import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
protected void checkAuthorization(ActionForm form, String methodToCall) throws AuthorizationException {
    if (!(form instanceof LookupForm)) {
        super.checkAuthorization(form, methodToCall);
    } else {
        try {
            Class businessObjectClass = Class.forName(((LookupForm) form).getBusinessObjectClassName());
            if (!KimApiServiceLocator.getPermissionService().isAuthorizedByTemplate(
                    GlobalVariables.getUserSession().getPrincipalId(), KRADConstants.KNS_NAMESPACE,
                    KimConstants.PermissionTemplateNames.LOOK_UP_RECORDS,
                    KRADUtils.getNamespaceAndComponentSimpleName(businessObjectClass),
                    Collections.<String, String>emptyMap())) {
                throw new AuthorizationException(GlobalVariables.getUserSession().getPerson().getPrincipalName(),
                        KimConstants.PermissionTemplateNames.LOOK_UP_RECORDS,
                        businessObjectClass.getSimpleName());
            }
        }
        catch (ClassNotFoundException e) {
            LOG.warn("Unable to load BusinessObject class: " + ((LookupForm) form).getBusinessObjectClassName(), e);
            super.checkAuthorization(form, methodToCall);
        }
    }
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
  public HtmlData getInquiryUrl(BusinessObject businessObject, String attributeName, boolean forceInquiry) {
  	/*
  	 *  - permission detail values (attribute name and value separated by colon, commas between attributes)
 *	- required role qualifiers (attribute name and value separated by colon, commas between attributes)
 *	- list of roles assigned: role type, role namespace, role name
  	 */
if(NAME.equals(attributeName) || NAME_TO_DISPLAY.equals(attributeName)){
	return getInquiryUrlForPrimaryKeys(UberPermissionBo.class, businessObject, Collections.singletonList(KimConstants.PrimaryKeyConstants.PERMISSION_ID), null);
} else if(NAMESPACE_CODE.equals(attributeName) || TEMPLATE_NAMESPACE_CODE.equals(attributeName)){
	NamespaceBo parameterNamespace = new NamespaceBo();
          String code = (String) KradDataServiceLocator.getDataObjectService().wrap(businessObject).getPropertyValueNullSafe(attributeName);
	parameterNamespace.setCode(code);
	return getInquiryUrlForPrimaryKeys(NamespaceBo.class, parameterNamespace, Collections.singletonList(KRADPropertyConstants.CODE), null);
      } else if(DETAIL_OBJECTS.equals(attributeName)){
      	//return getAttributesInquiryUrl(businessObject, DETAIL_OBJECTS);
      } else if(ASSIGNED_TO_ROLES.equals(attributeName)){
      	return getAssignedRoleInquiryUrl(businessObject);
      }

      return super.getInquiryUrl(businessObject, attributeName, forceInquiry);
  }
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected boolean validAssignGroup(GroupDocumentMember groupMember, IdentityManagementGroupDocument document){
       boolean rulePassed = true;
	if(StringUtils.isNotEmpty(document.getGroupNamespace())){
		Map<String,String> roleDetails = new HashMap<String,String>();
		roleDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, document.getGroupNamespace());
		roleDetails.put(KimConstants.AttributeConstants.GROUP_NAME, document.getGroupName());
		if (!getDocumentDictionaryService().getDocumentAuthorizer(document).isAuthorizedByTemplate(
				document, 
				KimConstants.NAMESPACE_CODE, 
				KimConstants.PermissionTemplateNames.POPULATE_GROUP,
				GlobalVariables.getUserSession().getPerson().getPrincipalId(), 
				roleDetails, null)){
            GlobalVariables.getMessageMap().putError(ERROR_PATH, RiceKeyConstants.ERROR_ASSIGN_GROUP, 
            		new String[] {document.getGroupNamespace(), document.getGroupName()});
            rulePassed = false;
		}
	}
	return rulePassed;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
   public List<RoleMembership> getRoleMembersFromDerivedRole(String namespaceCode, String roleName, Map<String, String> qualification) {
	if (StringUtils.isBlank(namespaceCode)) {
           throw new RiceIllegalArgumentException("namespaceCode was null or blank");
       }

       if (StringUtils.isBlank(roleName)) {
           throw new RiceIllegalArgumentException("roleName was null");
       }
       List<RoleMembership> members = new ArrayList<RoleMembership>();
	if ( qualification != null && !qualification.isEmpty() ) {
	    String principalId = qualification.get(KimConstants.AttributeConstants.PRINCIPAL_ID);
		if (qualification.containsKey(KimConstants.AttributeConstants.PRINCIPAL_ID)
				&& hasDerivedRole(principalId, null, namespaceCode,
						roleName, qualification)) {
               members.add(RoleMembership.Builder.create(null/*roleId*/, null, principalId, MemberType.PRINCIPAL, null).build());
		}
	}
	return members;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * @see ViewAuthorizer#canEditGroup(org.kuali.rice.krad.uif.view.View, org.kuali.rice.krad.uif.view.ViewModel,
 * org.kuali.rice.krad.uif.container.Group, java.lang.String, org.kuali.rice.kim.api.identity.Person)
 */
public boolean canEditGroup(View view, ViewModel model, Group group, String groupId, Person user) {
    ComponentSecurity componentSecurity = group.getComponentSecurity();

    // check component security exists
    if (componentSecurity == null) {
        return true;
    }

    // check edit group authz flag is set
    if (componentSecurity.isEditAuthz() == null || !componentSecurity.isEditAuthz().booleanValue()) {
        return true;
    }

    return isAuthorizedByTemplate(view, group, model, KimConstants.PermissionTemplateNames.EDIT_GROUP, user, null,
            null, false);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * @see ViewAuthorizer#canEditWidget(org.kuali.rice.krad.uif.view.View, org.kuali.rice.krad.uif.view.ViewModel,
 * org.kuali.rice.krad.uif.widget.Widget, java.lang.String, org.kuali.rice.kim.api.identity.Person)
 */
public boolean canEditWidget(View view, ViewModel model, Widget widget, String widgetId, Person user) {
    ComponentSecurity componentSecurity = widget.getComponentSecurity();

    // check component security exists
    if (componentSecurity == null) {
        return true;
    }

    // check edit widget authz flag is set
    if (componentSecurity.isEditAuthz() == null || !componentSecurity.isEditAuthz().booleanValue()) {
        return true;
    }

    return isAuthorizedByTemplate(view, widget, model, KimConstants.PermissionTemplateNames.EDIT_WIDGET, user, null,
            null, false);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * @see ViewAuthorizer#canViewWidget(org.kuali.rice.krad.uif.view.View, org.kuali.rice.krad.uif.view.ViewModel,
 * org.kuali.rice.krad.uif.widget.Widget, java.lang.String, org.kuali.rice.kim.api.identity.Person)
 */
public boolean canViewWidget(View view, ViewModel model, Widget widget, String widgetId, Person user) {
    ComponentSecurity componentSecurity = widget.getComponentSecurity();

    // check component security exists
    if (componentSecurity == null) {
        return true;
    }

    // check view widget authz flag is set
    if (componentSecurity.isViewAuthz() == null || !componentSecurity.isViewAuthz().booleanValue()) {
        return true;
    }

    return isAuthorizedByTemplate(view, widget, model, KimConstants.PermissionTemplateNames.VIEW_WIDGET, user, null,
            null, false);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected boolean checkAllowsMaintenanceEdit(String initiatorPrincipalId, ParameterBo newBO) {

		 boolean allowsEdit = false;
	        ParameterBo parm = newBO;
	        
	        Map<String, String> permissionDetails = new HashMap<String, String>();
	        permissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, parm.getNamespaceCode());
	        permissionDetails.put(KimConstants.AttributeConstants.COMPONENT_NAME, parm.getComponentCode());
	        permissionDetails.put(KimConstants.AttributeConstants.PARAMETER_NAME, parm.getName());
	        allowsEdit = KimApiServiceLocator.getPermissionService().isAuthorizedByTemplate(
                    GlobalVariables.getUserSession().getPerson().getPrincipalId(), KRADConstants.KNS_NAMESPACE,
                    KimConstants.PermissionTemplateNames.MAINTAIN_SYSTEM_PARAMETER, permissionDetails,
                    Collections.<String, String>emptyMap());
	        if(!allowsEdit){
	        	putGlobalError(RiceKeyConstants.AUTHORIZATION_ERROR_PARAMETER);
	        }
	        return allowsEdit;
	}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
public boolean removePrincipalFromGroup(String principalId, String groupId) throws RiceIllegalArgumentException {
	incomingParamCheck(principalId, "principalId");
    incomingParamCheck(groupId, "groupId");

    List<GroupMemberBo> groupMembers =
		getActiveGroupMembers(groupId, principalId, KimConstants.KimGroupMemberTypes.PRINCIPAL_MEMBER_TYPE);

    if(groupMembers.size() == 1) {
    	GroupMemberBo member = groupMembers.iterator().next();
    	member.setActiveToDateValue(new java.sql.Timestamp(DateTime.now().getMillis()));
    	this.dataObjectService.save(member);
        KimImplServiceLocator.getGroupInternalService().updateForUserRemovedFromGroup(member.getMemberId(),
                member.getGroupId());
        return true;
    }

    return false;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected HtmlData getEditGroupUrl(GroupBo groupBo) {
  	String href = "";

      Properties parameters = new Properties();
      parameters.put(KRADConstants.DISPATCH_REQUEST_PARAMETER, KRADConstants.DOC_HANDLER_METHOD);
      parameters.put(KRADConstants.PARAMETER_COMMAND, KewApiConstants.INITIATE_COMMAND);
      parameters.put(KRADConstants.DOCUMENT_TYPE_NAME, KimConstants.KimUIConstants.KIM_GROUP_DOCUMENT_TYPE_NAME);
      parameters.put(KimConstants.PrimaryKeyConstants.GROUP_ID, groupBo.getId());
      if (StringUtils.isNotBlank(getReturnLocation())) {
      	parameters.put(KRADConstants.RETURN_LOCATION_PARAMETER, getReturnLocation());
}
      href = UrlFactory.parameterizeUrl(KimCommonUtilsInternal.getKimBasePath()+KimConstants.KimUIConstants.KIM_GROUP_DOCUMENT_ACTION, parameters);
      
      HtmlData.AnchorHtmlData anchorHtmlData = new HtmlData.AnchorHtmlData(href,
      		KRADConstants.DOC_HANDLER_METHOD, KRADConstants.MAINTENANCE_EDIT_METHOD_TO_CALL);
      return anchorHtmlData;
  }
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
   public boolean canPartiallyUnmaskField(
		Person user, Class<?> dataObjectClass, String fieldName, Document document) {
	// KFSMI-5095
	if(isNonProductionEnvAndUnmaskingTurnedOff()) {
           return false;
       }

	if(user==null || StringUtils.isEmpty(user.getPrincipalId())) {
           return false;
       }

	if ( document == null ) {
		return getPermissionService().isAuthorizedByTemplate(user.getPrincipalId(), KRADConstants.KNS_NAMESPACE,
                   KimConstants.PermissionTemplateNames.PARTIAL_UNMASK_FIELD, new HashMap<String, String>(
                   getFieldPermissionDetails(dataObjectClass, fieldName)), Collections.<String, String>emptyMap());
	} else { // if a document was passed, evaluate the permission in the context of a document
		return getDocumentHelperService().getDocumentAuthorizer( document )
				.isAuthorizedByTemplate( document,
										 KRADConstants.KNS_NAMESPACE,
										 KimConstants.PermissionTemplateNames.PARTIAL_UNMASK_FIELD,
										 user.getPrincipalId(), getFieldPermissionDetails(dataObjectClass, fieldName), Collections.<String, String>emptyMap()  );
	}
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected Map<String, String> getGroupQualifier( String groupId, String kimTypeId, Map<String, String> groupAttributes, String routeLevel ) {
Map<String, String> qualifier = new HashMap<String, String>();
// pull the group to get its attributes for adding to the qualifier 
      qualifier.put(KimConstants.PrimaryKeyConstants.KIM_TYPE_ID, kimTypeId);
      qualifier.put(KimConstants.AttributeConstants.QUALIFIER_RESOLVER_PROVIDED_IDENTIFIER, kimTypeId);
      qualifier.put(KimConstants.PrimaryKeyConstants.GROUP_ID, groupId);
  	KimTypeService typeService = getTypeService(kimTypeId);
  	if ( typeService != null ) {
  		// check for the custom document type for the group
  		String customDocTypeName = typeService.getWorkflowDocumentTypeName();
  		if ( StringUtils.isNotBlank(customDocTypeName)) {
  			qualifier.put(KIM_ATTRIBUTE_DOCUMENT_TYPE_NAME, customDocTypeName );
  		}
  		putMatchingAttributesIntoQualifier(qualifier, groupAttributes, typeService.getWorkflowRoutingAttributes(routeLevel) );
  	}
  	return qualifier;
  }
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected boolean validAssignRole(KimDocumentRoleMember roleMember, IdentityManagementRoleDocument document){
       boolean rulePassed = true;
	if(StringUtils.isNotEmpty(document.getRoleNamespace())){
		Map<String,String> roleDetails = new HashMap<String,String>();
		roleDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, document.getRoleNamespace());
		roleDetails.put(KimConstants.AttributeConstants.ROLE_NAME, document.getRoleName());
		if (!getDocumentDictionaryService().getDocumentAuthorizer(document).isAuthorizedByTemplate(
				document, 
				KimConstants.NAMESPACE_CODE, 
				KimConstants.PermissionTemplateNames.ASSIGN_ROLE,
				GlobalVariables.getUserSession().getPerson().getPrincipalId(), 
				roleDetails, null)){
            GlobalVariables.getMessageMap().putError(ERROR_PATH, RiceKeyConstants.ERROR_ASSIGN_ROLE, 
            		new String[] {document.getRoleNamespace(), document.getRoleName()});
            rulePassed = false;
		}
	}
	return rulePassed;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * Retrieves a KimDelegationMemberImpl object by its ID and the ID of the delegation it belongs to. If the
 * delegation member exists in the cache,
 * this method will return the cached one; otherwise, it will retrieve the uncached version from the database and
 * then cache it before returning it.
 */
protected DelegateMemberBo getKimDelegationMemberImplByDelegationAndId(String delegationId,
        String delegationMemberId) {
    if (StringUtils.isBlank(delegationId) || StringUtils.isBlank(delegationMemberId)) {
        return null;
    }

    Map<String, String> searchCriteria = new HashMap<String, String>(2);
    searchCriteria.put(KimConstants.PrimaryKeyConstants.DELEGATION_ID, delegationId);
    searchCriteria.put(KimConstants.PrimaryKeyConstants.DELEGATION_MEMBER_ID, delegationMemberId);
    QueryResults<DelegateMemberBo> memberList = getDataObjectService().findMatching(DelegateMemberBo.class,
            QueryByCriteria.Builder.andAttributes(searchCriteria).build());
    if (!memberList.getResults().isEmpty()) {
        return memberList.getResults().get(0);
    }
    return null;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
public String getCreateNewUrl() {
    String url = "";

    if (getLookupableHelperService().allowsNewOrCopyAction(KimConstants.KimUIConstants.KIM_REVIEW_RESPONSIBILITY_DOCUMENT_TYPE_NAME)) {
        Properties parameters = new Properties();
        parameters.put(KRADConstants.DISPATCH_REQUEST_PARAMETER, KRADConstants.MAINTENANCE_NEW_METHOD_TO_CALL);
        parameters.put(KRADConstants.BUSINESS_OBJECT_CLASS_ATTRIBUTE, ReviewResponsibilityBo.class.getName());
        if (StringUtils.isNotBlank(getReturnLocation())) {
            parameters.put(KRADConstants.RETURN_LOCATION_PARAMETER, getReturnLocation());
        }
        url = UrlFactory.parameterizeUrl(KRADConstants.MAINTENANCE_ACTION, parameters);
        url = "<a title=\"Create a new record\" href=\"" + url + "\"><img src=\"images/tinybutton-createnew.gif\" alt=\"create new\" width=\"70\" height=\"15\"/></a>";
    }

    return url;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * Filters the given permission list to return those that match on widget id, then calls super
 * to filter based on view id
 *
 * @param requestedDetails - map of details requested with permission (used for matching)
 * @param permissionsList - list of permissions to process for matches
 * @return List<Permission> list of permissions that match the requested details
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
        List<Permission> permissionsList) {

    String requestedWidgetId = requestedDetails.get(KimConstants.AttributeConstants.WIDGET_ID);

    List<Permission> matchingPermissions = new ArrayList<Permission>();
    for (Permission permission : permissionsList) {
        PermissionBo bo = PermissionBo.from(permission);

        String permissionWidgetId = bo.getDetails().get(KimConstants.AttributeConstants.WIDGET_ID);
        if (StringUtils.equals(requestedWidgetId, permissionWidgetId)) {
            matchingPermissions.add(permission);
        }
    }

    return super.performPermissionMatches(requestedDetails, matchingPermissions);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
   protected boolean performMatch(Map<String, String> inputMap,
		Map<String, String> storedMap) {

	String requestedDocumentType = inputMap.get(KimConstants.AttributeConstants.DOCUMENT_TYPE_NAME);
	String permissionDocumentType = storedMap.get(KimConstants.AttributeConstants.DOCUMENT_TYPE_NAME);
	if ( requestedDocumentType == null || permissionDocumentType == null ) {
		return false; // again, don't match if missing document types
	}
	// exit if document types don't match
	if ( !requestedDocumentType.equals(permissionDocumentType) ) {
		return false;
	}
	// check the existing attributes only flag
	if ( !Boolean.parseBoolean(storedMap.get(KimConstants.AttributeConstants.EXISTING_RECORDS_ONLY)) ) {
		// if not set, then any document action allowed
		return true;
	}
	// otherwise, only edit actions are allowed (no New/Copy)
	return StringUtils.equals(inputMap.get(KRADConstants.MAINTENANCE_ACTN), KRADConstants.MAINTENANCE_EDIT_ACTION);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
@Override
public List<KimAttributeField> getAttributeDefinitions(String kimTypeId) {
	if (StringUtils.isBlank(kimTypeId)) {
           throw new RiceIllegalArgumentException("kimTypeId was null or blank");
       }

       List<KimAttributeField> map = new ArrayList<KimAttributeField>(super.getAttributeDefinitions(kimTypeId));

	for (int i = 0; i < map.size(); i++) {
           final KimAttributeField definition = map.get(i);
		if (KimConstants.AttributeConstants.CAMPUS_CODE.equals(definition.getAttributeField().getName())) {
			KimAttributeField.Builder b = KimAttributeField.Builder.create(definition);

               RemotableAttributeField.Builder fb =  b.getAttributeField();
               fb.setRequired(true);

               b.setAttributeField(fb);
               map.set(i, b.build());
		}
	}
	return Collections.unmodifiableList(map);
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
protected boolean validAssignRole(IdentityManagementRoleDocument document) {
    boolean rulePassed = true;
    if (StringUtils.isNotEmpty(document.getRoleNamespace())) {
        Map<String, String> additionalPermissionDetails = new HashMap<String, String>();
        additionalPermissionDetails.put(KimConstants.AttributeConstants.NAMESPACE_CODE, document.getRoleNamespace());
        additionalPermissionDetails.put(KimConstants.AttributeConstants.ROLE_NAME, document.getRoleName());
        if (!getDocumentHelperService().getDocumentAuthorizer(document).isAuthorizedByTemplate(
                document,
                KimConstants.NAMESPACE_CODE,
                KimConstants.PermissionTemplateNames.ASSIGN_ROLE,
                GlobalVariables.getUserSession().getPrincipalId(),
                additionalPermissionDetails, null)) {
            rulePassed = false;
        }
    }
    return rulePassed;
}
 

import org.kuali.rice.kim.api.KimConstants; //导入依赖的package包/类
/**
 * 
 *	consider the document type hierarchy - check for a permission that just specifies the document type first at each level 
 *	- then if you don't find that, check for the doc type and the node, then the doc type and the field.
 *
 *	- if the field value passed in starts with the value on the permission detail it is a match.  so...
 *	permision detail sourceAccountingLines will match passed in value of sourceAccountingLines.amount and sourceAccountingLines 
 *	permission detail sourceAccountingLines.objectCode will match sourceAccountingLines.objectCode but not sourceAccountingLines
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
		List<Permission> permissionsList) {

       List<Permission> matchingPermissions = new ArrayList<Permission>();
	// loop over the permissions, checking the non-document-related ones
	for ( Permission kpi : permissionsList ) {
           PermissionBo bo = PermissionBo.from(kpi);
		if ( routeNodeMatches(requestedDetails, bo.getDetails()) &&
				doesPropertyNameMatch(requestedDetails.get(KimConstants.AttributeConstants.PROPERTY_NAME), bo.getDetails().get(KimConstants.AttributeConstants.PROPERTY_NAME)) ) {
			matchingPermissions.add( kpi );
		}			
	}
	// now, filter the list to just those for the current document
	matchingPermissions = super.performPermissionMatches( requestedDetails, matchingPermissions );
	return matchingPermissions;
}