import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public void orderBefore(AccessControlEntry srcEntry, AccessControlEntry destEntry) throws RepositoryException {
    ACE src = checkACE(srcEntry);
    ACE dest = (destEntry == null) ? null : checkACE(destEntry);

    if (src.equals(dest)) {
        log.debug("'srcEntry' equals 'destEntry' -> no reordering required.");
        return;
    }

    int index = (dest == null) ? entries.size() - 1 : entries.indexOf(dest);
    if (index < 0) {
        throw new AccessControlException("'destEntry' not contained in this AccessControlList.");
    } else {
        if (entries.remove(src)) {
            // re-insert the srcEntry at the new position.
            entries.add(index, src);
        } else {
            // src entry not contained in this list.
            throw new AccessControlException("srcEntry not contained in this AccessControlList");
        }
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public Restriction createRestriction(String oakPath, String oakName, Value value) throws RepositoryException {
    RestrictionDefinition definition = getDefinition(oakPath, oakName);
    Type<?> requiredType = definition.getRequiredType();
    int tag = requiredType.tag();
    if (tag != PropertyType.UNDEFINED && tag != value.getType()) {
        throw new AccessControlException("Unsupported restriction: Expected value of type " + requiredType);
    }
    PropertyState propertyState;
    if (requiredType.isArray()) {
        propertyState = PropertyStates.createProperty(oakName, ImmutableList.of(value), tag);
    } else {
        propertyState = PropertyStates.createProperty(oakName, value);
    }
    return createRestriction(propertyState, definition);
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public void validateRestrictions(@Nullable String oakPath, @Nonnull Tree aceTree) throws RepositoryException {
    Map<String,RestrictionDefinition> supported = getSupported(oakPath);
    Set<String> rNames = new HashSet<String>();
    for (Restriction r : readRestrictions(oakPath, aceTree)) {
        String name = getName(r);
        rNames.add(name);
        if (!supported.containsKey(name)) {
            throw new AccessControlException("Unsupported restriction: " + name + " at " + oakPath);
        }
        if (!r.getDefinition().equals(supported.get(name))) {
            throw new AccessControlException("Invalid restriction: " + name + " at " + oakPath);
        }
    }
    for (RestrictionDefinition def : supported.values()) {
        String defName = def.getName();
        if (hasRestrictionProperty(aceTree, defName) && !rNames.contains(defName)) {
            throw new AccessControlException("Invalid restriction " + defName + " at " + oakPath);
        }
        if (def.isMandatory() && !rNames.contains(defName)) {
            throw new AccessControlException("Mandatory restriction " + defName + " is missing.");
        }
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Nonnull
protected Tree getTree(@Nullable String oakPath, long permissions, boolean checkAcContent) throws RepositoryException {
    Tree tree = (oakPath == null) ? root.getTree("/") : root.getTree(oakPath);
    if (!tree.exists()) {
        throw new PathNotFoundException("No tree at " + oakPath);
    }
    if (permissions != Permissions.NO_PERMISSION) {
        // check permissions
        checkPermissions((oakPath == null) ? null : tree, permissions);
    }
    // check if the tree defines access controlled content
    if (checkAcContent && config.getContext().definesTree(tree)) {
        throw new AccessControlException("Tree " + tree.getPath() + " defines access control content.");
    }
    return tree;
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Test
public void testCreateInvalidMvRestriction() throws Exception {
    Map<String, Value[]> invalid = ImmutableMap.of(
            "boolean", new Value[] {vf.createValue(true), vf.createValue(false)},
            "longs", new Value[] {vf.createValue("wrong_type")},
            REP_NT_NAMES, new Value[] {vf.createValue(true)}
    );
    for (String name : invalid.keySet()) {
        try {
            provider.createRestriction("/testPath", name, invalid.get(name));
            fail("invalid restriction " + name);
        } catch (AccessControlException e) {
            // success
        }
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
/**
 * Create a {@linkplain JcrCallback} for setting up ACL management in test repository
 * 
 * @return acl management callback
 */
static JcrCallback setAclManagementCallback() {
  return new JcrCallback() {
    @Override
    public Object doInJcr( Session session ) throws IOException, RepositoryException {
      PentahoJcrConstants pentahoJcrConstants = new PentahoJcrConstants( session );
      Workspace workspace = session.getWorkspace();
      PrivilegeManager privilegeManager = ( (JackrabbitWorkspace) workspace ).getPrivilegeManager();
      try {
        privilegeManager.getPrivilege( pentahoJcrConstants.getPHO_ACLMANAGEMENT_PRIVILEGE() );
      } catch ( AccessControlException ace ) {
        privilegeManager.registerPrivilege( pentahoJcrConstants.getPHO_ACLMANAGEMENT_PRIVILEGE(), false,
            new String[0] );
      }
      session.save();
      return null;
    }
  };
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
private void setAclManagement() {
  testJcrTemplate.execute( new JcrCallback() {
    @Override
    public Object doInJcr( Session session ) throws IOException, RepositoryException {
      PentahoJcrConstants pentahoJcrConstants = new PentahoJcrConstants( session );
      Workspace workspace = session.getWorkspace();
      PrivilegeManager privilegeManager = ( (JackrabbitWorkspace) workspace ).getPrivilegeManager();
      try {
        privilegeManager.getPrivilege( pentahoJcrConstants.getPHO_ACLMANAGEMENT_PRIVILEGE() );
      } catch ( AccessControlException ace ) {
        privilegeManager.registerPrivilege( pentahoJcrConstants.getPHO_ACLMANAGEMENT_PRIVILEGE(), false,
            new String[0] );
      }
      session.save();
      return null;
    }
  } );
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
public static JackrabbitAccessControlList getModifiableAcl(final AccessControlManager accessManager,
		final String path) throws RepositoryException {
	final JackrabbitAccessControlList acl = getAccessControlList(accessManager, path);
	if (null != acl) {
		return acl;
	}

	final JackrabbitAccessControlList applicableAcl = getApplicableAccessControlList(accessManager, path);
	if (null != applicableAcl) {
		return applicableAcl;
	}

	throw new AccessControlException("No modifiable ACL at " + path);
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public void validateRestrictions(String oakPath, Tree aceTree) throws AccessControlException {
    super.validateRestrictions(oakPath, aceTree);

    Tree restrictionsTree = getRestrictionsTree(aceTree);
    PropertyState glob = restrictionsTree.getProperty(REP_GLOB);
    if (glob != null) {
        GlobPattern.validate(glob.getValue(Type.STRING));
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
static void validate(@Nonnull String restriction) throws AccessControlException {
    int cnt = 0;
    for (int i = 0; i < restriction.length(); i++) {
        if (WILDCARD_CHAR == restriction.charAt(i)) {
            cnt++;
        }
        if (cnt > MAX_WILDCARD) {
            throw new AccessControlException("Number of wildcards in rep:glob exceeds allowed complexity.");
        }
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public void removeAccessControlEntry(AccessControlEntry ace) throws RepositoryException {
    ACE entry = checkACE(ace);
    if (!entries.remove(entry)) {
        throw new AccessControlException("Cannot remove AccessControlEntry " + ace);
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
private String getNodePath(ACE principalBasedAce) throws RepositoryException {
    Value v = principalBasedAce.getRestriction(REP_NODE_PATH);
    if (v == null) {
        throw new AccessControlException("Missing mandatory restriction rep:nodePath");
    } else {
        return getOakPath(v.getString());
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
public static void checkValidPrincipal(@Nullable Principal principal,
                                       @Nonnull PrincipalManager principalManager,
                                       boolean verifyExists) throws AccessControlException {
    String name = (principal == null) ? null : principal.getName();
    if (name == null || name.isEmpty()) {
        throw new AccessControlException("Invalid principal " + name);
    }
    if (verifyExists && !(principal instanceof PrincipalImpl) && !principalManager.hasPrincipal(name)) {
        throw new AccessControlException("Unknown principal " + name);
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
public static void checkValidPrincipals(@Nullable Set<Principal> principals,
                                        @Nonnull PrincipalManager principalManager) throws AccessControlException {
    if (principals == null) {
        throw new AccessControlException("Valid principals expected. Found null.");
    }
    for (Principal principal : principals) {
        checkValidPrincipal(principal, principalManager, true);
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public Privilege getPrivilege(String privilegeName) throws RepositoryException {
    PrivilegeDefinition def = getPrivilegeDefinition(getOakName(privilegeName));
    if (def == null) {
        throw new AccessControlException("No such privilege " + privilegeName);
    } else {
        return getPrivilege(def);
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Nonnull
private String getOakName(String jcrName) throws RepositoryException {
    if (jcrName == null) {
        throw new AccessControlException("Invalid privilege name 'null'");
    }
    String oakName = namePathMapper.getOakNameOrNull(jcrName);
    if (oakName == null) {
    	throw new AccessControlException("Cannot resolve privilege name " + jcrName);
    }
    return oakName;
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
/**
 * Wraps the given {@link CommitFailedException} instance using the
 * appropriate {@link javax.jcr.RepositoryException} subclass based on the
 * {@link CommitFailedException#getType() type} of the given exception.
 *
 * @param message The exception message.
 * @return matching repository exception
 */
public RepositoryException asRepositoryException(@Nonnull String message) {
    if (isConstraintViolation()) {
        return new ConstraintViolationException(message, this);
    } else if (isOfType(NAMESPACE)) {
        return new NamespaceException(message, this);
    } else if (isOfType(NODE_TYPE)) {
        return new NoSuchNodeTypeException(message, this);
    } else if (isAccessViolation()) {
        return new AccessDeniedException(message, this);
    } else if (isAccessControlViolation()) {
        return new AccessControlException(message, this);
    } else if (isOfType(INTEGRITY)) {
        return new ReferentialIntegrityException(message, this);
    } else if (isOfType(STATE)) {
        return new InvalidItemStateException(message, this);
    } else if (isOfType(MERGE)) {
        return new InvalidItemStateException(message, this);
    } else if (isOfType(VERSION)) {
        return new VersionException(message, this);
    } else if (isOfType(LABEL_EXISTS)) {
        return new LabelExistsVersionException(message, this);
    } else if (isOfType(LOCK)) {
        return new LockException(message, this);
    } else if (isOfType(UNSUPPORTED)) {
        return new UnsupportedRepositoryOperationException(message, this);
    } else {
        return new RepositoryException(message, this);
    }
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Nonnull
private RestrictionDefinition getDefinition(@Nullable String oakPath, @Nonnull String oakName) throws AccessControlException {
    if (isUnsupportedPath(oakPath)) {
        throw new AccessControlException("Unsupported restriction at " + oakPath);
    }
    RestrictionDefinition definition = supported.get(oakName);
    if (definition == null) {
        throw new AccessControlException("Unsupported restriction: " + oakName);
    }
    return definition;
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
private RestrictionProvider getProvider(@Nullable String oakPath, @Nonnull String oakName) throws AccessControlException {
    for (RestrictionProvider rp : providers) {
        for (RestrictionDefinition def : rp.getSupportedRestrictions(oakPath)) {
            if (def.getName().equals(oakName)) {
                return rp;
            }
        }
    }
    throw new AccessControlException("Unsupported restriction (path = " + oakPath + "; name = " + oakName + ')');
}
 

import javax.jcr.security.AccessControlException; //导入依赖的package包/类
@Override
public void setPolicy(String absPath, AccessControlPolicy policy) throws RepositoryException {
    for (AccessControlManager acMgr : acMgrs) {
        if (acMgr instanceof PolicyOwner && ((PolicyOwner) acMgr).defines(absPath, policy)) {
            acMgr.setPolicy(absPath, policy);
            return;
        }
    }
    throw new AccessControlException("Cannot set access control policy " + policy + "; no PolicyOwner found.");
}