import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Grants the specified {@code permissions} to the specified {@code role}.
 * 
 * @param role
 *            the role to apply the {@code permissions} to
 * @param permissions
 *            the permissions to be applied
 * 
 * @throws AuthManagementException
 *             if the realm is closed, if the specified {@code role} does
 *             not exist or if the defined {@code permissions} are
 *             {@code null} or empty
 */
public void grantPermissionsToRole(final String role,
		final String[] permissions) throws AuthManagementException {
	if (isClosed()) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1003);
	} else if (permissions == null || permissions.length == 0) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1013, role);
	}

	final SimpleRole simpleRole = this.roles.get(role);
	if (simpleRole == null) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1011, Arrays.asList(permissions), role);
	} else {
		final SimpleRole clone = clone(simpleRole);
		final Set<Permission> perms = PermissionUtils.resolvePermissions(
				Arrays.asList(permissions), getPermissionResolver());
		clone.addAll(perms);

		this.roles.put(role, clone);
		db.commit();
	}
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Revokes the specified {@code permissions} from the specified {@code role}
 * .
 * 
 * @param role
 *            the role to revoke the {@code permissions} from
 * @param permissions
 *            the permissions to be revoked
 * 
 * @throws AuthManagementException
 *             if the realm is closed or if the specified {@code role} does
 *             not exist
 */
public void revokePermissionsFromRole(final String role,
		final String[] permissions) throws AuthManagementException {
	if (isClosed()) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1003);
	} else if (permissions == null || permissions.length == 0) {
		return;
	}

	final SimpleRole simpleRole = this.roles.get(role);
	if (simpleRole == null) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1012, Arrays.asList(permissions), role);
	} else {
		final SimpleRole clone = clone(simpleRole);
		final Set<Permission> perms = PermissionUtils.resolvePermissions(
				Arrays.asList(permissions), getPermissionResolver());
		final Set<Permission> rolePermissions = clone.getPermissions();
		rolePermissions.removeAll(perms);
		clone.setPermissions(rolePermissions);

		this.roles.put(role, clone);
		db.commit();
	}
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
protected void processRoleDefinitions(Map<String, String> roleDefs) {
    if (roleDefs == null || roleDefs.isEmpty()) {
        return;
    }
    for (String rolename : roleDefs.keySet()) {

        String value = roleDefs.get(rolename);

        //Parse the rolename for partition.
        String partition;

        Matcher matcher = rolePartitionPattern.matcher(rolename);
        if (matcher.matches()) {
            partition = matcher.group("partition");
            rolename = matcher.group("rolename");
        }else {
            partition = getDefaultPartitionName();
        }

        IOTRole role = getIOTRole(partition, rolename);
        if (role == null) {
            role = addIOTRole(partition, rolename);

        }

        Set<Permission> permissions = PermissionUtils.resolveDelimitedPermissions(value, getPermissionResolver());

        for (Permission permission : permissions) {
            role.add((IOTPermission) permission);
        }

        saveIOTRole(role);
    }
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Adds a role to the realm.
 * 
 * @param role
 *            the name of the role to be added
 * 
 * @param permissions
 *            the permissions assign to the role
 * @throws AuthManagementException
 *             if another role with the same name already exists
 */
public void addRole(final String role, final String[] permissions)
		throws AuthManagementException {

	if (isClosed()) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1003);
	} else if (!validateRole(role)) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1006, role);
	} else if (this.roles.containsKey(role)) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1002, role);
	} else {
		if (LOG.isTraceEnabled()) {
			LOG.trace("Adding role '"
					+ role
					+ "' with permissions '"
					+ (permissions == null ? null : Arrays
							.asList(permissions)) + ".");
		}

		final Set<Permission> perms = PermissionUtils.resolvePermissions(
				Arrays.asList(permissions), getPermissionResolver());

		final SimpleRole r = new SimpleRole(role, perms);
		roles.put(role, r);
		db.commit();
	}
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Grants the specified {@code permissions} to the specified
 * {@code username}.
 * 
 * @param username
 *            the name of the user to grant the permissions to
 * @param permissions
 *            the permissions to be granted (cannot be {@code null} or
 *            empty)
 * 
 * @throws AuthManagementException
 *             if the permissions are empty, if the {@code username} does
 *             not exist or if the realm is closed
 */
public void grantPermissionsToUser(final String username,
		final String[] permissions) throws AuthManagementException {

	if (isClosed()) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1003);
	} else if (permissions == null || permissions.length == 0) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1008, username);
	}
	final SimpleAccount account = this.users.get(username);

	if (account == null) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1009, Arrays.asList(permissions), username);
	} else {
		final List<String> perms = Arrays.asList(permissions);

		if (LOG.isTraceEnabled()) {
			LOG.trace("Granting '" + perms + "' to user '" + username
					+ "'.");
		}
		final SimpleAccount clone = clone(account);
		clone.addObjectPermissions(PermissionUtils.resolvePermissions(
				perms, getPermissionResolver()));

		this.users.put(username, clone);
		db.commit();
	}
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
@Override
public Collection<Permission> resolvePermissionsInRole(String roleString) {
  Collection<Permission> cachedPerms = rolePermissionsCache.getIfPresent(roleString);
  if (cachedPerms != null) return cachedPerms;

  List<String> permissions = loadSubjectPermissions(roleString, SubjectAcl.Type.GROUP);
  // built-in permissions
  Collection<Permission> perms;
  switch(roleString) {
    case Roles.MICA_ADMIN:
      perms = mergePermissions("*", permissions);
      break;
    case Roles.MICA_REVIEWER:
      // all permissions: edition and publication on draft, view on published
      perms = mergePermissions("/files:UPLOAD", permissions);
      Arrays.stream(ALL_RESOURCES).forEach(e -> {
        perms.addAll(toPermissions(String.format("/draft/%s", e)));
        perms.addAll(toPermissions(String.format("/draft/file:*:/%s", e)));
        perms.addAll(toPermissions(String.format("/%s:VIEW", e)));
        perms.addAll(toPermissions(String.format("/file:VIEW:/%s", e)));
      });
      break;
    case Roles.MICA_EDITOR:
      // all edition permissions on draft
      perms = mergePermissions("/files:UPLOAD", permissions);
      Arrays.stream(ALL_RESOURCES).forEach(e -> PermissionsUtils.EDITOR_ACTIONS.forEach(a -> {
        perms.addAll(toPermissions(String.format("/draft/%s:%s", e, a)));
        perms.addAll(toPermissions(String.format("/draft/file:%s:/%s", a, e)));

      }));
      // all view permissions on published
      Arrays.stream(ALL_RESOURCES).forEach(e -> {
        perms.addAll(toPermissions(String.format("/%s:VIEW", e)));
        perms.addAll(toPermissions(String.format("/file:VIEW:/%s", e)));
      });
      break;
    case Roles.MICA_DAO:
      // can view and delete any project and data access requests
      perms = mergePermissions(
          "/data-access-request:ADD,/data-access-request:VIEW,/data-access-request:DELETE," +
          "/files:UPLOAD",
        permissions);
      break;
    case Roles.MICA_USER:
      perms = mergePermissions("/data-access-request:ADD,/files:UPLOAD", permissions);
      break;
    default:
        // other groups
        perms = PermissionUtils.resolvePermissions(permissions, getPermissionResolver());
  }
  rolePermissionsCache.put(roleString, perms);
  return perms;
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
private Collection<Permission> mergePermissions(String delimitedPermissions, Collection<String> permissions) {
  Collection<Permission> perms = toPermissions(delimitedPermissions);
  perms.addAll(PermissionUtils.resolvePermissions(permissions, getPermissionResolver()));
  return perms;
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
private Collection<Permission> toPermissions(String delimitedPermissions) {
  return PermissionUtils.resolveDelimitedPermissions(delimitedPermissions, getPermissionResolver());
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Adds a user to the realm using the specified {@code name} and
 * {@code password}. It is possible to assign {@code roles} to the user, as
 * well as {@code permissions}.
 * 
 * @param name
 *            the name of the user
 * @param password
 *            the password
 * @param roles
 *            the roles, can be {@code null}
 * @param permissions
 *            the permissions, can be {@code null}
 * 
 * @throws ForwardedRuntimeException
 *             if an other already exists with the same {@code name}, the
 *             exception wraps a {@code AuthManagementException}
 */
public void addUser(final String name, final String password,
		final String[] roles, final String[] permissions)
		throws ForwardedRuntimeException {

	if (isClosed()) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1003);
	} else if (!validateUser(name)) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1007, name);
	} else if (this.users.containsKey(name)) {
		throw new ForwardedRuntimeException(AuthManagementException.class,
				1000, name);
	} else {
		if (LOG.isTraceEnabled()) {
			LOG.trace("Adding user '"
					+ name
					+ "' with roles '"
					+ (roles == null ? null : Arrays.asList(roles))
					+ "' and permissions '"
					+ (permissions == null ? null : Arrays
							.asList(permissions)) + "'.");
		}

		// create the account
		final SimpleAccount account = new SimpleAccount(name, password,
				getName());

		// set the roles
		if (roles != null && roles.length > 0) {
			account.addRole(Arrays.asList(roles));
		}

		// set the permissions for the account
		if (permissions != null && permissions.length > 0) {
			final Set<Permission> perms = PermissionUtils
					.resolvePermissions(Arrays.asList(permissions),
							getPermissionResolver());
			account.setObjectPermissions(perms);
		}

		// add the user to the map
		this.users.put(name, account);
		db.commit();
	}
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
/**
 * Resolve the specified {@code perm} to a set of {@code Permissions}.
 * 
 * @param perm
 *            the {@code ExtendedWildcardPermission} to resolve the
 *            permissions from
 * @param separator
 *            the separator used to separate the different parts of the
 *            permission
 * 
 * @return the resolved permissions
 * 
 * @see ExtendedWildcardPermission
 */
protected Set<String> resolvePermission(final Permission perm,
		final String separator) {
	final Set<String> permissions = new LinkedHashSet<String>();

	if (perm == null) {
		// do nothing
	} else {
		for (final net.meisen.dissertation.model.auth.permissions.Permission sysPerm : net.meisen.dissertation.model.auth.permissions.Permission
				.values()) {

			final String strPerm = (sysPerm.isGlobal() ? sysPerm.create()
					: sysPerm.create("*")).toString(separator);
			final Set<Permission> resPerms = PermissionUtils
					.resolveDelimitedPermissions(strPerm,
							getPermissionResolver());

			final Permission resPerm;
			if (resPerms == null || resPerms.size() != 1) {
				continue;
			} else {
				resPerm = resPerms.iterator().next();
			}

			if (perm.implies(resPerm) || resPerm.implies(perm)) {

				// check if the perm contains a model
				if (perm instanceof ExtendedWildcardPermission) {
					final ExtendedWildcardPermission wPerm = (ExtendedWildcardPermission) perm;
					final DefinedPermission defPerm = wPerm.get();

					if (defPerm == null) {
						permissions.add(strPerm);
					} else {
						permissions.add(defPerm.toString(separator));
					}
				}
			}
		}
	}

	return permissions;
}
 

import org.apache.shiro.util.PermissionUtils; //导入依赖的package包/类
public static Set<String> toPrivilegeStrings(String s) {
  return PermissionUtils.toPermissionStrings(s);
}