import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Test
/**
 * tests {@link NamespaceWildcardAllowedAndOrStringExactMatchPermissionTypeServiceImpl#getMatchingPermissions(java.util.Map, java.util.List)}
 */
public void testIngesterPermissionExampleLikeRice() {
    Map<String, String> requestedDetails = getUseIngesterRequestedDetails();
    
    List<PermissionBo> permissionsList = new ArrayList<PermissionBo>();

    Template template = KimApiServiceLocator.getPermissionService().findPermTemplateByNamespaceCodeAndName("KR-NS",
            "Use Screen");
    permissionsList.add(createPermission(template, "Use All Screens", "KR-SYS", "namespaceCode=KR*"));
    PermissionBo exactMatch = createPermission(template, "Use Ingester Screen", "KR-WKFLW", "actionClass=" + INGESTER_ACTION, "namespaceCode=KR-WKFLW");
    permissionsList.add(exactMatch);

    List<Permission> immutablePermissionList = new ArrayList<Permission>();
    for (PermissionBo bo : permissionsList) {
        immutablePermissionList.add(PermissionBo.to(bo));
    }
   
    List<Permission> returnedPermissions = permissionService.getMatchingPermissions(requestedDetails, immutablePermissionList);
    assertTrue(returnedPermissions.size() == 1);
    assertTrue(returnedPermissions.get(0).equals(PermissionBo.to(exactMatch)));
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * tests for the data described in KULRICE-3770
 */
@Test
public void testIngesterPermissionExampleLikeKFS() {
    Map<String, String> requestedDetails = getUseIngesterRequestedDetails();
    
    List<PermissionBo> permissionsList = new ArrayList<PermissionBo>();

    Template template = KimApiServiceLocator.getPermissionService().findPermTemplateByNamespaceCodeAndName("KR-NS", "Use Screen");
    permissionsList.add(createPermission(template, "Use Screen", "KR-SYS", "namespaceCode=KR*"));
    PermissionBo exactMatch = createPermission(template, "Use Screen", "KR-WKFLW", "actionClass=" + INGESTER_ACTION);
    permissionsList.add(exactMatch);

    List<Permission> immutablePermissionList = new ArrayList<Permission>();
    for (PermissionBo bo : permissionsList) { immutablePermissionList.add(PermissionBo.to(bo));}
   
    List<Permission> returnedPermissions = permissionService.getMatchingPermissions(requestedDetails, immutablePermissionList);
    assertTrue(returnedPermissions.size() == 1);
    assertTrue(returnedPermissions.get(0).equals(PermissionBo.to(exactMatch)));
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * Filters the given permission list to return those that match on widget id, then calls super
 * to filter based on view id
 *
 * @param requestedDetails - map of details requested with permission (used for matching)
 * @param permissionsList - list of permissions to process for matches
 * @return List<Permission> list of permissions that match the requested details
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
        List<Permission> permissionsList) {

    String requestedWidgetId = requestedDetails.get(KimConstants.AttributeConstants.WIDGET_ID);

    List<Permission> matchingPermissions = new ArrayList<Permission>();
    for (Permission permission : permissionsList) {
        PermissionBo bo = PermissionBo.from(permission);

        String permissionWidgetId = bo.getDetails().get(KimConstants.AttributeConstants.WIDGET_ID);
        if (StringUtils.equals(requestedWidgetId, permissionWidgetId)) {
            matchingPermissions.add(permission);
        }
    }

    return super.performPermissionMatches(requestedDetails, matchingPermissions);
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * Filters the given permission list to return those that match on edit mode, then calls super to filter
 * based on view id
 *
 * @param requestedDetails - map of details requested with permission (used for matching)
 * @param permissionsList - list of permissions to process for matches
 * @return List<Permission> list of permissions that match the requested details
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
        List<Permission> permissionsList) {

    List<Permission> matchingPermissions = new ArrayList<Permission>();
    for (Permission permission : permissionsList) {
        PermissionBo bo = PermissionBo.from(permission);

        if (requestedDetails.get(KimConstants.AttributeConstants.EDIT_MODE).equals(bo.getDetails().get(
                KimConstants.AttributeConstants.EDIT_MODE))) {
            matchingPermissions.add(permission);
        }
    }

    return super.performPermissionMatches(requestedDetails, matchingPermissions);
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails, List<Permission> permissionsList) {
    String requestedParameterName = requestedDetails.get(KimConstants.AttributeConstants.PARAMETER_NAME);
    String requestedComponentName = requestedDetails.get(KimConstants.AttributeConstants.COMPONENT_NAME);
    List<Permission> matchingPermissions = new ArrayList<Permission>();
    for (Permission kpi : permissionsList ) {
        PermissionBo bo = PermissionBo.from(kpi);
        String parameterName = bo.getDetails().get(KimConstants.AttributeConstants.PARAMETER_NAME);
        String componentName = bo.getDetails().get(KimConstants.AttributeConstants.COMPONENT_NAME);
        if ( (StringUtils.isBlank(parameterName)
                || StringUtils.equals(requestedParameterName, parameterName)) 
            &&(StringUtils.isBlank(componentName)
                    || StringUtils.equals(requestedComponentName, componentName))) {
            matchingPermissions.add(kpi);
        }
    }
    return super.performPermissionMatches(requestedDetails, matchingPermissions);
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * 
 *	consider the document type hierarchy - check for a permission that just specifies the document type first at each level 
 *	- then if you don't find that, check for the doc type and the node, then the doc type and the Action Type.
 *
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
		List<Permission> permissionsList) {

       List<Permission> matchingPermissions = new ArrayList<Permission>();
	// loop over the permissions, checking the non-document-related ones
	for ( Permission kpi : permissionsList ) {
           PermissionBo bo = PermissionBo.from(kpi);
		if ( (routeNodeMatches(requestedDetails, bo.getDetails())) &&
			 (routeStatusMatches(requestedDetails, bo.getDetails())) ) {
			matchingPermissions.add( kpi );
		}			
	}
	// now, filter the list to just those for the current document
	matchingPermissions = super.performPermissionMatches( requestedDetails, matchingPermissions );
	return matchingPermissions;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
   *  Permission type service which can check the route node and status as well as the document hierarchy.
   *  
   *  Permission should be able to (in addition to taking the routingStatus, routingNote, and documentTypeName attributes) 
   *  should take a documentNumber and retrieve those values from workflow before performing the comparison.
   *
   *  consider the document type hierarchy - check for a permission that just specifies the document type first at each level 
   *  - then if you don't find that, check for the doc type and the node, then the doc type and the state. 
   *
*/
  @Override
  protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
          List<Permission> permissionsList) {
      List<Permission> matchingPermissions = new ArrayList<Permission>();
      // loop over the permissions, checking the non-document-related ones
      for ( Permission kpi : permissionsList ) {
          PermissionBo bo = PermissionBo.from(kpi);
          if ( routeNodeMatches(requestedDetails, bo.getDetails()) &&
               routeStatusMatches(requestedDetails, bo.getDetails()) &&
               appDocStatusMatches(requestedDetails, bo.getDetails()) ) {
              matchingPermissions.add( kpi );
          }           
      }
      // now, filter the list to just those for the current document
      matchingPermissions = super.performPermissionMatches( requestedDetails, matchingPermissions );
      return matchingPermissions;
  }
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * 
 *	consider the document type hierarchy - check for a permission that just specifies the document type first at each level 
 *	- then if you don't find that, check for the doc type and the node, then the doc type and the field.
 *
 *	- if the field value passed in starts with the value on the permission detail it is a match.  so...
 *	permision detail sourceAccountingLines will match passed in value of sourceAccountingLines.amount and sourceAccountingLines 
 *	permission detail sourceAccountingLines.objectCode will match sourceAccountingLines.objectCode but not sourceAccountingLines
 */
@Override
protected List<Permission> performPermissionMatches(Map<String, String> requestedDetails,
		List<Permission> permissionsList) {

       List<Permission> matchingPermissions = new ArrayList<Permission>();
	// loop over the permissions, checking the non-document-related ones
	for ( Permission kpi : permissionsList ) {
           PermissionBo bo = PermissionBo.from(kpi);
		if ( routeNodeMatches(requestedDetails, bo.getDetails()) &&
				doesPropertyNameMatch(requestedDetails.get(KimConstants.AttributeConstants.PROPERTY_NAME), bo.getDetails().get(KimConstants.AttributeConstants.PROPERTY_NAME)) ) {
			matchingPermissions.add( kpi );
		}			
	}
	// now, filter the list to just those for the current document
	matchingPermissions = super.performPermissionMatches( requestedDetails, matchingPermissions );
	return matchingPermissions;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Override
public List<Permission> getAuthorizedPermissions( String principalId,
        String namespaceCode, String permissionName,
        Map<String, String> qualification ) throws RiceIllegalArgumentException {
    incomingParamCheck(principalId, "principalId");
    incomingParamCheck(namespaceCode, "namespaceCode");
    incomingParamCheck(permissionName, "permissionName");
    incomingParamCheck(qualification, "qualification");

    // get all the permission objects whose name match that requested
	List<Permission> permissions = getPermissionsByName(namespaceCode, permissionName);
	// now, filter the full list by the detail passed
	List<Permission> applicablePermissions = getMatchingPermissions( permissions, null );
    List<Permission> permissionsForUser = getPermissionsForUser(principalId, applicablePermissions, qualification);
	return permissionsForUser;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Override
public List<String> getRoleIdsForPermission(String namespaceCode, String permissionName) throws RiceIllegalArgumentException {
    incomingParamCheck(namespaceCode, "namespaceCode");
    incomingParamCheck(permissionName, "permissionName");
    // note...this method is cached at the RoleService interface level using an annotation, but it's called quite
    // a bit internally, so we'll reproduce the caching here using the same key to help optimize
    String cacheKey =  new StringBuilder("{RoleIds}")
            .append("namespaceCode=").append(namespaceCode).append("|")
            .append("name=").append(permissionName).toString();
    Cache.ValueWrapper cachedValue = cacheManager.getCache(Permission.Cache.NAME).get(cacheKey);
    if (cachedValue != null && cachedValue.get() instanceof List) {
        return ((List<String>)cachedValue.get());
    }
    // get all the permission objects whose name match that requested
    List<Permission> permissions = getPermissionsByName(namespaceCode, permissionName);
    // now, filter the full list by the detail passed
    List<Permission> applicablePermissions = getMatchingPermissions(permissions, null);
    List<String> roleIds = getRoleIdsForPermissions(applicablePermissions);
    cacheManager.getCache(Permission.Cache.NAME).put(cacheKey, roleIds);
    return roleIds;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
protected List<String> getRoleIdsForPermissionTemplate(String namespaceCode,
        String permissionTemplateName,
        Map<String, String> permissionDetails) {
    String cacheKey =  new StringBuilder("{getRoleIdsForPermissionTemplate}")
            .append("namespaceCode=").append(namespaceCode).append("|")
            .append("permissionTemplateName=").append(permissionTemplateName).append("|")
            .append("permissionDetails=").append(CacheKeyUtils.mapKey(permissionDetails)).toString();
    Cache.ValueWrapper cachedValue = cacheManager.getCache(Permission.Cache.NAME).get(cacheKey);
    if (cachedValue != null && cachedValue.get() instanceof List) {
        return ((List<String>)cachedValue.get());
    }
	// get all the permission objects whose name match that requested
	List<Permission> permissions = getPermissionsByTemplateName(namespaceCode, permissionTemplateName);
	// now, filter the full list by the detail passed
	List<Permission> applicablePermissions = getMatchingPermissions(permissions, permissionDetails);
	List<String> roleIds = getRoleIdsForPermissions(applicablePermissions);
    cacheManager.getCache(Permission.Cache.NAME).put(cacheKey, roleIds);
    return roleIds;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
protected List<Permission> getPermissionsByTemplateName( String namespaceCode, String permissionTemplateName ){
    String cacheKey =  new StringBuilder("{getPermissionsByTemplateName}")
            .append("namespaceCode=").append(namespaceCode).append("|")
            .append("permissionTemplateName=").append(permissionTemplateName).toString();
    Cache.ValueWrapper cachedValue = cacheManager.getCache(Permission.Cache.NAME).get(cacheKey);
    if (cachedValue != null && cachedValue.get() instanceof List) {
        return ((List<Permission>)cachedValue.get());
    }
    HashMap<String,Object> criteria = new HashMap<String,Object>(3);
    criteria.put("template.namespaceCode", namespaceCode);
    criteria.put("template.name", permissionTemplateName);
    criteria.put("template.active", Boolean.TRUE);
    criteria.put(KRADPropertyConstants.ACTIVE, Boolean.TRUE);
    List<Permission> permissions =
            toPermissions(dataObjectService.findMatching(PermissionBo.class, QueryByCriteria.Builder.andAttributes(criteria).build()).getResults());
    cacheManager.getCache(Permission.Cache.NAME).put(cacheKey, permissions);
    return permissions;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
protected List<Permission> getPermissionsByName( String namespaceCode, String permissionName ) {
    String cacheKey =  new StringBuilder("{getPermissionsByName}")
            .append("namespaceCode=").append(namespaceCode).append("|")
            .append("permissionName=").append(permissionName).toString();
    Cache.ValueWrapper cachedValue = cacheManager.getCache(Permission.Cache.NAME).get(cacheKey);
    if (cachedValue != null && cachedValue.get() instanceof List) {
        return ((List<Permission>)cachedValue.get());
    }
    HashMap<String,Object> criteria = new HashMap<String,Object>(3);
    criteria.put(KimConstants.UniqueKeyConstants.NAMESPACE_CODE, namespaceCode);
    criteria.put(KimConstants.UniqueKeyConstants.PERMISSION_NAME, permissionName);
    criteria.put(KRADPropertyConstants.ACTIVE, Boolean.TRUE);
    List<Permission> permissions =
            toPermissions(dataObjectService.findMatching( PermissionBo.class, QueryByCriteria.Builder.andAttributes(criteria).build() ).getResults());
    cacheManager.getCache(Permission.Cache.NAME).put(cacheKey, permissions);
    return permissions;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Override
public Permission createPermission(Permission permission)
		throws RiceIllegalArgumentException, RiceIllegalStateException {
       incomingParamCheck(permission, "permission");

       if (StringUtils.isNotBlank(permission.getId()) && getPermission(permission.getId()) != null) {
           throw new RiceIllegalStateException("the permission to create already exists: " + permission);
       }
       List<PermissionAttributeBo> attrBos = Collections.emptyList();
       if (permission.getTemplate() != null) {
           attrBos = KimAttributeDataBo.createFrom(PermissionAttributeBo.class, permission.getAttributes(), permission.getTemplate().getKimTypeId());
       }
       PermissionBo bo = PermissionBo.from(permission);
       if (bo.getTemplate() == null && bo.getTemplateId() != null) {
           bo.setTemplate(PermissionTemplateBo.from(getPermissionTemplate(bo.getTemplateId())));
       }
       bo.setAttributeDetails(attrBos);
       return PermissionBo.to(dataObjectService.save(bo));
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Override
public PermissionQueryResults findPermissions(final QueryByCriteria queryByCriteria)
        throws RiceIllegalArgumentException {
    incomingParamCheck(queryByCriteria, "queryByCriteria");

    QueryResults<PermissionBo> results = dataObjectService.findMatching(PermissionBo.class,
            AttributeTransform.getInstance().apply(queryByCriteria));

    PermissionQueryResults.Builder builder = PermissionQueryResults.Builder.create();
    builder.setMoreResultsAvailable(results.isMoreResultsAvailable());
    builder.setTotalRowCount(results.getTotalRowCount());

    final List<Permission.Builder> ims = new ArrayList<Permission.Builder>();
    for (PermissionBo bo : results.getResults()) {
        ims.add(Permission.Builder.create(bo));
    }

    builder.setResults(ims);
    return builder.build();
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
private List<String> getRoleIdsForPermissionIds(Collection<String> permissionIds) {
    if (CollectionUtils.isEmpty(permissionIds)) {
        return Collections.emptyList();
    }
    String cacheKey =  new StringBuilder("{getRoleIdsForPermissionIds}")
            .append("permissionIds=").append(CacheKeyUtils.key(permissionIds)).toString();
    Cache.ValueWrapper cachedValue = cacheManager.getCache(Permission.Cache.NAME).get(cacheKey);
    if (cachedValue != null && cachedValue.get() instanceof List) {
        return ((List<String>)cachedValue.get());
    }
    QueryByCriteria query = QueryByCriteria.Builder.fromPredicates(equal("active", Boolean.TRUE), in("permissionId", permissionIds.toArray(new String[]{})));
    QueryResults<RolePermissionBo> results = dataObjectService.findMatching(RolePermissionBo.class, query);
    List<String> roleIds = new ArrayList<String>();
    for (RolePermissionBo bo : results.getResults()) {
        roleIds.add(bo.getRoleId());
    }
    roleIds = Collections.unmodifiableList(roleIds);
    cacheManager.getCache(Permission.Cache.NAME).put(cacheKey, roleIds);
    return roleIds;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * Converts a immutable object to its mutable counterpart
 * @param im immutable object
 * @return the mutable bo
 */
public static PermissionBo from(Permission im) {
    if (im == null) {
        return null;
    }
    PermissionBo bo = new PermissionBo();
    bo.setId(im.getId());
    bo.setNamespaceCode(im.getNamespaceCode());
    bo.setName(im.getName());
    bo.setDescription(im.getDescription());
    bo.setActive(im.isActive());
    bo.setTemplateId(im.getTemplate() != null ? im.getTemplate().getId() : null);
    bo.setTemplate(PermissionTemplateBo.from(im.getTemplate()));
    bo.setAttributes(im.getAttributes());
    bo.setVersionNumber(im.getVersionNumber());
    bo.setObjectId(im.getObjectId());
    return bo;
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
/**
 * Validates a new permission and then saves it.
 * 
 * @param newPermission
 * @throws IllegalArgumentException if newPermission is null.
 * @throws UnmarshalException if newPermission contains invalid data.
 */
static void validateAndPersistNewPermission(PermissionXmlDTO newPermission) throws UnmarshalException {
    if (newPermission == null) {
        throw new IllegalArgumentException("Cannot persist a null permission");
    }
    
    // Validate the new permission.
    validatePermission(newPermission);
    
    // Save the permission.
    Permission.Builder builder = Permission.Builder.create(newPermission.getNamespaceCode(), newPermission.getPermissionName());
    builder.setDescription(newPermission.getPermissionDescription());
    builder.setActive(newPermission.getActive().booleanValue());
    builder.setAttributes(newPermission.getPermissionDetails());
    
    KimApiServiceLocator.getPermissionService().createPermission(builder.build());
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Test
public void testGroupNameMatchOnPopulateGroupPermission() {
    Map<String, String> requestedDetails = getGroupRequestedDetails();
    List<PermissionBo> permissionsList = new ArrayList<PermissionBo>();

    Template template = KimApiServiceLocator.getPermissionService().findPermTemplateByNamespaceCodeAndName
        ("KR-IDM","Populate Group");

    List <String> permAttrsGeneric= new ArrayList<String>();
    permAttrsGeneric.add("namespaceCode=KR*");

    List <String> permAttrsForSpecificKimTypeName= new ArrayList<String>();
    permAttrsForSpecificKimTypeName.add("namespaceCode=KR*");
    permAttrsForSpecificKimTypeName.add("kimTypeName=Default");

    List <String> permAttrsForSpecificGroupName= new ArrayList<String>();
    permAttrsForSpecificGroupName.add("groupName=WorkflowAdmin");
    permAttrsForSpecificGroupName.add("namespaceCode=KR*");

    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_NMSPC_KR, "KR-SYS", permAttrsGeneric));
    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_TYPE_DEFAULT, "KR-SYS", permAttrsForSpecificKimTypeName));
    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_GROUP_NM, "KR-SYS", permAttrsForSpecificGroupName));

    List<Permission> immutablePermissionList = new ArrayList<Permission>();
    for (PermissionBo bo : permissionsList) {
        immutablePermissionList.add(PermissionBo.to(bo));
    }
   
    List<Permission> returnedPermissions = permissionService.getMatchingPermissions(requestedDetails, immutablePermissionList);
    assertTrue(returnedPermissions.size() == 1);
    assertTrue(returnedPermissions.get(0).getName().equals(PERM_NM_POP_GROUP_GROUP_NM));
}
 

import org.kuali.rice.kim.api.permission.Permission; //导入依赖的package包/类
@Test
public void testTypeNameMatchOnPopulateGroupPermission() {
    Map<String, String> requestedDetails = getGroupRequestedDetails();
    List<PermissionBo> permissionsList = new ArrayList<PermissionBo>();

    Template template = KimApiServiceLocator.getPermissionService().findPermTemplateByNamespaceCodeAndName
            ("KR-IDM","Populate Group");

    List <String> permAttrsGeneric= new ArrayList<String>();
    permAttrsGeneric.add("namespaceCode=KR*");

    List <String> permAttrsForSpecificKimTypeName= new ArrayList<String>();
    permAttrsForSpecificKimTypeName.add("namespaceCode=KR*");
    permAttrsForSpecificKimTypeName.add("kimTypeName=Default");

    List <String> permAttrsForSpecificGroupName= new ArrayList<String>();
    permAttrsForSpecificGroupName.add("groupName=NotTheGroupWeAreModifying");
    permAttrsForSpecificGroupName.add("namespaceCode=KR*");

    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_NMSPC_KR, "KR-SYS", permAttrsGeneric));
    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_TYPE_DEFAULT, "KR-SYS", permAttrsForSpecificKimTypeName));
    permissionsList.add(createPermission(template, PERM_NM_POP_GROUP_GROUP_NM, "KR-SYS", permAttrsForSpecificGroupName));

    List<Permission> immutablePermissionList = new ArrayList<Permission>();
    for (PermissionBo bo : permissionsList) {
        immutablePermissionList.add(PermissionBo.to(bo));
    }

    List<Permission> returnedPermissions = permissionService.getMatchingPermissions(requestedDetails, immutablePermissionList);
    assertTrue(returnedPermissions.size() == 1);
    assertTrue(returnedPermissions.get(0).getName().equals(PERM_NM_POP_GROUP_TYPE_DEFAULT));
}