import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Test
public void testNoPermissionsToFindFolder() throws Exception
{
    try
    {
        AuthenticationUtil.pushAuthentication();
        AuthenticationUtil.setFullyAuthenticatedUser("BOB-1");
        fileFolderLoader.createFiles(
                hiddenFolderPath,
                0, 256, 1024L, 1024L, Long.MAX_VALUE, false,
                10, 256L);
        fail("No permissions to see folder.");
    }
    catch (AccessDeniedException e)
    {
        // Expected
    }
    finally
    {
        AuthenticationUtil.popAuthentication();
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
public TaskFormPersister(ContentModelItemData<WorkflowTask> itemData,
            NamespaceService namespaceService,
            DictionaryService dictionaryService,
            WorkflowService workflowService,
            NodeService nodeService,
            AuthenticationService authenticationService,
            BehaviourFilter behaviourFilter, Log logger)
{
    super(itemData, namespaceService, dictionaryService, logger);
    WorkflowTask item = itemData.getItem();

    // make sure that the task is not already completed
    if (item.getState().equals(WorkflowTaskState.COMPLETED))
    {
        throw new AlfrescoRuntimeException("workflowtask.already.done.error");
    }

    // make sure the current user is able to edit the task
    if (!workflowService.isTaskEditable(item, authenticationService.getCurrentUserName()))
    {
        throw new AccessDeniedException("Failed to update task with id '" + item.getId() + "'.");
    }
    
    this.updater = new TaskUpdater(item.getId(), workflowService, nodeService, behaviourFilter);
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Override
protected ItemType getTypedItem(Item item)
{
    try
    {
        ParameterCheck.mandatory("item", item);
        return getTypedItemForDecodedId(item.getId());
    }
    catch (AccessDeniedException ade)
    {
        throw ade;
    }
    catch (Exception e)
    {
        throw new FormNotFoundException(item, e);
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Override
public void beforeDeleteNode(final NodeRef commentNodeRef)
{
    NodeRef discussableNodeRef = getDiscussableAncestor(commentNodeRef);
    if (discussableNodeRef != null)
    {
        boolean canDelete = canDeletePermission(commentNodeRef);
        if (behaviourFilter.isEnabled(ContentModel.ASPECT_LOCKABLE) // eg. delete site (MNT-14671)
                && isWorkingCopyOrLocked(discussableNodeRef)
                && !isLockOwner(discussableNodeRef)
                && canDelete)
        {
            throw new NodeLockedException(discussableNodeRef);
        }

        if (! canDelete)
        {
            throw new AccessDeniedException("Cannot delete comment");
        }
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Returns count of messages with {@link javax.mail.Flags.Flag#RECENT} flag.
 * If {@code reset} parameter is {@code true} - removes {@link javax.mail.Flags.Flag#RECENT} flag from
 * the message for current user.
 * 
 * @param reset - if true the {@link javax.mail.Flags.Flag#RECENT} will be deleted for current user if exists.
 * @return returns count of recent messages.
 */
@Override
public int getRecentCount(boolean reset)
{
    int recent = getFolderStatus().recentCount;
    if (reset && recent > 0)
    {
        CommandCallback<Void> command = new CommandCallback<Void>()
        {
            public Void command() throws Throwable
            {
                for (FileInfo fileInfo : folderStatus.search.values())
                {
                    Flags flags = imapService.getFlags(fileInfo);
                    if (flags.contains(Flags.Flag.RECENT))
                    {
                        imapService.setFlag(fileInfo, Flags.Flag.RECENT, false);
                    }
                }
                return null;
            }
        };
        try
        {
            command.run();
        }
        catch (AccessDeniedException ade)
        {
            if (logger.isDebugEnabled())
            {
                logger.debug("Access denied to reset RECENT FLAG");
            }
        }
    }
    return recent;        
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Override
public BlogPostInfo getBlogPost(NodeRef parentNodeRef, String postName) 
{
   NodeRef postNode;
   try
   {
      postNode = nodeService.getChildByName(parentNodeRef, ContentModel.ASSOC_CONTAINS, postName);
   }
   catch(AccessDeniedException e)
   {
      // You can't see that blog post
      // For compatibility with the old webscripts, rather than
      //  reporting permission denied, pretend it isn't there
      postNode = null;
   }

   // If we found a node, wrap it as a BlogPostInfo
   if (postNode != null)
   {
      return buildBlogPost(postNode, parentNodeRef, postName);
   }
   return null;
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Checks if the current user is allowed to get change data.
 */
protected void checkWrite(String userId)
{
    if (userId == null)
    {
        throw new IllegalArgumentException("User Id may not be null!");
    }

    String currentUser = AuthenticationUtil.getRunAsUser();
    if (currentUser == null)
    {
        throw new IllegalArgumentException("No current user!");
    }

    if (currentUser.equalsIgnoreCase(userId) || authorityService.isAdminAuthority(currentUser)
            || AuthenticationUtil.isRunAsUserTheSystemUser())
    {
        return;
    }

    throw new AccessDeniedException("subscription_service.err.write-denied");
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Gets the Person given the username
 * 
 * @param username  the username of the person to get
 * @return the person node (type cm:person) or null if no such person exists 
 */
public ScriptNode getPerson(final String username)
{
	NodeRef personRef = null;

    ParameterCheck.mandatory("Username", username);
    try
    {
     personRef = personService.getPersonOrNull(username);
    }
    catch(AccessDeniedException e)
    {
    	// ok, just return null to indicate not found
    }

    return personRef == null ? null : new ScriptNode(personRef, services, getScope());
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
public Network getNetwork(String networkId)
{
	Network network = null;

       if(networkId.equals(TenantUtil.SYSTEM_TENANT) || networkId.equals(TenantUtil.DEFAULT_TENANT))
       {
       	return DEFAULT_NETWORK;
       }
       else if(tenantAdminService.existsTenant(networkId))
	{
		Tenant tenant = tenantAdminService.getTenant(networkId);
		if(hasAccess(networkId))
		{
			// if the user has access, then this must be their home network
			network = new Network(tenant, true, null, null, null, null);
		}
		else
		{
			throw new AccessDeniedException("Cannot get network, no permission");
		}
	}

	return network;
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Override
public boolean canRead(String sharedId)
{
    Pair<String, NodeRef> pair = getTenantNodeRefFromSharedId(sharedId);
    final String tenantDomain = pair.getFirst();
    final NodeRef nodeRef = pair.getSecond();
    
    return TenantUtil.runAsTenant(new TenantRunAsWork<Boolean>()
    {
        public Boolean doWork() throws Exception
        {
            try
            {
                checkQuickShareNode(nodeRef);
                return permissionService.hasPermission(nodeRef, PermissionService.READ) == AccessStatus.ALLOWED;
            }
            catch (AccessDeniedException ex)
            {
                return false;
            }
        }
    }, tenantDomain);
    
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
private String getCurrentUser()
{
    String currentUser = AuthenticationUtil.getFullyAuthenticatedUser();
    if (currentUser == null)
    {
        throw new AccessDeniedException("No authenticated user; cannot get archived nodes.");
    }

    if (!userNamesAreCaseSensitive
                && !AuthenticationUtil.getSystemUserName().equals(
                            tenantService.getBaseNameUser(currentUser)))
    {
        // user names are not case-sensitive
        currentUser = currentUser.toLowerCase();
    }
    return currentUser;
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
public void test_AR_2055()
{
    runAs(AuthenticationUtil.getAdminUserName());
    NodeRef folder = nodeService.createNode(rootNodeRef, ContentModel.ASSOC_CHILDREN, QName.createQName("{namespace}one"), ContentModel.TYPE_FOLDER).getChildRef();

    runAs("andy");
    List<String> pathElements = new ArrayList<String>();
    pathElements.add("monkey");
    try
    {
        FileFolderServiceImpl.makeFolders(serviceRegistry.getFileFolderService(), folder, pathElements, ContentModel.TYPE_FOLDER);
        fail();
    }
    catch (AccessDeniedException ade)
    {

    }

    runAs(AuthenticationUtil.getAdminUserName());
    permissionService.setPermission(folder, "andy", PermissionService.ALL_PERMISSIONS, true);

    FileFolderServiceImpl.makeFolders(serviceRegistry.getFileFolderService(), folder, pathElements, ContentModel.TYPE_FOLDER);

}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
private void checkThatNonMembersCanNotCreateFiles(final String userCollaborator, String fileFolderPrefix, FileInfo folder2Info)
{
    // now, as another user, that is not yet a member, try to create a file in this site
    // this use case is not really relevant to test method, but it is a good test for permissions
    AUTHENTICATION_COMPONENT.setCurrentUser(userCollaborator);
    try
    {
        FileInfo fileInfoForTestNewFileAsAnotherUser = FILE_FOLDER_SERVICE.create(
                folder2Info.getNodeRef(), 
                fileFolderPrefix + "user2.txt",
                ContentModel.TYPE_CONTENT);
        ContentWriter writer3_user2 = FILE_FOLDER_SERVICE.getWriter(fileInfoForTestNewFileAsAnotherUser.getNodeRef());
        writer3_user2.putContent("Just some old content that doesn't mean anything");

        fail("We should not reach this point. the user that tries to run this code, add the file, is not yet a member of the site");
    }
    catch (AccessDeniedException e)
    {
        // Expected
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Test
public void testNoPermissionsToWriteToFolder() throws Exception
{
    try
    {
        AuthenticationUtil.pushAuthentication();
        AuthenticationUtil.setFullyAuthenticatedUser("BOB-1");
        fileFolderLoader.createFiles(
                readOnlyFolderPath,
                1, 256, 1024L, 1024L, Long.MAX_VALUE, false,
                10, 256L);
        fail("Folder is read only.  Should not be able to write to it.");
    }
    catch (AccessDeniedException e)
    {
        // Expected
    }
    finally
    {
        AuthenticationUtil.popAuthentication();
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Tests the creation of a document link when the user doesn't have read
 * permission on the source node
 * 
 * @throws Exception
 */
public void testCreateDocLinkWithoutReadPermissionOnSource() throws Exception
{
    try
    {
        AuthenticationUtil.runAs(new RunAsWork<Void>()
        {
            @Override
            public Void doWork() throws Exception
            {
                documentLinkService.createDocumentLink(site2File, site1Folder2);
                return null;
            }
        }, TEST_USER);

        fail("no read permission on the source node must generate AccessDeniedException.");
    }
    catch (AccessDeniedException ex)
    {
        // Expected
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Tests the creation of a document link when the user doesn't have write
 * permission on the destination node
 * 
 * @throws Exception
 */
public void testCreateDocLinkWithoutWritePermissionOnDestination() throws Exception
{
    try
    {
        AuthenticationUtil.runAs(new RunAsWork<Void>()
        {
            @Override
            public Void doWork() throws Exception
            {
                documentLinkService.createDocumentLink(site1File1, site2Folder1);
                return null;
            }
        }, TEST_USER);

        fail("no write permission on the destination node must generate AccessDeniedException.");
    }
    catch (AccessDeniedException ex)
    {
        // Expected
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Tests the deletion of a document's links, with and without write
 * permissions
 * 
 * @throws Exception
 */
public void testDeleteLinks() throws Exception
{
    DeleteLinksStatusReport report = AuthenticationUtil.runAs(new RunAsWork<DeleteLinksStatusReport>()
    {
        @Override
        public DeleteLinksStatusReport doWork() throws Exception
        {
            return documentLinkService.deleteLinksToDocument(site1File2);
        }
    }, TEST_USER);

    // check if the service found 2 links of the document
    assertEquals(2, report.getTotalLinksFoundCount());

    // check if the service successfully deleted one
    assertEquals(1, report.getDeletedLinksCount());

    assertEquals(true, nodeService.hasAspect(site1File2, ApplicationModel.ASPECT_LINKED));

    // check if the second one failed with access denied
    Throwable ex = report.getErrorDetails().get(linkOfFile1Site2);
    assertNotNull(ex);
    assertEquals(ex.getClass(), AccessDeniedException.class);
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
public void testNonAdminCannotDeployWorkflowBySwitchingNodeTypeEvenInCorrectLocation()
{
    // Test precondition
    assertNull(workflowService.getDefinitionByName("activiti$testProcess"));
    
    AuthenticationUtil.setFullyAuthenticatedUser(USER1);
    NodeRef workflowParent = findWorkflowParent();
    
    try
    {
        createContentAndSwitchToWorkflow(
                "activiti$testProcess",
                "alfresco/workflow/test-security.bpmn20.xml",
                workflowParent);
        fail("User should not be able to create a node in the 'correct location'.");
    }
    catch (AccessDeniedException e)
    {
        // Good!
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
@Test
public void testCreateNode_noFilingRule() throws Exception
{
    NodeRef testTemplate2 = createVirtualizedFolder(testRootFolder.getNodeRef(),
                                                    "aVFTestTemplate2",
                                                    TEST_TEMPLATE_2_JSON_SYS_PATH);
    NodeRef testTemplate2Node2 = nodeService.getChildByName(testTemplate2,
                                                            ContentModel.ASSOC_CONTAINS,
                                                            "Node2");

    try
    {
        createContent(testTemplate2Node2,
                      "shouldNotBeCreated");
        fail("Should not be able to create node in a readonly context.");
    }
    catch (AccessDeniedException e)
    {
        logger.info("Succesfully denied creation in readonly",
                    e);
    }
}
 

import org.alfresco.repo.security.permissions.AccessDeniedException; //导入依赖的package包/类
/**
 * Test version service lock checking
 */
public void testVersionServiceLockBehaviour02()
{
    // Add the version aspect to the node
    this.nodeService.addAspect(this.nodeRef, ContentModel.ASPECT_VERSIONABLE, null);
    
    // Lock the node as the bad user with a write lock
    this.lockService.lock(this.nodeRef, LockType.WRITE_LOCK);
    try
    {
        TestWithUserUtils.authenticateUser(BAD_USER_NAME, PWD, rootNodeRef, this.authenticationService); 
        
        this.versionService.createVersion(this.nodeRef, new HashMap<String, Serializable>());
        fail("Should have failed since this node has been locked by another user with a write lock.");
    }
    catch (AccessDeniedException exception)
    {
        // Exception occurs when the properties are updated for a node
    }
}