detected
+     *
+     * @return a 32-character representation of the bit mask
+     */
+    public static String printBinary(int mask, char code) {
+        Assert.doesNotContain(Character.toString(code), Character.toString(Permission.RESERVED_ON),
+            Permission.RESERVED_ON + " is a reserved character code");
+        Assert.doesNotContain(Character.toString(code), Character.toString(Permission.RESERVED_OFF),
+            Permission.RESERVED_OFF + " is a reserved character code");
+
+        return printBinary(mask, Permission.RESERVED_ON, Permission.RESERVED_OFF).replace(Permission.RESERVED_ON, code);
+    }
+}

acl/src/main/java/org/springframework/security/acls/AclPermissionCacheOptimizer.java

@@ -1,67 +0,0 @@
-package org.springframework.security.acls;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.PermissionCacheOptimizer;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-/**
- * Batch loads ACLs for collections of objects to allow optimised filtering.
- *
- * @author Luke Taylor
- * @since 3.1
- */
-public class AclPermissionCacheOptimizer implements PermissionCacheOptimizer {
-	private final Log logger = LogFactory.getLog(getClass());
-	private final AclService aclService;
-	private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-	private ObjectIdentityRetrievalStrategy oidRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-
-	public AclPermissionCacheOptimizer(AclService aclService) {
-		this.aclService = aclService;
-	}
-
-	public void cachePermissionsFor(Authentication authentication, Collection<?> objects) {
-		if (objects.isEmpty()) {
-			return;
-		}
-
-		List<ObjectIdentity> oidsToCache = new ArrayList<ObjectIdentity>(objects.size());
-
-		for (Object domainObject : objects) {
-			if (domainObject == null) {
-				continue;
-			}
-			ObjectIdentity oid = oidRetrievalStrategy.getObjectIdentity(domainObject);
-			oidsToCache.add(oid);
-		}
-
-		List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-		if (logger.isDebugEnabled()) {
-			logger.debug("Eagerly loading Acls for " + oidsToCache.size() + " objects");
-		}
-
-		aclService.readAclsById(oidsToCache, sids);
-	}
-
-	public void setObjectIdentityRetrievalStrategy(
-			ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-		this.oidRetrievalStrategy = objectIdentityRetrievalStrategy;
-	}
-
-	public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-		this.sidRetrievalStrategy = sidRetrievalStrategy;
-	}
-}

acl/src/main/java/org/springframework/security/acls/AclPermissionEvaluator.java

@@ -1,162 +0,0 @@
-package org.springframework.security.acls;
-
-import java.io.Serializable;
-import java.util.Arrays;
-import java.util.List;
-import java.util.Locale;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.PermissionEvaluator;
-import org.springframework.security.acls.domain.DefaultPermissionFactory;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.PermissionFactory;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-
-/**
- * Used by Spring Security's expression-based access control implementation to evaluate
- * permissions for a particular object using the ACL module. Similar in behaviour to
- * {@link org.springframework.security.acls.AclEntryVoter AclEntryVoter}.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public class AclPermissionEvaluator implements PermissionEvaluator {
-
-	private final Log logger = LogFactory.getLog(getClass());
-
-	private final AclService aclService;
-	private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-	private ObjectIdentityGenerator objectIdentityGenerator = new ObjectIdentityRetrievalStrategyImpl();
-	private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-	private PermissionFactory permissionFactory = new DefaultPermissionFactory();
-
-	public AclPermissionEvaluator(AclService aclService) {
-		this.aclService = aclService;
-	}
-
-	/**
-	 * Determines whether the user has the given permission(s) on the domain object using
-	 * the ACL configuration. If the domain object is null, returns false (this can always
-	 * be overridden using a null check in the expression itself).
-	 */
-	public boolean hasPermission(Authentication authentication, Object domainObject,
-			Object permission) {
-		if (domainObject == null) {
-			return false;
-		}
-
-		ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy
-				.getObjectIdentity(domainObject);
-
-		return checkPermission(authentication, objectIdentity, permission);
-	}
-
-	public boolean hasPermission(Authentication authentication, Serializable targetId,
-			String targetType, Object permission) {
-		ObjectIdentity objectIdentity = objectIdentityGenerator.createObjectIdentity(
-				targetId, targetType);
-
-		return checkPermission(authentication, objectIdentity, permission);
-	}
-
-	private boolean checkPermission(Authentication authentication, ObjectIdentity oid,
-			Object permission) {
-		// Obtain the SIDs applicable to the principal
-		List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-		List<Permission> requiredPermission = resolvePermission(permission);
-
-		final boolean debug = logger.isDebugEnabled();
-
-		if (debug) {
-			logger.debug("Checking permission '" + permission + "' for object '" + oid
-					+ "'");
-		}
-
-		try {
-			// Lookup only ACLs for SIDs we're interested in
-			Acl acl = aclService.readAclById(oid, sids);
-
-			if (acl.isGranted(requiredPermission, sids, false)) {
-				if (debug) {
-					logger.debug("Access is granted");
-				}
-
-				return true;
-			}
-
-			if (debug) {
-				logger.debug("Returning false - ACLs returned, but insufficient permissions for this principal");
-			}
-
-		}
-		catch (NotFoundException nfe) {
-			if (debug) {
-				logger.debug("Returning false - no ACLs apply for this principal");
-			}
-		}
-
-		return false;
-
-	}
-
-	List<Permission> resolvePermission(Object permission) {
-		if (permission instanceof Integer) {
-			return Arrays.asList(permissionFactory.buildFromMask(((Integer) permission)
-					.intValue()));
-		}
-
-		if (permission instanceof Permission) {
-			return Arrays.asList((Permission) permission);
-		}
-
-		if (permission instanceof Permission[]) {
-			return Arrays.asList((Permission[]) permission);
-		}
-
-		if (permission instanceof String) {
-			String permString = (String) permission;
-			Permission p;
-
-			try {
-				p = permissionFactory.buildFromName(permString);
-			}
-			catch (IllegalArgumentException notfound) {
-				p = permissionFactory.buildFromName(permString.toUpperCase(Locale.ENGLISH));
-			}
-
-			if (p != null) {
-				return Arrays.asList(p);
-			}
-
-		}
-		throw new IllegalArgumentException("Unsupported permission: " + permission);
-	}
-
-	public void setObjectIdentityRetrievalStrategy(
-			ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-		this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-	}
-
-	public void setObjectIdentityGenerator(ObjectIdentityGenerator objectIdentityGenerator) {
-		this.objectIdentityGenerator = objectIdentityGenerator;
-	}
-
-	public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-		this.sidRetrievalStrategy = sidRetrievalStrategy;
-	}
-
-	public void setPermissionFactory(PermissionFactory permissionFactory) {
-		this.permissionFactory = permissionFactory;
-	}
-}

acl/src/main/java/org/springframework/security/acls/AclService.java

@@ -0,0 +1,101 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.sid.Sid;
+
+import java.util.Map;
+
+
+/**
+ * Provides retrieval of {@link Acl} instances.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface AclService {
+    //~ Methods ========================================================================================================
+
+    /**
+     * Locates all object identities that use the specified parent.  This is useful for administration tools.
+     *
+     * @param parentIdentity to locate children of
+     *
+     * @return the children (or <tt>null</tt> if none were found)
+     */
+    ObjectIdentity[] findChildren(ObjectIdentity parentIdentity);
+
+    /**
+     * Same as {@link #readAclsById(ObjectIdentity[])} except it returns only a single Acl.<p>This method
+     * should not be called as it does not leverage the underlaying implementation's potential ability to filter
+     * <tt>Acl</tt> entries based on a {@link Sid} parameter.</p>
+     *
+     * @param object to locate an {@link Acl} for
+     *
+     * @return the {@link Acl} for the requested {@link ObjectIdentity} (never <tt>null</tt>)
+     *
+     * @throws NotFoundException if an {@link Acl} was not found for the requested {@link ObjectIdentity}
+     */
+    Acl readAclById(ObjectIdentity object) throws NotFoundException;
+
+    /**
+     * Same as {@link #readAclsById(ObjectIdentity[], Sid[])} except it returns only a single Acl.
+     *
+     * @param object to locate an {@link Acl} for
+     * @param sids the security identities for which  {@link Acl} information is required 
+     *        (may be <tt>null</tt> to denote all entries)
+     *
+     * @return the {@link Acl} for the requested {@link ObjectIdentity} (never <tt>null</tt>)
+     *
+     * @throws NotFoundException if an {@link Acl} was not found for the requested {@link ObjectIdentity}
+     */
+    Acl readAclById(ObjectIdentity object, Sid[] sids)
+        throws NotFoundException;
+
+    /**
+     * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s.<p>The returned map is
+     * keyed on the passed objects, with the values being the <tt>Acl</tt> instances. Any unknown objects will not
+     * have a map key.</p>
+     *
+     * @param objects the objects to find {@link Acl} information for
+     *
+     * @return a map with exactly one element for each {@link ObjectIdentity} passed as an argument (never <tt>null</tt>)
+     *
+     * @throws NotFoundException if an {@link Acl} was not found for each requested {@link ObjectIdentity}
+     */
+    Map readAclsById(ObjectIdentity[] objects) throws NotFoundException;
+
+    /**
+     * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s, but only for the
+     * security identifies passed.<p>Implementations <em>MAY</em> provide a subset of the ACLs via this method
+     * although this is NOT a requirement. This is intended to allow performance optimisations within implementations.
+     * Callers should therefore use this method in preference to the alternative overloaded version which does not
+     * have performance optimisation opportunities.</p>
+     *  <p>The returned map is keyed on the passed objects, with the values being the <tt>Acl</tt>
+     * instances. Any unknown objects (or objects for which the interested <tt>Sid</tt>s do not have entries) will
+     * not have a map key.</p>
+     *
+     * @param objects the objects to find {@link Acl} information for
+     * @param sids the security identities for which  {@link Acl} information is required 
+     *        (may be <tt>null</tt> to denote all entries)
+     *
+     * @return a map with exactly one element for each {@link ObjectIdentity} passed as an argument (never <tt>null</tt>)
+     *
+     * @throws NotFoundException if an {@link Acl} was not found for each requested {@link ObjectIdentity}
+     */
+    Map readAclsById(ObjectIdentity[] objects, Sid[] sids)
+        throws NotFoundException;
+}

acl/src/main/java/org/springframework/security/acls/AlreadyExistsException.java

@@ -0,0 +1,48 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.SpringSecurityException;
+
+
+/**
+ * Thrown if an <code>Acl</code> entry already exists for the object.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class AlreadyExistsException extends SpringSecurityException {
+    //~ Constructors ===================================================================================================
+
+/**
+     * Constructs an <code>AlreadyExistsException</code> with the specified message.
+     *
+     * @param msg the detail message
+     */
+    public AlreadyExistsException(String msg) {
+        super(msg);
+    }
+
+/**
+     * Constructs an <code>AlreadyExistsException</code> with the specified message
+     * and root cause.
+     *
+     * @param msg the detail message
+     * @param t root cause
+     */
+    public AlreadyExistsException(String msg, Throwable t) {
+        super(msg, t);
+    }
+}

acl/src/main/java/org/springframework/security/acls/AuditableAccessControlEntry.java

@@ -12,19 +12,19 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.acls.model;
+package org.springframework.security.acls;
 
 /**
  * Represents an ACE that provides auditing information.
  *
  * @author Ben Alex
+ * @version $Id$
  *
  */
 public interface AuditableAccessControlEntry extends AccessControlEntry {
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	boolean isAuditFailure();
+    boolean isAuditFailure();
 
-	boolean isAuditSuccess();
+    boolean isAuditSuccess();
 }

acl/src/main/java/org/springframework/security/acls/AuditableAcl.java

@@ -0,0 +1,30 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+
+
+/**
+ * A mutable ACL that provides audit capabilities.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ *
+ */
+public interface AuditableAcl extends MutableAcl {
+    //~ Methods ========================================================================================================
+
+    void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure);
+}

acl/src/main/java/org/springframework/security/acls/ChildrenExistException.java

@@ -0,0 +1,49 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.SpringSecurityException;
+
+
+/**
+ * Thrown if an {@link Acl} cannot be deleted because children <code>Acl</code>s exist.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class ChildrenExistException extends SpringSecurityException {
+    //~ Constructors ===================================================================================================
+
+/**
+     * Constructs an <code>ChildrenExistException</code> with the specified
+     * message.
+     *
+     * @param msg the detail message
+     */
+    public ChildrenExistException(String msg) {
+        super(msg);
+    }
+
+/**
+     * Constructs an <code>ChildrenExistException</code> with the specified
+     * message and root cause.
+     *
+     * @param msg the detail message
+     * @param t root cause
+     */
+    public ChildrenExistException(String msg, Throwable t) {
+        super(msg, t);
+    }
+}

acl/src/main/java/org/springframework/security/acls/IdentityUnavailableException.java

@@ -0,0 +1,48 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.SpringSecurityException;
+
+
+/**
+ * Thrown if an ACL identity could not be extracted from an object.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class IdentityUnavailableException extends SpringSecurityException {
+    //~ Constructors ===================================================================================================
+
+/**
+     * Constructs an <code>IdentityUnavailableException</code> with the specified message.
+     *
+     * @param msg the detail message
+     */
+    public IdentityUnavailableException(String msg) {
+        super(msg);
+    }
+
+/**
+     * Constructs an <code>IdentityUnavailableException</code> with the specified message
+     * and root cause.
+     *
+     * @param msg the detail message
+     * @param t root cause
+     */
+    public IdentityUnavailableException(String msg, Throwable t) {
+        super(msg, t);
+    }
+}

acl/src/main/java/org/springframework/security/acls/MutableAcl.java

@@ -0,0 +1,71 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import java.io.Serializable;
+
+import org.springframework.security.acls.sid.Sid;
+
+
+/**
+ * A mutable <tt>Acl</tt>.
+ *
+ * <p>
+ * A mutable ACL must ensure that appropriate security checks are performed
+ * before allowing access to its methods.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface MutableAcl extends Acl {
+    //~ Methods ========================================================================================================
+
+    void deleteAce(int aceIndex) throws NotFoundException;
+
+    /**
+     * Obtains an identifier that represents this <tt>MutableAcl</tt>.
+     *
+     * @return the identifier, or <tt>null</tt> if unsaved
+     */
+    Serializable getId();
+
+    void insertAce(int atIndexLocation, Permission permission, Sid sid, boolean granting)
+        throws NotFoundException;
+
+    /**
+     * Changes the present owner to a different owner.
+     * 
+     * @param newOwner the new owner (mandatory; cannot be null)
+     */
+    void setOwner(Sid newOwner);
+
+    /**
+     * Change the value returned by {@link Acl#isEntriesInheriting()}.
+     *
+     * @param entriesInheriting the new value
+     */
+    void setEntriesInheriting(boolean entriesInheriting);
+
+    /**
+     * Changes the parent of this ACL.
+     *
+     * @param newParent the new parent
+     */
+    void setParent(Acl newParent);
+
+    void updateAce(int aceIndex, Permission permission)
+        throws NotFoundException;
+}

acl/src/main/java/org/springframework/security/acls/MutableAclService.java

@@ -0,0 +1,65 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+
+
+/**
+ * Provides support for creating and storing <code>Acl</code> instances.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface MutableAclService extends AclService {
+    //~ Methods ========================================================================================================
+
+    /**
+     * Creates an empty <code>Acl</code> object in the database. It will have no entries. The returned object
+     * will then be used to add entries.
+     *
+     * @param objectIdentity the object identity to create
+     *
+     * @return an ACL object with its ID set
+     *
+     * @throws AlreadyExistsException if the passed object identity already has a record
+     */
+    MutableAcl createAcl(ObjectIdentity objectIdentity)
+        throws AlreadyExistsException;
+
+    /**
+     * Removes the specified entry from the database.
+     *
+     * @param objectIdentity the object identity to remove
+     * @param deleteChildren whether to cascade the delete to children
+     *
+     * @throws ChildrenExistException if the deleteChildren argument was <code>false</code> but children exist
+     */
+    void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren)
+        throws ChildrenExistException;
+
+    /**
+     * Changes an existing <code>Acl</code> in the database.
+     *
+     * @param acl to modify
+     *
+     * @return DOCUMENT ME!
+     *
+     * @throws NotFoundException if the relevant record could not be found (did you remember to use {@link
+     *         #createAcl(ObjectIdentity)} to create the object, rather than creating it with the <code>new</code>
+     *         keyword?)
+     */
+    MutableAcl updateAcl(MutableAcl acl) throws NotFoundException;
+}

acl/src/main/java/org/springframework/security/acls/NotFoundException.java

@@ -0,0 +1,48 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.SpringSecurityException;
+
+
+/**
+ * Thrown if an ACL-related object cannot be found.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class NotFoundException extends SpringSecurityException {
+    //~ Constructors ===================================================================================================
+
+/**
+     * Constructs an <code>NotFoundException</code> with the specified message.
+     *
+     * @param msg the detail message
+     */
+    public NotFoundException(String msg) {
+        super(msg);
+    }
+
+/**
+     * Constructs an <code>NotFoundException</code> with the specified message
+     * and root cause.
+     *
+     * @param msg the detail message
+     * @param t root cause
+     */
+    public NotFoundException(String msg, Throwable t) {
+        super(msg, t);
+    }
+}

acl/src/main/java/org/springframework/security/acls/OwnershipAcl.java

@@ -0,0 +1,35 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.acls.sid.Sid;
+
+
+/**
+ * A mutable ACL that provides ownership capabilities.
+ *
+ * <p>
+ * Generally the owner of an ACL is able to call any ACL mutator method, as
+ * well as assign a new owner.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface OwnershipAcl extends MutableAcl {
+    //~ Methods ========================================================================================================
+
+    void setOwner(Sid newOwner);
+}

acl/src/main/java/org/springframework/security/acls/Permission.java

@@ -0,0 +1,57 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import java.io.Serializable;
+
+/**
+ * Represents a permission granted to a {@link org.springframework.security.acls.sid.Sid Sid} for a given domain object.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface Permission extends Serializable {
+    //~ Static fields/initializers =====================================================================================
+
+    char RESERVED_ON = '~';
+    char RESERVED_OFF = '.';
+    String THIRTY_TWO_RESERVED_OFF = "................................";
+
+    //~ Methods ========================================================================================================
+
+    /**
+     * Returns the bits that represents the permission.
+     *
+     * @return the bits that represent the permission
+     */
+    int getMask();
+
+    /**
+     * Returns a 32-character long bit pattern <code>String</code> representing this permission.
+     * <p>
+     * Implementations are free to format the pattern as they see fit, although under no circumstances may
+     * {@link #RESERVED_OFF} or {@link #RESERVED_ON} be used within the pattern. An exemption is in the case of
+     * {@link #RESERVED_OFF} which is used to denote a bit that is off (clear).
+     * Implementations may also elect to use {@link #RESERVED_ON} internally for computation purposes,
+     * although this method may not return any <code>String</code> containing {@link #RESERVED_ON}.
+     * </p>
+     *  <p>The returned String must be 32 characters in length.</p>
+     *  <p>This method is only used for user interface and logging purposes. It is not used in any permission
+     * calculations. Therefore, duplication of characters within the output is permitted.</p>
+     *
+     * @return a 32-character bit pattern
+     */
+    String getPattern();
+}

acl/src/main/java/org/springframework/security/acls/UnloadedSidException.java

@@ -0,0 +1,49 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls;
+
+import org.springframework.security.SpringSecurityException;
+
+
+/**
+ * Thrown if an {@link Acl} cannot perform an operation because it only loaded a subset of <code>Sid</code>s and
+ * the caller has requested details for an unloaded <code>Sid</code>.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class UnloadedSidException extends SpringSecurityException {
+    //~ Constructors ===================================================================================================
+
+/**
+     * Constructs an <code>NotFoundException</code> with the specified message.
+     *
+     * @param msg the detail message
+     */
+    public UnloadedSidException(String msg) {
+        super(msg);
+    }
+
+/**
+     * Constructs an <code>NotFoundException</code> with the specified message
+     * and root cause.
+     *
+     * @param msg the detail message
+     * @param t root cause
+     */
+    public UnloadedSidException(String msg, Throwable t) {
+        super(msg, t);
+    }
+}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AbstractAclProvider.java

@@ -1,136 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Arrays;
-import java.util.List;
-
-import org.springframework.security.access.AfterInvocationProvider;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.domain.BasePermission;
-import org.springframework.security.acls.domain.ObjectIdentityRetrievalStrategyImpl;
-import org.springframework.security.acls.domain.SidRetrievalStrategyImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.util.Assert;
-
-/**
- * Abstract {@link AfterInvocationProvider} which provides commonly-used ACL-related
- * services.
- *
- * @author Ben Alex
- */
-public abstract class AbstractAclProvider implements AfterInvocationProvider {
-	// ~ Instance fields
-	// ================================================================================================
-
-	protected final AclService aclService;
-	protected Class<?> processDomainObjectClass = Object.class;
-	protected ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
-	protected SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
-	protected String processConfigAttribute;
-	protected final List<Permission> requirePermission;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public AbstractAclProvider(AclService aclService, String processConfigAttribute,
-			List<Permission> requirePermission) {
-		Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
-		Assert.notNull(aclService, "An AclService is mandatory");
-
-		if (requirePermission == null || requirePermission.isEmpty()) {
-			throw new IllegalArgumentException(
-					"One or more requirePermission entries is mandatory");
-		}
-
-		this.aclService = aclService;
-		this.processConfigAttribute = processConfigAttribute;
-		this.requirePermission = requirePermission;
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	protected Class<?> getProcessDomainObjectClass() {
-		return processDomainObjectClass;
-	}
-
-	protected boolean hasPermission(Authentication authentication, Object domainObject) {
-		// Obtain the OID applicable to the domain object
-		ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy
-				.getObjectIdentity(domainObject);
-
-		// Obtain the SIDs applicable to the principal
-		List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
-
-		try {
-			// Lookup only ACLs for SIDs we're interested in
-			Acl acl = aclService.readAclById(objectIdentity, sids);
-
-			return acl.isGranted(requirePermission, sids, false);
-		}
-		catch (NotFoundException ignore) {
-			return false;
-		}
-	}
-
-	public void setObjectIdentityRetrievalStrategy(
-			ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
-		Assert.notNull(objectIdentityRetrievalStrategy,
-				"ObjectIdentityRetrievalStrategy required");
-		this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
-	}
-
-	protected void setProcessConfigAttribute(String processConfigAttribute) {
-		Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
-		this.processConfigAttribute = processConfigAttribute;
-	}
-
-	public void setProcessDomainObjectClass(Class<?> processDomainObjectClass) {
-		Assert.notNull(processDomainObjectClass,
-				"processDomainObjectClass cannot be set to null");
-		this.processDomainObjectClass = processDomainObjectClass;
-	}
-
-	public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-		Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-		this.sidRetrievalStrategy = sidRetrievalStrategy;
-	}
-
-	public boolean supports(ConfigAttribute attribute) {
-		return processConfigAttribute.equals(attribute.getAttribute());
-	}
-
-	/**
-	 * This implementation supports any type of class, because it does not query the
-	 * presented secure object.
-	 *
-	 * @param clazz the secure object
-	 *
-	 * @return always <code>true</code>
-	 */
-	public boolean supports(Class<?> clazz) {
-		return true;
-	}
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

@@ -1,138 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.AuthorizationServiceException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.core.Authentication;
-
-/**
- * <p>
- * Given a <code>Collection</code> of domain object instances returned from a secure
- * object invocation, remove any <code>Collection</code> elements the principal does not
- * have appropriate permission to access as defined by the {@link AclService}.
- * <p>
- * The <code>AclService</code> is used to retrieve the access control list (ACL)
- * permissions associated with each <code>Collection</code> domain object instance element
- * for the current <code>Authentication</code> object.
- * <p>
- * This after invocation provider will fire if any {@link ConfigAttribute#getAttribute()}
- * matches the {@link #processConfigAttribute}. The provider will then lookup the ACLs
- * from the <code>AclService</code> and ensure the principal is
- * {@link org.springframework.security.acls.model.Acl#isGranted(List, List, boolean)
- * Acl.isGranted()} when presenting the {@link #requirePermission} array to that method.
- * <p>
- * If the principal does not have permission, that element will not be included in the
- * returned <code>Collection</code>.
- * <p>
- * Often users will setup a <code>BasicAclEntryAfterInvocationProvider</code> with a
- * {@link #processConfigAttribute} of <code>AFTER_ACL_COLLECTION_READ</code> and a
- * {@link #requirePermission} of <code>BasePermission.READ</code>. These are also the
- * defaults.
- * <p>
- * If the provided <code>returnObject</code> is <code>null</code>, a <code>null</code>
- * <code>Collection</code> will be returned. If the provided <code>returnObject</code> is
- * not a <code>Collection</code>, an {@link AuthorizationServiceException} will be thrown.
- * <p>
- * All comparisons and prefixes are case sensitive.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-public class AclEntryAfterInvocationCollectionFilteringProvider extends
-		AbstractAclProvider {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	protected static final Log logger = LogFactory
-			.getLog(AclEntryAfterInvocationCollectionFilteringProvider.class);
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public AclEntryAfterInvocationCollectionFilteringProvider(AclService aclService,
-			List<Permission> requirePermission) {
-		super(aclService, "AFTER_ACL_COLLECTION_READ", requirePermission);
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	@SuppressWarnings("unchecked")
-	public Object decide(Authentication authentication, Object object,
-			Collection<ConfigAttribute> config, Object returnedObject)
-			throws AccessDeniedException {
-
-		if (returnedObject == null) {
-			logger.debug("Return object is null, skipping");
-
-			return null;
-		}
-
-		for (ConfigAttribute attr : config) {
-			if (!this.supports(attr)) {
-				continue;
-			}
-
-			// Need to process the Collection for this invocation
-			Filterer filterer;
-
-			if (returnedObject instanceof Collection) {
-				filterer = new CollectionFilterer((Collection) returnedObject);
-			}
-			else if (returnedObject.getClass().isArray()) {
-				filterer = new ArrayFilterer((Object[]) returnedObject);
-			}
-			else {
-				throw new AuthorizationServiceException(
-						"A Collection or an array (or null) was required as the "
-								+ "returnedObject, but the returnedObject was: "
-								+ returnedObject);
-			}
-
-			// Locate unauthorised Collection elements
-			for (Object domainObject : filterer) {
-				// Ignore nulls or entries which aren't instances of the configured domain
-				// object class
-				if (domainObject == null
-						|| !getProcessDomainObjectClass().isAssignableFrom(
-								domainObject.getClass())) {
-					continue;
-				}
-
-				if (!hasPermission(authentication, domainObject)) {
-					filterer.remove(domainObject);
-
-					if (logger.isDebugEnabled()) {
-						logger.debug("Principal is NOT authorised for element: "
-								+ domainObject);
-					}
-				}
-			}
-
-			return filterer.getFilteredObject();
-		}
-
-		return returnedObject;
-	}
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -1,131 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Collection;
-import java.util.List;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.context.MessageSource;
-import org.springframework.context.MessageSourceAware;
-import org.springframework.context.support.MessageSourceAccessor;
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.access.ConfigAttribute;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.SpringSecurityMessageSource;
-
-/**
- * Given a domain object instance returned from a secure object invocation, ensures the
- * principal has appropriate permission as defined by the {@link AclService}.
- * <p>
- * The <code>AclService</code> is used to retrieve the access control list (ACL)
- * permissions associated with a domain object instance for the current
- * <code>Authentication</code> object.
- * <p>
- * This after invocation provider will fire if any {@link ConfigAttribute#getAttribute()}
- * matches the {@link #processConfigAttribute}. The provider will then lookup the ACLs
- * from the <tt>AclService</tt> and ensure the principal is
- * {@link org.springframework.security.acls.model.Acl#isGranted(List, List, boolean)
- * Acl.isGranted(List, List, boolean)} when presenting the {@link #requirePermission}
- * array to that method.
- * <p>
- * Often users will set up an <code>AclEntryAfterInvocationProvider</code> with a
- * {@link #processConfigAttribute} of <code>AFTER_ACL_READ</code> and a
- * {@link #requirePermission} of <code>BasePermission.READ</code>. These are also the
- * defaults.
- * <p>
- * If the principal does not have sufficient permissions, an
- * <code>AccessDeniedException</code> will be thrown.
- * <p>
- * If the provided <tt>returnedObject</tt> is <code>null</code>, permission will always be
- * granted and <code>null</code> will be returned.
- * <p>
- * All comparisons and prefixes are case sensitive.
- */
-public class AclEntryAfterInvocationProvider extends AbstractAclProvider implements
-		MessageSourceAware {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	protected static final Log logger = LogFactory
-			.getLog(AclEntryAfterInvocationProvider.class);
-
-	// ~ Instance fields
-	// ================================================================================================
-
-	protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public AclEntryAfterInvocationProvider(AclService aclService,
-			List<Permission> requirePermission) {
-		this(aclService, "AFTER_ACL_READ", requirePermission);
-	}
-
-	public AclEntryAfterInvocationProvider(AclService aclService,
-			String processConfigAttribute, List<Permission> requirePermission) {
-		super(aclService, processConfigAttribute, requirePermission);
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public Object decide(Authentication authentication, Object object,
-			Collection<ConfigAttribute> config, Object returnedObject)
-			throws AccessDeniedException {
-
-		if (returnedObject == null) {
-			// AclManager interface contract prohibits nulls
-			// As they have permission to null/nothing, grant access
-			logger.debug("Return object is null, skipping");
-
-			return null;
-		}
-
-		if (!getProcessDomainObjectClass().isAssignableFrom(returnedObject.getClass())) {
-			logger.debug("Return object is not applicable for this provider, skipping");
-
-			return returnedObject;
-		}
-
-		for (ConfigAttribute attr : config) {
-			if (!this.supports(attr)) {
-				continue;
-			}
-			// Need to make an access decision on this invocation
-
-			if (hasPermission(authentication, returnedObject)) {
-				return returnedObject;
-			}
-
-			logger.debug("Denying access");
-
-			throw new AccessDeniedException(messages.getMessage(
-					"AclEntryAfterInvocationProvider.noPermission", new Object[] {
-							authentication.getName(), returnedObject },
-					"Authentication {0} has NO permissions to the domain object {1}"));
-		}
-
-		return returnedObject;
-	}
-
-	public void setMessageSource(MessageSource messageSource) {
-		this.messages = new MessageSourceAccessor(messageSource);
-	}
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/ArrayFilterer.java

@@ -1,121 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.lang.reflect.Array;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.NoSuchElementException;
-import java.util.Set;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-/**
- * A filter used to filter arrays.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-class ArrayFilterer<T> implements Filterer<T> {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	protected static final Log logger = LogFactory.getLog(ArrayFilterer.class);
-
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final Set<T> removeList;
-	private final T[] list;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	ArrayFilterer(T[] list) {
-		this.list = list;
-
-		// Collect the removed objects to a HashSet so that
-		// it is fast to lookup them when a filtered array
-		// is constructed.
-		removeList = new HashSet<T>();
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
-	 */
-	@SuppressWarnings("unchecked")
-	public T[] getFilteredObject() {
-		// Recreate an array of same type and filter the removed objects.
-		int originalSize = list.length;
-		int sizeOfResultingList = originalSize - removeList.size();
-		T[] filtered = (T[]) Array.newInstance(list.getClass().getComponentType(),
-				sizeOfResultingList);
-
-		for (int i = 0, j = 0; i < list.length; i++) {
-			T object = list[i];
-
-			if (!removeList.contains(object)) {
-				filtered[j] = object;
-				j++;
-			}
-		}
-
-		if (logger.isDebugEnabled()) {
-			logger.debug("Original array contained " + originalSize
-					+ " elements; now contains " + sizeOfResultingList + " elements");
-		}
-
-		return filtered;
-	}
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
-	 */
-	public Iterator<T> iterator() {
-		return new Iterator<T>() {
-			private int index = 0;
-
-			public boolean hasNext() {
-				return index < list.length;
-			}
-
-			public T next() {
-				if (!hasNext()) {
-					throw new NoSuchElementException();
-				}
-				return list[index++];
-			}
-
-			public void remove() {
-				throw new UnsupportedOperationException();
-			}
-		};
-	}
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
-	 */
-	public void remove(T object) {
-		removeList.add(object);
-	}
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/CollectionFilterer.java

@@ -1,101 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-
-import java.util.Collection;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.Set;
-
-/**
- * A filter used to filter Collections.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-class CollectionFilterer<T> implements Filterer<T> {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	protected static final Log logger = LogFactory.getLog(CollectionFilterer.class);
-
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final Collection<T> collection;
-
-	private final Set<T> removeList;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	CollectionFilterer(Collection<T> collection) {
-		this.collection = collection;
-
-		// We create a Set of objects to be removed from the Collection,
-		// as ConcurrentModificationException prevents removal during
-		// iteration, and making a new Collection to be returned is
-		// problematic as the original Collection implementation passed
-		// to the method may not necessarily be re-constructable (as
-		// the Collection(collection) constructor is not guaranteed and
-		// manually adding may lose sort order or other capabilities)
-		removeList = new HashSet<T>();
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#getFilteredObject()
-	 */
-	public Object getFilteredObject() {
-		// Now the Iterator has ended, remove Objects from Collection
-		Iterator<T> removeIter = removeList.iterator();
-
-		int originalSize = collection.size();
-
-		while (removeIter.hasNext()) {
-			collection.remove(removeIter.next());
-		}
-
-		if (logger.isDebugEnabled()) {
-			logger.debug("Original collection contained " + originalSize
-					+ " elements; now contains " + collection.size() + " elements");
-		}
-
-		return collection;
-	}
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#iterator()
-	 */
-	public Iterator<T> iterator() {
-		return collection.iterator();
-	}
-
-	/**
-	 *
-	 * @see org.springframework.security.acls.afterinvocation.Filterer#remove(java.lang.Object)
-	 */
-	public void remove(T object) {
-		removeList.add(object);
-	}
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/Filterer.java

@@ -1,50 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.afterinvocation;
-
-import java.util.Iterator;
-
-/**
- * Filterer strategy interface.
- *
- * @author Ben Alex
- * @author Paulo Neves
- */
-interface Filterer<T> extends Iterable<T> {
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Gets the filtered collection or array.
-	 *
-	 * @return the filtered collection or array
-	 */
-	Object getFilteredObject();
-
-	/**
-	 * Returns an iterator over the filtered collection or array.
-	 *
-	 * @return an Iterator
-	 */
-	Iterator<T> iterator();
-
-	/**
-	 * Removes the the given object from the resulting list.
-	 *
-	 * @param object the object to be removed
-	 */
-	void remove(T object);
-}

acl/src/main/java/org/springframework/security/acls/afterinvocation/package-info.java

@@ -1,6 +0,0 @@
-/**
- * After-invocation providers for collection and array filtering. Consider using a {@code PostFilter} annotation in
- * preference.
- */
-package org.springframework.security.acls.afterinvocation;
-

acl/src/main/java/org/springframework/security/acls/domain/AbstractPermission.java

@@ -1,74 +1,57 @@
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.AclFormattingUtils;
+import org.springframework.security.acls.Permission;
 
 /**
  * Provides an abstract superclass for {@link Permission} implementations.
- *
+ * 
  * @author Ben Alex
  * @since 2.0.3
+ * @see AbstractRegisteredPermission
+ * 
  */
 public abstract class AbstractPermission implements Permission {
 
-	// ~ Instance fields
-	// ================================================================================================
+    //~ Instance fields ================================================================================================
 
-	protected final char code;
-	protected int mask;
+    protected char code;
+    protected int mask;
 
-	// ~ Constructors
-	// ===================================================================================================
-	/**
-	 * Sets the permission mask and uses the '*' character to represent active bits when
-	 * represented as a bit pattern string.
-	 *
-	 * @param mask the integer bit mask for the permission
-	 */
-	protected AbstractPermission(int mask) {
-		this.mask = mask;
-		this.code = '*';
-	}
+    //~ Constructors ===================================================================================================
 
-	/**
-	 * Sets the permission mask and uses the specified character for active bits.
-	 *
-	 * @param mask the integer bit mask for the permission
-	 * @param code the character to print for each active bit in the mask (see
-	 * {@link Permission#getPattern()})
-	 */
-	protected AbstractPermission(int mask, char code) {
-		this.mask = mask;
-		this.code = code;
-	}
+    protected AbstractPermission(int mask, char code) {
+        this.mask = mask;
+        this.code = code;
+    }
 
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	public final boolean equals(Object arg0) {
-		if (arg0 == null) {
-			return false;
-		}
+    public final boolean equals(Object arg0) {
+        if (arg0 == null) {
+            return false;
+        }
 
-		if (!(arg0 instanceof Permission)) {
-			return false;
-		}
+        if (!(arg0 instanceof Permission)) {
+            return false;
+        }
 
-		Permission rhs = (Permission) arg0;
+        Permission rhs = (Permission) arg0;
 
-		return (this.mask == rhs.getMask());
-	}
+        return (this.mask == rhs.getMask());
+    }
 
-	public final int getMask() {
-		return mask;
-	}
+    public final int getMask() {
+        return mask;
+    }
 
-	public String getPattern() {
-		return AclFormattingUtils.printBinary(mask, code);
-	}
+    public String getPattern() {
+        return AclFormattingUtils.printBinary(mask, code);
+    }
 
-	public final String toString() {
-		return this.getClass().getSimpleName() + "[" + getPattern() + "=" + mask + "]";
-	}
+    public final String toString() {
+        return this.getClass().getSimpleName() + "[" + getPattern() + "=" + mask + "]";
+    }
 
 	public final int hashCode() {
 		return this.mask;

acl/src/main/java/org/springframework/security/acls/domain/AccessControlEntryImpl.java

@@ -14,171 +14,162 @@
  */
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.Sid;
+import org.springframework.security.acls.AccessControlEntry;
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AuditableAccessControlEntry;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.sid.Sid;
 
 import org.springframework.util.Assert;
 
 import java.io.Serializable;
 
+
 /**
  * An immutable default implementation of <code>AccessControlEntry</code>.
  *
  * @author Ben Alex
+ * @version $Id$
  */
-public class AccessControlEntryImpl implements AccessControlEntry,
-		AuditableAccessControlEntry {
-	// ~ Instance fields
-	// ================================================================================================
+public class AccessControlEntryImpl implements AccessControlEntry, AuditableAccessControlEntry {
+    //~ Instance fields ================================================================================================
 
-	private final Acl acl;
-	private Permission permission;
-	private final Serializable id;
-	private final Sid sid;
-	private boolean auditFailure = false;
-	private boolean auditSuccess = false;
-	private final boolean granting;
+    private Acl acl;
+    private Permission permission;
+    private Serializable id;
+    private Sid sid;
+    private boolean auditFailure = false;
+    private boolean auditSuccess = false;
+    private boolean granting;
 
-	// ~ Constructors
-	// ===================================================================================================
+    //~ Constructors ===================================================================================================
 
-	public AccessControlEntryImpl(Serializable id, Acl acl, Sid sid,
-			Permission permission, boolean granting, boolean auditSuccess,
-			boolean auditFailure) {
-		Assert.notNull(acl, "Acl required");
-		Assert.notNull(sid, "Sid required");
-		Assert.notNull(permission, "Permission required");
-		this.id = id;
-		this.acl = acl; // can be null
-		this.sid = sid;
-		this.permission = permission;
-		this.granting = granting;
-		this.auditSuccess = auditSuccess;
-		this.auditFailure = auditFailure;
-	}
+    public AccessControlEntryImpl(Serializable id, Acl acl, Sid sid, Permission permission, boolean granting,
+        boolean auditSuccess, boolean auditFailure) {
+        Assert.notNull(acl, "Acl required");
+        Assert.notNull(sid, "Sid required");
+        Assert.notNull(permission, "Permission required");
+        this.id = id;
+        this.acl = acl; // can be null
+        this.sid = sid;
+        this.permission = permission;
+        this.granting = granting;
+        this.auditSuccess = auditSuccess;
+        this.auditFailure = auditFailure;
+    }
 
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	public boolean equals(Object arg0) {
-		if (!(arg0 instanceof AccessControlEntryImpl)) {
-			return false;
-		}
+    public boolean equals(Object arg0) {
+        if (!(arg0 instanceof AccessControlEntryImpl)) {
+            return false;
+        }
 
-		AccessControlEntryImpl rhs = (AccessControlEntryImpl) arg0;
+        AccessControlEntryImpl rhs = (AccessControlEntryImpl) arg0;
 
-		if (this.acl == null) {
-			if (rhs.getAcl() != null) {
-				return false;
-			}
-			// Both this.acl and rhs.acl are null and thus equal
-		}
-		else {
-			// this.acl is non-null
-			if (rhs.getAcl() == null) {
-				return false;
-			}
+        if (this.acl == null) {
+        	if (rhs.getAcl() != null) {
+        		return false;
+        	}
+        	// Both this.acl and rhs.acl are null and thus equal
+        } else {
+        	// this.acl is non-null
+        	if (rhs.getAcl() == null) {
+        		return false;
+        	}
+        	
+        	// Both this.acl and rhs.acl are non-null, so do a comparison
+        	if (this.acl.getObjectIdentity() == null) {
+        		if (rhs.acl.getObjectIdentity() != null) {
+        			return false;
+        		}
+        		// Both this.acl and rhs.acl are null and thus equal
+        	} else {
+        		// Both this.acl.objectIdentity and rhs.acl.objectIdentity are non-null
+            	if (!this.acl.getObjectIdentity().equals(rhs.getAcl().getObjectIdentity())) {
+            		return false;
+            	}
+        	}
+        }
+        
+        if (this.id == null) {
+        	if (rhs.id != null) {
+        		return false;
+        	}
+        	// Both this.id and rhs.id are null and thus equal
+        } else {
+        	// this.id is non-null
+        	if (rhs.id == null) {
+        		return false;
+        	}
 
-			// Both this.acl and rhs.acl are non-null, so do a comparison
-			if (this.acl.getObjectIdentity() == null) {
-				if (rhs.acl.getObjectIdentity() != null) {
-					return false;
-				}
-				// Both this.acl and rhs.acl are null and thus equal
-			}
-			else {
-				// Both this.acl.objectIdentity and rhs.acl.objectIdentity are non-null
-				if (!this.acl.getObjectIdentity()
-						.equals(rhs.getAcl().getObjectIdentity())) {
-					return false;
-				}
-			}
-		}
+        	// Both this.id and rhs.id are non-null
+        	if (!this.id.equals(rhs.id)) {
+        		return false;
+        	}
+        }
+        
+        if ((this.auditFailure != rhs.isAuditFailure()) || (this.auditSuccess != rhs.isAuditSuccess())
+            || (this.granting != rhs.isGranting())
+            || !this.permission.equals(rhs.getPermission()) || !this.sid.equals(rhs.getSid())) {
+            return false;
+        }
 
-		if (this.id == null) {
-			if (rhs.id != null) {
-				return false;
-			}
-			// Both this.id and rhs.id are null and thus equal
-		}
-		else {
-			// this.id is non-null
-			if (rhs.id == null) {
-				return false;
-			}
+        return true;
+    }
 
-			// Both this.id and rhs.id are non-null
-			if (!this.id.equals(rhs.id)) {
-				return false;
-			}
-		}
+    public Acl getAcl() {
+        return acl;
+    }
 
-		if ((this.auditFailure != rhs.isAuditFailure())
-				|| (this.auditSuccess != rhs.isAuditSuccess())
-				|| (this.granting != rhs.isGranting())
-				|| !this.permission.equals(rhs.getPermission())
-				|| !this.sid.equals(rhs.getSid())) {
-			return false;
-		}
+    public Serializable getId() {
+        return id;
+    }
 
-		return true;
-	}
+    public Permission getPermission() {
+        return permission;
+    }
 
-	public Acl getAcl() {
-		return acl;
-	}
+    public Sid getSid() {
+        return sid;
+    }
 
-	public Serializable getId() {
-		return id;
-	}
+    public boolean isAuditFailure() {
+        return auditFailure;
+    }
 
-	public Permission getPermission() {
-		return permission;
-	}
+    public boolean isAuditSuccess() {
+        return auditSuccess;
+    }
 
-	public Sid getSid() {
-		return sid;
-	}
+    public boolean isGranting() {
+        return granting;
+    }
 
-	public boolean isAuditFailure() {
-		return auditFailure;
-	}
+    void setAuditFailure(boolean auditFailure) {
+        this.auditFailure = auditFailure;
+    }
 
-	public boolean isAuditSuccess() {
-		return auditSuccess;
-	}
+    void setAuditSuccess(boolean auditSuccess) {
+        this.auditSuccess = auditSuccess;
+    }
 
-	public boolean isGranting() {
-		return granting;
-	}
+    void setPermission(Permission permission) {
+        Assert.notNull(permission, "Permission required");
+        this.permission = permission;
+    }
 
-	void setAuditFailure(boolean auditFailure) {
-		this.auditFailure = auditFailure;
-	}
+    public String toString() {
+        StringBuffer sb = new StringBuffer();
+        sb.append("AccessControlEntryImpl[");
+        sb.append("id: ").append(this.id).append("; ");
+        sb.append("granting: ").append(this.granting).append("; ");
+        sb.append("sid: ").append(this.sid).append("; ");
+        sb.append("permission: ").append(this.permission).append("; ");
+        sb.append("auditSuccess: ").append(this.auditSuccess).append("; ");
+        sb.append("auditFailure: ").append(this.auditFailure);
+        sb.append("]");
 
-	void setAuditSuccess(boolean auditSuccess) {
-		this.auditSuccess = auditSuccess;
-	}
-
-	void setPermission(Permission permission) {
-		Assert.notNull(permission, "Permission required");
-		this.permission = permission;
-	}
-
-	public String toString() {
-		StringBuilder sb = new StringBuilder();
-		sb.append("AccessControlEntryImpl[");
-		sb.append("id: ").append(this.id).append("; ");
-		sb.append("granting: ").append(this.granting).append("; ");
-		sb.append("sid: ").append(this.sid).append("; ");
-		sb.append("permission: ").append(this.permission).append("; ");
-		sb.append("auditSuccess: ").append(this.auditSuccess).append("; ");
-		sb.append("auditFailure: ").append(this.auditFailure);
-		sb.append("]");
-
-		return sb.toString();
-	}
+        return sb.toString();
+    }
 }

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategy.java

@@ -15,24 +15,24 @@
 
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.Acl;
+import org.springframework.security.acls.Acl;
+
 
 /**
  * Strategy used by {@link AclImpl} to determine whether a principal is permitted to call
  * adminstrative methods on the <code>AclImpl</code>.
  *
  * @author Ben Alex
+ * @version $Id$
  */
 public interface AclAuthorizationStrategy {
-	// ~ Static fields/initializers
-	// =====================================================================================
+    //~ Static fields/initializers =====================================================================================
 
-	int CHANGE_OWNERSHIP = 0;
-	int CHANGE_AUDITING = 1;
-	int CHANGE_GENERAL = 2;
+    int CHANGE_OWNERSHIP = 0;
+    int CHANGE_AUDITING = 1;
+    int CHANGE_GENERAL = 2;
 
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	void securityCheck(Acl acl, int changeType);
+    void securityCheck(Acl acl, int changeType);
 }

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java

@@ -15,136 +15,112 @@
 
 package org.springframework.security.acls.domain;
 
-import java.util.Arrays;
-import java.util.List;
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.sid.PrincipalSid;
+import org.springframework.security.acls.sid.Sid;
+import org.springframework.security.acls.sid.SidRetrievalStrategy;
+import org.springframework.security.acls.sid.SidRetrievalStrategyImpl;
+
+import org.springframework.security.context.SecurityContextHolder;
 
-import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.util.Assert;
 
+
 /**
- * Default implementation of {@link AclAuthorizationStrategy}.
- * <p>
- * Permission will be granted if at least one of the following conditions is true for the
- * current principal.
- * <ul>
- * <li>is the owner (as defined by the ACL).</li>
- * <li>holds the relevant system-wide {@link GrantedAuthority} injected into the
- * constructor.</li>
- * <li>has {@link BasePermission#ADMINISTRATION} permission (as defined by the ACL).</li>
- * </ul>
+ * Default implementation of {@link AclAuthorizationStrategy}.<p>Permission will be granted provided the current
+ * principal is either the owner (as defined by the ACL), has {@link BasePermission#ADMINISTRATION} (as defined by the
+ * ACL and via a {@link Sid} retrieved for the current principal via {@link #sidRetrievalStrategy}), or if the current
+ * principal holds the relevant system-wide {@link GrantedAuthority} and injected into the constructor.</p>
  *
  * @author Ben Alex
+ * @version $Id$
  */
 public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
-	// ~ Instance fields
-	// ================================================================================================
+    //~ Instance fields ================================================================================================
 
-	private final GrantedAuthority gaGeneralChanges;
-	private final GrantedAuthority gaModifyAuditing;
-	private final GrantedAuthority gaTakeOwnership;
-	private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
+    private GrantedAuthority gaGeneralChanges;
+    private GrantedAuthority gaModifyAuditing;
+    private GrantedAuthority gaTakeOwnership;
+    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
 
-	// ~ Constructors
-	// ===================================================================================================
+    //~ Constructors ===================================================================================================
 
-	/**
-	 * Constructor. The only mandatory parameter relates to the system-wide
-	 * {@link GrantedAuthority} instances that can be held to always permit ACL changes.
-	 *
-	 * @param auths the <code>GrantedAuthority</code>s that have special permissions
-	 * (index 0 is the authority needed to change ownership, index 1 is the authority
-	 * needed to modify auditing details, index 2 is the authority needed to change other
-	 * ACL and ACE details) (required)
-	 * <p>
-	 * Alternatively, a single value can be supplied for all three permissions.
-	 */
-	public AclAuthorizationStrategyImpl(GrantedAuthority... auths) {
-		Assert.isTrue(auths != null && (auths.length == 3 || auths.length == 1),
-				"One or three GrantedAuthority instances required");
-		if (auths.length == 3) {
-			gaTakeOwnership = auths[0];
-			gaModifyAuditing = auths[1];
-			gaGeneralChanges = auths[2];
-		}
-		else {
-			gaTakeOwnership = gaModifyAuditing = gaGeneralChanges = auths[0];
-		}
-	}
+/**
+     * Constructor. The only mandatory parameter relates to the system-wide {@link GrantedAuthority} instances that
+     * can be held to always permit ACL changes.
+     *
+     * @param auths an array of <code>GrantedAuthority</code>s that have
+     * special permissions (index 0 is the authority needed to change
+     * ownership, index 1 is the authority needed to modify auditing details,
+     * index 2 is the authority needed to change other ACL and ACE details) (required)
+     */
+    public AclAuthorizationStrategyImpl(GrantedAuthority[] auths) {
+        Assert.notEmpty(auths, "GrantedAuthority[] with three elements required");
+        Assert.isTrue(auths.length == 3, "GrantedAuthority[] with three elements required");
+        this.gaTakeOwnership = auths[0];
+        this.gaModifyAuditing = auths[1];
+        this.gaGeneralChanges = auths[2];
+    }
 
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	public void securityCheck(Acl acl, int changeType) {
-		if ((SecurityContextHolder.getContext() == null)
-				|| (SecurityContextHolder.getContext().getAuthentication() == null)
-				|| !SecurityContextHolder.getContext().getAuthentication()
-						.isAuthenticated()) {
-			throw new AccessDeniedException(
-					"Authenticated principal required to operate with ACLs");
-		}
+    public void securityCheck(Acl acl, int changeType) {
+        if ((SecurityContextHolder.getContext() == null)
+            || (SecurityContextHolder.getContext().getAuthentication() == null)
+            || !SecurityContextHolder.getContext().getAuthentication().isAuthenticated()) {
+            throw new AccessDeniedException("Authenticated principal required to operate with ACLs");
+        }
 
-		Authentication authentication = SecurityContextHolder.getContext()
-				.getAuthentication();
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 
-		// Check if authorized by virtue of ACL ownership
-		Sid currentUser = createCurrentUser(authentication);
+        // Check if authorized by virtue of ACL ownership
+        Sid currentUser = new PrincipalSid(authentication);
 
-		if (currentUser.equals(acl.getOwner())
-				&& ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
-			return;
-		}
+        if (currentUser.equals(acl.getOwner())
+                && ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
+            return;
+        }
 
-		// Not authorized by ACL ownership; try via adminstrative permissions
-		GrantedAuthority requiredAuthority;
+        // Not authorized by ACL ownership; try via adminstrative permissions
+        GrantedAuthority requiredAuthority = null;
 
-		if (changeType == CHANGE_AUDITING) {
-			requiredAuthority = this.gaModifyAuditing;
-		}
-		else if (changeType == CHANGE_GENERAL) {
-			requiredAuthority = this.gaGeneralChanges;
-		}
-		else if (changeType == CHANGE_OWNERSHIP) {
-			requiredAuthority = this.gaTakeOwnership;
-		}
-		else {
-			throw new IllegalArgumentException("Unknown change type");
-		}
+        if (changeType == CHANGE_AUDITING) {
+            requiredAuthority = this.gaModifyAuditing;
+        } else if (changeType == CHANGE_GENERAL) {
+            requiredAuthority = this.gaGeneralChanges;
+        } else if (changeType == CHANGE_OWNERSHIP) {
+            requiredAuthority = this.gaTakeOwnership;
+        } else {
+            throw new IllegalArgumentException("Unknown change type");
+        }
 
-		// Iterate this principal's authorities to determine right
-		if (authentication.getAuthorities().contains(requiredAuthority)) {
-			return;
-		}
+        // Iterate this principal's authorities to determine right
+        GrantedAuthority[] auths = authentication.getAuthorities();
 
-		// Try to get permission via ACEs within the ACL
-		List<Sid> sids = sidRetrievalStrategy.getSids(authentication);
+        for (int i = 0; i < auths.length; i++) {
+            if (requiredAuthority.equals(auths[i])) {
+                return;
+            }
+        }
 
-		if (acl.isGranted(Arrays.asList(BasePermission.ADMINISTRATION), sids, false)) {
-			return;
-		}
+        // Try to get permission via ACEs within the ACL
+        Sid[] sids = sidRetrievalStrategy.getSids(authentication);
 
-		throw new AccessDeniedException(
-				"Principal does not have required ACL permissions to perform requested operation");
-	}
+        if (acl.isGranted(new Permission[] {BasePermission.ADMINISTRATION}, sids, false)) {
+            return;
+        }
 
-	/**
-	 * Creates a principal-like sid from the authentication information.
-	 *
-	 * @param authentication the authentication information that can provide principal and
-	 * thus the sid's id will be dependant on the value inside
-	 * @return a sid with the ID taken from the authentication information
-	 */
-	protected Sid createCurrentUser(Authentication authentication) {
-		return new PrincipalSid(authentication);
-	}
+        throw new AccessDeniedException(
+            "Principal does not have required ACL permissions to perform requested operation");
+    }
 
-	public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
-		Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
-		this.sidRetrievalStrategy = sidRetrievalStrategy;
-	}
+    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
+        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
+        this.sidRetrievalStrategy = sidRetrievalStrategy;
+    }
 }

acl/src/main/java/org/springframework/security/acls/domain/AclFormattingUtils.java

@@ -1,111 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Permission;
-import org.springframework.util.Assert;
-
-/**
- * Utility methods for displaying ACL information.
- *
- * @author Ben Alex
- */
-public abstract class AclFormattingUtils {
-
-	public static String demergePatterns(String original, String removeBits) {
-		Assert.notNull(original, "Original string required");
-		Assert.notNull(removeBits, "Bits To Remove string required");
-		Assert.isTrue(original.length() == removeBits.length(),
-				"Original and Bits To Remove strings must be identical length");
-
-		char[] replacement = new char[original.length()];
-
-		for (int i = 0; i < original.length(); i++) {
-			if (removeBits.charAt(i) == Permission.RESERVED_OFF) {
-				replacement[i] = original.charAt(i);
-			}
-			else {
-				replacement[i] = Permission.RESERVED_OFF;
-			}
-		}
-
-		return new String(replacement);
-	}
-
-	public static String mergePatterns(String original, String extraBits) {
-		Assert.notNull(original, "Original string required");
-		Assert.notNull(extraBits, "Extra Bits string required");
-		Assert.isTrue(original.length() == extraBits.length(),
-				"Original and Extra Bits strings must be identical length");
-
-		char[] replacement = new char[extraBits.length()];
-
-		for (int i = 0; i < extraBits.length(); i++) {
-			if (extraBits.charAt(i) == Permission.RESERVED_OFF) {
-				replacement[i] = original.charAt(i);
-			}
-			else {
-				replacement[i] = extraBits.charAt(i);
-			}
-		}
-
-		return new String(replacement);
-	}
-
-	/**
-	 * Returns a representation of the active bits in the presented mask, with each active
-	 * bit being denoted by character '*'.
-	 * <p>
-	 * Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.
-	 *
-	 * @param i the integer bit mask to print the active bits for
-	 *
-	 * @return a 32-character representation of the bit mask
-	 */
-	public static String printBinary(int i) {
-		return printBinary(i, '*', Permission.RESERVED_OFF);
-	}
-
-	/**
-	 * Returns a representation of the active bits in the presented mask, with each active
-	 * bit being denoted by the passed character.
-	 * <p>
-	 * Inactive bits will be denoted by character {@link Permission#RESERVED_OFF}.
-	 *
-	 * @param mask the integer bit mask to print the active bits for
-	 * @param code the character to print when an active bit is detected
-	 *
-	 * @return a 32-character representation of the bit mask
-	 */
-	public static String printBinary(int mask, char code) {
-		Assert.doesNotContain(Character.toString(code),
-				Character.toString(Permission.RESERVED_ON), Permission.RESERVED_ON
-						+ " is a reserved character code");
-		Assert.doesNotContain(Character.toString(code),
-				Character.toString(Permission.RESERVED_OFF), Permission.RESERVED_OFF
-						+ " is a reserved character code");
-
-		return printBinary(mask, Permission.RESERVED_ON, Permission.RESERVED_OFF)
-				.replace(Permission.RESERVED_ON, code);
-	}
-
-	private static String printBinary(int i, char on, char off) {
-		String s = Integer.toBinaryString(i);
-		String pattern = Permission.THIRTY_TWO_RESERVED_OFF;
-		String temp2 = pattern.substring(0, pattern.length() - s.length()) + s;
-
-		return temp2.replace('0', off).replace('1', on);
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -15,306 +15,390 @@
 package org.springframework.security.acls.domain;
 
 import java.io.Serializable;
-import java.util.ArrayList;
+import java.util.Iterator;
 import java.util.List;
+import java.util.Vector;
 
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AuditableAcl;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.OwnershipAcl;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.UnloadedSidException;
+import org.springframework.security.acls.AccessControlEntry;
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AuditableAcl;
+import org.springframework.security.acls.MutableAcl;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.OwnershipAcl;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.UnloadedSidException;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.sid.Sid;
 import org.springframework.util.Assert;
 
+
 /**
  * Base implementation of <code>Acl</code>.
  *
  * @author Ben Alex
+ * @version $Id
  */
 public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
-	// ~ Instance fields
-	// ================================================================================================
+    //~ Instance fields ================================================================================================
+	
+    private Acl parentAcl;
+    private transient AclAuthorizationStrategy aclAuthorizationStrategy;
+    private transient AuditLogger auditLogger;
+    private List aces = new Vector();
+    private ObjectIdentity objectIdentity;
+    private Serializable id;
+    private Sid owner; // OwnershipAcl
+    private Sid[] loadedSids = null; // includes all SIDs the WHERE clause covered, even if there was no ACE for a SID
+    private boolean entriesInheriting = true;
 
-	private Acl parentAcl;
-	private transient AclAuthorizationStrategy aclAuthorizationStrategy;
-	private transient PermissionGrantingStrategy permissionGrantingStrategy;
-	private final List<AccessControlEntry> aces = new ArrayList<AccessControlEntry>();
-	private ObjectIdentity objectIdentity;
-	private Serializable id;
-	private Sid owner; // OwnershipAcl
-	private List<Sid> loadedSids = null; // includes all SIDs the WHERE clause covered,
-											// even if there was no ACE for a SID
-	private boolean entriesInheriting = true;
+    //~ Constructors ===================================================================================================
 
-	// ~ Constructors
-	// ===================================================================================================
+/**
+     * Minimal constructor, which should be used {@link
+     * org.springframework.security.acls.MutableAclService#createAcl(ObjectIdentity)}.
+     *
+     * @param objectIdentity the object identity this ACL relates to (required)
+     * @param id the primary key assigned to this ACL (required)
+     * @param aclAuthorizationStrategy authorization strategy (required)
+     * @param auditLogger audit logger (required)
+     */
+    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
+        AuditLogger auditLogger) {
+        Assert.notNull(objectIdentity, "Object Identity required");
+        Assert.notNull(id, "Id required");
+        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
+        Assert.notNull(auditLogger, "AuditLogger required");
+        this.objectIdentity = objectIdentity;
+        this.id = id;
+        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
+        this.auditLogger = auditLogger;
+    }
 
-	/**
-	 * Minimal constructor, which should be used
-	 * {@link org.springframework.security.acls.model.MutableAclService#createAcl(ObjectIdentity)}
-	 * .
-	 *
-	 * @param objectIdentity the object identity this ACL relates to (required)
-	 * @param id the primary key assigned to this ACL (required)
-	 * @param aclAuthorizationStrategy authorization strategy (required)
-	 * @param auditLogger audit logger (required)
-	 */
-	public AclImpl(ObjectIdentity objectIdentity, Serializable id,
-			AclAuthorizationStrategy aclAuthorizationStrategy, AuditLogger auditLogger) {
-		Assert.notNull(objectIdentity, "Object Identity required");
-		Assert.notNull(id, "Id required");
-		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-		Assert.notNull(auditLogger, "AuditLogger required");
-		this.objectIdentity = objectIdentity;
-		this.id = id;
-		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-		this.permissionGrantingStrategy = new DefaultPermissionGrantingStrategy(
-				auditLogger);
-	}
+/**
+     * Full constructor, which should be used by persistence tools that do not
+     * provide field-level access features.
+     *
+     * @param objectIdentity the object identity this ACL relates to (required)
+     * @param id the primary key assigned to this ACL (required)
+     * @param aclAuthorizationStrategy authorization strategy (required)
+     * @param auditLogger audit logger (required)
+     * @param parentAcl the parent (may be <code>null</code>)
+     * @param loadedSids the loaded SIDs if only a subset were loaded (may be
+     *        <code>null</code>)
+     * @param entriesInheriting if ACEs from the parent should inherit into
+     *        this ACL
+     * @param owner the owner (required)
+     */
+    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
+        AuditLogger auditLogger, Acl parentAcl, Sid[] loadedSids, boolean entriesInheriting, Sid owner) {
+        Assert.notNull(objectIdentity, "Object Identity required");
+        Assert.notNull(id, "Id required");
+        Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
+        Assert.notNull(owner, "Owner required");
+        Assert.notNull(auditLogger, "AuditLogger required");
+        this.objectIdentity = objectIdentity;
+        this.id = id;
+        this.aclAuthorizationStrategy = aclAuthorizationStrategy;
+        this.auditLogger = auditLogger;
+        this.parentAcl = parentAcl; // may be null
+        this.loadedSids = loadedSids; // may be null
+        this.entriesInheriting = entriesInheriting;
+        this.owner = owner;
+    }
 
-	/**
-	 * Full constructor, which should be used by persistence tools that do not provide
-	 * field-level access features.
-	 *
-	 * @param objectIdentity the object identity this ACL relates to
-	 * @param id the primary key assigned to this ACL
-	 * @param aclAuthorizationStrategy authorization strategy
-	 * @param grantingStrategy the {@code PermissionGrantingStrategy} which will be used
-	 * by the {@code isGranted()} method
-	 * @param parentAcl the parent (may be may be {@code null})
-	 * @param loadedSids the loaded SIDs if only a subset were loaded (may be {@code null}
-	 * )
-	 * @param entriesInheriting if ACEs from the parent should inherit into this ACL
-	 * @param owner the owner (required)
-	 */
-	public AclImpl(ObjectIdentity objectIdentity, Serializable id,
-			AclAuthorizationStrategy aclAuthorizationStrategy,
-			PermissionGrantingStrategy grantingStrategy, Acl parentAcl,
-			List<Sid> loadedSids, boolean entriesInheriting, Sid owner) {
-		Assert.notNull(objectIdentity, "Object Identity required");
-		Assert.notNull(id, "Id required");
-		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-		Assert.notNull(owner, "Owner required");
+/**
+     * Private no-argument constructor for use by reflection-based persistence
+     * tools along with field-level access.
+     */
+    private AclImpl() {}
 
-		this.objectIdentity = objectIdentity;
-		this.id = id;
-		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-		this.parentAcl = parentAcl; // may be null
-		this.loadedSids = loadedSids; // may be null
-		this.entriesInheriting = entriesInheriting;
-		this.owner = owner;
-		this.permissionGrantingStrategy = grantingStrategy;
-	}
+    //~ Methods ========================================================================================================
 
-	/**
-	 * Private no-argument constructor for use by reflection-based persistence tools along
-	 * with field-level access.
-	 */
-	@SuppressWarnings("unused")
-	private AclImpl() {
-	}
+    private void verifyAceIndexExists(int aceIndex) {
+        if (aceIndex < 0) {
+        	throw new NotFoundException("aceIndex must be greater than or equal to zero");
+        }
+        if (aceIndex > this.aces.size()) {
+        	throw new NotFoundException("aceIndex must correctly refer to an index of the AccessControlEntry collection");
+        }
+    }
+    
+    public void deleteAce(int aceIndex) throws NotFoundException {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
+        verifyAceIndexExists(aceIndex);
+        
+        synchronized (aces) {
+            this.aces.remove(aceIndex);
+        }
+    }
 
-	// ~ Methods
-	// ========================================================================================================
+    public AccessControlEntry[] getEntries() {
+        // Can safely return AccessControlEntry directly, as they're immutable outside the ACL package
+        return (AccessControlEntry[]) aces.toArray(new AccessControlEntry[] {});
+    }
 
-	public void deleteAce(int aceIndex) throws NotFoundException {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_GENERAL);
-		verifyAceIndexExists(aceIndex);
+    public Serializable getId() {
+        return this.id;
+    }
 
-		synchronized (aces) {
-			this.aces.remove(aceIndex);
-		}
-	}
+    public ObjectIdentity getObjectIdentity() {
+        return objectIdentity;
+    }
 
-	private void verifyAceIndexExists(int aceIndex) {
-		if (aceIndex < 0) {
-			throw new NotFoundException("aceIndex must be greater than or equal to zero");
-		}
-		if (aceIndex >= this.aces.size()) {
-			throw new NotFoundException(
-					"aceIndex must refer to an index of the AccessControlEntry list. "
-							+ "List size is " + aces.size() + ", index was " + aceIndex);
-		}
-	}
+    public Sid getOwner() {
+        return this.owner;
+    }
 
-	public void insertAce(int atIndexLocation, Permission permission, Sid sid,
-			boolean granting) throws NotFoundException {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_GENERAL);
-		Assert.notNull(permission, "Permission required");
-		Assert.notNull(sid, "Sid required");
-		if (atIndexLocation < 0) {
-			throw new NotFoundException(
-					"atIndexLocation must be greater than or equal to zero");
-		}
-		if (atIndexLocation > this.aces.size()) {
-			throw new NotFoundException(
-					"atIndexLocation must be less than or equal to the size of the AccessControlEntry collection");
-		}
+    public Acl getParentAcl() {
+        return parentAcl;
+    }
 
-		AccessControlEntryImpl ace = new AccessControlEntryImpl(null, this, sid,
-				permission, granting, false, false);
+    public void insertAce(int atIndexLocation, Permission permission, Sid sid, boolean granting)
+        throws NotFoundException {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
+        Assert.notNull(permission, "Permission required");
+        Assert.notNull(sid, "Sid required");
+        if (atIndexLocation < 0) {
+        	throw new NotFoundException("atIndexLocation must be greater than or equal to zero");
+        }
+        if (atIndexLocation > this.aces.size()) {
+        	throw new NotFoundException("atIndexLocation must be less than or equal to the size of the AccessControlEntry collection");
+        }
 
-		synchronized (aces) {
-			this.aces.add(atIndexLocation, ace);
-		}
-	}
+        AccessControlEntryImpl ace = new AccessControlEntryImpl(null, this, sid, permission, granting, false, false);
 
-	public List<AccessControlEntry> getEntries() {
-		// Can safely return AccessControlEntry directly, as they're immutable outside the
-		// ACL package
-		return new ArrayList<AccessControlEntry>(aces);
-	}
+        synchronized (aces) {
+            this.aces.add(atIndexLocation, ace);
+        }
+    }
 
-	public Serializable getId() {
-		return this.id;
-	}
+    public boolean isEntriesInheriting() {
+        return entriesInheriting;
+    }
 
-	public ObjectIdentity getObjectIdentity() {
-		return objectIdentity;
-	}
+    /**
+     * Determines authorization.  The order of the <code>permission</code> and <code>sid</code> arguments is
+     * <em>extremely important</em>! The method will iterate through each of the <code>permission</code>s in the order
+     * specified. For each iteration, all of the <code>sid</code>s will be considered, again in the order they are
+     * presented. A search will then be performed for the first {@link AccessControlEntry} object that directly
+     * matches that <code>permission:sid</code> combination. When the <em>first full match</em> is found (ie an ACE
+     * that has the SID currently being searched for and the exact permission bit mask being search for), the grant or
+     * deny flag for that ACE will prevail. If the ACE specifies to grant access, the method will return
+     * <code>true</code>. If the ACE specifies to deny access, the loop will stop and the next <code>permission</code>
+     * iteration will be performed. If each permission indicates to deny access, the first deny ACE found will be
+     * considered the reason for the failure (as it was the first match found, and is therefore the one most logically
+     * requiring changes - although not always). If absolutely no matching ACE was found at all for any permission,
+     * the parent ACL will be tried (provided that there is a parent and {@link #isEntriesInheriting()} is
+     * <code>true</code>. The parent ACL will also scan its parent and so on. If ultimately no matching ACE is found,
+     * a <code>NotFoundException</code> will be thrown and the caller will need to decide how to handle the permission
+     * check. Similarly, if any of the SID arguments presented to the method were not loaded by the ACL,
+     * <code>UnloadedSidException</code> will be thrown.
+     *
+     * @param permission the exact permissions to scan for (order is important)
+     * @param sids the exact SIDs to scan for (order is important)
+     * @param administrativeMode if <code>true</code> denotes the query is for administrative purposes and no auditing
+     *        will be undertaken
+     *
+     * @return <code>true</code> if one of the permissions has been granted, <code>false</code> if one of the
+     *         permissions has been specifically revoked
+     *
+     * @throws NotFoundException if an exact ACE for one of the permission bit masks and SID combination could not be
+     *         found
+     * @throws UnloadedSidException if the passed SIDs are unknown to this ACL because the ACL was only loaded for a
+     *         subset of SIDs
+     */
+    public boolean isGranted(Permission[] permission, Sid[] sids, boolean administrativeMode)
+        throws NotFoundException, UnloadedSidException {
+        Assert.notEmpty(permission, "Permissions required");
+        Assert.notEmpty(sids, "SIDs required");
 
-	public boolean isEntriesInheriting() {
-		return entriesInheriting;
-	}
+        if (!this.isSidLoaded(sids)) {
+            throw new UnloadedSidException("ACL was not loaded for one or more SID");
+        }
 
-	/**
-	 * Delegates to the {@link PermissionGrantingStrategy}.
-	 *
-	 * @throws UnloadedSidException if the passed SIDs are unknown to this ACL because the
-	 * ACL was only loaded for a subset of SIDs
-	 * @see DefaultPermissionGrantingStrategy
-	 */
-	public boolean isGranted(List<Permission> permission, List<Sid> sids,
-			boolean administrativeMode) throws NotFoundException, UnloadedSidException {
-		Assert.notEmpty(permission, "Permissions required");
-		Assert.notEmpty(sids, "SIDs required");
+        AccessControlEntry firstRejection = null;
 
-		if (!this.isSidLoaded(sids)) {
-			throw new UnloadedSidException("ACL was not loaded for one or more SID");
-		}
+        for (int i = 0; i < permission.length; i++) {
+            for (int x = 0; x < sids.length; x++) {
+                // Attempt to find exact match for this permission mask and SID
+                Iterator acesIterator = aces.iterator();
+                boolean scanNextSid = true;
 
-		return permissionGrantingStrategy.isGranted(this, permission, sids,
-				administrativeMode);
-	}
+                while (acesIterator.hasNext()) {
+                    AccessControlEntry ace = (AccessControlEntry) acesIterator.next();
 
-	public boolean isSidLoaded(List<Sid> sids) {
-		// If loadedSides is null, this indicates all SIDs were loaded
-		// Also return true if the caller didn't specify a SID to find
-		if ((this.loadedSids == null) || (sids == null) || (sids.size() == 0)) {
-			return true;
-		}
+                    if ((ace.getPermission().getMask() == permission[i].getMask()) && ace.getSid().equals(sids[x])) {
+                        // Found a matching ACE, so its authorization decision will prevail
+                        if (ace.isGranting()) {
+                            // Success
+                            if (!administrativeMode) {
+                                auditLogger.logIfNeeded(true, ace);
+                            }
 
-		// This ACL applies to a SID subset only. Iterate to check it applies.
-		for (Sid sid : sids) {
-			boolean found = false;
+                            return true;
+                        } else {
+                            // Failure for this permission, so stop search
+                            // We will see if they have a different permission
+                            // (this permission is 100% rejected for this SID)
+                            if (firstRejection == null) {
+                                // Store first rejection for auditing reasons
+                                firstRejection = ace;
+                            }
 
-			for (Sid loadedSid : loadedSids) {
-				if (sid.equals(loadedSid)) {
-					// this SID is OK
-					found = true;
+                            scanNextSid = false; // helps break the loop
 
-					break; // out of loadedSids for loop
-				}
-			}
+                            break; // exit "aceIterator" while loop
+                        }
+                    }
+                }
 
-			if (!found) {
-				return false;
-			}
-		}
+                if (!scanNextSid) {
+                    break; // exit SID for loop (now try next permission)
+                }
+            }
+        }
 
-		return true;
-	}
+        if (firstRejection != null) {
+            // We found an ACE to reject the request at this point, as no
+            // other ACEs were found that granted a different permission
+            if (!administrativeMode) {
+                auditLogger.logIfNeeded(false, firstRejection);
+            }
 
-	public void setEntriesInheriting(boolean entriesInheriting) {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_GENERAL);
-		this.entriesInheriting = entriesInheriting;
-	}
+            return false;
+        }
 
-	public void setOwner(Sid newOwner) {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_OWNERSHIP);
-		Assert.notNull(newOwner, "Owner required");
-		this.owner = newOwner;
-	}
+        // No matches have been found so far
+        if (isEntriesInheriting() && (parentAcl != null)) {
+            // We have a parent, so let them try to find a matching ACE
+            return parentAcl.isGranted(permission, sids, false);
+        } else {
+            // We either have no parent, or we're the uppermost parent
+            throw new NotFoundException("Unable to locate a matching ACE for passed permissions and SIDs");
+        }
+    }
 
-	public Sid getOwner() {
-		return this.owner;
-	}
+    public boolean isSidLoaded(Sid[] sids) {
+        // If loadedSides is null, this indicates all SIDs were loaded
+        // Also return true if the caller didn't specify a SID to find
+        if ((this.loadedSids == null) || (sids == null) || (sids.length == 0)) {
+            return true;
+        }
 
-	public void setParent(Acl newParent) {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_GENERAL);
-		Assert.isTrue(newParent == null || !newParent.equals(this),
-				"Cannot be the parent of yourself");
-		this.parentAcl = newParent;
-	}
+        // This ACL applies to a SID subset only. Iterate to check it applies.
+        for (int i = 0; i < sids.length; i++) {
+            boolean found = false;
 
-	public Acl getParentAcl() {
-		return parentAcl;
-	}
+            for (int y = 0; y < this.loadedSids.length; y++) {
+                if (sids[i].equals(this.loadedSids[y])) {
+                    // this SID is OK
+                    found = true;
 
-	public void updateAce(int aceIndex, Permission permission) throws NotFoundException {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_GENERAL);
-		verifyAceIndexExists(aceIndex);
+                    break; // out of loadedSids for loop
+                }
+            }
 
-		synchronized (aces) {
-			AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
-			ace.setPermission(permission);
-		}
-	}
+            if (!found) {
+                return false;
+            }
+        }
 
-	public void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure) {
-		aclAuthorizationStrategy.securityCheck(this,
-				AclAuthorizationStrategy.CHANGE_AUDITING);
-		verifyAceIndexExists(aceIndex);
+        return true;
+    }
 
-		synchronized (aces) {
-			AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
-			ace.setAuditSuccess(auditSuccess);
-			ace.setAuditFailure(auditFailure);
-		}
-	}
+    public void setEntriesInheriting(boolean entriesInheriting) {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
+        this.entriesInheriting = entriesInheriting;
+    }
 
+    public void setOwner(Sid newOwner) {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_OWNERSHIP);
+        Assert.notNull(newOwner, "Owner required");
+        this.owner = newOwner;
+    }
+
+    public void setParent(Acl newParent) {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
+        Assert.isTrue(newParent == null || !newParent.equals(this), "Cannot be the parent of yourself");
+        this.parentAcl = newParent;
+    }
+
+    public String toString() {
+        StringBuffer sb = new StringBuffer();
+        sb.append("AclImpl[");
+        sb.append("id: ").append(this.id).append("; ");
+        sb.append("objectIdentity: ").append(this.objectIdentity).append("; ");
+        sb.append("owner: ").append(this.owner).append("; ");
+
+        Iterator iterator = this.aces.iterator();
+        int count = 0;
+
+        while (iterator.hasNext()) {
+            count++;
+
+            if (count == 1) {
+                sb.append("\r\n");
+            }
+
+            sb.append(iterator.next().toString()).append("\r\n");
+        }
+
+        if (count == 0) {
+            sb.append("no ACEs; ");
+        }
+
+        sb.append("inheriting: ").append(this.entriesInheriting).append("; ");
+        sb.append("parent: ").append((this.parentAcl == null) ? "Null" : this.parentAcl.getObjectIdentity().toString());
+        sb.append("aclAuthorizationStrategy: ").append(this.aclAuthorizationStrategy).append("; ");
+        sb.append("auditLogger: ").append(this.auditLogger);
+        sb.append("]");
+
+        return sb.toString();
+    }
+
+    public void updateAce(int aceIndex, Permission permission)
+        throws NotFoundException {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
+        verifyAceIndexExists(aceIndex);
+        
+        synchronized (aces) {
+            AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
+            ace.setPermission(permission);
+        }
+    }
+
+    public void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure) {
+        aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_AUDITING);
+        verifyAceIndexExists(aceIndex);
+        
+        synchronized (aces) {
+            AccessControlEntryImpl ace = (AccessControlEntryImpl) aces.get(aceIndex);
+            ace.setAuditSuccess(auditSuccess);
+            ace.setAuditFailure(auditFailure);
+        }
+    }
+    
 	public boolean equals(Object obj) {
 		if (obj instanceof AclImpl) {
 			AclImpl rhs = (AclImpl) obj;
 			if (this.aces.equals(rhs.aces)) {
-				if ((this.parentAcl == null && rhs.parentAcl == null)
-						|| (this.parentAcl != null && this.parentAcl
-								.equals(rhs.parentAcl))) {
-					if ((this.objectIdentity == null && rhs.objectIdentity == null)
-							|| (this.objectIdentity != null && this.objectIdentity
-									.equals(rhs.objectIdentity))) {
-						if ((this.id == null && rhs.id == null)
-								|| (this.id != null && this.id.equals(rhs.id))) {
-							if ((this.owner == null && rhs.owner == null)
-									|| (this.owner != null && this.owner
-											.equals(rhs.owner))) {
+				if ((this.parentAcl == null && rhs.parentAcl == null) || (this.parentAcl.equals(rhs.parentAcl))) {
+					if ((this.objectIdentity == null && rhs.objectIdentity == null) || (this.objectIdentity.equals(rhs.objectIdentity))) {
+						if ((this.id == null && rhs.id == null) || (this.id.equals(rhs.id))) {
+							if ((this.owner == null && rhs.owner == null) || this.owner.equals(rhs.owner)) {
 								if (this.entriesInheriting == rhs.entriesInheriting) {
 									if ((this.loadedSids == null && rhs.loadedSids == null)) {
 										return true;
 									}
-									if (this.loadedSids != null
-											&& (this.loadedSids.size() == rhs.loadedSids
-													.size())) {
-										for (int i = 0; i < this.loadedSids.size(); i++) {
-											if (!this.loadedSids.get(i).equals(
-													rhs.loadedSids.get(i))) {
+									if (this.loadedSids.length == rhs.loadedSids.length) {
+										for (int i = 0; i < this.loadedSids.length; i++) {
+											if (!this.loadedSids[i].equals(rhs.loadedSids[i])) {
 												return false;
 											}
 										}
 										return true;
 									}
-								}
+								}								
 							}
 						}
 					}
@@ -323,41 +407,5 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
 		}
 		return false;
 	}
-
-	public String toString() {
-		StringBuilder sb = new StringBuilder();
-		sb.append("AclImpl[");
-		sb.append("id: ").append(this.id).append("; ");
-		sb.append("objectIdentity: ").append(this.objectIdentity).append("; ");
-		sb.append("owner: ").append(this.owner).append("; ");
-
-		int count = 0;
-
-		for (AccessControlEntry ace : aces) {
-			count++;
-
-			if (count == 1) {
-				sb.append("\n");
-			}
-
-			sb.append(ace).append("\n");
-		}
-
-		if (count == 0) {
-			sb.append("no ACEs; ");
-		}
-
-		sb.append("inheriting: ").append(this.entriesInheriting).append("; ");
-		sb.append("parent: ").append(
-				(this.parentAcl == null) ? "Null" : this.parentAcl.getObjectIdentity()
-						.toString());
-		sb.append("; ");
-		sb.append("aclAuthorizationStrategy: ").append(this.aclAuthorizationStrategy)
-				.append("; ");
-		sb.append("permissionGrantingStrategy: ").append(this.permissionGrantingStrategy);
-		sb.append("]");
-
-		return sb.toString();
-	}
-
+    
 }

acl/src/main/java/org/springframework/security/acls/domain/AuditLogger.java

@@ -14,17 +14,18 @@
  */
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.AccessControlEntry;
+import org.springframework.security.acls.AccessControlEntry;
+
 
 /**
  * Used by <code>AclImpl</code> to log audit events.
  *
  * @author Ben Alex
+ * @version $Id$
  *
  */
 public interface AuditLogger {
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	void logIfNeeded(boolean granted, AccessControlEntry ace);
+    void logIfNeeded(boolean granted, AccessControlEntry ace);
 }

acl/src/main/java/org/springframework/security/acls/domain/BasePermission.java

@@ -14,30 +14,59 @@
  */
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.Permission;
+
 
 /**
  * A set of standard permissions.
- *
+ * 
  * <p>
  * You may subclass this class to add additional permissions, or use this class as a guide
  * for creating your own permission classes.
  * </p>
- *
+ * 
  * @author Ben Alex
+ * @version $Id$
  */
 public class BasePermission extends AbstractPermission {
-	public static final Permission READ = new BasePermission(1 << 0, 'R'); // 1
-	public static final Permission WRITE = new BasePermission(1 << 1, 'W'); // 2
-	public static final Permission CREATE = new BasePermission(1 << 2, 'C'); // 4
-	public static final Permission DELETE = new BasePermission(1 << 3, 'D'); // 8
-	public static final Permission ADMINISTRATION = new BasePermission(1 << 4, 'A'); // 16
+    public static final Permission READ = new BasePermission(1 << 0, 'R'); // 1
+    public static final Permission WRITE = new BasePermission(1 << 1, 'W'); // 2
+    public static final Permission CREATE = new BasePermission(1 << 2, 'C'); // 4
+    public static final Permission DELETE = new BasePermission(1 << 3, 'D'); // 8
+    public static final Permission ADMINISTRATION = new BasePermission(1 << 4, 'A'); // 16
+    
+	protected static DefaultPermissionFactory defaultPermissionFactory = new DefaultPermissionFactory();
 
-	protected BasePermission(int mask) {
-		super(mask);
-	}
+	/**
+     * Registers the public static permissions defined on this class. This is mandatory so
+     * that the static methods will operate correctly.
+     */
+    static {
+    	registerPermissionsFor(BasePermission.class);
+    }
 
-	protected BasePermission(int mask, char code) {
-		super(mask, code);
-	}
-}
+    protected BasePermission(int mask, char code) {
+    	super(mask, code);
+    }
+
+    protected final static void registerPermissionsFor(Class subClass) {
+    	defaultPermissionFactory.registerPublicPermissions(subClass);
+    }
+    
+    public final static Permission buildFromMask(int mask) {
+        return defaultPermissionFactory.buildFromMask(mask);
+    }
+
+    public final static Permission[] buildFromMask(int[] masks) {
+        return defaultPermissionFactory.buildFromMask(masks);
+    }
+
+    public final static Permission buildFromName(String name) {
+    	return defaultPermissionFactory.buildFromName(name);
+    }
+
+    public final static Permission[] buildFromName(String[] names) {
+        return defaultPermissionFactory.buildFromName(names);
+    }
+
+}

acl/src/main/java/org/springframework/security/acls/domain/ConsoleAuditLogger.java

@@ -14,32 +14,32 @@
  */
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.AuditableAccessControlEntry;
+import org.springframework.security.acls.AccessControlEntry;
+import org.springframework.security.acls.AuditableAccessControlEntry;
 
 import org.springframework.util.Assert;
 
+
 /**
- * A basic implementation of {@link AuditLogger}.
+ * A bsaic implementation of {@link AuditLogger}.
  *
  * @author Ben Alex
+ * @version $Id$
  */
 public class ConsoleAuditLogger implements AuditLogger {
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	public void logIfNeeded(boolean granted, AccessControlEntry ace) {
-		Assert.notNull(ace, "AccessControlEntry required");
+    public void logIfNeeded(boolean granted, AccessControlEntry ace) {
+        Assert.notNull(ace, "AccessControlEntry required");
 
-		if (ace instanceof AuditableAccessControlEntry) {
-			AuditableAccessControlEntry auditableAce = (AuditableAccessControlEntry) ace;
+        if (ace instanceof AuditableAccessControlEntry) {
+            AuditableAccessControlEntry auditableAce = (AuditableAccessControlEntry) ace;
 
-			if (granted && auditableAce.isAuditSuccess()) {
-				System.out.println("GRANTED due to ACE: " + ace);
-			}
-			else if (!granted && auditableAce.isAuditFailure()) {
-				System.out.println("DENIED due to ACE: " + ace);
-			}
-		}
-	}
+            if (granted && auditableAce.isAuditSuccess()) {
+                System.out.println("GRANTED due to ACE: " + ace);
+            } else if (!granted && auditableAce.isAuditFailure()) {
+                System.out.println("DENIED due to ACE: " + ace);
+            }
+        }
+    }
 }

acl/src/main/java/org/springframework/security/acls/domain/CumulativePermission.java

@@ -14,51 +14,49 @@
  */
 package org.springframework.security.acls.domain;
 
-import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.AclFormattingUtils;
+import org.springframework.security.acls.Permission;
+
 
 /**
- * Represents a <code>Permission</code> that is constructed at runtime from other
- * permissions.
- *
- * <p>
- * Methods return <code>this</code>, in order to facilitate method chaining.
- * </p>
+ * Represents a <code>Permission</code> that is constructed at runtime from other permissions.
+ * 
+ * <p>Methods return <code>this</code>, in order to facilitate method chaining.</p>
  *
  * @author Ben Alex
+ * @version $Id$
  */
 public class CumulativePermission extends AbstractPermission {
 
-	private String pattern = THIRTY_TWO_RESERVED_OFF;
+    private String pattern = THIRTY_TWO_RESERVED_OFF;
 
-	public CumulativePermission() {
-		super(0, ' ');
-	}
+    public CumulativePermission() {
+    	super(0, ' ');
+    }
+    
+    public CumulativePermission clear(Permission permission) {
+        this.mask &= ~permission.getMask();
+        this.pattern = AclFormattingUtils.demergePatterns(this.pattern, permission.getPattern());
 
-	public CumulativePermission clear(Permission permission) {
-		this.mask &= ~permission.getMask();
-		this.pattern = AclFormattingUtils.demergePatterns(this.pattern,
-				permission.getPattern());
+        return this;
+    }
 
-		return this;
-	}
+    public CumulativePermission clear() {
+        this.mask = 0;
+        this.pattern = THIRTY_TWO_RESERVED_OFF;
 
-	public CumulativePermission clear() {
-		this.mask = 0;
-		this.pattern = THIRTY_TWO_RESERVED_OFF;
+        return this;
+    }
+    
+    public CumulativePermission set(Permission permission) {
+        this.mask |= permission.getMask();
+        this.pattern = AclFormattingUtils.mergePatterns(this.pattern, permission.getPattern());
 
-		return this;
-	}
-
-	public CumulativePermission set(Permission permission) {
-		this.mask |= permission.getMask();
-		this.pattern = AclFormattingUtils.mergePatterns(this.pattern,
-				permission.getPattern());
-
-		return this;
-	}
-
-	public String getPattern() {
-		return this.pattern;
-	}
+        return this;
+    }
+    
+    public String getPattern() {
+        return this.pattern;
+    }
 
 }

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionFactory.java

@@ -1,153 +1,127 @@
 package org.springframework.security.acls.domain;
 
 import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Collections;
 import java.util.HashMap;
-import java.util.List;
 import java.util.Map;
 
-import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.jdbc.LookupStrategy;
 import org.springframework.util.Assert;
 
 /**
  * Default implementation of {@link PermissionFactory}.
+ * 
  * <p>
- * Used as a strategy by classes which wish to map integer masks and permission names to
- * <tt>Permission</tt> instances for use with the ACL implementation.
- * <p>
- * Maintains a registry of permission names and masks to <tt>Permission</tt> instances.
- *
+ * Generally this class will be used by a {@link Permission} instance, as opposed to being dependency
+ * injected into a {@link LookupStrategy} or similar. Nevertheless, the latter mode of operation is
+ * fully supported (in which case your {@link Permission} implementations probably should extend
+ * {@link AbstractPermission} instead of {@link AbstractRegisteredPermission}).
+ * </p>
+ * 
  * @author Ben Alex
- * @author Luke Taylor
  * @since 2.0.3
+ *
  */
 public class DefaultPermissionFactory implements PermissionFactory {
-	private final Map<Integer, Permission> registeredPermissionsByInteger = new HashMap<Integer, Permission>();
-	private final Map<String, Permission> registeredPermissionsByName = new HashMap<String, Permission>();
+    private Map registeredPermissionsByInteger = new HashMap();
+    private Map registeredPermissionsByName = new HashMap();
 
-	/**
-	 * Registers the <tt>Permission</tt> fields from the <tt>BasePermission</tt> class.
-	 */
-	public DefaultPermissionFactory() {
-		registerPublicPermissions(BasePermission.class);
-	}
+    /**
+     * Permit registration of a {@link DefaultPermissionFactory} class. The class must provide
+     * public static fields of type {@link Permission} to represent the possible permissions.
+     * 
+     * @param clazz a {@link Permission} class with public static fields to register
+     */
+    public void registerPublicPermissions(Class clazz) {
+        Assert.notNull(clazz, "Class required");
+        Assert.isAssignable(Permission.class, clazz);
+        
+    	Field[] fields = clazz.getFields();
 
-	/**
-	 * Registers the <tt>Permission</tt> fields from the supplied class.
-	 */
-	public DefaultPermissionFactory(Class<? extends Permission> permissionClass) {
-		registerPublicPermissions(permissionClass);
-	}
+        for (int i = 0; i < fields.length; i++) {
+            try {
+                Object fieldValue = fields[i].get(null);
 
-	/**
-	 * Registers a map of named <tt>Permission</tt> instances.
-	 *
-	 * @param namedPermissions the map of <tt>Permission</tt>s, keyed by name.
-	 */
-	public DefaultPermissionFactory(Map<String, ? extends Permission> namedPermissions) {
-		for (String name : namedPermissions.keySet()) {
-			registerPermission(namedPermissions.get(name), name);
-		}
-	}
+                if (Permission.class.isAssignableFrom(fieldValue.getClass())) {
+                    // Found a Permission static field
+                    Permission perm = (Permission) fieldValue;
+                    String permissionName = fields[i].getName();
+                    
+                    registerPermission(perm, permissionName);
+                }
+            } catch (Exception ignore) {}
+        }
+    }
 
-	/**
-	 * Registers the public static fields of type {@link Permission} for a give class.
-	 * <p>
-	 * These permissions will be registered under the name of the field. See
-	 * {@link BasePermission} for an example.
-	 *
-	 * @param clazz a {@link Permission} class with public static fields to register
-	 */
-	protected void registerPublicPermissions(Class<? extends Permission> clazz) {
-		Assert.notNull(clazz, "Class required");
-
-		Field[] fields = clazz.getFields();
-
-		for (Field field : fields) {
-			try {
-				Object fieldValue = field.get(null);
-
-				if (Permission.class.isAssignableFrom(fieldValue.getClass())) {
-					// Found a Permission static field
-					Permission perm = (Permission) fieldValue;
-					String permissionName = field.getName();
-
-					registerPermission(perm, permissionName);
-				}
-			}
-			catch (Exception ignore) {
-			}
-		}
-	}
-
-	protected void registerPermission(Permission perm, String permissionName) {
+	public void registerPermission(Permission perm, String permissionName) {
 		Assert.notNull(perm, "Permission required");
 		Assert.hasText(permissionName, "Permission name required");
-
-		Integer mask = Integer.valueOf(perm.getMask());
+		
+		Integer mask = new Integer(perm.getMask());
 
 		// Ensure no existing Permission uses this integer or code
-		Assert.isTrue(!registeredPermissionsByInteger.containsKey(mask),
-				"An existing Permission already provides mask " + mask);
-		Assert.isTrue(!registeredPermissionsByName.containsKey(permissionName),
-				"An existing Permission already provides name '" + permissionName + "'");
-
+		Assert.isTrue(!registeredPermissionsByInteger.containsKey(mask), "An existing Permission already provides mask " + mask);
+		Assert.isTrue(!registeredPermissionsByName.containsKey(permissionName), "An existing Permission already provides name '" + permissionName + "'");
+		
 		// Register the new Permission
 		registeredPermissionsByInteger.put(mask, perm);
 		registeredPermissionsByName.put(permissionName, perm);
 	}
+    
+    public Permission buildFromMask(int mask) {
+        if (registeredPermissionsByInteger.containsKey(new Integer(mask))) {
+            // The requested mask has an exactly match against a statically-defined Permission, so return it
+            return (Permission) registeredPermissionsByInteger.get(new Integer(mask));
+        }
 
-	public Permission buildFromMask(int mask) {
-		if (registeredPermissionsByInteger.containsKey(Integer.valueOf(mask))) {
-			// The requested mask has an exact match against a statically-defined
-			// Permission, so return it
-			return registeredPermissionsByInteger.get(Integer.valueOf(mask));
-		}
+        // To get this far, we have to use a CumulativePermission
+        CumulativePermission permission = new CumulativePermission();
 
-		// To get this far, we have to use a CumulativePermission
-		CumulativePermission permission = new CumulativePermission();
+        for (int i = 0; i < 32; i++) {
+            int permissionToCheck = 1 << i;
 
-		for (int i = 0; i < 32; i++) {
-			int permissionToCheck = 1 << i;
+            if ((mask & permissionToCheck) == permissionToCheck) {
+                Permission p = (Permission) registeredPermissionsByInteger.get(new Integer(permissionToCheck));
+                Assert.state(p != null, "Mask " + permissionToCheck + " does not have a corresponding static Permission");
+                permission.set(p);
+            }
+        }
 
-			if ((mask & permissionToCheck) == permissionToCheck) {
-				Permission p = registeredPermissionsByInteger.get(Integer
-						.valueOf(permissionToCheck));
+        return permission;
+    }
 
-				if (p == null) {
-					throw new IllegalStateException("Mask '" + permissionToCheck
-							+ "' does not have a corresponding static Permission");
-				}
-				permission.set(p);
-			}
-		}
+    public Permission[] buildFromMask(int[] masks) {
+        if ((masks == null) || (masks.length == 0)) {
+            return new Permission[0];
+        }
 
-		return permission;
-	}
+        Permission[] permissions = new Permission[masks.length];
 
-	public Permission buildFromName(String name) {
-		Permission p = registeredPermissionsByName.get(name);
+        for (int i = 0; i < masks.length; i++) {
+            permissions[i] = buildFromMask(masks[i]);
+        }
 
-		if (p == null) {
-			throw new IllegalArgumentException("Unknown permission '" + name + "'");
-		}
+        return permissions;
+    }
 
-		return p;
-	}
+    public Permission buildFromName(String name) {
+        Assert.isTrue(registeredPermissionsByName.containsKey(name), "Unknown permission '" + name + "'");
 
-	public List<Permission> buildFromNames(List<String> names) {
-		if ((names == null) || (names.size() == 0)) {
-			return Collections.emptyList();
-		}
+        return (Permission) registeredPermissionsByName.get(name);
+    }
 
-		List<Permission> permissions = new ArrayList<Permission>(names.size());
+    public Permission[] buildFromName(String[] names) {
+        if ((names == null) || (names.length == 0)) {
+            return new Permission[0];
+        }
 
-		for (String name : names) {
-			permissions.add(buildFromName(name));
-		}
+        Permission[] permissions = new Permission[names.length];
 
-		return permissions;
-	}
+        for (int i = 0; i < names.length; i++) {
+            permissions[i] = buildFromName(names[i]);
+        }
 
+        return permissions;
+    }
+    
 }

acl/src/main/java/org/springframework/security/acls/domain/DefaultPermissionGrantingStrategy.java

@@ -1,130 +0,0 @@
-package org.springframework.security.acls.domain;
-
-import java.util.List;
-
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.Permission;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.util.Assert;
-
-public class DefaultPermissionGrantingStrategy implements PermissionGrantingStrategy {
-
-	private final transient AuditLogger auditLogger;
-
-	/**
-	 * Creates an instance with the logger which will be used to record granting and
-	 * denial of requested permissions.
-	 */
-	public DefaultPermissionGrantingStrategy(AuditLogger auditLogger) {
-		Assert.notNull(auditLogger, "auditLogger cannot be null");
-		this.auditLogger = auditLogger;
-	}
-
-	/**
-	 * Determines authorization. The order of the <code>permission</code> and
-	 * <code>sid</code> arguments is <em>extremely important</em>! The method will iterate
-	 * through each of the <code>permission</code>s in the order specified. For each
-	 * iteration, all of the <code>sid</code>s will be considered, again in the order they
-	 * are presented. A search will then be performed for the first
-	 * {@link AccessControlEntry} object that directly matches that
-	 * <code>permission:sid</code> combination. When the <em>first full match</em> is
-	 * found (ie an ACE that has the SID currently being searched for and the exact
-	 * permission bit mask being search for), the grant or deny flag for that ACE will
-	 * prevail. If the ACE specifies to grant access, the method will return
-	 * <code>true</code>. If the ACE specifies to deny access, the loop will stop and the
-	 * next <code>permission</code> iteration will be performed. If each permission
-	 * indicates to deny access, the first deny ACE found will be considered the reason
-	 * for the failure (as it was the first match found, and is therefore the one most
-	 * logically requiring changes - although not always). If absolutely no matching ACE
-	 * was found at all for any permission, the parent ACL will be tried (provided that
-	 * there is a parent and {@link Acl#isEntriesInheriting()} is <code>true</code>. The
-	 * parent ACL will also scan its parent and so on. If ultimately no matching ACE is
-	 * found, a <code>NotFoundException</code> will be thrown and the caller will need to
-	 * decide how to handle the permission check. Similarly, if any of the SID arguments
-	 * presented to the method were not loaded by the ACL,
-	 * <code>UnloadedSidException</code> will be thrown.
-	 *
-	 * @param permission the exact permissions to scan for (order is important)
-	 * @param sids the exact SIDs to scan for (order is important)
-	 * @param administrativeMode if <code>true</code> denotes the query is for
-	 * administrative purposes and no auditing will be undertaken
-	 *
-	 * @return <code>true</code> if one of the permissions has been granted,
-	 * <code>false</code> if one of the permissions has been specifically revoked
-	 *
-	 * @throws NotFoundException if an exact ACE for one of the permission bit masks and
-	 * SID combination could not be found
-	 */
-	public boolean isGranted(Acl acl, List<Permission> permission, List<Sid> sids,
-			boolean administrativeMode) throws NotFoundException {
-
-		final List<AccessControlEntry> aces = acl.getEntries();
-
-		AccessControlEntry firstRejection = null;
-
-		for (Permission p : permission) {
-			for (Sid sid : sids) {
-				// Attempt to find exact match for this permission mask and SID
-				boolean scanNextSid = true;
-
-				for (AccessControlEntry ace : aces) {
-
-					if ((ace.getPermission().getMask() == p.getMask())
-							&& ace.getSid().equals(sid)) {
-						// Found a matching ACE, so its authorization decision will
-						// prevail
-						if (ace.isGranting()) {
-							// Success
-							if (!administrativeMode) {
-								auditLogger.logIfNeeded(true, ace);
-							}
-
-							return true;
-						}
-
-						// Failure for this permission, so stop search
-						// We will see if they have a different permission
-						// (this permission is 100% rejected for this SID)
-						if (firstRejection == null) {
-							// Store first rejection for auditing reasons
-							firstRejection = ace;
-						}
-
-						scanNextSid = false; // helps break the loop
-
-						break; // exit aces loop
-					}
-				}
-
-				if (!scanNextSid) {
-					break; // exit SID for loop (now try next permission)
-				}
-			}
-		}
-
-		if (firstRejection != null) {
-			// We found an ACE to reject the request at this point, as no
-			// other ACEs were found that granted a different permission
-			if (!administrativeMode) {
-				auditLogger.logIfNeeded(false, firstRejection);
-			}
-
-			return false;
-		}
-
-		// No matches have been found so far
-		if (acl.isEntriesInheriting() && (acl.getParentAcl() != null)) {
-			// We have a parent, so let them try to find a matching ACE
-			return acl.getParentAcl().isGranted(permission, sids, false);
-		}
-		else {
-			// We either have no parent, or we're the uppermost parent
-			throw new NotFoundException(
-					"Unable to locate a matching ACE for passed permissions and SIDs");
-		}
-	}
-
-}

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -1,161 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-
-import net.sf.ehcache.CacheException;
-import net.sf.ehcache.Ehcache;
-import net.sf.ehcache.Element;
-
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.util.FieldUtils;
-import org.springframework.util.Assert;
-
-/**
- * Simple implementation of {@link AclCache} that delegates to EH-CACHE.
- * <p>
- * Designed to handle the transient fields in {@link AclImpl}. Note that this
- * implementation assumes all {@link AclImpl} instances share the same
- * {@link PermissionGrantingStrategy} and {@link AclAuthorizationStrategy} instances.
- *
- * @author Ben Alex
- */
-public class EhCacheBasedAclCache implements AclCache {
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final Ehcache cache;
-	private PermissionGrantingStrategy permissionGrantingStrategy;
-	private AclAuthorizationStrategy aclAuthorizationStrategy;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public EhCacheBasedAclCache(Ehcache cache,
-			PermissionGrantingStrategy permissionGrantingStrategy,
-			AclAuthorizationStrategy aclAuthorizationStrategy) {
-		Assert.notNull(cache, "Cache required");
-		Assert.notNull(permissionGrantingStrategy, "PermissionGrantingStrategy required");
-		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-		this.cache = cache;
-		this.permissionGrantingStrategy = permissionGrantingStrategy;
-		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public void evictFromCache(Serializable pk) {
-		Assert.notNull(pk, "Primary key (identifier) required");
-
-		MutableAcl acl = getFromCache(pk);
-
-		if (acl != null) {
-			cache.remove(acl.getId());
-			cache.remove(acl.getObjectIdentity());
-		}
-	}
-
-	public void evictFromCache(ObjectIdentity objectIdentity) {
-		Assert.notNull(objectIdentity, "ObjectIdentity required");
-
-		MutableAcl acl = getFromCache(objectIdentity);
-
-		if (acl != null) {
-			cache.remove(acl.getId());
-			cache.remove(acl.getObjectIdentity());
-		}
-	}
-
-	public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
-		Assert.notNull(objectIdentity, "ObjectIdentity required");
-
-		Element element = null;
-
-		try {
-			element = cache.get(objectIdentity);
-		}
-		catch (CacheException ignored) {
-		}
-
-		if (element == null) {
-			return null;
-		}
-
-		return initializeTransientFields((MutableAcl) element.getValue());
-	}
-
-	public MutableAcl getFromCache(Serializable pk) {
-		Assert.notNull(pk, "Primary key (identifier) required");
-
-		Element element = null;
-
-		try {
-			element = cache.get(pk);
-		}
-		catch (CacheException ignored) {
-		}
-
-		if (element == null) {
-			return null;
-		}
-
-		return initializeTransientFields((MutableAcl) element.getValue());
-	}
-
-	public void putInCache(MutableAcl acl) {
-		Assert.notNull(acl, "Acl required");
-		Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
-		Assert.notNull(acl.getId(), "ID required");
-
-		if (this.aclAuthorizationStrategy == null) {
-			if (acl instanceof AclImpl) {
-				this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils
-						.getProtectedFieldValue("aclAuthorizationStrategy", acl);
-				this.permissionGrantingStrategy = (PermissionGrantingStrategy) FieldUtils
-						.getProtectedFieldValue("permissionGrantingStrategy", acl);
-			}
-		}
-
-		if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
-			putInCache((MutableAcl) acl.getParentAcl());
-		}
-
-		cache.put(new Element(acl.getObjectIdentity(), acl));
-		cache.put(new Element(acl.getId(), acl));
-	}
-
-	private MutableAcl initializeTransientFields(MutableAcl value) {
-		if (value instanceof AclImpl) {
-			FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value,
-					this.aclAuthorizationStrategy);
-			FieldUtils.setProtectedFieldValue("permissionGrantingStrategy", value,
-					this.permissionGrantingStrategy);
-		}
-
-		if (value.getParentAcl() != null) {
-			initializeTransientFields((MutableAcl) value.getParentAcl());
-		}
-		return value;
-	}
-
-	public void clearCache() {
-		cache.removeAll();
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/GrantedAuthoritySid.java

@@ -1,79 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.GrantedAuthority;
-
-import org.springframework.util.Assert;
-
-/**
- * Represents a <code>GrantedAuthority</code> as a <code>Sid</code>.
- * <p>
- * This is a basic implementation that simply uses the <code>String</code>-based principal
- * for <code>Sid</code> comparison. More complex principal objects may wish to provide an
- * alternative <code>Sid</code> implementation that uses some other identifier.
- * </p>
- *
- * @author Ben Alex
- */
-public class GrantedAuthoritySid implements Sid {
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final String grantedAuthority;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public GrantedAuthoritySid(String grantedAuthority) {
-		Assert.hasText(grantedAuthority, "GrantedAuthority required");
-		this.grantedAuthority = grantedAuthority;
-	}
-
-	public GrantedAuthoritySid(GrantedAuthority grantedAuthority) {
-		Assert.notNull(grantedAuthority, "GrantedAuthority required");
-		Assert.notNull(
-				grantedAuthority.getAuthority(),
-				"This Sid is only compatible with GrantedAuthoritys that provide a non-null getAuthority()");
-		this.grantedAuthority = grantedAuthority.getAuthority();
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public boolean equals(Object object) {
-		if ((object == null) || !(object instanceof GrantedAuthoritySid)) {
-			return false;
-		}
-
-		// Delegate to getGrantedAuthority() to perform actual comparison (both should be
-		// identical)
-		return ((GrantedAuthoritySid) object).getGrantedAuthority().equals(
-				this.getGrantedAuthority());
-	}
-
-	public int hashCode() {
-		return this.getGrantedAuthority().hashCode();
-	}
-
-	public String getGrantedAuthority() {
-		return grantedAuthority;
-	}
-
-	public String toString() {
-		return "GrantedAuthoritySid[" + this.grantedAuthority + "]";
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/IdentityUnavailableException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-/**
- * Thrown if an ACL identity could not be extracted from an object.
- *
- * @author Ben Alex
- */
-public class IdentityUnavailableException extends RuntimeException {
-	// ~ Constructors
-	// ===================================================================================================
-
-	/**
-	 * Constructs an <code>IdentityUnavailableException</code> with the specified message.
-	 *
-	 * @param msg the detail message
-	 */
-	public IdentityUnavailableException(String msg) {
-		super(msg);
-	}
-
-	/**
-	 * Constructs an <code>IdentityUnavailableException</code> with the specified message
-	 * and root cause.
-	 *
-	 * @param msg the detail message
-	 * @param t root cause
-	 */
-	public IdentityUnavailableException(String msg, Throwable t) {
-		super(msg, t);
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/ObjectIdentityImpl.java

@@ -1,165 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-import java.lang.reflect.Method;
-
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.util.Assert;
-import org.springframework.util.ClassUtils;
-
-/**
- * Simple implementation of {@link ObjectIdentity}.
- * <p>
- * Uses <code>String</code>s to store the identity of the domain object instance. Also
- * offers a constructor that uses reflection to build the identity information.
- *
- * @author Ben Alex
- */
-public class ObjectIdentityImpl implements ObjectIdentity {
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final String type;
-	private Serializable identifier;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public ObjectIdentityImpl(String type, Serializable identifier) {
-		Assert.hasText(type, "Type required");
-		Assert.notNull(identifier, "identifier required");
-
-		this.identifier = identifier;
-		this.type = type;
-	}
-
-	/**
-	 * Constructor which uses the name of the supplied class as the <tt>type</tt>
-	 * property.
-	 */
-	public ObjectIdentityImpl(Class<?> javaType, Serializable identifier) {
-		Assert.notNull(javaType, "Java Type required");
-		Assert.notNull(identifier, "identifier required");
-		this.type = javaType.getName();
-		this.identifier = identifier;
-	}
-
-	/**
-	 * Creates the <code>ObjectIdentityImpl</code> based on the passed object instance.
-	 * The passed object must provide a <code>getId()</code> method, otherwise an
-	 * exception will be thrown.
-	 * <p>
-	 * The class name of the object passed will be considered the {@link #type}, so if
-	 * more control is required, a different constructor should be used.
-	 *
-	 * @param object the domain object instance to create an identity for.
-	 *
-	 * @throws IdentityUnavailableException if identity could not be extracted
-	 */
-	public ObjectIdentityImpl(Object object) throws IdentityUnavailableException {
-		Assert.notNull(object, "object cannot be null");
-
-		Class<?> typeClass = ClassUtils.getUserClass(object.getClass());
-		type = typeClass.getName();
-
-		Object result;
-
-		try {
-			Method method = typeClass.getMethod("getId", new Class[] {});
-			result = method.invoke(object);
-		}
-		catch (Exception e) {
-			throw new IdentityUnavailableException(
-					"Could not extract identity from object " + object, e);
-		}
-
-		Assert.notNull(result, "getId() is required to return a non-null value");
-		Assert.isInstanceOf(Serializable.class, result,
-				"Getter must provide a return value of type Serializable");
-		this.identifier = (Serializable) result;
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Important so caching operates properly.
-	 * <p>
-	 * Considers an object of the same class equal if it has the same
-	 * <code>classname</code> and <code>id</code> properties.
-	 * <p>
-	 * Numeric identities (Integer and Long values) are considered equal if they are
-	 * numerically equal. Other serializable types are evaluated using a simple equality.
-	 *
-	 * @param arg0 object to compare
-	 *
-	 * @return <code>true</code> if the presented object matches this object
-	 */
-	public boolean equals(Object arg0) {
-		if (arg0 == null || !(arg0 instanceof ObjectIdentityImpl)) {
-			return false;
-		}
-
-		ObjectIdentityImpl other = (ObjectIdentityImpl) arg0;
-
-		if (identifier instanceof Number && other.identifier instanceof Number) {
-			// Integers and Longs with same value should be considered equal
-			if (((Number) identifier).longValue() != ((Number) other.identifier)
-					.longValue()) {
-				return false;
-			}
-		}
-		else {
-			// Use plain equality for other serializable types
-			if (!identifier.equals(other.identifier)) {
-				return false;
-			}
-		}
-
-		return type.equals(other.type);
-	}
-
-	public Serializable getIdentifier() {
-		return identifier;
-	}
-
-	public String getType() {
-		return type;
-	}
-
-	/**
-	 * Important so caching operates properly.
-	 *
-	 * @return the hash
-	 */
-	public int hashCode() {
-		int code = 31;
-		code ^= this.type.hashCode();
-		code ^= this.identifier.hashCode();
-
-		return code;
-	}
-
-	public String toString() {
-		StringBuilder sb = new StringBuilder();
-		sb.append(this.getClass().getName()).append("[");
-		sb.append("Type: ").append(this.type);
-		sb.append("; Identifier: ").append(this.identifier).append("]");
-
-		return sb.toString();
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/ObjectIdentityRetrievalStrategyImpl.java

@@ -1,43 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import java.io.Serializable;
-
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.ObjectIdentityGenerator;
-import org.springframework.security.acls.model.ObjectIdentityRetrievalStrategy;
-
-/**
- * Basic implementation of {@link ObjectIdentityRetrievalStrategy} and
- * <tt>ObjectIdentityGenerator</tt> that uses the constructors of
- * {@link ObjectIdentityImpl} to create the {@link ObjectIdentity}.
- *
- * @author Ben Alex
- */
-public class ObjectIdentityRetrievalStrategyImpl implements
-		ObjectIdentityRetrievalStrategy, ObjectIdentityGenerator {
-	// ~ Methods
-	// ========================================================================================================
-
-	public ObjectIdentity getObjectIdentity(Object domainObject) {
-		return new ObjectIdentityImpl(domainObject);
-	}
-
-	public ObjectIdentity createObjectIdentity(Serializable id, String type) {
-		return new ObjectIdentityImpl(type, id);
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/PermissionFactory.java

@@ -1,30 +1,24 @@
 package org.springframework.security.acls.domain;
 
-import java.util.List;
-
-import org.springframework.security.acls.model.Permission;
+import org.springframework.security.acls.Permission;
 
 /**
- * Provides a simple mechanism to retrieve {@link Permission} instances from integer
- * masks.
- *
+ * Provides a simple mechanism to retrieve {@link Permission} instances from integer masks.
+ * 
  * @author Ben Alex
  * @since 2.0.3
- *
+ * 
  */
 public interface PermissionFactory {
 
 	/**
-	 * Dynamically creates a <code>CumulativePermission</code> or
-	 * <code>BasePermission</code> representing the active bits in the passed mask.
+	 * Dynamically creates a <code>CumulativePermission</code> or <code>BasePermission</code> representing the
+	 * active bits in the passed mask.
 	 *
 	 * @param mask to build
 	 *
 	 * @return a Permission representing the requested object
 	 */
-	Permission buildFromMask(int mask);
+	public abstract Permission buildFromMask(int mask);
 
-	Permission buildFromName(String name);
-
-	List<Permission> buildFromNames(List<String> names);
-}
+}

acl/src/main/java/org/springframework/security/acls/domain/PrincipalSid.java

@@ -1,83 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.userdetails.UserDetails;
-
-import org.springframework.util.Assert;
-
-/**
- * Represents an <code>Authentication.getPrincipal()</code> as a <code>Sid</code>.
- * <p>
- * This is a basic implementation that simply uses the <code>String</code>-based principal
- * for <code>Sid</code> comparison. More complex principal objects may wish to provide an
- * alternative <code>Sid</code> implementation that uses some other identifier.
- * </p>
- *
- * @author Ben Alex
- */
-public class PrincipalSid implements Sid {
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final String principal;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public PrincipalSid(String principal) {
-		Assert.hasText(principal, "Principal required");
-		this.principal = principal;
-	}
-
-	public PrincipalSid(Authentication authentication) {
-		Assert.notNull(authentication, "Authentication required");
-		Assert.notNull(authentication.getPrincipal(), "Principal required");
-
-		if (authentication.getPrincipal() instanceof UserDetails) {
-			this.principal = ((UserDetails) authentication.getPrincipal()).getUsername();
-		}
-		else {
-			this.principal = authentication.getPrincipal().toString();
-		}
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public boolean equals(Object object) {
-		if ((object == null) || !(object instanceof PrincipalSid)) {
-			return false;
-		}
-
-		// Delegate to getPrincipal() to perform actual comparison (both should be
-		// identical)
-		return ((PrincipalSid) object).getPrincipal().equals(this.getPrincipal());
-	}
-
-	public int hashCode() {
-		return this.getPrincipal().hashCode();
-	}
-
-	public String getPrincipal() {
-		return principal;
-	}
-
-	public String toString() {
-		return "PrincipalSid[" + this.principal + "]";
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/SidRetrievalStrategyImpl.java

@@ -1,69 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.domain;
-
-import java.util.ArrayList;
-import java.util.Collection;
-import java.util.List;
-
-import org.springframework.security.access.hierarchicalroles.NullRoleHierarchy;
-import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.model.SidRetrievalStrategy;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.GrantedAuthority;
-import org.springframework.util.Assert;
-
-/**
- * Basic implementation of {@link SidRetrievalStrategy} that creates a {@link Sid} for the
- * principal, as well as every granted authority the principal holds. Can optionally have
- * a <tt>RoleHierarchy</tt> injected in order to determine the extended list of
- * authorities that the principal is assigned.
- * <p>
- * The returned array will always contain the {@link PrincipalSid} before any
- * {@link GrantedAuthoritySid} elements.
- *
- * @author Ben Alex
- */
-public class SidRetrievalStrategyImpl implements SidRetrievalStrategy {
-
-	private RoleHierarchy roleHierarchy = new NullRoleHierarchy();
-
-	public SidRetrievalStrategyImpl() {
-	}
-
-	public SidRetrievalStrategyImpl(RoleHierarchy roleHierarchy) {
-		Assert.notNull(roleHierarchy, "RoleHierarchy must not be null");
-		this.roleHierarchy = roleHierarchy;
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public List<Sid> getSids(Authentication authentication) {
-		Collection<? extends GrantedAuthority> authorities = roleHierarchy
-				.getReachableGrantedAuthorities(authentication.getAuthorities());
-		List<Sid> sids = new ArrayList<Sid>(authorities.size() + 1);
-
-		sids.add(new PrincipalSid(authentication));
-
-		for (GrantedAuthority authority : authorities) {
-			sids.add(new GrantedAuthoritySid(authority));
-		}
-
-		return sids;
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/SpringCacheBasedAclCache.java

@@ -1,138 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.domain;
-
-import org.springframework.cache.Cache;
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.PermissionGrantingStrategy;
-import org.springframework.security.util.FieldUtils;
-import org.springframework.util.Assert;
-
-import java.io.Serializable;
-
-/**
- * Simple implementation of {@link org.springframework.security.acls.model.AclCache} that
- * delegates to {@link Cache} implementation.
- * <p>
- * Designed to handle the transient fields in
- * {@link org.springframework.security.acls.domain.AclImpl}. Note that this implementation
- * assumes all {@link org.springframework.security.acls.domain.AclImpl} instances share
- * the same {@link org.springframework.security.acls.model.PermissionGrantingStrategy} and
- * {@link org.springframework.security.acls.domain.AclAuthorizationStrategy} instances.
- *
- * @author Marten Deinum
- * @since 3.2
- */
-public class SpringCacheBasedAclCache implements AclCache {
-	// ~ Instance fields
-	// ================================================================================================
-
-	private final Cache cache;
-	private PermissionGrantingStrategy permissionGrantingStrategy;
-	private AclAuthorizationStrategy aclAuthorizationStrategy;
-
-	// ~ Constructors
-	// ===================================================================================================
-
-	public SpringCacheBasedAclCache(Cache cache,
-			PermissionGrantingStrategy permissionGrantingStrategy,
-			AclAuthorizationStrategy aclAuthorizationStrategy) {
-		Assert.notNull(cache, "Cache required");
-		Assert.notNull(permissionGrantingStrategy, "PermissionGrantingStrategy required");
-		Assert.notNull(aclAuthorizationStrategy, "AclAuthorizationStrategy required");
-		this.cache = cache;
-		this.permissionGrantingStrategy = permissionGrantingStrategy;
-		this.aclAuthorizationStrategy = aclAuthorizationStrategy;
-	}
-
-	// ~ Methods
-	// ========================================================================================================
-
-	public void evictFromCache(Serializable pk) {
-		Assert.notNull(pk, "Primary key (identifier) required");
-
-		MutableAcl acl = getFromCache(pk);
-
-		if (acl != null) {
-			cache.evict(acl.getId());
-			cache.evict(acl.getObjectIdentity());
-		}
-	}
-
-	public void evictFromCache(ObjectIdentity objectIdentity) {
-		Assert.notNull(objectIdentity, "ObjectIdentity required");
-
-		MutableAcl acl = getFromCache(objectIdentity);
-
-		if (acl != null) {
-			cache.evict(acl.getId());
-			cache.evict(acl.getObjectIdentity());
-		}
-	}
-
-	public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
-		Assert.notNull(objectIdentity, "ObjectIdentity required");
-		return getFromCache((Object) objectIdentity);
-	}
-
-	public MutableAcl getFromCache(Serializable pk) {
-		Assert.notNull(pk, "Primary key (identifier) required");
-		return getFromCache((Object) pk);
-	}
-
-	public void putInCache(MutableAcl acl) {
-		Assert.notNull(acl, "Acl required");
-		Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
-		Assert.notNull(acl.getId(), "ID required");
-
-		if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
-			putInCache((MutableAcl) acl.getParentAcl());
-		}
-
-		cache.put(acl.getObjectIdentity(), acl);
-		cache.put(acl.getId(), acl);
-	}
-
-	private MutableAcl getFromCache(Object key) {
-		Cache.ValueWrapper element = cache.get(key);
-
-		if (element == null) {
-			return null;
-		}
-
-		return initializeTransientFields((MutableAcl) element.get());
-	}
-
-	private MutableAcl initializeTransientFields(MutableAcl value) {
-		if (value instanceof AclImpl) {
-			FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value,
-					this.aclAuthorizationStrategy);
-			FieldUtils.setProtectedFieldValue("permissionGrantingStrategy", value,
-					this.permissionGrantingStrategy);
-		}
-
-		if (value.getParentAcl() != null) {
-			initializeTransientFields((MutableAcl) value.getParentAcl());
-		}
-		return value;
-	}
-
-	public void clearCache() {
-		cache.clear();
-	}
-}

acl/src/main/java/org/springframework/security/acls/domain/package-info.java

@@ -1,5 +0,0 @@
-/**
- * Basic implementation of access control lists (ACLs) interfaces.
- */
-package org.springframework.security.acls.domain;
-

acl/src/main/java/org/springframework/security/acls/domain/package.html

@@ -0,0 +1,5 @@
+<html>
+<body>
+Basic implementation of access control lists (ACLs) interfaces.
+</body>
+</html>

acl/src/main/java/org/springframework/security/acls/jdbc/AclCache.java

@@ -0,0 +1,42 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.jdbc;
+
+import org.springframework.security.acls.MutableAcl;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+
+import java.io.Serializable;
+
+
+/**
+ * A caching layer for {@link JdbcAclService}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ *
+ */
+public interface AclCache {
+    //~ Methods ========================================================================================================
+
+    void evictFromCache(Serializable pk);
+
+    void evictFromCache(ObjectIdentity objectIdentity);
+
+    MutableAcl getFromCache(ObjectIdentity objectIdentity);
+
+    MutableAcl getFromCache(Serializable pk);
+
+    void putInCache(MutableAcl acl);
+}

acl/src/main/java/org/springframework/security/acls/jdbc/EhCacheBasedAclCache.java

@@ -0,0 +1,140 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.jdbc;
+
+import java.io.Serializable;
+
+import net.sf.ehcache.CacheException;
+import net.sf.ehcache.Ehcache;
+import net.sf.ehcache.Element;
+
+import org.springframework.security.acls.MutableAcl;
+import org.springframework.security.acls.domain.AclAuthorizationStrategy;
+import org.springframework.security.acls.domain.AclImpl;
+import org.springframework.security.acls.domain.AuditLogger;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.util.FieldUtils;
+import org.springframework.util.Assert;
+
+
+/**
+ * Simple implementation of {@link AclCache} that delegates to EH-CACHE.
+ * 
+ * <p>
+ * Designed to handle the transient fields in {@link AclImpl}. Note that this implementation assumes all
+ * {@link AclImpl} instances share the same {@link AuditLogger} and {@link AclAuthorizationStrategy} instance.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class EhCacheBasedAclCache implements AclCache {
+    //~ Instance fields ================================================================================================
+
+    private Ehcache cache;
+    private AuditLogger auditLogger;
+    private AclAuthorizationStrategy aclAuthorizationStrategy;
+
+    //~ Constructors ===================================================================================================
+
+    public EhCacheBasedAclCache(Ehcache cache) {
+        Assert.notNull(cache, "Cache required");
+        this.cache = cache;
+    }
+
+    //~ Methods ========================================================================================================
+
+    public void evictFromCache(Serializable pk) {
+        Assert.notNull(pk, "Primary key (identifier) required");
+
+        MutableAcl acl = getFromCache(pk);
+
+        if (acl != null) {
+            cache.remove(acl.getId());
+            cache.remove(acl.getObjectIdentity());
+        }
+    }
+
+    public void evictFromCache(ObjectIdentity objectIdentity) {
+        Assert.notNull(objectIdentity, "ObjectIdentity required");
+
+        MutableAcl acl = getFromCache(objectIdentity);
+
+        if (acl != null) {
+            cache.remove(acl.getId());
+            cache.remove(acl.getObjectIdentity());
+        }
+    }
+
+    public MutableAcl getFromCache(ObjectIdentity objectIdentity) {
+        Assert.notNull(objectIdentity, "ObjectIdentity required");
+
+        Element element = null;
+
+        try {
+            element = cache.get(objectIdentity);
+        } catch (CacheException ignored) {}
+
+        if (element == null) {
+            return null;
+        }
+
+        return initializeTransientFields((MutableAcl)element.getValue());
+    }
+
+	public MutableAcl getFromCache(Serializable pk) {
+        Assert.notNull(pk, "Primary key (identifier) required");
+
+        Element element = null;
+
+        try {
+            element = cache.get(pk);
+        } catch (CacheException ignored) {}
+
+        if (element == null) {
+            return null;
+        }
+
+        return initializeTransientFields((MutableAcl) element.getValue());
+    }
+
+    public void putInCache(MutableAcl acl) {
+        Assert.notNull(acl, "Acl required");
+        Assert.notNull(acl.getObjectIdentity(), "ObjectIdentity required");
+        Assert.notNull(acl.getId(), "ID required");
+
+        if (this.aclAuthorizationStrategy == null) {
+            if (acl instanceof AclImpl) {
+            	this.aclAuthorizationStrategy = (AclAuthorizationStrategy) FieldUtils.getProtectedFieldValue("aclAuthorizationStrategy", acl);
+            	this.auditLogger = (AuditLogger) FieldUtils.getProtectedFieldValue("auditLogger", acl);
+            }
+        }
+        
+        if ((acl.getParentAcl() != null) && (acl.getParentAcl() instanceof MutableAcl)) {
+            putInCache((MutableAcl) acl.getParentAcl());
+        }
+
+        cache.put(new Element(acl.getObjectIdentity(), acl));
+        cache.put(new Element(acl.getId(), acl));
+    }
+
+    private MutableAcl initializeTransientFields(MutableAcl value) {
+    	if (value instanceof AclImpl) {
+    		FieldUtils.setProtectedFieldValue("aclAuthorizationStrategy", value, this.aclAuthorizationStrategy);
+    		FieldUtils.setProtectedFieldValue("auditLogger", value, this.auditLogger);
+    	}
+    	return value;
+	}
+}

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcAclService.java

@@ -14,127 +14,113 @@
  */
 package org.springframework.security.acls.jdbc;
 
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AclService;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.objectidentity.ObjectIdentityImpl;
+import org.springframework.security.acls.sid.Sid;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.jdbc.core.RowMapper;
+
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
 import java.sql.ResultSet;
 import java.sql.SQLException;
-import java.util.Arrays;
+
 import java.util.List;
 import java.util.Map;
 
 import javax.sql.DataSource;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.jdbc.core.JdbcTemplate;
-import org.springframework.jdbc.core.RowMapper;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.util.Assert;
 
 /**
  * Simple JDBC-based implementation of <code>AclService</code>.
  * <p>
- * Requires the "dirty" flags in {@link org.springframework.security.acls.domain.AclImpl}
- * and {@link org.springframework.security.acls.domain.AccessControlEntryImpl} to be set,
- * so that the implementation can detect changed parameters easily.
+ * Requires the "dirty" flags in {@link org.springframework.security.acls.domain.AclImpl} and 
+ * {@link org.springframework.security.acls.domain.AccessControlEntryImpl} to be set, so that the implementation can
+ * detect changed parameters easily.
  *
  * @author Ben Alex
+ * @version $Id$
  */
 public class JdbcAclService implements AclService {
-	// ~ Static fields/initializers
-	// =====================================================================================
+    //~ Static fields/initializers =====================================================================================
 
-	protected static final Log log = LogFactory.getLog(JdbcAclService.class);
-	private static final String DEFAULT_SELECT_ACL_WITH_PARENT_SQL = "select obj.object_id_identity as obj_id, class.class as class "
-			+ "from acl_object_identity obj, acl_object_identity parent, acl_class class "
-			+ "where obj.parent_object = parent.id and obj.object_id_class = class.id "
-			+ "and parent.object_id_identity = ? and parent.object_id_class = ("
-			+ "select id FROM acl_class where acl_class.class = ?)";
+    protected static final Log log = LogFactory.getLog(JdbcAclService.class);
+    private static final String selectAclObjectWithParent = "select obj.object_id_identity as obj_id, class.class as class "
+        + "from acl_object_identity obj, acl_object_identity parent, acl_class class "
+        + "where obj.parent_object = parent.id and obj.object_id_class = class.id "
+        + "and parent.object_id_identity = ? and parent.object_id_class = ("
+        + "select id FROM acl_class where acl_class.class = ?)";
 
-	// ~ Instance fields
-	// ================================================================================================
+    //~ Instance fields ================================================================================================
 
-	protected final JdbcTemplate jdbcTemplate;
-	private final LookupStrategy lookupStrategy;
-	private String findChildrenSql = DEFAULT_SELECT_ACL_WITH_PARENT_SQL;
+    protected JdbcTemplate jdbcTemplate;
+    private LookupStrategy lookupStrategy;
 
-	// ~ Constructors
-	// ===================================================================================================
+    //~ Constructors ===================================================================================================
 
-	public JdbcAclService(DataSource dataSource, LookupStrategy lookupStrategy) {
-		Assert.notNull(dataSource, "DataSource required");
-		Assert.notNull(lookupStrategy, "LookupStrategy required");
-		this.jdbcTemplate = new JdbcTemplate(dataSource);
-		this.lookupStrategy = lookupStrategy;
-	}
+    public JdbcAclService(DataSource dataSource, LookupStrategy lookupStrategy) {
+        Assert.notNull(dataSource, "DataSource required");
+        Assert.notNull(lookupStrategy, "LookupStrategy required");
+        this.jdbcTemplate = new JdbcTemplate(dataSource);
+        this.lookupStrategy = lookupStrategy;
+    }
 
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	public List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity) {
-		Object[] args = { parentIdentity.getIdentifier(), parentIdentity.getType() };
-		List<ObjectIdentity> objects = jdbcTemplate.query(findChildrenSql, args,
-				new RowMapper<ObjectIdentity>() {
-					public ObjectIdentity mapRow(ResultSet rs, int rowNum)
-							throws SQLException {
-						String javaType = rs.getString("class");
-						Long identifier = new Long(rs.getLong("obj_id"));
+    public ObjectIdentity[] findChildren(ObjectIdentity parentIdentity) {
+        Object[] args = {parentIdentity.getIdentifier(), parentIdentity.getJavaType().getName()};
+        List objects = jdbcTemplate.query(selectAclObjectWithParent, args,
+                new RowMapper() {
+                    public Object mapRow(ResultSet rs, int rowNum)
+                        throws SQLException {
+                        String javaType = rs.getString("class");
+                        Long identifier = new Long(rs.getLong("obj_id"));
 
-						return new ObjectIdentityImpl(javaType, identifier);
-					}
-				});
+                        return new ObjectIdentityImpl(javaType, identifier);
+                    }
+                });
 
-		if (objects.size() == 0) {
-			return null;
-		}
+        if (objects.size() == 0) {
+        	return null;
+        }
+        
+        return (ObjectIdentityImpl[]) objects.toArray(new ObjectIdentityImpl[objects.size()]);
+    }
 
-		return objects;
-	}
+    public Acl readAclById(ObjectIdentity object, Sid[] sids) throws NotFoundException {
+        Map map = readAclsById(new ObjectIdentity[] {object}, sids);
+        Assert.isTrue(map.containsKey(object), "There should have been an Acl entry for ObjectIdentity " + object);
 
-	public Acl readAclById(ObjectIdentity object, List<Sid> sids)
-			throws NotFoundException {
-		Map<ObjectIdentity, Acl> map = readAclsById(Arrays.asList(object), sids);
-		Assert.isTrue(map.containsKey(object),
-				"There should have been an Acl entry for ObjectIdentity " + object);
+        return (Acl) map.get(object);
+    }
 
-		return (Acl) map.get(object);
-	}
+    public Acl readAclById(ObjectIdentity object) throws NotFoundException {
+        return readAclById(object, null);
+    }
 
-	public Acl readAclById(ObjectIdentity object) throws NotFoundException {
-		return readAclById(object, null);
-	}
+    public Map readAclsById(ObjectIdentity[] objects) throws NotFoundException {
+        return readAclsById(objects, null);
+    }
 
-	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects)
-			throws NotFoundException {
-		return readAclsById(objects, null);
-	}
-
-	public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects,
-			List<Sid> sids) throws NotFoundException {
-		Map<ObjectIdentity, Acl> result = lookupStrategy.readAclsById(objects, sids);
-
-		// Check every requested object identity was found (throw NotFoundException if
-		// needed)
-		for (ObjectIdentity oid : objects) {
-			if (!result.containsKey(oid)) {
-				throw new NotFoundException(
-						"Unable to find ACL information for object identity '" + oid
-								+ "'");
-			}
-		}
-
-		return result;
-	}
-
-	/**
-	 * Allows customization of the SQL query used to find child object identities.
-	 *
-	 * @param findChildrenSql
-	 */
-	public void setFindChildrenQuery(String findChildrenSql) {
-		this.findChildrenSql = findChildrenSql;
-	}
+    public Map readAclsById(ObjectIdentity[] objects, Sid[] sids) throws NotFoundException {
+        Map result = lookupStrategy.readAclsById(objects, sids);
+        
+        // Check every requested object identity was found (throw NotFoundException if needed)
+        for (int i = 0; i < objects.length; i++) {
+            if (!result.containsKey(objects[i])) {
+                throw new NotFoundException("Unable to find ACL information for object identity '"
+                    + objects[i].toString() + "'");
+            }
+        }
+        
+        return result;
+    }
 }

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -14,472 +14,385 @@
  */
 package org.springframework.security.acls.jdbc;
 
+import org.springframework.security.Authentication;
+
+import org.springframework.security.acls.AccessControlEntry;
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AlreadyExistsException;
+import org.springframework.security.acls.ChildrenExistException;
+import org.springframework.security.acls.MutableAcl;
+import org.springframework.security.acls.MutableAclService;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.domain.AccessControlEntryImpl;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.objectidentity.ObjectIdentityImpl;
+import org.springframework.security.acls.sid.GrantedAuthoritySid;
+import org.springframework.security.acls.sid.PrincipalSid;
+import org.springframework.security.acls.sid.Sid;
+
+import org.springframework.security.context.SecurityContextHolder;
+
+import org.springframework.dao.DataAccessException;
+
+import org.springframework.jdbc.core.BatchPreparedStatementSetter;
+
+import org.springframework.transaction.support.TransactionSynchronizationManager;
+
+import org.springframework.util.Assert;
+
+import java.lang.reflect.Array;
+
 import java.sql.PreparedStatement;
 import java.sql.SQLException;
+
 import java.util.List;
 
 import javax.sql.DataSource;
 
-import org.springframework.dao.DataAccessException;
-import org.springframework.jdbc.core.BatchPreparedStatementSetter;
-import org.springframework.security.acls.domain.AccessControlEntryImpl;
-import org.springframework.security.acls.domain.GrantedAuthoritySid;
-import org.springframework.security.acls.domain.ObjectIdentityImpl;
-import org.springframework.security.acls.domain.PrincipalSid;
-import org.springframework.security.acls.model.AccessControlEntry;
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.AclCache;
-import org.springframework.security.acls.model.AlreadyExistsException;
-import org.springframework.security.acls.model.ChildrenExistException;
-import org.springframework.security.acls.model.MutableAcl;
-import org.springframework.security.acls.model.MutableAclService;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
-import org.springframework.security.core.Authentication;
-import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.transaction.support.TransactionSynchronizationManager;
-import org.springframework.util.Assert;
 
 /**
- * Provides a base JDBC implementation of {@link MutableAclService}.
- * <p>
- * The default settings are for HSQLDB. If you are using a different database you will
- * probably need to set the {@link #setSidIdentityQuery(String) sidIdentityQuery} and
- * {@link #setClassIdentityQuery(String) classIdentityQuery} properties appropriately. The
- * other queries, SQL inserts and updates can also be customized to accomodate schema
- * variations, but must produce results consistent with those expected by the defaults.
- * <p>
- * See the appendix of the Spring Security reference manual for more information on the
- * expected schema and how it is used. Information on using PostgreSQL is also included.
+ * Provides a base implementation of {@link MutableAclService}.
  *
  * @author Ben Alex
  * @author Johannes Zlattinger
+ * @version $Id$
  */
 public class JdbcMutableAclService extends JdbcAclService implements MutableAclService {
-	// ~ Instance fields
-	// ================================================================================================
+    //~ Instance fields ================================================================================================
 
 	private boolean foreignKeysInDatabase = true;
-	private final AclCache aclCache;
-	private String deleteEntryByObjectIdentityForeignKey = "delete from acl_entry where acl_object_identity=?";
-	private String deleteObjectIdentityByPrimaryKey = "delete from acl_object_identity where id=?";
-	private String classIdentityQuery = "call identity()";
-	private String sidIdentityQuery = "call identity()";
-	private String insertClass = "insert into acl_class (class) values (?)";
-	private String insertEntry = "insert into acl_entry "
-			+ "(acl_object_identity, ace_order, sid, mask, granting, audit_success, audit_failure)"
-			+ "values (?, ?, ?, ?, ?, ?, ?)";
-	private String insertObjectIdentity = "insert into acl_object_identity "
-			+ "(object_id_class, object_id_identity, owner_sid, entries_inheriting) "
-			+ "values (?, ?, ?, ?)";
-	private String insertSid = "insert into acl_sid (principal, sid) values (?, ?)";
-	private String selectClassPrimaryKey = "select id from acl_class where class=?";
-	private String selectObjectIdentityPrimaryKey = "select acl_object_identity.id from acl_object_identity, acl_class "
-			+ "where acl_object_identity.object_id_class = acl_class.id and acl_class.class=? "
-			+ "and acl_object_identity.object_id_identity = ?";
-	private String selectSidPrimaryKey = "select id from acl_sid where principal=? and sid=?";
-	private String updateObjectIdentity = "update acl_object_identity set "
-			+ "parent_object = ?, owner_sid = ?, entries_inheriting = ?"
-			+ " where id = ?";
+    private AclCache aclCache;
+    private String deleteEntryByObjectIdentityForeignKey = "delete from acl_entry where acl_object_identity=?";
+    private String deleteObjectIdentityByPrimaryKey = "delete from acl_object_identity where id=?";
+    private String classIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_class_seq')
+    private String sidIdentityQuery = "call identity()"; // should be overridden for postgres : select currval('acl_siq_seq')
+    private String insertClass = "insert into acl_class (class) values (?)";
+    private String insertEntry = "insert into acl_entry "
+        + "(acl_object_identity, ace_order, sid, mask, granting, audit_success, audit_failure)"
+        + "values (?, ?, ?, ?, ?, ?, ?)";
+    private String insertObjectIdentity = "insert into acl_object_identity "
+        + "(object_id_class, object_id_identity, owner_sid, entries_inheriting) " + "values (?, ?, ?, ?)";
+    private String insertSid = "insert into acl_sid (principal, sid) values (?, ?)";
+    private String selectClassPrimaryKey = "select id from acl_class where class=?";
+    private String selectObjectIdentityPrimaryKey = "select acl_object_identity.id from acl_object_identity, acl_class "
+        + "where acl_object_identity.object_id_class = acl_class.id and acl_class.class=? "
+        + "and acl_object_identity.object_id_identity = ?";
+    private String selectSidPrimaryKey = "select id from acl_sid where principal=? and sid=?";
+    private String updateObjectIdentity = "update acl_object_identity set "
+        + "parent_object = ?, owner_sid = ?, entries_inheriting = ?" + " where id = ?";
 
-	// ~ Constructors
-	// ===================================================================================================
+    //~ Constructors ===================================================================================================
 
-	public JdbcMutableAclService(DataSource dataSource, LookupStrategy lookupStrategy,
-			AclCache aclCache) {
-		super(dataSource, lookupStrategy);
-		Assert.notNull(aclCache, "AclCache required");
-		this.aclCache = aclCache;
+    public JdbcMutableAclService(DataSource dataSource, LookupStrategy lookupStrategy, AclCache aclCache) {
+        super(dataSource, lookupStrategy);
+        Assert.notNull(aclCache, "AclCache required");
+        this.aclCache = aclCache;
+    }
+
+    //~ Methods ========================================================================================================
+
+    public MutableAcl createAcl(ObjectIdentity objectIdentity)
+        throws AlreadyExistsException {
+        Assert.notNull(objectIdentity, "Object Identity required");
+
+        // Check this object identity hasn't already been persisted
+        if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
+            throw new AlreadyExistsException("Object identity '" + objectIdentity + "' already exists");
+        }
+
+        // Need to retrieve the current principal, in order to know who "owns" this ACL (can be changed later on)
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        PrincipalSid sid = new PrincipalSid(auth);
+
+        // Create the acl_object_identity row
+        createObjectIdentity(objectIdentity, sid);
+
+        // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
+        Acl acl = readAclById(objectIdentity);
+        Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");
+
+        return (MutableAcl) acl;
+    }
+
+    /**
+     * Creates a new row in acl_entry for every ACE defined in the passed MutableAcl object.
+     *
+     * @param acl containing the ACEs to insert
+     */
+    protected void createEntries(final MutableAcl acl) {
+        jdbcTemplate.batchUpdate(insertEntry,
+            new BatchPreparedStatementSetter() {
+                public int getBatchSize() {
+                    return acl.getEntries().length;
+                }
+
+                public void setValues(PreparedStatement stmt, int i)
+                        throws SQLException {
+                    AccessControlEntry entry_ = (AccessControlEntry) Array.get(acl.getEntries(), i);
+                    Assert.isTrue(entry_ instanceof AccessControlEntryImpl, "Unknown ACE class");
+
+                    AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
+
+                    stmt.setLong(1, ((Long) acl.getId()).longValue());
+                    stmt.setInt(2, i);
+                    stmt.setLong(3, createOrRetrieveSidPrimaryKey(entry.getSid(), true).longValue());
+                    stmt.setInt(4, entry.getPermission().getMask());
+                    stmt.setBoolean(5, entry.isGranting());
+                    stmt.setBoolean(6, entry.isAuditSuccess());
+                    stmt.setBoolean(7, entry.isAuditFailure());
+                }
+            });
+    }
+
+    /**
+     * Creates an entry in the acl_object_identity table for the passed ObjectIdentity. The Sid is also
+     * necessary, as acl_object_identity has defined the sid column as non-null.
+     *
+     * @param object to represent an acl_object_identity for
+     * @param owner for the SID column (will be created if there is no acl_sid entry for this particular Sid already)
+     */
+    protected void createObjectIdentity(ObjectIdentity object, Sid owner) {
+        Long sidId = createOrRetrieveSidPrimaryKey(owner, true);
+        Long classId = createOrRetrieveClassPrimaryKey(object.getJavaType(), true);
+        jdbcTemplate.update(insertObjectIdentity,
+            new Object[] {classId, object.getIdentifier().toString(), sidId, new Boolean(true)});
+    }
+
+    /**
+     * Retrieves the primary key from acl_class, creating a new row if needed and the allowCreate property is
+     * true.
+     *
+     * @param clazz to find or create an entry for (this implementation uses the fully-qualified class name String)
+     * @param allowCreate true if creation is permitted if not found
+     *
+     * @return the primary key or null if not found
+     */
+    protected Long createOrRetrieveClassPrimaryKey(Class clazz, boolean allowCreate) {
+        List classIds = jdbcTemplate.queryForList(selectClassPrimaryKey, new Object[] {clazz.getName()}, Long.class);
+        Long classId = null;
+
+        if (classIds.isEmpty()) {
+            if (allowCreate) {
+                classId = null;
+                jdbcTemplate.update(insertClass, new Object[] {clazz.getName()});
+                Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
+                        "Transaction must be running");
+                classId = new Long(jdbcTemplate.queryForLong(classIdentityQuery));
+            }
+        } else {
+            classId = (Long) classIds.iterator().next();
+        }
+
+        return classId;
+    }
+
+    /**
+     * Retrieves the primary key from acl_sid, creating a new row if needed and the allowCreate property is
+     * true.
+     *
+     * @param sid to find or create
+     * @param allowCreate true if creation is permitted if not found
+     *
+     * @return the primary key or null if not found
+     *
+     * @throws IllegalArgumentException DOCUMENT ME!
+     */
+    protected Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
+        Assert.notNull(sid, "Sid required");
+
+        String sidName = null;
+        boolean principal = true;
+
+        if (sid instanceof PrincipalSid) {
+            sidName = ((PrincipalSid) sid).getPrincipal();
+        } else if (sid instanceof GrantedAuthoritySid) {
+            sidName = ((GrantedAuthoritySid) sid).getGrantedAuthority();
+            principal = false;
+        } else {
+            throw new IllegalArgumentException("Unsupported implementation of Sid");
+        }
+
+        List sidIds = jdbcTemplate.queryForList(selectSidPrimaryKey, new Object[] {new Boolean(principal), sidName},
+                Long.class);
+        Long sidId = null;
+
+        if (sidIds.isEmpty()) {
+            if (allowCreate) {
+                sidId = null;
+                jdbcTemplate.update(insertSid, new Object[] {new Boolean(principal), sidName});
+                Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
+                        "Transaction must be running");
+                sidId = new Long(jdbcTemplate.queryForLong(sidIdentityQuery));
+            }
+        } else {
+            sidId = (Long) sidIds.iterator().next();
+        }
+
+        return sidId;
+    }
+
+    public void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren)
+        throws ChildrenExistException {
+        Assert.notNull(objectIdentity, "Object Identity required");
+        Assert.notNull(objectIdentity.getIdentifier(), "Object Identity doesn't provide an identifier");
+
+        if (deleteChildren) {
+        	ObjectIdentity[] children = findChildren(objectIdentity);
+        	if (children != null) {
+            	for (int i = 0; i < children.length; i++) {
+                    deleteAcl(children[i], true);
+                }
+        	}
+        } else {
+        	if (!foreignKeysInDatabase) {
+        		// We need to perform a manual verification for what a FK would normally do
+        		// We generally don't do this, in the interests of deadlock management
+        		ObjectIdentity[] children = findChildren(objectIdentity);
+        		if (children != null) {
+                    throw new ChildrenExistException("Cannot delete '" + objectIdentity + "' (has " + children.length
+                            + " children)");
+        		}
+        	}
+        }
+
+        Long oidPrimaryKey = retrieveObjectIdentityPrimaryKey(objectIdentity);
+        
+        // Delete this ACL's ACEs in the acl_entry table
+        deleteEntries(oidPrimaryKey);
+
+        // Delete this ACL's acl_object_identity row
+        deleteObjectIdentity(oidPrimaryKey);
+
+        // Clear the cache
+        aclCache.evictFromCache(objectIdentity);
+    }
+
+    /**
+     * Deletes all ACEs defined in the acl_entry table belonging to the presented ObjectIdentity primary key.
+     *
+     * @param oidPrimaryKey the rows in acl_entry to delete
+     */
+    protected void deleteEntries(Long oidPrimaryKey) {
+    	jdbcTemplate.update(deleteEntryByObjectIdentityForeignKey,
+                new Object[] {oidPrimaryKey});
+    }
+
+    /**
+     * Deletes a single row from acl_object_identity that is associated with the presented ObjectIdentity primary key.
+     * 
+     * <p>
+     * We do not delete any entries from acl_class, even if no classes are using that class any longer. This is a
+     * deadlock avoidance approach.
+     * </p>
+     *
+     * @param oidPrimaryKey to delete the acl_object_identity
+     */
+    protected void deleteObjectIdentity(Long oidPrimaryKey) {
+        // Delete the acl_object_identity row
+        jdbcTemplate.update(deleteObjectIdentityByPrimaryKey, new Object[] {oidPrimaryKey});
+    }
+
+    /**
+     * Retrieves the primary key from the acl_object_identity table for the passed ObjectIdentity. Unlike some
+     * other methods in this implementation, this method will NOT create a row (use {@link
+     * #createObjectIdentity(ObjectIdentity, Sid)} instead).
+     *
+     * @param oid to find
+     *
+     * @return the object identity or null if not found
+     */
+    protected Long retrieveObjectIdentityPrimaryKey(ObjectIdentity oid) {
+        try {
+            return new Long(jdbcTemplate.queryForLong(selectObjectIdentityPrimaryKey,
+                    new Object[] {oid.getJavaType().getName(), oid.getIdentifier()}));
+        } catch (DataAccessException notFound) {
+            return null;
+        }
+    }
+
+    /**
+     * This implementation will simply delete all ACEs in the database and recreate them on each invocation of
+     * this method. A more comprehensive implementation might use dirty state checking, or more likely use ORM
+     * capabilities for create, update and delete operations of {@link MutableAcl}.
+     *
+     * @param acl DOCUMENT ME!
+     *
+     * @return DOCUMENT ME!
+     *
+     * @throws NotFoundException DOCUMENT ME!
+     */
+    public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
+        Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");
+
+        // Delete this ACL's ACEs in the acl_entry table
+        deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));
+
+        // Create this ACL's ACEs in the acl_entry table
+        createEntries(acl);
+
+        // Change the mutable columns in acl_object_identity
+        updateObjectIdentity(acl);
+
+        // Clear the cache, including children
+        clearCacheIncludingChildren(acl.getObjectIdentity());
+
+        // Retrieve the ACL via superclass (ensures cache registration, proper retrieval etc)
+        return (MutableAcl) super.readAclById(acl.getObjectIdentity());
+    }
+    
+    private void clearCacheIncludingChildren(ObjectIdentity objectIdentity) {
+    	Assert.notNull(objectIdentity, "ObjectIdentity required");
+        ObjectIdentity[] children = findChildren(objectIdentity);
+        if (children != null) {
+        	for (int i = 0; i < children.length; i++) {
+        		clearCacheIncludingChildren(children[i]);
+        	}
+        }
+        aclCache.evictFromCache(objectIdentity);
+    }
+
+    /**
+     * Updates an existing acl_object_identity row, with new information presented in the passed MutableAcl
+     * object. Also will create an acl_sid entry if needed for the Sid that owns the MutableAcl.
+     *
+     * @param acl to modify (a row must already exist in acl_object_identity)
+     *
+     * @throws NotFoundException DOCUMENT ME!
+     */
+    protected void updateObjectIdentity(MutableAcl acl) {
+        Long parentId = null;
+
+        if (acl.getParentAcl() != null) {
+            Assert.isInstanceOf(ObjectIdentityImpl.class, acl.getParentAcl().getObjectIdentity(),
+                "Implementation only supports ObjectIdentityImpl");
+
+            ObjectIdentityImpl oii = (ObjectIdentityImpl) acl.getParentAcl().getObjectIdentity();
+            parentId = retrieveObjectIdentityPrimaryKey(oii);
+        }
+
+        Assert.notNull(acl.getOwner(), "Owner is required in this implementation");
+
+        Long ownerSid = createOrRetrieveSidPrimaryKey(acl.getOwner(), true);
+        int count = jdbcTemplate.update(updateObjectIdentity,
+                new Object[] {parentId, ownerSid, new Boolean(acl.isEntriesInheriting()), acl.getId()});
+
+        if (count != 1) {
+            throw new NotFoundException("Unable to locate ACL to update");
+        }
+    }
+
+	public void setClassIdentityQuery(String identityQuery) {
+		Assert.hasText(identityQuery, "New identity query is required");
+		this.classIdentityQuery = identityQuery;
 	}
 
-	// ~ Methods
-	// ========================================================================================================
-
-	public MutableAcl createAcl(ObjectIdentity objectIdentity)
-			throws AlreadyExistsException {
-		Assert.notNull(objectIdentity, "Object Identity required");
-
-		// Check this object identity hasn't already been persisted
-		if (retrieveObjectIdentityPrimaryKey(objectIdentity) != null) {
-			throw new AlreadyExistsException("Object identity '" + objectIdentity
-					+ "' already exists");
-		}
-
-		// Need to retrieve the current principal, in order to know who "owns" this ACL
-		// (can be changed later on)
-		Authentication auth = SecurityContextHolder.getContext().getAuthentication();
-		PrincipalSid sid = new PrincipalSid(auth);
-
-		// Create the acl_object_identity row
-		createObjectIdentity(objectIdentity, sid);
-
-		// Retrieve the ACL via superclass (ensures cache registration, proper retrieval
-		// etc)
-		Acl acl = readAclById(objectIdentity);
-		Assert.isInstanceOf(MutableAcl.class, acl, "MutableAcl should be been returned");
-
-		return (MutableAcl) acl;
+	public void setSidIdentityQuery(String identityQuery) {
+		Assert.hasText(identityQuery, "New identity query is required");
+		this.sidIdentityQuery = identityQuery;
 	}
-
 	/**
-	 * Creates a new row in acl_entry for every ACE defined in the passed MutableAcl
-	 * object.
-	 *
-	 * @param acl containing the ACEs to insert
-	 */
-	protected void createEntries(final MutableAcl acl) {
-		if (acl.getEntries().isEmpty()) {
-			return;
-		}
-		jdbcTemplate.batchUpdate(insertEntry, new BatchPreparedStatementSetter() {
-			public int getBatchSize() {
-				return acl.getEntries().size();
-			}
-
-			public void setValues(PreparedStatement stmt, int i) throws SQLException {
-				AccessControlEntry entry_ = acl.getEntries().get(i);
-				Assert.isTrue(entry_ instanceof AccessControlEntryImpl,
-						"Unknown ACE class");
-				AccessControlEntryImpl entry = (AccessControlEntryImpl) entry_;
-
-				stmt.setLong(1, ((Long) acl.getId()).longValue());
-				stmt.setInt(2, i);
-				stmt.setLong(3, createOrRetrieveSidPrimaryKey(entry.getSid(), true)
-						.longValue());
-				stmt.setInt(4, entry.getPermission().getMask());
-				stmt.setBoolean(5, entry.isGranting());
-				stmt.setBoolean(6, entry.isAuditSuccess());
-				stmt.setBoolean(7, entry.isAuditFailure());
-			}
-		});
-	}
-
-	/**
-	 * Creates an entry in the acl_object_identity table for the passed ObjectIdentity.
-	 * The Sid is also necessary, as acl_object_identity has defined the sid column as
-	 * non-null.
-	 *
-	 * @param object to represent an acl_object_identity for
-	 * @param owner for the SID column (will be created if there is no acl_sid entry for
-	 * this particular Sid already)
-	 */
-	protected void createObjectIdentity(ObjectIdentity object, Sid owner) {
-		Long sidId = createOrRetrieveSidPrimaryKey(owner, true);
-		Long classId = createOrRetrieveClassPrimaryKey(object.getType(), true);
-		jdbcTemplate.update(insertObjectIdentity, classId, object.getIdentifier(), sidId,
-				Boolean.TRUE);
-	}
-
-	/**
-	 * Retrieves the primary key from {@code acl_class}, creating a new row if needed and
-	 * the {@code allowCreate} property is {@code true}.
-	 *
-	 * @param type to find or create an entry for (often the fully-qualified class name)
-	 * @param allowCreate true if creation is permitted if not found
-	 *
-	 * @return the primary key or null if not found
-	 */
-	protected Long createOrRetrieveClassPrimaryKey(String type, boolean allowCreate) {
-		List<Long> classIds = jdbcTemplate.queryForList(selectClassPrimaryKey,
-				new Object[] { type }, Long.class);
-
-		if (!classIds.isEmpty()) {
-			return classIds.get(0);
-		}
-
-		if (allowCreate) {
-			jdbcTemplate.update(insertClass, type);
-			Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
-					"Transaction must be running");
-			return jdbcTemplate.queryForObject(classIdentityQuery, Long.class);
-		}
-
-		return null;
-	}
-
-	/**
-	 * Retrieves the primary key from acl_sid, creating a new row if needed and the
-	 * allowCreate property is true.
-	 *
-	 * @param sid to find or create
-	 * @param allowCreate true if creation is permitted if not found
-	 *
-	 * @return the primary key or null if not found
-	 *
-	 * @throws IllegalArgumentException if the <tt>Sid</tt> is not a recognized
-	 * implementation.
-	 */
-	protected Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
-		Assert.notNull(sid, "Sid required");
-
-		String sidName;
-		boolean sidIsPrincipal = true;
-
-		if (sid instanceof PrincipalSid) {
-			sidName = ((PrincipalSid) sid).getPrincipal();
-		}
-		else if (sid instanceof GrantedAuthoritySid) {
-			sidName = ((GrantedAuthoritySid) sid).getGrantedAuthority();
-			sidIsPrincipal = false;
-		}
-		else {
-			throw new IllegalArgumentException("Unsupported implementation of Sid");
-		}
-
-		return createOrRetrieveSidPrimaryKey(sidName, sidIsPrincipal, allowCreate);
-	}
-
-	/**
-	 * Retrieves the primary key from acl_sid, creating a new row if needed and the
-	 * allowCreate property is true.
-	 * @param sidName name of Sid to find or to create
-	 * @param sidIsPrincipal whether it's a user or granted authority like role
-	 * @param allowCreate true if creation is permitted if not found
-	 * @return the primary key or null if not found
-	 */
-	protected Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal,
-			boolean allowCreate) {
-
-		List<Long> sidIds = jdbcTemplate.queryForList(selectSidPrimaryKey, new Object[] {
-				Boolean.valueOf(sidIsPrincipal), sidName }, Long.class);
-
-		if (!sidIds.isEmpty()) {
-			return sidIds.get(0);
-		}
-
-		if (allowCreate) {
-			jdbcTemplate.update(insertSid, Boolean.valueOf(sidIsPrincipal), sidName);
-			Assert.isTrue(TransactionSynchronizationManager.isSynchronizationActive(),
-					"Transaction must be running");
-			return jdbcTemplate.queryForObject(sidIdentityQuery, Long.class);
-		}
-
-		return null;
-	}
-
-	public void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren)
-			throws ChildrenExistException {
-		Assert.notNull(objectIdentity, "Object Identity required");
-		Assert.notNull(objectIdentity.getIdentifier(),
-				"Object Identity doesn't provide an identifier");
-
-		if (deleteChildren) {
-			List<ObjectIdentity> children = findChildren(objectIdentity);
-			if (children != null) {
-				for (ObjectIdentity child : children) {
-					deleteAcl(child, true);
-				}
-			}
-		}
-		else {
-			if (!foreignKeysInDatabase) {
-				// We need to perform a manual verification for what a FK would normally
-				// do
-				// We generally don't do this, in the interests of deadlock management
-				List<ObjectIdentity> children = findChildren(objectIdentity);
-				if (children != null) {
-					throw new ChildrenExistException("Cannot delete '" + objectIdentity
-							+ "' (has " + children.size() + " children)");
-				}
-			}
-		}
-
-		Long oidPrimaryKey = retrieveObjectIdentityPrimaryKey(objectIdentity);
-
-		// Delete this ACL's ACEs in the acl_entry table
-		deleteEntries(oidPrimaryKey);
-
-		// Delete this ACL's acl_object_identity row
-		deleteObjectIdentity(oidPrimaryKey);
-
-		// Clear the cache
-		aclCache.evictFromCache(objectIdentity);
-	}
-
-	/**
-	 * Deletes all ACEs defined in the acl_entry table belonging to the presented
-	 * ObjectIdentity primary key.
-	 *
-	 * @param oidPrimaryKey the rows in acl_entry to delete
-	 */
-	protected void deleteEntries(Long oidPrimaryKey) {
-		jdbcTemplate.update(deleteEntryByObjectIdentityForeignKey, oidPrimaryKey);
-	}
-
-	/**
-	 * Deletes a single row from acl_object_identity that is associated with the presented
-	 * ObjectIdentity primary key.
-	 * <p>
-	 * We do not delete any entries from acl_class, even if no classes are using that
-	 * class any longer. This is a deadlock avoidance approach.
-	 *
-	 * @param oidPrimaryKey to delete the acl_object_identity
-	 */
-	protected void deleteObjectIdentity(Long oidPrimaryKey) {
-		// Delete the acl_object_identity row
-		jdbcTemplate.update(deleteObjectIdentityByPrimaryKey, oidPrimaryKey);
-	}
-
-	/**
-	 * Retrieves the primary key from the acl_object_identity table for the passed
-	 * ObjectIdentity. Unlike some other methods in this implementation, this method will
-	 * NOT create a row (use {@link #createObjectIdentity(ObjectIdentity, Sid)} instead).
-	 *
-	 * @param oid to find
-	 *
-	 * @return the object identity or null if not found
-	 */
-	protected Long retrieveObjectIdentityPrimaryKey(ObjectIdentity oid) {
-		try {
-			return jdbcTemplate.queryForObject(selectObjectIdentityPrimaryKey, Long.class,
-					oid.getType(), oid.getIdentifier());
-		}
-		catch (DataAccessException notFound) {
-			return null;
-		}
-	}
-
-	/**
-	 * This implementation will simply delete all ACEs in the database and recreate them
-	 * on each invocation of this method. A more comprehensive implementation might use
-	 * dirty state checking, or more likely use ORM capabilities for create, update and
-	 * delete operations of {@link MutableAcl}.
-	 */
-	public MutableAcl updateAcl(MutableAcl acl) throws NotFoundException {
-		Assert.notNull(acl.getId(), "Object Identity doesn't provide an identifier");
-
-		// Delete this ACL's ACEs in the acl_entry table
-		deleteEntries(retrieveObjectIdentityPrimaryKey(acl.getObjectIdentity()));
-
-		// Create this ACL's ACEs in the acl_entry table
-		createEntries(acl);
-
-		// Change the mutable columns in acl_object_identity
-		updateObjectIdentity(acl);
-
-		// Clear the cache, including children
-		clearCacheIncludingChildren(acl.getObjectIdentity());
-
-		// Retrieve the ACL via superclass (ensures cache registration, proper retrieval
-		// etc)
-		return (MutableAcl) super.readAclById(acl.getObjectIdentity());
-	}
-
-	private void clearCacheIncludingChildren(ObjectIdentity objectIdentity) {
-		Assert.notNull(objectIdentity, "ObjectIdentity required");
-		List<ObjectIdentity> children = findChildren(objectIdentity);
-		if (children != null) {
-			for (ObjectIdentity child : children) {
-				clearCacheIncludingChildren(child);
-			}
-		}
-		aclCache.evictFromCache(objectIdentity);
-	}
-
-	/**
-	 * Updates an existing acl_object_identity row, with new information presented in the
-	 * passed MutableAcl object. Also will create an acl_sid entry if needed for the Sid
-	 * that owns the MutableAcl.
-	 *
-	 * @param acl to modify (a row must already exist in acl_object_identity)
-	 *
-	 * @throws NotFoundException if the ACL could not be found to update.
-	 */
-	protected void updateObjectIdentity(MutableAcl acl) {
-		Long parentId = null;
-
-		if (acl.getParentAcl() != null) {
-			Assert.isInstanceOf(ObjectIdentityImpl.class, acl.getParentAcl()
-					.getObjectIdentity(),
-					"Implementation only supports ObjectIdentityImpl");
-
-			ObjectIdentityImpl oii = (ObjectIdentityImpl) acl.getParentAcl()
-					.getObjectIdentity();
-			parentId = retrieveObjectIdentityPrimaryKey(oii);
-		}
-
-		Assert.notNull(acl.getOwner(), "Owner is required in this implementation");
-
-		Long ownerSid = createOrRetrieveSidPrimaryKey(acl.getOwner(), true);
-		int count = jdbcTemplate.update(updateObjectIdentity, parentId, ownerSid,
-				Boolean.valueOf(acl.isEntriesInheriting()), acl.getId());
-
-		if (count != 1) {
-			throw new NotFoundException("Unable to locate ACL to update");
-		}
-	}
-
-	/**
-	 * Sets the query that will be used to retrieve the identity of a newly created row in
-	 * the <tt>acl_class</tt> table.
-	 *
-	 * @param classIdentityQuery the query, which should return the identifier. Defaults
-	 * to <tt>call identity()</tt>
-	 */
-	public void setClassIdentityQuery(String classIdentityQuery) {
-		Assert.hasText(classIdentityQuery, "New classIdentityQuery query is required");
-		this.classIdentityQuery = classIdentityQuery;
-	}
-
-	/**
-	 * Sets the query that will be used to retrieve the identity of a newly created row in
-	 * the <tt>acl_sid</tt> table.
-	 *
-	 * @param sidIdentityQuery the query, which should return the identifier. Defaults to
-	 * <tt>call identity()</tt>
-	 */
-	public void setSidIdentityQuery(String sidIdentityQuery) {
-		Assert.hasText(sidIdentityQuery, "New sidIdentityQuery query is required");
-		this.sidIdentityQuery = sidIdentityQuery;
-	}
-
-	public void setDeleteEntryByObjectIdentityForeignKeySql(
-			String deleteEntryByObjectIdentityForeignKey) {
-		this.deleteEntryByObjectIdentityForeignKey = deleteEntryByObjectIdentityForeignKey;
-	}
-
-	public void setDeleteObjectIdentityByPrimaryKeySql(
-			String deleteObjectIdentityByPrimaryKey) {
-		this.deleteObjectIdentityByPrimaryKey = deleteObjectIdentityByPrimaryKey;
-	}
-
-	public void setInsertClassSql(String insertClass) {
-		this.insertClass = insertClass;
-	}
-
-	public void setInsertEntrySql(String insertEntry) {
-		this.insertEntry = insertEntry;
-	}
-
-	public void setInsertObjectIdentitySql(String insertObjectIdentity) {
-		this.insertObjectIdentity = insertObjectIdentity;
-	}
-
-	public void setInsertSidSql(String insertSid) {
-		this.insertSid = insertSid;
-	}
-
-	public void setClassPrimaryKeyQuery(String selectClassPrimaryKey) {
-		this.selectClassPrimaryKey = selectClassPrimaryKey;
-	}
-
-	public void setObjectIdentityPrimaryKeyQuery(String selectObjectIdentityPrimaryKey) {
-		this.selectObjectIdentityPrimaryKey = selectObjectIdentityPrimaryKey;
-	}
-
-	public void setSidPrimaryKeyQuery(String selectSidPrimaryKey) {
-		this.selectSidPrimaryKey = selectSidPrimaryKey;
-	}
-
-	public void setUpdateObjectIdentity(String updateObjectIdentity) {
-		this.updateObjectIdentity = updateObjectIdentity;
-	}
-
-	/**
-	 * @param foreignKeysInDatabase if false this class will perform additional FK
-	 * constrain checking, which may cause deadlocks (the default is true, so deadlocks
-	 * are avoided but the database is expected to enforce FKs)
+	 * @param foreignKeysInDatabase if false this class will perform additional FK constrain checking, which may
+	 * cause deadlocks (the default is true, so deadlocks are avoided but the database is expected to enforce FKs)
 	 */
 	public void setForeignKeysInDatabase(boolean foreignKeysInDatabase) {
 		this.foreignKeysInDatabase = foreignKeysInDatabase;

acl/src/main/java/org/springframework/security/acls/jdbc/LookupStrategy.java

@@ -14,35 +14,33 @@
  */
 package org.springframework.security.acls.jdbc;
 
-import org.springframework.security.acls.model.Acl;
-import org.springframework.security.acls.model.NotFoundException;
-import org.springframework.security.acls.model.ObjectIdentity;
-import org.springframework.security.acls.model.Sid;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.sid.Sid;
 
-import java.util.List;
 import java.util.Map;
 
+
 /**
- * Performs lookups for {@link org.springframework.security.acls.model.AclService}.
- *
+ * Performs lookups for {@link org.springframework.security.acls.AclService}.
+ * 
  * @author Ben Alex
+ * @version $Id$
  */
 public interface LookupStrategy {
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	/**
-	 * Perform database-specific optimized lookup.
-	 *
-	 * @param objects the identities to lookup (required)
-	 * @param sids the SIDs for which identities are required (may be <tt>null</tt> -
-	 * implementations may elect not to provide SID optimisations)
-	 *
-	 * @return a <tt>Map</tt> where keys represent the {@link ObjectIdentity} of the
-	 * located {@link Acl} and values are the located {@link Acl} (never <tt>null</tt>
-	 * although some entries may be missing; this method should not throw
-	 * {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used to
-	 * automatically create entries if required)
-	 */
-	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids);
+    /**
+     * Perform database-specific optimized lookup.
+     *
+     * @param objects the identities to lookup (required)
+     * @param sids the SIDs for which identities are required (may be <tt>null</tt> - implementations may elect not
+     *        to provide SID optimisations)
+     *
+     * @return a <tt>Map</tt> where keys represent the {@link ObjectIdentity} of the located {@link Acl} and values
+     *         are the located {@link Acl} (never <tt>null</tt> although some entries may be missing; this method
+     *         should not throw {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used
+     *         to automatically create entries if required) 
+     */
+    Map readAclsById(ObjectIdentity[] objects, Sid[] sids);
 }

acl/src/main/java/org/springframework/security/acls/jdbc/package-info.java

@@ -1,5 +0,0 @@
-/**
- * JDBC-based persistence of ACL information
- */
-package org.springframework.security.acls.jdbc;
-

acl/src/main/java/org/springframework/security/acls/jdbc/package.html

@@ -0,0 +1,5 @@
+<html>
+<body>
+JDBC-based persistence of ACL information.
+</body>
+</html>

acl/src/main/java/org/springframework/security/acls/model/AccessControlEntry.java

@@ -1,54 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * Represents an individual permission assignment within an {@link Acl}.
- *
- * <p>
- * Instances MUST be immutable, as they are returned by <code>Acl</code> and should not
- * allow client modification.
- * </p>
- *
- * @author Ben Alex
- *
- */
-public interface AccessControlEntry extends Serializable {
-	// ~ Methods
-	// ========================================================================================================
-
-	Acl getAcl();
-
-	/**
-	 * Obtains an identifier that represents this ACE.
-	 *
-	 * @return the identifier, or <code>null</code> if unsaved
-	 */
-	Serializable getId();
-
-	Permission getPermission();
-
-	Sid getSid();
-
-	/**
-	 * Indicates the a Permission is being granted to the relevant Sid. If false,
-	 * indicates the permission is being revoked/blocked.
-	 *
-	 * @return true if being granted, false otherwise
-	 */
-	boolean isGranting();
-}

acl/src/main/java/org/springframework/security/acls/model/Acl.java

@@ -1,201 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-import java.util.List;
-
-/**
- * Represents an access control list (ACL) for a domain object.
- *
- * <p>
- * An <tt>Acl</tt> represents all ACL entries for a given domain object. In order to avoid
- * needing references to the domain object itself, this interface handles indirection
- * between a domain object and an ACL object identity via the
- * {@link org.springframework.security.acls.model.ObjectIdentity} interface.
- * </p>
- *
- * <p>
- * Implementing classes may elect to return instances that represent
- * {@link org.springframework.security.acls.model.Permission} information for either some
- * OR all {@link org.springframework.security.acls.model.Sid} instances. Therefore, an
- * instance may NOT necessarily contain ALL <tt>Sid</tt>s for a given domain object.
- * </p>
- *
- * @author Ben Alex
- */
-public interface Acl extends Serializable {
-
-	/**
-	 * Returns all of the entries represented by the present <tt>Acl</tt>. Entries
-	 * associated with the <tt>Acl</tt> parents are not returned.
-	 *
-	 * <p>
-	 * This method is typically used for administrative purposes.
-	 * </p>
-	 *
-	 * <p>
-	 * The order that entries appear in the array is important for methods declared in the
-	 * {@link MutableAcl} interface. Furthermore, some implementations MAY use ordering as
-	 * part of advanced permission checking.
-	 * </p>
-	 *
-	 * <p>
-	 * Do <em>NOT</em> use this method for making authorization decisions. Instead use
-	 * {@link #isGranted(List, List, boolean)}.
-	 * </p>
-	 *
-	 * <p>
-	 * This method must operate correctly even if the <tt>Acl</tt> only represents a
-	 * subset of <tt>Sid</tt>s. The caller is responsible for correctly handling the
-	 * result if only a subset of <tt>Sid</tt>s is represented.
-	 * </p>
-	 *
-	 * @return the list of entries represented by the <tt>Acl</tt>, or <tt>null</tt> if
-	 * there are no entries presently associated with this <tt>Acl</tt>.
-	 */
-	List<AccessControlEntry> getEntries();
-
-	/**
-	 * Obtains the domain object this <tt>Acl</tt> provides entries for. This is immutable
-	 * once an <tt>Acl</tt> is created.
-	 *
-	 * @return the object identity (never <tt>null</tt>)
-	 */
-	ObjectIdentity getObjectIdentity();
-
-	/**
-	 * Determines the owner of the <tt>Acl</tt>. The meaning of ownership varies by
-	 * implementation and is unspecified.
-	 *
-	 * @return the owner (may be <tt>null</tt> if the implementation does not use
-	 * ownership concepts)
-	 */
-	Sid getOwner();
-
-	/**
-	 * A domain object may have a parent for the purpose of ACL inheritance. If there is a
-	 * parent, its ACL can be accessed via this method. In turn, the parent's parent
-	 * (grandparent) can be accessed and so on.
-	 *
-	 * <p>
-	 * This method solely represents the presence of a navigation hierarchy between the
-	 * parent <tt>Acl</tt> and this <tt>Acl</tt>. For actual inheritance to take place,
-	 * the {@link #isEntriesInheriting()} must also be <tt>true</tt>.
-	 * </p>
-	 *
-	 * <p>
-	 * This method must operate correctly even if the <tt>Acl</tt> only represents a
-	 * subset of <tt>Sid</tt>s. The caller is responsible for correctly handling the
-	 * result if only a subset of <tt>Sid</tt>s is represented.
-	 * </p>
-	 *
-	 * @return the parent <tt>Acl</tt> (may be <tt>null</tt> if this <tt>Acl</tt> does not
-	 * have a parent)
-	 */
-	Acl getParentAcl();
-
-	/**
-	 * Indicates whether the ACL entries from the {@link #getParentAcl()} should flow down
-	 * into the current <tt>Acl</tt>.
-	 * <p>
-	 * The mere link between an <tt>Acl</tt> and a parent <tt>Acl</tt> on its own is
-	 * insufficient to cause ACL entries to inherit down. This is because a domain object
-	 * may wish to have entirely independent entries, but maintain the link with the
-	 * parent for navigation purposes. Thus, this method denotes whether or not the
-	 * navigation relationship also extends to the actual inheritance of entries.
-	 * </p>
-	 *
-	 * @return <tt>true</tt> if parent ACL entries inherit into the current <tt>Acl</tt>
-	 */
-	boolean isEntriesInheriting();
-
-	/**
-	 * This is the actual authorization logic method, and must be used whenever ACL
-	 * authorization decisions are required.
-	 *
-	 * <p>
-	 * An array of <tt>Sid</tt>s are presented, representing security identifies of the
-	 * current principal. In addition, an array of <tt>Permission</tt>s is presented which
-	 * will have one or more bits set in order to indicate the permissions needed for an
-	 * affirmative authorization decision. An array is presented because holding
-	 * <em>any</em> of the <tt>Permission</tt>s inside the array will be sufficient for an
-	 * affirmative authorization.
-	 * </p>
-	 *
-	 * <p>
-	 * The actual approach used to make authorization decisions is left to the
-	 * implementation and is not specified by this interface. For example, an
-	 * implementation <em>MAY</em> search the current ACL in the order the ACL entries
-	 * have been stored. If a single entry is found that has the same active bits as are
-	 * shown in a passed <tt>Permission</tt>, that entry's grant or deny state may
-	 * determine the authorization decision. If the case of a deny state, the deny
-	 * decision will only be relevant if all other <tt>Permission</tt>s passed in the
-	 * array have also been unsuccessfully searched. If no entry is found that match the
-	 * bits in the current ACL, provided that {@link #isEntriesInheriting()} is
-	 * <tt>true</tt>, the authorization decision may be passed to the parent ACL. If there
-	 * is no matching entry, the implementation MAY throw an exception, or make a
-	 * predefined authorization decision.
-	 * </p>
-	 *
-	 * <p>
-	 * This method must operate correctly even if the <tt>Acl</tt> only represents a
-	 * subset of <tt>Sid</tt>s, although the implementation is permitted to throw one of
-	 * the signature-defined exceptions if the method is called requesting an
-	 * authorization decision for a {@link Sid} that was never loaded in this <tt>Acl</tt>
-	 * .
-	 * </p>
-	 *
-	 * @param permission the permission or permissions required (at least one entry
-	 * required)
-	 * @param sids the security identities held by the principal (at least one entry
-	 * required)
-	 * @param administrativeMode if <tt>true</tt> denotes the query is for administrative
-	 * purposes and no logging or auditing (if supported by the implementation) should be
-	 * undertaken
-	 *
-	 * @return <tt>true</tt> if authorization is granted
-	 *
-	 * @throws NotFoundException MUST be thrown if an implementation cannot make an
-	 * authoritative authorization decision, usually because there is no ACL information
-	 * for this particular permission and/or SID
-	 * @throws UnloadedSidException thrown if the <tt>Acl</tt> does not have details for
-	 * one or more of the <tt>Sid</tt>s passed as arguments
-	 */
-	boolean isGranted(List<Permission> permission, List<Sid> sids,
-			boolean administrativeMode) throws NotFoundException, UnloadedSidException;
-
-	/**
-	 * For efficiency reasons an <tt>Acl</tt> may be loaded and <em>not</em> contain
-	 * entries for every <tt>Sid</tt> in the system. If an <tt>Acl</tt> has been loaded
-	 * and does not represent every <tt>Sid</tt>, all methods of the <tt>Acl</tt> can only
-	 * be used within the limited scope of the <tt>Sid</tt> instances it actually
-	 * represents.
-	 * <p>
-	 * It is normal to load an <tt>Acl</tt> for only particular <tt>Sid</tt>s if read-only
-	 * authorization decisions are being made. However, if user interface reporting or
-	 * modification of <tt>Acl</tt>s are desired, an <tt>Acl</tt> should be loaded with
-	 * all <tt>Sid</tt>s. This method denotes whether or not the specified <tt>Sid</tt>s
-	 * have been loaded or not.
-	 * </p>
-	 *
-	 * @param sids one or more security identities the caller is interest in knowing
-	 * whether this <tt>Sid</tt> supports
-	 *
-	 * @return <tt>true</tt> if every passed <tt>Sid</tt> is represented by this
-	 * <tt>Acl</tt> instance
-	 */
-	boolean isSidLoaded(List<Sid> sids);
-}

acl/src/main/java/org/springframework/security/acls/model/AclCache.java

@@ -1,42 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import org.springframework.security.acls.jdbc.JdbcAclService;
-
-import java.io.Serializable;
-
-/**
- * A caching layer for {@link JdbcAclService}.
- *
- * @author Ben Alex
- *
- */
-public interface AclCache {
-	// ~ Methods
-	// ========================================================================================================
-
-	void evictFromCache(Serializable pk);
-
-	void evictFromCache(ObjectIdentity objectIdentity);
-
-	MutableAcl getFromCache(ObjectIdentity objectIdentity);
-
-	MutableAcl getFromCache(Serializable pk);
-
-	void putInCache(MutableAcl acl);
-
-	void clearCache();
-}

acl/src/main/java/org/springframework/security/acls/model/AclDataAccessException.java

@@ -1,31 +0,0 @@
-package org.springframework.security.acls.model;
-
-/**
- * Abstract base class for Acl data operations.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public abstract class AclDataAccessException extends RuntimeException {
-
-	/**
-	 * Constructs an <code>AclDataAccessException</code> with the specified message and
-	 * root cause.
-	 *
-	 * @param msg the detail message
-	 * @param cause the root cause
-	 */
-	public AclDataAccessException(String msg, Throwable cause) {
-		super(msg, cause);
-	}
-
-	/**
-	 * Constructs an <code>AclDataAccessException</code> with the specified message and no
-	 * root cause.
-	 *
-	 * @param msg the detail message
-	 */
-	public AclDataAccessException(String msg) {
-		super(msg);
-	}
-}

acl/src/main/java/org/springframework/security/acls/model/AclService.java

@@ -1,118 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.util.List;
-import java.util.Map;
-
-/**
- * Provides retrieval of {@link Acl} instances.
- *
- * @author Ben Alex
- */
-public interface AclService {
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Locates all object identities that use the specified parent. This is useful for
-	 * administration tools.
-	 *
-	 * @param parentIdentity to locate children of
-	 *
-	 * @return the children (or <tt>null</tt> if none were found)
-	 */
-	List<ObjectIdentity> findChildren(ObjectIdentity parentIdentity);
-
-	/**
-	 * Same as {@link #readAclsById(List)} except it returns only a single Acl.
-	 * <p>
-	 * This method should not be called as it does not leverage the underlying
-	 * implementation's potential ability to filter <tt>Acl</tt> entries based on a
-	 * {@link Sid} parameter.
-	 * </p>
-	 *
-	 * @param object to locate an {@link Acl} for
-	 *
-	 * @return the {@link Acl} for the requested {@link ObjectIdentity} (never
-	 * <tt>null</tt>)
-	 *
-	 * @throws NotFoundException if an {@link Acl} was not found for the requested
-	 * {@link ObjectIdentity}
-	 */
-	Acl readAclById(ObjectIdentity object) throws NotFoundException;
-
-	/**
-	 * Same as {@link #readAclsById(List, List)} except it returns only a single Acl.
-	 *
-	 * @param object to locate an {@link Acl} for
-	 * @param sids the security identities for which {@link Acl} information is required
-	 * (may be <tt>null</tt> to denote all entries)
-	 *
-	 * @return the {@link Acl} for the requested {@link ObjectIdentity} (never
-	 * <tt>null</tt>)
-	 *
-	 * @throws NotFoundException if an {@link Acl} was not found for the requested
-	 * {@link ObjectIdentity}
-	 */
-	Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException;
-
-	/**
-	 * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s.
-	 * <p>
-	 * The returned map is keyed on the passed objects, with the values being the
-	 * <tt>Acl</tt> instances. Any unknown objects will not have a map key.
-	 * </p>
-	 *
-	 * @param objects the objects to find {@link Acl} information for
-	 *
-	 * @return a map with exactly one element for each {@link ObjectIdentity} passed as an
-	 * argument (never <tt>null</tt>)
-	 *
-	 * @throws NotFoundException if an {@link Acl} was not found for each requested
-	 * {@link ObjectIdentity}
-	 */
-	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects)
-			throws NotFoundException;
-
-	/**
-	 * Obtains all the <tt>Acl</tt>s that apply for the passed <tt>Object</tt>s, but only
-	 * for the security identifies passed.
-	 * <p>
-	 * Implementations <em>MAY</em> provide a subset of the ACLs via this method although
-	 * this is NOT a requirement. This is intended to allow performance optimisations
-	 * within implementations. Callers should therefore use this method in preference to
-	 * the alternative overloaded version which does not have performance optimisation
-	 * opportunities.
-	 * </p>
-	 * <p>
-	 * The returned map is keyed on the passed objects, with the values being the
-	 * <tt>Acl</tt> instances. Any unknown objects (or objects for which the interested
-	 * <tt>Sid</tt>s do not have entries) will not have a map key.
-	 * </p>
-	 *
-	 * @param objects the objects to find {@link Acl} information for
-	 * @param sids the security identities for which {@link Acl} information is required
-	 * (may be <tt>null</tt> to denote all entries)
-	 *
-	 * @return a map with exactly one element for each {@link ObjectIdentity} passed as an
-	 * argument (never <tt>null</tt>)
-	 *
-	 * @throws NotFoundException if an {@link Acl} was not found for each requested
-	 * {@link ObjectIdentity}
-	 */
-	Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids)
-			throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/AlreadyExistsException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * Thrown if an <code>Acl</code> entry already exists for the object.
- *
- * @author Ben Alex
- */
-public class AlreadyExistsException extends AclDataAccessException {
-	// ~ Constructors
-	// ===================================================================================================
-
-	/**
-	 * Constructs an <code>AlreadyExistsException</code> with the specified message.
-	 *
-	 * @param msg the detail message
-	 */
-	public AlreadyExistsException(String msg) {
-		super(msg);
-	}
-
-	/**
-	 * Constructs an <code>AlreadyExistsException</code> with the specified message and
-	 * root cause.
-	 *
-	 * @param msg the detail message
-	 * @param t root cause
-	 */
-	public AlreadyExistsException(String msg, Throwable t) {
-		super(msg, t);
-	}
-}

acl/src/main/java/org/springframework/security/acls/model/AuditableAcl.java

@@ -1,28 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * A mutable ACL that provides audit capabilities.
- *
- * @author Ben Alex
- *
- */
-public interface AuditableAcl extends MutableAcl {
-	// ~ Methods
-	// ========================================================================================================
-
-	void updateAuditing(int aceIndex, boolean auditSuccess, boolean auditFailure);
-}

acl/src/main/java/org/springframework/security/acls/model/ChildrenExistException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * Thrown if an {@link Acl} cannot be deleted because children <code>Acl</code>s exist.
- *
- * @author Ben Alex
- */
-public class ChildrenExistException extends AclDataAccessException {
-	// ~ Constructors
-	// ===================================================================================================
-
-	/**
-	 * Constructs an <code>ChildrenExistException</code> with the specified message.
-	 *
-	 * @param msg the detail message
-	 */
-	public ChildrenExistException(String msg) {
-		super(msg);
-	}
-
-	/**
-	 * Constructs an <code>ChildrenExistException</code> with the specified message and
-	 * root cause.
-	 *
-	 * @param msg the detail message
-	 * @param t root cause
-	 */
-	public ChildrenExistException(String msg, Throwable t) {
-		super(msg, t);
-	}
-}

acl/src/main/java/org/springframework/security/acls/model/MutableAcl.java

@@ -1,65 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * A mutable <tt>Acl</tt>.
- * <p>
- * A mutable ACL must ensure that appropriate security checks are performed before
- * allowing access to its methods.
- *
- * @author Ben Alex
- */
-public interface MutableAcl extends Acl {
-	// ~ Methods
-	// ========================================================================================================
-
-	void deleteAce(int aceIndex) throws NotFoundException;
-
-	/**
-	 * Obtains an identifier that represents this <tt>MutableAcl</tt>.
-	 *
-	 * @return the identifier, or <tt>null</tt> if unsaved
-	 */
-	Serializable getId();
-
-	void insertAce(int atIndexLocation, Permission permission, Sid sid, boolean granting)
-			throws NotFoundException;
-
-	/**
-	 * Changes the present owner to a different owner.
-	 *
-	 * @param newOwner the new owner (mandatory; cannot be null)
-	 */
-	void setOwner(Sid newOwner);
-
-	/**
-	 * Change the value returned by {@link Acl#isEntriesInheriting()}.
-	 *
-	 * @param entriesInheriting the new value
-	 */
-	void setEntriesInheriting(boolean entriesInheriting);
-
-	/**
-	 * Changes the parent of this ACL.
-	 *
-	 * @param newParent the new parent
-	 */
-	void setParent(Acl newParent);
-
-	void updateAce(int aceIndex, Permission permission) throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/MutableAclService.java

@@ -1,60 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * Provides support for creating and storing <code>Acl</code> instances.
- *
- * @author Ben Alex
- */
-public interface MutableAclService extends AclService {
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Creates an empty <code>Acl</code> object in the database. It will have no entries.
-	 * The returned object will then be used to add entries.
-	 *
-	 * @param objectIdentity the object identity to create
-	 *
-	 * @return an ACL object with its ID set
-	 *
-	 * @throws AlreadyExistsException if the passed object identity already has a record
-	 */
-	MutableAcl createAcl(ObjectIdentity objectIdentity) throws AlreadyExistsException;
-
-	/**
-	 * Removes the specified entry from the database.
-	 *
-	 * @param objectIdentity the object identity to remove
-	 * @param deleteChildren whether to cascade the delete to children
-	 *
-	 * @throws ChildrenExistException if the deleteChildren argument was
-	 * <code>false</code> but children exist
-	 */
-	void deleteAcl(ObjectIdentity objectIdentity, boolean deleteChildren)
-			throws ChildrenExistException;
-
-	/**
-	 * Changes an existing <code>Acl</code> in the database.
-	 *
-	 * @param acl to modify
-	 *
-	 * @throws NotFoundException if the relevant record could not be found (did you
-	 * remember to use {@link #createAcl(ObjectIdentity)} to create the object, rather
-	 * than creating it with the <code>new</code> keyword?)
-	 */
-	MutableAcl updateAcl(MutableAcl acl) throws NotFoundException;
-}

acl/src/main/java/org/springframework/security/acls/model/NotFoundException.java

@@ -1,45 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * Thrown if an ACL-related object cannot be found.
- *
- * @author Ben Alex
- */
-public class NotFoundException extends AclDataAccessException {
-	// ~ Constructors
-	// ===================================================================================================
-
-	/**
-	 * Constructs an <code>NotFoundException</code> with the specified message.
-	 *
-	 * @param msg the detail message
-	 */
-	public NotFoundException(String msg) {
-		super(msg);
-	}
-
-	/**
-	 * Constructs an <code>NotFoundException</code> with the specified message and root
-	 * cause.
-	 *
-	 * @param msg the detail message
-	 * @param t root cause
-	 */
-	public NotFoundException(String msg, Throwable t) {
-		super(msg, t);
-	}
-}

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java

@@ -1,74 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * Represents the identity of an individual domain object instance.
- *
- * <p>
- * As implementations of <tt>ObjectIdentity</tt> are used as the key to represent domain
- * objects in the ACL subsystem, it is essential that implementations provide methods so
- * that object-equality rather than reference-equality can be relied upon reliably. In
- * other words, the ACL subsystem can consider two <tt>ObjectIdentity</tt>s equal if
- * <tt>identity1.equals(identity2)</tt>, rather than reference-equality of
- * <tt>identity1==identity2</tt>.
- * </p>
- *
- * @author Ben Alex
- */
-public interface ObjectIdentity extends Serializable {
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * @param obj to be compared
-	 *
-	 * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
-	 * @see Object#equals(Object)
-	 */
-	boolean equals(Object obj);
-
-	/**
-	 * Obtains the actual identifier. This identifier must not be reused to represent
-	 * other domain objects with the same <tt>javaType</tt>.
-	 *
-	 * <p>
-	 * Because ACLs are largely immutable, it is strongly recommended to use a synthetic
-	 * identifier (such as a database sequence number for the primary key). Do not use an
-	 * identifier with business meaning, as that business meaning may change in the future
-	 * such change will cascade to the ACL subsystem data.
-	 * </p>
-	 *
-	 * @return the identifier (unique within this <tt>type</tt>; never <tt>null</tt>)
-	 */
-	Serializable getIdentifier();
-
-	/**
-	 * Obtains the "type" metadata for the domain object. This will often be a Java type
-	 * name (an interface or a class) &ndash; traditionally it is the name of the domain
-	 * object implementation class.
-	 *
-	 * @return the "type" of the domain object (never <tt>null</tt>).
-	 */
-	String getType();
-
-	/**
-	 * @return a hash code representation of the <tt>ObjectIdentity</tt>
-	 * @see Object#hashCode()
-	 */
-	int hashCode();
-}

acl/src/main/java/org/springframework/security/acls/model/ObjectIdentityGenerator.java

@@ -1,26 +0,0 @@
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * Strategy which creates an {@link ObjectIdentity} from an object identifier (such as a
- * primary key) and type information.
- * <p>
- * Differs from {@link ObjectIdentityRetrievalStrategy} in that it is used in situations
- * when the actual object instance isn't available.
- *
- * @author Luke Taylor
- * @since 3.0
- */
-public interface ObjectIdentityGenerator {
-
-	/**
-	 *
-	 * @param id the identifier of the domain object, not null
-	 * @param type the type of the object (often a class name), not null
-	 * @return the identity constructed using the supplied identifier and type
-	 * information.
-	 */
-	ObjectIdentity createObjectIdentity(Serializable id, String type);
-
-}

acl/src/main/java/org/springframework/security/acls/model/OwnershipAcl.java

@@ -1,31 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * A mutable ACL that provides ownership capabilities.
- *
- * <p>
- * Generally the owner of an ACL is able to call any ACL mutator method, as well as assign
- * a new owner.
- *
- * @author Ben Alex
- */
-public interface OwnershipAcl extends MutableAcl {
-	// ~ Methods
-	// ========================================================================================================
-
-	void setOwner(Sid newOwner);
-}

acl/src/main/java/org/springframework/security/acls/model/Permission.java

@@ -1,62 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * Represents a permission granted to a <tt>Sid</tt> for a given domain object.
- *
- * @author Ben Alex
- */
-public interface Permission extends Serializable {
-	// ~ Static fields/initializers
-	// =====================================================================================
-
-	char RESERVED_ON = '~';
-	char RESERVED_OFF = '.';
-	String THIRTY_TWO_RESERVED_OFF = "................................";
-
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Returns the bits that represents the permission.
-	 *
-	 * @return the bits that represent the permission
-	 */
-	int getMask();
-
-	/**
-	 * Returns a 32-character long bit pattern <code>String</code> representing this
-	 * permission.
-	 * <p>
-	 * Implementations are free to format the pattern as they see fit, although under no
-	 * circumstances may {@link #RESERVED_OFF} or {@link #RESERVED_ON} be used within the
-	 * pattern. An exemption is in the case of {@link #RESERVED_OFF} which is used to
-	 * denote a bit that is off (clear). Implementations may also elect to use
-	 * {@link #RESERVED_ON} internally for computation purposes, although this method may
-	 * not return any <code>String</code> containing {@link #RESERVED_ON}.
-	 * <p>
-	 * The returned String must be 32 characters in length.
-	 * <p>
-	 * This method is only used for user interface and logging purposes. It is not used in
-	 * any permission calculations. Therefore, duplication of characters within the output
-	 * is permitted.
-	 *
-	 * @return a 32-character bit pattern
-	 */
-	String getPattern();
-}

acl/src/main/java/org/springframework/security/acls/model/PermissionGrantingStrategy.java

@@ -1,21 +0,0 @@
-package org.springframework.security.acls.model;
-
-import java.util.List;
-
-/**
- * Allow customization of the logic for determining whether a permission or permissions
- * are granted to a particular sid or sids by an {@link Acl}.
- *
- * @author Luke Taylor
- * @since 3.0.2
- */
-public interface PermissionGrantingStrategy {
-
-	/**
-	 * Returns true if the the supplied strategy decides that the supplied {@code Acl}
-	 * grants access based on the supplied list of permissions and sids.
-	 */
-	boolean isGranted(Acl acl, List<Permission> permission, List<Sid> sids,
-			boolean administrativeMode);
-
-}

acl/src/main/java/org/springframework/security/acls/model/Sid.java

@@ -1,53 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-import java.io.Serializable;
-
-/**
- * A security identity recognised by the ACL system.
- *
- * <p>
- * This interface provides indirection between actual security objects (eg principals,
- * roles, groups etc) and what is stored inside an <code>Acl</code>. This is because an
- * <code>Acl</code> will not store an entire security object, but only an abstraction of
- * it. This interface therefore provides a simple way to compare these abstracted security
- * identities with other security identities and actual security objects.
- * </p>
- *
- * @author Ben Alex
- */
-public interface Sid extends Serializable {
-	// ~ Methods
-	// ========================================================================================================
-
-	/**
-	 * Refer to the <code>java.lang.Object</code> documentation for the interface
-	 * contract.
-	 *
-	 * @param obj to be compared
-	 *
-	 * @return <code>true</code> if the objects are equal, <code>false</code> otherwise
-	 */
-	boolean equals(Object obj);
-
-	/**
-	 * Refer to the <code>java.lang.Object</code> documentation for the interface
-	 * contract.
-	 *
-	 * @return a hash code representation of this object
-	 */
-	int hashCode();
-}

acl/src/main/java/org/springframework/security/acls/model/SidRetrievalStrategy.java

@@ -1,33 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.acls.model;
-
-import java.util.List;
-
-import org.springframework.security.core.Authentication;
-
-/**
- * Strategy interface that provides an ability to determine the {@link Sid} instances
- * applicable for an {@link Authentication}.
- *
- * @author Ben Alex
- */
-public interface SidRetrievalStrategy {
-	// ~ Methods
-	// ========================================================================================================
-
-	List<Sid> getSids(Authentication authentication);
-}

acl/src/main/java/org/springframework/security/acls/model/UnloadedSidException.java

@@ -1,47 +0,0 @@
-/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *     http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.acls.model;
-
-/**
- * Thrown if an {@link Acl} cannot perform an operation because it only loaded a subset of
- * <code>Sid</code>s and the caller has requested details for an unloaded <code>Sid</code>
- * .
- *
- * @author Ben Alex
- */
-public class UnloadedSidException extends AclDataAccessException {
-	// ~ Constructors
-	// ===================================================================================================
-
-	/**
-	 * Constructs an <code>NotFoundException</code> with the specified message.
-	 *
-	 * @param msg the detail message
-	 */
-	public UnloadedSidException(String msg) {
-		super(msg);
-	}
-
-	/**
-	 * Constructs an <code>NotFoundException</code> with the specified message and root
-	 * cause.
-	 *
-	 * @param msg the detail message
-	 * @param t root cause
-	 */
-	public UnloadedSidException(String msg, Throwable t) {
-		super(msg, t);
-	}
-}

acl/src/main/java/org/springframework/security/acls/model/package-info.java

@@ -1,5 +0,0 @@
-/**
- * Interfaces and shared classes to manage access control lists (ACLs) for domain object instances.
- */
-package org.springframework.security.acls.model;
-

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentity.java

@@ -0,0 +1,72 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.objectidentity;
+
+import java.io.Serializable;
+
+
+/**
+ * Represents the identity of an individual domain object instance.
+ *
+ * <p>
+ * As implementations of <tt>ObjectIdentity</tt> are used as the key to represent 
+ * domain objects in the ACL subsystem, it is essential that implementations provide
+ * methods so that object-equality rather than reference-equality can be relied upon
+ * reliably. In other words, the ACL subsystem can consider two 
+ * <tt>ObjectIdentity</tt>s equal if <tt>identity1.equals(identity2)</tt>, rather than 
+ * reference-equality of <tt>identity1==identity2</tt>.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface ObjectIdentity extends Serializable {
+    //~ Methods ========================================================================================================
+
+    /**
+     * @param obj to be compared
+     *
+     * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
+     * @see Object#equals(Object)
+     */
+    boolean equals(Object obj);
+
+    /**
+     * Obtains the actual identifier. This identifier must not be reused to represent other domain objects with
+     * the same <tt>javaType</tt>.
+     * 
+     * <p>Because ACLs are largely immutable, it is strongly recommended to use
+     * a synthetic identifier (such as a database sequence number for the primary key). Do not use an identifier with
+     * business meaning, as that business meaning may change in the future such change will cascade to the ACL 
+     * subsystem data.</p>
+     *
+     * @return the identifier (unique within this <tt>javaType</tt>; never <tt>null</tt>)
+     */
+    Serializable getIdentifier();
+
+    /**
+     * Obtains the Java type represented by the domain object. The Java type can be an interface or a class, but is
+     * most often the domain object implementation class.
+     *
+     * @return the Java type of the domain object (never <tt>null</tt>)
+     */
+    Class getJavaType();
+
+    /**
+     * @return a hash code representation of the <tt>ObjectIdentity</tt>
+     * @see Object#hashCode()
+     */
+    int hashCode();
+}

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityImpl.java

@@ -0,0 +1,159 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.objectidentity;
+
+import org.springframework.security.acls.IdentityUnavailableException;
+import org.springframework.security.acls.jdbc.LookupStrategy;
+
+import org.springframework.util.Assert;
+import org.springframework.util.ClassUtils;
+import org.springframework.util.ReflectionUtils;
+
+import java.io.Serializable;
+
+import java.lang.reflect.Method;
+
+
+/**
+ * Simple implementation of {@link ObjectIdentity}.
+ * <p>
+ * Uses <code>String</code>s to store the identity of the domain object instance. Also offers a constructor that uses
+ * reflection to build the identity information.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class ObjectIdentityImpl implements ObjectIdentity {
+    //~ Instance fields ================================================================================================
+
+    private Class javaType;
+    private Serializable identifier;
+
+    //~ Constructors ===================================================================================================
+
+    public ObjectIdentityImpl(String javaType, Serializable identifier) {
+        Assert.hasText(javaType, "Java Type required");
+        Assert.notNull(identifier, "identifier required");
+
+        try {
+            this.javaType = Class.forName(javaType);
+        } catch (Exception ex) {
+            ReflectionUtils.handleReflectionException(ex);
+        }
+
+        this.identifier = identifier;
+    }
+
+    public ObjectIdentityImpl(Class javaType, Serializable identifier) {
+        Assert.notNull(javaType, "Java Type required");
+        Assert.notNull(identifier, "identifier required");
+        this.javaType = javaType;
+        this.identifier = identifier;
+    }
+
+/**
+     * Creates the <code>ObjectIdentityImpl</code> based on the passed
+     * object instance. The passed object must provide a <code>getId()</code>
+     * method, otherwise an exception will be thrown. The object passed will
+     * be considered the {@link #javaType}, so if more control is required,
+     * an alternate constructor should be used instead.
+     *
+     * @param object the domain object instance to create an identity for
+     *
+     * @throws IdentityUnavailableException if identity could not be extracted
+     */
+    public ObjectIdentityImpl(Object object) throws IdentityUnavailableException {
+        Assert.notNull(object, "object cannot be null");
+
+        this.javaType = ClassUtils.getUserClass(object.getClass());
+
+        Object result;
+
+        try {
+            Method method = this.javaType.getMethod("getId", new Class[] {});
+            result = method.invoke(object, new Object[] {});
+        } catch (Exception e) {
+            throw new IdentityUnavailableException("Could not extract identity from object " + object, e);
+        }
+
+        Assert.notNull(result, "getId() is required to return a non-null value");
+        Assert.isInstanceOf(Serializable.class, result, "Getter must provide a return value of type Serializable");
+        this.identifier = (Serializable) result;
+    }
+
+    //~ Methods ========================================================================================================
+
+    /**
+     * Important so caching operates properly.<P>Considers an object of the same class equal if it has the same
+     * <code>classname</code> and <code>id</code> properties.</p>
+     * 
+     * <p>
+     * Note that this class uses string equality for the identifier field, which ensures it better supports
+     * differences between {@link LookupStrategy} requirements and the domain object represented by this
+     * <code>ObjectIdentityImpl</code>.
+     * </p>
+     *
+     * @param arg0 object to compare
+     *
+     * @return <code>true</code> if the presented object matches this object
+     */
+    public boolean equals(Object arg0) {
+        if (arg0 == null) {
+            return false;
+        }
+
+        if (!(arg0 instanceof ObjectIdentityImpl)) {
+            return false;
+        }
+
+        ObjectIdentityImpl other = (ObjectIdentityImpl) arg0;
+
+        if (this.getIdentifier().toString().equals(other.getIdentifier().toString()) && this.getJavaType().equals(other.getJavaType())) {
+            return true;
+        }
+
+        return false;
+    }
+
+    public Serializable getIdentifier() {
+        return identifier;
+    }
+
+    public Class getJavaType() {
+        return javaType;
+    }
+
+    /**
+     * Important so caching operates properly.
+     *
+     * @return the hash
+     */
+    public int hashCode() {
+        int code = 31;
+        code ^= this.javaType.hashCode();
+        code ^= this.identifier.hashCode();
+
+        return code;
+    }
+
+    public String toString() {
+        StringBuffer sb = new StringBuffer();
+        sb.append(this.getClass().getName()).append("[");
+        sb.append("Java Type: ").append(this.javaType.getName());
+        sb.append("; Identifier: ").append(this.identifier).append("]");
+
+        return sb.toString();
+    }
+}

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategy.java

@@ -13,18 +13,18 @@
  * limitations under the License.
  */
 
-package org.springframework.security.acls.model;
+package org.springframework.security.acls.objectidentity;
 
 /**
  * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
  * will be returned for a particular domain object
  *
  * @author Ben Alex
+ * @version $Id$
  *
  */
 public interface ObjectIdentityRetrievalStrategy {
-	// ~ Methods
-	// ========================================================================================================
+    //~ Methods ========================================================================================================
 
-	ObjectIdentity getObjectIdentity(Object domainObject);
+    ObjectIdentity getObjectIdentity(Object domainObject);
 }

acl/src/main/java/org/springframework/security/acls/objectidentity/ObjectIdentityRetrievalStrategyImpl.java

@@ -0,0 +1,31 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.objectidentity;
+
+/**
+ * Basic implementation of {@link ObjectIdentityRetrievalStrategy} that uses the constructor of {@link
+ * ObjectIdentityImpl} to create the {@link ObjectIdentity}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class ObjectIdentityRetrievalStrategyImpl implements ObjectIdentityRetrievalStrategy {
+    //~ Methods ========================================================================================================
+
+    public ObjectIdentity getObjectIdentity(Object domainObject) {
+        return new ObjectIdentityImpl(domainObject);
+    }
+}

acl/src/main/java/org/springframework/security/acls/objectidentity/package.html

@@ -0,0 +1,5 @@
+<html>
+<body>
+Provides indirection between ACL packages and domain objects.
+</body>
+</html>

acl/src/main/java/org/springframework/security/acls/package-info.java

@@ -1,9 +0,0 @@
-/**
- * The Spring Security ACL package which implements instance-based security for domain objects.
- * <p>
- * Consider using the annotation based approach ({@code @PreAuthorize}, {@code @PostFilter} annotations) combined
- * with a {@link org.springframework.security.acls.AclPermissionEvaluator} in preference to the older and more verbose
- * attribute/voter/after-invocation approach from versions before Spring Security 3.0.
- */
-package org.springframework.security.acls;
-

acl/src/main/java/org/springframework/security/acls/package.html

@@ -0,0 +1,5 @@
+<html>
+<body>
+Interfaces and shared classes to manage access control lists (ACLs) for domain object instances.
+</body>
+</html>

acl/src/main/java/org/springframework/security/acls/sid/GrantedAuthoritySid.java

@@ -0,0 +1,71 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.sid;
+
+import org.springframework.security.GrantedAuthority;
+
+import org.springframework.util.Assert;
+
+
+/**
+ * Represents a <code>GrantedAuthority</code> as a <code>Sid</code>.<p>This is a basic implementation that simply
+ * uses the <code>String</code>-based principal for <code>Sid</code> comparison. More complex principal objects may
+ * wish to provide an alternative <code>Sid</code> implementation that uses some other identifier.</p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class GrantedAuthoritySid implements Sid {
+    //~ Instance fields ================================================================================================
+
+    private String grantedAuthority;
+
+    //~ Constructors ===================================================================================================
+
+    public GrantedAuthoritySid(String grantedAuthority) {
+        Assert.hasText(grantedAuthority, "GrantedAuthority required");
+        this.grantedAuthority = grantedAuthority;
+    }
+
+    public GrantedAuthoritySid(GrantedAuthority grantedAuthority) {
+        Assert.notNull(grantedAuthority, "GrantedAuthority required");
+        Assert.notNull(grantedAuthority.getAuthority(),
+            "This Sid is only compatible with GrantedAuthoritys that provide a non-null getAuthority()");
+        this.grantedAuthority = grantedAuthority.getAuthority();
+    }
+
+    //~ Methods ========================================================================================================
+
+    public boolean equals(Object object) {
+        if ((object == null) || !(object instanceof GrantedAuthoritySid)) {
+            return false;
+        }
+
+        // Delegate to getGrantedAuthority() to perform actual comparison (both should be identical)
+        return ((GrantedAuthoritySid) object).getGrantedAuthority().equals(this.getGrantedAuthority());
+    }
+
+    public int hashCode() {
+        return this.getGrantedAuthority().hashCode();
+    }
+
+    public String getGrantedAuthority() {
+        return grantedAuthority;
+    }
+
+    public String toString() {
+        return "GrantedAuthoritySid[" + this.grantedAuthority + "]";
+    }
+}

acl/src/main/java/org/springframework/security/acls/sid/PrincipalSid.java

@@ -0,0 +1,77 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.sid;
+
+import org.springframework.security.Authentication;
+
+import org.springframework.security.userdetails.UserDetails;
+
+import org.springframework.util.Assert;
+
+
+/**
+ * Represents an <code>Authentication.getPrincipal()</code> as a <code>Sid</code>.<p>This is a basic implementation
+ * that simply uses the <code>String</code>-based principal for <code>Sid</code> comparison. More complex principal
+ * objects may wish to provide an alternative <code>Sid</code> implementation that uses some other identifier.</p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class PrincipalSid implements Sid {
+    //~ Instance fields ================================================================================================
+
+    private String principal;
+
+    //~ Constructors ===================================================================================================
+
+    public PrincipalSid(String principal) {
+        Assert.hasText(principal, "Principal required");
+        this.principal = principal;
+    }
+
+    public PrincipalSid(Authentication authentication) {
+        Assert.notNull(authentication, "Authentication required");
+        Assert.notNull(authentication.getPrincipal(), "Principal required");
+
+        if (authentication.getPrincipal() instanceof UserDetails) {
+            this.principal = ((UserDetails) authentication.getPrincipal()).getUsername();
+        } else {
+            this.principal = authentication.getPrincipal().toString();
+        }
+    }
+
+    //~ Methods ========================================================================================================
+
+    public boolean equals(Object object) {
+        if ((object == null) || !(object instanceof PrincipalSid)) {
+            return false;
+        }
+
+        // Delegate to getPrincipal() to perform actual comparison (both should be identical)
+        return ((PrincipalSid) object).getPrincipal().equals(this.getPrincipal());
+    }
+
+    public int hashCode() {
+        return this.getPrincipal().hashCode();
+    }
+
+    public String getPrincipal() {
+        return principal;
+    }
+
+    public String toString() {
+        return "PrincipalSid[" + this.principal + "]";
+    }
+}

acl/src/main/java/org/springframework/security/acls/sid/Sid.java

@@ -0,0 +1,52 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.acls.sid;
+
+import java.io.Serializable;
+
+/**
+ * A security identity recognised by the ACL system.
+ *
+ * <p>
+ * This interface provides indirection between actual security objects (eg
+ * principals, roles, groups etc) and what is stored inside an
+ * <code>Acl</code>. This is because an <code>Acl</code> will not store an
+ * entire security object, but only an abstraction of it. This interface
+ * therefore provides a simple way to compare these abstracted security
+ * identities with other security identities and actual security objects.
+ * </p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface Sid extends Serializable {
+    //~ Methods ========================================================================================================
+
+    /**
+     * Refer to the <code>java.lang.Object</code> documentation for the interface contract.
+     *
+     * @param obj to be compared
+     *
+     * @return <code>true</code> if the objects are equal, <code>false</code> otherwise
+     */
+    boolean equals(Object obj);
+
+    /**
+     * Refer to the <code>java.lang.Object</code> documentation for the interface contract.
+     *
+     * @return a hash code representation of this object
+     */
+    int hashCode();
+}

acl/src/main/java/org/springframework/security/acls/sid/SidRetrievalStrategy.java

@@ -0,0 +1,32 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.sid;
+
+import org.springframework.security.Authentication;
+
+
+/**
+ * Strategy interface that provides an ability to determine the {@link Sid} instances applicable
+ * for an {@link Authentication}.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public interface SidRetrievalStrategy {
+    //~ Methods ========================================================================================================
+
+    Sid[] getSids(Authentication authentication);
+}

acl/src/main/java/org/springframework/security/acls/sid/SidRetrievalStrategyImpl.java

@@ -0,0 +1,45 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.acls.sid;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.GrantedAuthority;
+
+/**
+ * Basic implementation of {@link SidRetrievalStrategy} that creates a {@link Sid} for the principal, as well as
+ * every granted authority the principal holds.
+ * <p>
+ * The returned array will always contain the {@link PrincipalSid} before any {@link GrantedAuthoritySid} elements.
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class SidRetrievalStrategyImpl implements SidRetrievalStrategy {
+    //~ Methods ========================================================================================================
+
+    public Sid[] getSids(Authentication authentication) {
+        GrantedAuthority[] authorities = authentication.getAuthorities();
+        Sid[] sids = new Sid[authorities.length + 1];
+
+        sids[0] = new PrincipalSid(authentication);
+
+        for (int i = 1; i <= authorities.length; i++) {
+            sids[i] = new GrantedAuthoritySid(authorities[i - 1]);
+        }
+
+        return sids;
+    }
+}

acl/src/main/java/org/springframework/security/acls/sid/package.html

@@ -0,0 +1,5 @@
+<html>
+<body>
+Provides indirection between ACL packages and security identities, such as principals and GrantedAuthority[]s.
+</body>
+</html>

acl/src/main/java/org/springframework/security/afterinvocation/AbstractAclProvider.java

@@ -0,0 +1,126 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.afterinvocation;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.ConfigAttribute;
+
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AclService;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.domain.BasePermission;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategy;
+import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.sid.Sid;
+import org.springframework.security.acls.sid.SidRetrievalStrategy;
+import org.springframework.security.acls.sid.SidRetrievalStrategyImpl;
+
+import org.springframework.util.Assert;
+
+
+/**
+ * Abstract {@link AfterInvocationProvider} which provides commonly-used ACL-related services.
+ *
+ * @author Ben Alex
+ * @version $Id$
+  */
+public abstract class AbstractAclProvider implements AfterInvocationProvider {
+    //~ Instance fields ================================================================================================
+
+    protected AclService aclService;
+    protected Class processDomainObjectClass = Object.class;
+    protected ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
+    protected SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
+    protected String processConfigAttribute;
+    protected Permission[] requirePermission = {BasePermission.READ};
+
+    //~ Constructors ===================================================================================================
+
+    public AbstractAclProvider(AclService aclService, String processConfigAttribute, Permission[] requirePermission) {
+        Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
+        Assert.notNull(aclService, "An AclService is mandatory");
+
+        if ((requirePermission == null) || (requirePermission.length == 0)) {
+            throw new IllegalArgumentException("One or more requirePermission entries is mandatory");
+        }
+
+        this.aclService = aclService;
+        this.processConfigAttribute = processConfigAttribute;
+        this.requirePermission = requirePermission;
+    }
+
+    //~ Methods ========================================================================================================
+
+    protected Class getProcessDomainObjectClass() {
+        return processDomainObjectClass;
+    }
+
+    protected boolean hasPermission(Authentication authentication, Object domainObject) {
+        // Obtain the OID applicable to the domain object
+        ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
+
+        // Obtain the SIDs applicable to the principal
+        Sid[] sids = sidRetrievalStrategy.getSids(authentication);
+
+        Acl acl = null;
+
+        try {
+            // Lookup only ACLs for SIDs we're interested in
+            acl = aclService.readAclById(objectIdentity, sids);
+
+            return acl.isGranted(requirePermission, sids, false);
+        } catch (NotFoundException ignore) {
+            return false;
+        }
+    }
+
+    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
+        Assert.notNull(objectIdentityRetrievalStrategy, "ObjectIdentityRetrievalStrategy required");
+        this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
+    }
+
+    protected void setProcessConfigAttribute(String processConfigAttribute) {
+        Assert.hasText(processConfigAttribute, "A processConfigAttribute is mandatory");
+        this.processConfigAttribute = processConfigAttribute;
+    }
+
+    public void setProcessDomainObjectClass(Class processDomainObjectClass) {
+        Assert.notNull(processDomainObjectClass, "processDomainObjectClass cannot be set to null");
+        this.processDomainObjectClass = processDomainObjectClass;
+    }
+
+    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
+        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
+        this.sidRetrievalStrategy = sidRetrievalStrategy;
+    }
+
+    public boolean supports(ConfigAttribute attribute) {
+        return processConfigAttribute.equals(attribute.getAttribute());
+    }
+
+    /**
+     * This implementation supports any type of class, because it does not query the presented secure object.
+     *
+     * @param clazz the secure object
+     *
+     * @return always <code>true</code>
+     */
+    public boolean supports(Class clazz) {
+        return true;
+    }
+}

acl/src/main/java/org/springframework/security/afterinvocation/AclEntryAfterInvocationCollectionFilteringProvider.java

@@ -0,0 +1,135 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.afterinvocation;
+
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.Authentication;
+import org.springframework.security.AuthorizationServiceException;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+
+import org.springframework.security.acls.AclService;
+import org.springframework.security.acls.Permission;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import java.util.Collection;
+import java.util.Iterator;
+
+
+/**
+ * <p>
+ * Given a <code>Collection</code> of domain object instances returned from a secure object invocation, remove
+ * any <code>Collection</code> elements the principal does not have appropriate permission to access as defined by the
+ * {@link AclService}.
+ * <p>
+ * The <code>AclService</code> is used to retrieve the access control list (ACL) permissions associated with
+ * each <code>Collection</code> domain object instance element for the current <code>Authentication</code> object.
+ * <p>
+ * This after invocation provider will fire if any {@link ConfigAttribute#getAttribute()} matches the {@link
+ * #processConfigAttribute}. The provider will then lookup the ACLs from the <code>AclService</code> and ensure the
+ * principal is {@link org.springframework.security.acls.Acl#isGranted(org.springframework.security.acls.Permission[],
+ * org.springframework.security.acls.sid.Sid[], boolean) Acl.isGranted(Permission[], Sid[], boolean)}
+ * when presenting the {@link #requirePermission} array to that method.
+ * <p>
+ * If the principal does not have permission, that element will not be included in the returned
+ * <code>Collection</code>.
+ * <p>
+ * Often users will setup a <code>BasicAclEntryAfterInvocationProvider</code> with a {@link
+ * #processConfigAttribute} of <code>AFTER_ACL_COLLECTION_READ</code> and a {@link #requirePermission} of
+ * <code>BasePermission.READ</code>. These are also the defaults.
+ * <p>
+ * If the provided <code>returnObject</code> is <code>null</code>, a <code>null</code><code>Collection</code>
+ * will be returned. If the provided <code>returnObject</code> is not a <code>Collection</code>, an {@link
+ * AuthorizationServiceException} will be thrown.
+ * <p>
+ * All comparisons and prefixes are case sensitive.
+ *
+ * @author Ben Alex
+ * @author Paulo Neves
+ * @version $Id$
+ */
+public class AclEntryAfterInvocationCollectionFilteringProvider extends AbstractAclProvider {
+    //~ Static fields/initializers =====================================================================================
+
+    protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationCollectionFilteringProvider.class);
+
+    //~ Constructors ===================================================================================================
+
+    public AclEntryAfterInvocationCollectionFilteringProvider(AclService aclService, Permission[] requirePermission) {
+        super(aclService, "AFTER_ACL_COLLECTION_READ", requirePermission);
+    }
+
+    //~ Methods ========================================================================================================
+
+    public Object decide(Authentication authentication, Object object, ConfigAttributeDefinition config,
+            Object returnedObject) throws AccessDeniedException {
+
+        if (returnedObject == null) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Return object is null, skipping");
+            }
+
+            return null;
+        }
+
+        Iterator iter = config.getConfigAttributes().iterator();
+
+        while (iter.hasNext()) {
+            ConfigAttribute attr = (ConfigAttribute) iter.next();
+
+            if (!this.supports(attr)) {
+                continue;
+            }
+
+            // Need to process the Collection for this invocation
+            Filterer filterer;
+
+            if (returnedObject instanceof Collection) {
+                filterer = new CollectionFilterer((Collection) returnedObject);
+            } else if (returnedObject.getClass().isArray()) {
+                filterer = new ArrayFilterer((Object[]) returnedObject);
+            } else {
+                throw new AuthorizationServiceException("A Collection or an array (or null) was required as the "
+                        + "returnedObject, but the returnedObject was: " + returnedObject);
+            }
+
+            // Locate unauthorised Collection elements
+            Iterator collectionIter = filterer.iterator();
+
+            while (collectionIter.hasNext()) {
+                Object domainObject = collectionIter.next();
+
+                // Ignore nulls or entries which aren't instances of the configured domain object class
+                if (domainObject == null || !getProcessDomainObjectClass().isAssignableFrom(domainObject.getClass())) {
+                    continue;
+                }
+
+                if(!hasPermission(authentication, domainObject)) {
+                    filterer.remove(domainObject);
+
+                    if (logger.isDebugEnabled()) {
+                        logger.debug("Principal is NOT authorised for element: " + domainObject);
+                    }
+                }
+            }
+
+            return filterer.getFilteredObject();
+        }
+
+        return returnedObject;
+    }
+}

acl/src/main/java/org/springframework/security/afterinvocation/AclEntryAfterInvocationProvider.java

@@ -0,0 +1,125 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.afterinvocation;
+
+import org.springframework.security.AccessDeniedException;
+import org.springframework.security.SpringSecurityMessageSource;
+import org.springframework.security.Authentication;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+
+import org.springframework.security.acls.AclService;
+import org.springframework.security.acls.Permission;
+
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+
+import org.springframework.context.MessageSource;
+import org.springframework.context.MessageSourceAware;
+import org.springframework.context.support.MessageSourceAccessor;
+
+import java.util.Iterator;
+
+
+/**
+ * Given a domain object instance returned from a secure object invocation, ensures the principal has
+ * appropriate permission as defined by the {@link AclService}.
+ * <p>
+ * The <code>AclService</code> is used to retrieve the access control list (ACL) permissions associated with a
+ * domain object instance for the current <code>Authentication</code> object.
+ * <p>
+ * This after invocation provider will fire if any  {@link ConfigAttribute#getAttribute()} matches the {@link
+ * #processConfigAttribute}. The provider will then lookup the ACLs from the <tt>AclService</tt> and ensure the
+ * principal is {@link org.springframework.security.acls.Acl#isGranted(org.springframework.security.acls.Permission[],
+   org.springframework.security.acls.sid.Sid[], boolean) Acl.isGranted(Permission[], Sid[], boolean)}
+ * when presenting the {@link #requirePermission} array to that method.
+ * <p>
+ * Often users will setup an <code>AclEntryAfterInvocationProvider</code> with a {@link
+ * #processConfigAttribute} of <code>AFTER_ACL_READ</code> and a {@link #requirePermission} of
+ * <code>BasePermission.READ</code>. These are also the defaults.
+ * <p>
+ * If the principal does not have sufficient permissions, an <code>AccessDeniedException</code> will be thrown.
+ * <p>
+ * If the provided <tt>returnedObject</tt> is <code>null</code>, permission will always be granted and
+ * <code>null</code> will be returned.
+ * <p>
+ * All comparisons and prefixes are case sensitive.
+ */
+public class AclEntryAfterInvocationProvider extends AbstractAclProvider implements MessageSourceAware {
+    //~ Static fields/initializers =====================================================================================
+
+    protected static final Log logger = LogFactory.getLog(AclEntryAfterInvocationProvider.class);
+
+    //~ Instance fields ================================================================================================
+
+    protected MessageSourceAccessor messages = SpringSecurityMessageSource.getAccessor();
+
+    //~ Constructors ===================================================================================================
+
+    public AclEntryAfterInvocationProvider(AclService aclService, Permission[] requirePermission) {
+        super(aclService, "AFTER_ACL_READ", requirePermission);
+    }
+
+    //~ Methods ========================================================================================================
+
+    public Object decide(Authentication authentication, Object object, ConfigAttributeDefinition config,
+            Object returnedObject) throws AccessDeniedException {
+
+        Iterator iter = config.getConfigAttributes().iterator();
+
+        if (returnedObject == null) {
+            // AclManager interface contract prohibits nulls
+            // As they have permission to null/nothing, grant access
+            if (logger.isDebugEnabled()) {
+                logger.debug("Return object is null, skipping");
+            }
+
+            return null;
+        }
+
+        if (!getProcessDomainObjectClass().isAssignableFrom(returnedObject.getClass())) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("Return object is not applicable for this provider, skipping");
+            }
+
+            return returnedObject;
+        }        
+
+        while (iter.hasNext()) {
+            ConfigAttribute attr = (ConfigAttribute) iter.next();
+
+            if (!this.supports(attr)) {
+                continue;
+            }
+            // Need to make an access decision on this invocation
+
+            if (hasPermission(authentication, returnedObject)) {
+                return returnedObject;
+            }
+
+            logger.debug("Denying access");
+
+            throw new AccessDeniedException(messages.getMessage("BasicAclEntryAfterInvocationProvider.noPermission",
+                    new Object[] {authentication.getName(), returnedObject},
+                    "Authentication {0} has NO permissions to the domain object {1}"));
+        }
+
+        return returnedObject;
+    }
+
+    public void setMessageSource(MessageSource messageSource) {
+        this.messages = new MessageSourceAccessor(messageSource);
+    }
+}

acl/src/main/java/org/springframework/security/vote/AclEntryVoter.java

@@ -0,0 +1,243 @@
+/* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.vote;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.Iterator;
+
+import org.springframework.security.Authentication;
+import org.springframework.security.AuthorizationServiceException;
+import org.springframework.security.ConfigAttribute;
+import org.springframework.security.ConfigAttributeDefinition;
+import org.springframework.security.acls.Acl;
+import org.springframework.security.acls.AclService;
+import org.springframework.security.acls.NotFoundException;
+import org.springframework.security.acls.Permission;
+import org.springframework.security.acls.objectidentity.ObjectIdentity;
+import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategy;
+import org.springframework.security.acls.objectidentity.ObjectIdentityRetrievalStrategyImpl;
+import org.springframework.security.acls.sid.Sid;
+import org.springframework.security.acls.sid.SidRetrievalStrategy;
+import org.springframework.security.acls.sid.SidRetrievalStrategyImpl;
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
+import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
+
+
+/**
+ * <p>
+ * Given a domain object instance passed as a method argument, ensures the principal has appropriate permission
+ * as indicated by the {@link AclService}.
+ * <p>
+ * The <tt>AclService</tt> is used to retrieve the access control list (ACL) permissions associated with a
+ * domain object instance for the current <tt>Authentication</tt> object.
+ * <p>
+ * The voter will vote if any  {@link ConfigAttribute#getAttribute()} matches the {@link #processConfigAttribute}.
+ * The provider will then locate the first method argument of type {@link #processDomainObjectClass}. Assuming that
+ * method argument is non-null, the provider will then lookup the ACLs from the <code>AclManager</code> and ensure the
+ * principal is {@link Acl#isGranted(org.springframework.security.acls.Permission[],
+ * org.springframework.security.acls.sid.Sid[], boolean)} when presenting the {@link #requirePermission} array to that
+ * method.
+ * <p>
+ * If the method argument is <tt>null</tt>, the voter will abstain from voting. If the method argument
+ * could not be found, an {@link org.springframework.security.AuthorizationServiceException} will be thrown.
+ * <p>
+ * In practical terms users will typically setup a number of <tt>AclEntryVoter</tt>s. Each will have a
+ * different {@link #processDomainObjectClass}, {@link #processConfigAttribute} and {@link #requirePermission}
+ * combination. For example, a small application might employ the following instances of <tt>AclEntryVoter</tt>:
+ *  <ul>
+ *      <li>Process domain object class <code>BankAccount</code>, configuration attribute
+ *      <code>VOTE_ACL_BANK_ACCONT_READ</code>, require permission <code>BasePermission.READ</code></li>
+ *      <li>Process domain object class <code>BankAccount</code>, configuration attribute
+ *      <code>VOTE_ACL_BANK_ACCOUNT_WRITE</code>, require permission list <code>BasePermission.WRITE</code> and
+ *      <code>BasePermission.CREATE</code> (allowing the principal to have <b>either</b> of these two permissions)</li>
+ *      <li>Process domain object class <code>Customer</code>, configuration attribute
+ *      <code>VOTE_ACL_CUSTOMER_READ</code>, require permission <code>BasePermission.READ</code></li>
+ *      <li>Process domain object class <code>Customer</code>, configuration attribute
+ *      <code>VOTE_ACL_CUSTOMER_WRITE</code>, require permission list <code>BasePermission.WRITE</code> and
+ *      <code>BasePermission.CREATE</code></li>
+ *  </ul>
+ *  Alternatively, you could have used a common superclass or interface for the {@link #processDomainObjectClass}
+ * if both <code>BankAccount</code> and <code>Customer</code> had common parents.</p>
+ *  <p>If the principal does not have sufficient permissions, the voter will vote to deny access.</p>
+ *  <p>All comparisons and prefixes are case sensitive.</p>
+ *
+ * @author Ben Alex
+ * @version $Id$
+ */
+public class AclEntryVoter extends AbstractAclVoter {
+    //~ Static fields/initializers =====================================================================================
+
+    private static final Log logger = LogFactory.getLog(AclEntryVoter.class);
+
+    //~ Instance fields ================================================================================================
+
+    private AclService aclService;
+    private ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy = new ObjectIdentityRetrievalStrategyImpl();
+    private SidRetrievalStrategy sidRetrievalStrategy = new SidRetrievalStrategyImpl();
+    private String internalMethod;
+    private String processConfigAttribute;
+    private Permission[] requirePermission;
+
+    //~ Constructors ===================================================================================================
+
+    public AclEntryVoter(AclService aclService, String processConfigAttribute, Permission[] requirePermission) {
+        Assert.notNull(processConfigAttribute, "A processConfigAttribute is mandatory");
+        Assert.notNull(aclService, "An AclService is mandatory");
+
+        if ((requirePermission == null) || (requirePermission.length == 0)) {
+            throw new IllegalArgumentException("One or more requirePermission entries is mandatory");
+        }
+
+        this.aclService = aclService;
+        this.processConfigAttribute = processConfigAttribute;
+        this.requirePermission = requirePermission;
+    }
+
+    //~ Methods ========================================================================================================
+
+    /**
+     * Optionally specifies a method of the domain object that will be used to obtain a contained domain
+     * object. That contained domain object will be used for the ACL evaluation. This is useful if a domain object
+     * contains a parent that an ACL evaluation should be targeted for, instead of the child domain object (which
+     * perhaps is being created and as such does not yet have any ACL permissions)
+     *
+     * @return <code>null</code> to use the domain object, or the name of a method (that requires no arguments) that
+     *         should be invoked to obtain an <code>Object</code> which will be the domain object used for ACL
+     *         evaluation
+     */
+    protected String getInternalMethod() {
+        return internalMethod;
+    }
+
+    public void setInternalMethod(String internalMethod) {
+        this.internalMethod = internalMethod;
+    }
+
+    protected String getProcessConfigAttribute() {
+        return processConfigAttribute;
+    }
+
+    public void setObjectIdentityRetrievalStrategy(ObjectIdentityRetrievalStrategy objectIdentityRetrievalStrategy) {
+        Assert.notNull(objectIdentityRetrievalStrategy, "ObjectIdentityRetrievalStrategy required");
+        this.objectIdentityRetrievalStrategy = objectIdentityRetrievalStrategy;
+    }
+
+    public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
+        Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
+        this.sidRetrievalStrategy = sidRetrievalStrategy;
+    }
+
+    public boolean supports(ConfigAttribute attribute) {
+        if ((attribute.getAttribute() != null) && attribute.getAttribute().equals(getProcessConfigAttribute())) {
+            return true;
+        } else {
+            return false;
+        }
+    }
+
+    public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config) {
+        Iterator iter = config.getConfigAttributes().iterator();
+
+        while (iter.hasNext()) {
+            ConfigAttribute attr = (ConfigAttribute) iter.next();
+
+            if (!this.supports(attr)) {
+                continue;
+            }
+            // Need to make an access decision on this invocation
+            // Attempt to locate the domain object instance to process
+            Object domainObject = getDomainObjectInstance(object);
+
+            // If domain object is null, vote to abstain
+            if (domainObject == null) {
+                if (logger.isDebugEnabled()) {
+                    logger.debug("Voting to abstain - domainObject is null");
+                }
+
+                return AccessDecisionVoter.ACCESS_ABSTAIN;
+            }
+
+            // Evaluate if we are required to use an inner domain object
+            if (StringUtils.hasText(internalMethod)) {
+                try {
+                    Class clazz = domainObject.getClass();
+                    Method method = clazz.getMethod(internalMethod, new Class[0]);
+                    domainObject = method.invoke(domainObject, new Object[0]);
+                } catch (NoSuchMethodException nsme) {
+                    throw new AuthorizationServiceException("Object of class '" + domainObject.getClass()
+                        + "' does not provide the requested internalMethod: " + internalMethod);
+                } catch (IllegalAccessException iae) {
+                    logger.debug("IllegalAccessException", iae);
+
+                    throw new AuthorizationServiceException("Problem invoking internalMethod: " + internalMethod
+                        + " for object: " + domainObject);
+                } catch (InvocationTargetException ite) {
+                    logger.debug("InvocationTargetException", ite);
+
+                    throw new AuthorizationServiceException("Problem invoking internalMethod: " + internalMethod
+                        + " for object: " + domainObject);
+                }
+            }
+
+            // Obtain the OID applicable to the domain object
+            ObjectIdentity objectIdentity = objectIdentityRetrievalStrategy.getObjectIdentity(domainObject);
+
+            // Obtain the SIDs applicable to the principal
+            Sid[] sids = sidRetrievalStrategy.getSids(authentication);
+
+            Acl acl;
+
+            try {
+                // Lookup only ACLs for SIDs we're interested in
+                acl = aclService.readAclById(objectIdentity, sids);
+            } catch (NotFoundException nfe) {
+                if (logger.isDebugEnabled()) {
+                    logger.debug("Voting to deny access - no ACLs apply for this principal");
+                }
+
+                return AccessDecisionVoter.ACCESS_DENIED;
+            }
+
+            try {
+                if (acl.isGranted(requirePermission, sids, false)) {
+                    if (logger.isDebugEnabled()) {
+                        logger.debug("Voting to grant access");
+                    }
+
+                    return AccessDecisionVoter.ACCESS_GRANTED;
+                } else {
+                    if (logger.isDebugEnabled()) {
+                        logger.debug(
+                            "Voting to deny access - ACLs returned, but insufficient permissions for this principal");
+                    }
+
+                    return AccessDecisionVoter.ACCESS_DENIED;
+                }
+            } catch (NotFoundException nfe) {
+                if (logger.isDebugEnabled()) {
+                    logger.debug("Voting to deny access - no ACLs apply for this principal");
+                }
+
+                return AccessDecisionVoter.ACCESS_DENIED;
+            }
+        }
+
+        // No configuration attribute matched, so abstain
+        return AccessDecisionVoter.ACCESS_ABSTAIN;
+    }
+}