import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * @param resultSet Set the result set
 * @param row Set the row
 * @return an access control entry
 * @throws SQLException if there is a problem
 */
public final AccessControlEntry mapRow(final ResultSet resultSet,
	 final int row) throws SQLException {
 ObjectIdentity objectIdentity = new ObjectIdentityImpl(
		 resultSet.getString("object_class"),
		 resultSet.getLong("object_identity"));
 Acl acl = new AclImpl(objectIdentity, 0, aclAuthorizationStrategy, auditLogger);
 int mask = resultSet.getInt("mask");
 Permission permission = null;
 if (mask == BasePermission.CREATE.getMask()) {
	 permission = BasePermission.CREATE;
 } else if (mask == BasePermission.READ.getMask()) {
	 permission = BasePermission.READ;
 } else if (mask == BasePermission.WRITE.getMask()) {
	 permission = BasePermission.WRITE;
 } else if (mask == BasePermission.DELETE.getMask()) {
	 permission = BasePermission.DELETE;
 }  else {
	 permission = BasePermission.ADMINISTRATION;
 }
 AccessControlEntry ace = new AccessControlEntryImpl(0, acl, sid,
		 permission, resultSet.getBoolean("granting"),
		 resultSet.getBoolean("auditSuccess"),
		 resultSet.getBoolean("auditFailure"));
 return ace;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Request Acls from the {@link CassandraAclRepository} and convert results.
 * 
 * @param objects a list of {@link ObjectIdentity} objects to lookup.
 * @return a map with {@link ObjectIdentity} instances as keys and {@link Acl} instances as values.
 */
private Map<ObjectIdentity, Acl> doLookup(List<ObjectIdentity> objects) {
	Map<ObjectIdentity, Acl> result = new HashMap<ObjectIdentity, Acl>();
	
	if (objects != null && !objects.isEmpty()) {
		List<AclObjectIdentity> objectIds = new ArrayList<AclObjectIdentity>();

		for (ObjectIdentity objId : objects) {
			objectIds.add(new AclObjectIdentity(objId));
		}

		Map<AclObjectIdentity, Set<AclEntry>> aeList = aclRepository.findAcls(objectIds);		
		Map<ObjectIdentity, Acl> parentAcls = lookupParents(aeList.keySet());

		for (Entry<AclObjectIdentity, Set<AclEntry>> entry : aeList.entrySet()) {
			Acl parentAcl = parentAcls.get(entry.getKey().getParentObjectIdentity());
			AclImpl loadedAcl = convert(entry.getKey(), entry.getValue(), parentAcl);
			result.put(loadedAcl.getObjectIdentity(), loadedAcl);
		}
	}		
	return result;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Creates an {@link AclImpl} instance out of the provided data.
 * 
 * @param aclObjectIdentity the {@link AclObjectIdentity} holding the basic Acl data.
 * @param aclEntries a set of {@link AclEntry} objects to be converted to {@link AccessControlEntry} objects.
 * @param parentAcl the parent {@link Acl}.
 * @return an {@link AclImpl} instance.
 */
private AclImpl convert(AclObjectIdentity aclObjectIdentity, Set<AclEntry> aclEntries, Acl parentAcl) {
	AclImpl acl = new AclImpl(aclObjectIdentity.toObjectIdentity(), aclObjectIdentity.getId(),
			aclAuthorizationStrategy, grantingStrategy, parentAcl, null, aclObjectIdentity.isEntriesInheriting(), aclObjectIdentity.getOwnerSid());

	List<AccessControlEntry> aces = new ArrayList<AccessControlEntry>(aclEntries.size());
	for (AclEntry entry : aclEntries) {
		AccessControlEntry ace = new AccessControlEntryImpl(entry.getId(), acl, entry.getSidObject(), permissionFactory.buildFromMask(entry.getMask()),
				entry.isGranting(), entry.isAuditSuccess(), entry.isAuditFailure());
		aces.add(entry.getOrder(), ace);
	}

	try {
		fieldAces.set(acl, aces);
	} catch (Exception e) {
		LOG.error("Could not set AccessControlEntries in the ACL", e);
	}
	return acl;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Creates a new row in acl_entry for every ACE defined in the passed MutableAcl object.
 *
 * @param acl containing the ACEs to insert
 */
protected void createEntries(final MutableAcl acl) {
    if(acl.getEntries().isEmpty()) {
        return;
    }
    AclImpl aclImpl = (AclImpl)acl;
    ObjectIdentityImpl objIdentity = (ObjectIdentityImpl) aclImpl.getObjectIdentity();
    List<AclEntry> entries = new ArrayList<>();
    for(int i=0;i<acl.getEntries().size();i++) {
        AccessControlEntryImpl entry = (AccessControlEntryImpl) acl.getEntries().get(i);
        AclEntry aclEntry = new AclEntry();
        aclEntry.setAclObjectIdentity(aclDao.getObjectIdentity(objIdentity.getType(), objIdentity.getIdentifier()));
        aclEntry.setAceOrder(i);
        PrincipalSid sid = (PrincipalSid) entry.getSid();
        AclSid aclSid = aclDao.findAclSid(sid.getPrincipal());
        if(aclSid==null) {
            aclSid = new AclSid();
            aclSid.setSid(sid.getPrincipal());
            aclSid.setPrincipal(true);
            aclSid = aclDao.createAclSid(aclSid);
        }
        aclEntry.setSid(aclSid);
        aclEntry.setMask(entry.getPermission().getMask());
        aclEntry.setGranting(entry.isGranting());
        aclEntry.setAuditSuccess(entry.isAuditSuccess());
        aclEntry.setAuditFailure(entry.isAuditFailure());
        entries.add(aclEntry);
    }
    aclDao.createEntries(entries);

}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
@SuppressWarnings("unchecked")
private List<AccessControlEntryImpl> readAces(AclImpl acl) {
    try {
        return (List<AccessControlEntryImpl>) fieldAces.get(acl);
    } catch (IllegalAccessException e) {
        throw new IllegalStateException("Could not obtain AclImpl.aces field", e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private void setAclOnAce(AccessControlEntryImpl ace, AclImpl acl) {
    try {
        fieldAcl.set(ace, acl);
    } catch (IllegalAccessException e) {
        throw new IllegalStateException("Could not or set AclImpl on AccessControlEntryImpl fields", e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private void setAces(AclImpl acl, List<AccessControlEntryImpl> aces) {
    try {
        fieldAces.set(acl, aces);
    } catch (IllegalAccessException e) {
        throw new IllegalStateException("Could not set AclImpl entries", e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
@Override
public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> oids, List<Sid> sids) throws NotFoundException {
    Message msg = MsgPicker.getMsg();
    Map<ObjectIdentity, Acl> aclMaps = new HashMap<ObjectIdentity, Acl>();
    try {
        for (ObjectIdentity oid : oids) {
            AclRecord record = aclStore.getResource(getQueryKeyById(String.valueOf(oid.getIdentifier())),
                    AclRecord.class, SERIALIZER);
            if (record != null && record.getOwnerInfo() != null) {
                SidInfo owner = record.getOwnerInfo();
                Sid ownerSid = owner.isPrincipal() ? new PrincipalSid(owner.getSid()) : new GrantedAuthoritySid(owner.getSid());
                boolean entriesInheriting = record.isEntriesInheriting();

                Acl parentAcl = null;
                DomainObjectInfo parent = record.getParentDomainObjectInfo();
                if (parent != null) {
                    ObjectIdentity parentObject = new ObjectIdentityImpl(parent.getType(), parent.getId());
                    parentAcl = readAclById(parentObject, null);
                }

                AclImpl acl = new AclImpl(oid, oid.getIdentifier(), aclAuthorizationStrategy, permissionGrantingStrategy, parentAcl, null, entriesInheriting, ownerSid);
                genAces(sids, record, acl);

                aclMaps.put(oid, acl);
            } else {
                throw new NotFoundException(String.format(msg.getACL_INFO_NOT_FOUND(), oid));
            }
        }
        return aclMaps;
    } catch (IOException e) {
        throw new InternalErrorException(e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private void setAces(AclImpl acl, List<AccessControlEntry> aces) {
    try {
        fieldAces.set(acl, aces);
    } catch (IllegalAccessException e) {
        throw new IllegalStateException("Could not set AclImpl entries", e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private Map<ObjectIdentity, Acl> lookupObjectIdentities(final Collection<ObjectIdentity> objectIdentities, List<Sid> sids) {
	Assert.notEmpty(objectIdentities, "Must provide identities to lookup");

	final Map<Serializable, Acl> acls = new HashMap<Serializable, Acl>(); // contains Acls with StubAclParents
	QAclObjectIdentity aclObjectIdentity = QAclObjectIdentity.aclObjectIdentity;
	BooleanExpression objectIdentityCondition = null;
	for (ObjectIdentity oid : objectIdentities) {
		String objectClassId = aclClassService.getObjectClassId(oid.getType());
		BooleanExpression oidCondition = aclObjectIdentity.objectIdIdentity
				.eq((String) oid.getIdentifier()).and(
						aclObjectIdentity.objectIdClass.eq(objectClassId));
		if (objectIdentityCondition == null) {
			objectIdentityCondition = oidCondition;
		} else {
			objectIdentityCondition = objectIdentityCondition.or(oidCondition);
		}
	}
	List<AclObjectIdentity> aoiList = (List<AclObjectIdentity>) objectIdentityRepository
			.findAll(objectIdentityCondition, aclObjectIdentity.objectIdIdentity.asc());
	
	
	Set<String> parentAclIds = getParentIdsToLookup(acls, aoiList, sids);
	
	if (parentAclIds.size() > 0) {
		lookUpParentAcls(acls, parentAclIds, sids);
	}

	// Finally, convert our "acls" containing StubAclParents into true Acls
	Map<ObjectIdentity, Acl> resultMap = new HashMap<ObjectIdentity, Acl>();
	for (Acl inputAcl : acls.values()) {
           Assert.isInstanceOf(AclImpl.class, inputAcl, "Map should have contained an AclImpl");
           Assert.isInstanceOf(String.class, ((AclImpl) inputAcl).getId(), "Acl.getId() must be String");

           Acl result = convert(acls, (String)((AclImpl) inputAcl).getId());
           resultMap.put(result.getObjectIdentity(), result);
       }
	return resultMap;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private void setAces(AclImpl acl, List<AccessControlEntryImpl> aces) {
    try {
        fieldAces.set(acl, aces);
    } catch (IllegalAccessException e) {
    	e.printStackTrace();
        throw new IllegalStateException("Could not set AclImpl entries", e);
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
@Override
public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> oids, List<Sid> sids) throws NotFoundException {
    Map<ObjectIdentity, Acl> aclMaps = new HashMap<ObjectIdentity, Acl>();
    HTableInterface htable = null;
    Result result = null;
    try {
        htable = HBaseConnection.get(hbaseUrl).getTable(aclTableName);

        for (ObjectIdentity oid : oids) {
            result = htable.get(new Get(Bytes.toBytes(String.valueOf(oid.getIdentifier()))));

            if (null != result && !result.isEmpty()) {
                SidInfo owner = sidSerializer.deserialize(result.getValue(Bytes.toBytes(ACL_INFO_FAMILY), Bytes.toBytes(ACL_INFO_FAMILY_OWNER_COLUMN)));
                Sid ownerSid = (null == owner) ? null : (owner.isPrincipal() ? new PrincipalSid(owner.getSid()) : new GrantedAuthoritySid(owner.getSid()));
                boolean entriesInheriting = Bytes.toBoolean(result.getValue(Bytes.toBytes(ACL_INFO_FAMILY), Bytes.toBytes(ACL_INFO_FAMILY_ENTRY_INHERIT_COLUMN)));

                Acl parentAcl = null;
                DomainObjectInfo parentInfo = domainObjSerializer.deserialize(result.getValue(Bytes.toBytes(ACL_INFO_FAMILY), Bytes.toBytes(ACL_INFO_FAMILY_PARENT_COLUMN)));
                if (null != parentInfo) {
                    ObjectIdentity parentObj = new ObjectIdentityImpl(parentInfo.getType(), parentInfo.getId());
                    parentAcl = readAclById(parentObj, null);
                }

                AclImpl acl = new AclImpl(oid, oid.getIdentifier(), aclAuthorizationStrategy, permissionGrantingStrategy, parentAcl, null, entriesInheriting, ownerSid);
                genAces(sids, result, acl);

                aclMaps.put(oid, acl);
            } else {
                throw new NotFoundException("Unable to find ACL information for object identity '" + oid + "'");
            }
        }
    } catch (IOException e) {
        throw new RuntimeException(e.getMessage(), e);
    } finally {
        IOUtils.closeQuietly(htable);
    }

    return aclMaps;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Read Aces from Acl
 * 
 * @param acl - Acl
 * @return List of Aces
 */
@SuppressWarnings("unchecked")
private List<AccessControlEntryImpl> readAces(AclImpl acl) {
	try {
		return (List<AccessControlEntryImpl>) fieldAces.get(acl);
	} catch (IllegalAccessException e) {
		throw new IllegalStateException(
				"Could not obtain AclImpl.aces field", e);
	}
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Set Acl on Ace
 * 
 * @param ace - Access Control Entry
 * @param acl - Access Control List
 */
private void setAclOnAce(AccessControlEntryImpl ace, AclImpl acl) {
	try {
		fieldAcl.set(ace, acl);
	} catch (IllegalAccessException e) {
		throw new IllegalStateException(
				"Could not or set AclImpl on AccessControlEntryImpl fields",
				e);
	}
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Set Aces for Acl
 * 
 * @param acl - Access Control List
 * @param aces - Access Control Entries
 */
private void setAces(AclImpl acl, List<AccessControlEntryImpl> aces) {
	try {
		fieldAces.set(acl, aces);
	} catch (IllegalAccessException e) {
		throw new IllegalStateException("Could not set AclImpl entries", e);
	}
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * The main method.
 * <p>
 * WARNING: This implementation completely disregards the "sids" argument! Every item in the cache is expected to
 * contain all SIDs. If you have serious performance needs (e.g. a very large number of
 * SIDs per object identity), you'll probably want to develop a custom {@link LookupStrategy} implementation
 * instead.
 * <p>
 * The implementation works in batch sizes specified by {@link #batchSize}.
 *
 * @param objects the identities to lookup (required)
 * @param sids the SIDs for which identities are required (ignored by this implementation)
 *
 * @return a <tt>Map</tt> where keys represent the {@link ObjectIdentity} of the located {@link Acl} and values
 *         are the located {@link Acl} (never <tt>null</tt> although some entries may be missing; this method
 *         should not throw {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used
 *         to automatically create entries if required)
 */
public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) {
    Assert.isTrue(batchSize >= 1, "BatchSize must be >= 1");
    Assert.notEmpty(objects, "Objects to lookup required");

    // Map<ObjectIdentity,Acl>
    Map<ObjectIdentity, Acl> result = new HashMap<ObjectIdentity, Acl>(); // contains FULLY loaded Acl objects

    Set<ObjectIdentity> currentBatchToLoad = new HashSet<ObjectIdentity>();

    for (int i = 0; i < objects.size(); i++) {
        final ObjectIdentity oid = objects.get(i);
        boolean aclFound = false;

        // Check we don't already have this ACL in the results
        if (result.containsKey(oid)) {
            aclFound = true;
        }

        // Check cache for the present ACL entry
        if (!aclFound) {
            Acl acl = aclCache.getFromCache(oid);

            // Ensure any cached element supports all the requested SIDs
            // (they should always, as our base impl doesn't filter on SID)
            if (acl != null) {
                if (acl.isSidLoaded(sids)) {
                    result.put(acl.getObjectIdentity(), acl);
                    aclFound = true;
                } else {
                    throw new IllegalStateException(
                        "Error: SID-filtered element detected when implementation does not perform SID filtering "
                                + "- have you added something to the cache manually?");
                }
            }
        }

        // Load the ACL from the database
        if (!aclFound) {
            currentBatchToLoad.add(oid);
        }

        // Is it time to load from JDBC the currentBatchToLoad?
        if ((currentBatchToLoad.size() == this.batchSize) || ((i + 1) == objects.size())) {
            if (currentBatchToLoad.size() > 0) {
                Map<ObjectIdentity, Acl> loadedBatch = lookupObjectIdentities(currentBatchToLoad, sids);

                // Add loaded batch (all elements 100% initialized) to results
                result.putAll(loadedBatch);

                // Add the loaded batch to the cache

                for (Acl loadedAcl : loadedBatch.values()) {
                    aclCache.putInCache((AclImpl) loadedAcl);
                }

                currentBatchToLoad.clear();
            }
        }
    }

    return result;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * Looks up a batch of <code>ObjectIdentity</code>s directly from the database.
 * <p>
 * The caller is responsible for optimization issues, such as selecting the identities to lookup, ensuring the
 * cache doesn't contain them already, and adding the returned elements to the cache etc.
 * <p>
 * This subclass is required to return fully valid <code>Acl</code>s, including properly-configured
 * parent ACLs.
 *
 */
private Map<ObjectIdentity, Acl> lookupObjectIdentities(final Collection<ObjectIdentity> objectIdentities, List<Sid> sids) {
    Assert.notEmpty(objectIdentities, "Must provide identities to lookup");

    final Map<Serializable, Acl> acls = new HashMap<Serializable, Acl>(); // contains Acls with StubAclParents

    // Make the "acls" map contain all requested objectIdentities
    // (including markers to each parent in the hierarchy)
    String sql = computeRepeatingSql(lookupObjectIdentitiesWhereClause, objectIdentities.size());

    Set<Long> parentsToLookup = jdbcTemplate.query(sql,
        new PreparedStatementSetter() {
            public void setValues(PreparedStatement ps) throws SQLException {
                int i = 0;
                for (ObjectIdentity oid : objectIdentities) {
                    // Determine prepared statement values for this iteration
                    String type = oid.getType();

                    // No need to check for nulls, as guaranteed non-null by ObjectIdentity.getIdentifier() interface contract
                    String identifier = oid.getIdentifier().toString();
                    long id = (Long.valueOf(identifier)).longValue();

                    // Inject values
                    ps.setLong((2 * i) + 1, id);
                    ps.setString((2 * i) + 2, type);
                    i++;
                }
            }
        }, new ProcessResultSet(acls, sids));

    // Lookup the parents, now that our JdbcTemplate has released the database connection (SEC-547)
    if (parentsToLookup.size() > 0) {
        lookupPrimaryKeys(acls, parentsToLookup, sids);
    }

    // Finally, convert our "acls" containing StubAclParents into true Acls
    Map<ObjectIdentity, Acl> resultMap = new HashMap<ObjectIdentity, Acl>();

    for (Acl inputAcl : acls.values()) {
        Assert.isInstanceOf(AclImpl.class, inputAcl, "Map should have contained an AclImpl");
        Assert.isInstanceOf(Long.class, ((AclImpl) inputAcl).getId(), "Acl.getId() must be Long");

        Acl result = convert(acls, (Long) ((AclImpl) inputAcl).getId());
        resultMap.put(result.getObjectIdentity(), result);
    }

    return resultMap;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
/**
 * The final phase of converting the <code>Map</code> of <code>AclImpl</code> instances which contain
 * <code>StubAclParent</code>s into proper, valid <code>AclImpl</code>s with correct ACL parents.
 *
 * @param inputMap the unconverted <code>AclImpl</code>s
 * @param currentIdentity the current<code>Acl</code> that we wish to convert (this may be
 *
 */
private AclImpl convert(Map<Serializable, Acl> inputMap, Long currentIdentity) {
    Assert.notEmpty(inputMap, "InputMap required");
    Assert.notNull(currentIdentity, "CurrentIdentity required");

    // Retrieve this Acl from the InputMap
    Acl uncastAcl = inputMap.get(currentIdentity);
    Assert.isInstanceOf(AclImpl.class, uncastAcl, "The inputMap contained a non-AclImpl");

    AclImpl inputAcl = (AclImpl) uncastAcl;

    Acl parent = inputAcl.getParentAcl();

    if ((parent != null) && parent instanceof StubAclParent) {
        // Lookup the parent
        StubAclParent stubAclParent = (StubAclParent) parent;
        parent = convert(inputMap, stubAclParent.getId());
    }

    // Now we have the parent (if there is one), create the true AclImpl
    AclImpl result = new AclImpl(inputAcl.getObjectIdentity(), (Long) inputAcl.getId(), aclAuthorizationStrategy,
            grantingStrategy, parent, null, inputAcl.isEntriesInheriting(), inputAcl.getOwner());

    // Copy the "aces" from the input to the destination

    // Obtain the "aces" from the input ACL
    List<AccessControlEntryImpl> aces = readAces(inputAcl);

    // Create a list in which to store the "aces" for the "result" AclImpl instance
    List<AccessControlEntryImpl> acesNew = new ArrayList<AccessControlEntryImpl>();

    // Iterate over the "aces" input and replace each nested AccessControlEntryImpl.getAcl() with the new "result" AclImpl instance
    // This ensures StubAclParent instances are removed, as per SEC-951
    for (AccessControlEntryImpl ace : aces) {
        setAclOnAce(ace, result);
        acesNew.add(ace);
    }

    // Finally, now that the "aces" have been converted to have the "result" AclImpl instance, modify the "result" AclImpl instance
    setAces(result, acesNew);

    return result;
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
@Override
@SuppressWarnings("unchecked")
public Acl readAclById(ObjectIdentity object, List<Sid> sids) throws NotFoundException {
    LOG.trace(ACL, "Reading ACL for object identity {}", object);

    Acl acl = aclCache.getFromCache(object);
    if (acl != null && acl.isSidLoaded(sids)) {
        LOG.debug(ACL, "ACL for id {} found in cache: {}", object, acl);

        return acl;
    } else {
        LOG.trace(ACL, "No ACL found in cache for id {}: looking into backend.", object);

        DBObject result = getAclCollection().findOne(queryByObjectIdentity(object));
        if (result == null) {
            LOG.warn(ACL, "No ACL found for object identity {}", object);

            throw new NotFoundException("No ACL found for object identity " + object);
        }

        LOG.trace(ACL, "Trying to loading parent ACL if needed.");

        Acl parentAcl = null;
        DBObject parentDbo = (DBObject) result.get(parentObjectFieldName);
        if (parentDbo != null) {
            parentAcl = readAclById(toObjectIdentity(parentDbo));
        }

        LOG.trace(ACL, "Extracting loaded SIDs");

        List<DBObject> entries = (List<DBObject>) result.get(entriesFieldName);
        Set<Sid> loadedSids = new HashSet<Sid>();
        if (sids != null) {
            loadedSids.addAll(sids);
        }
        if (entries != null) {
            for (DBObject entry : entries) {
                loadedSids.add(toSid((DBObject) entry.get(sidFieldName)));
            }
        }

        Sid owner = toSid((DBObject) result.get(ownerFieldName));

        AclImpl loadedAcl = new AclImpl(object, result.get("_id").toString(), aclAuthorizationStrategy,
                permissionGrantingStrategy, parentAcl, new ArrayList<Sid>(loadedSids),
                (Boolean) result.get(entriesInheritingFieldName), owner);
        if (entries != null) {
            List<AccessControlEntry> aces = new ArrayList<AccessControlEntry>();
            for (int i = 0; i < entries.size(); i++) {
                aces.add(toAccessControlEntry(i, loadedAcl, entries.get(i)));
            }
            try {
                acesField.set(loadedAcl, new ArrayList<AccessControlEntry>(aces));
            } catch (Exception ex) {
                throw new IllegalStateException("Unable to set ACEs.", ex);
            }
        }
        aclCache.putInCache(loadedAcl);
        return loadedAcl;
    }
}
 

import org.springframework.security.acls.domain.AclImpl; //导入依赖的package包/类
private Map<ObjectIdentity, Acl> doLookup(List<ObjectIdentity> objects,
		List<Sid> sids) {
	Assert.notEmpty(objects, "Objects to lookup required");

	// Map<ObjectIdentity,Acl>
	Map<ObjectIdentity, Acl> result = new HashMap<ObjectIdentity, Acl>(); // contains FULLY loaded Acl objects

	Set<ObjectIdentity> oidToLoad = new HashSet<ObjectIdentity>();

	for (int i = 0; i < objects.size(); i++) {
		final ObjectIdentity oid = objects.get(i);
		boolean aclFound = false;

		Acl acl = aclCache.getFromCache(oid);

		// Ensure any cached element supports all the requested SIDs
		// (they should always, as our base impl doesn't filter on SID)
		if (acl != null) {
			if (acl.isSidLoaded(sids)) {
				result.put(acl.getObjectIdentity(), acl);
				aclFound = true;
			} else {
				throw new IllegalStateException(
						"Error: SID-filtered element detected when implementation does not perform SID filtering "
								+ "- have you added something to the cache manually?");
			}
		}

		// Load the ACL from the database
		if (!aclFound) {
			oidToLoad.add(oid);
		}
	}

	// Is it time to load from Mongodb
	if (oidToLoad.size() > 0) {
		result = lookupObjectIdentities(oidToLoad, sids);

		// Add the loaded Acl to the cache
		for (Acl loadedAcl : result.values()) {
			aclCache.putInCache((AclImpl) loadedAcl);
		}
	}

	return result;
}