litvinovg/vitro
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NIHVIVO-3404 Require that the statement-based RequestedActions include a reference to an OntModel. So the paradigm changes from "may I do this with this statement?" to "may I do this with this statement and this model?"

Browse source
This commit is contained in:
j2blake 2012-04-01 15:46:43 +00:00
parent ed2f3ddc12
commit 7aa3b4f469
21 changed files with 204 additions and 131 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/policy/PolicyHelper.java
View file

@ -23,6 +23,7 @@ import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AddDataPro
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AddObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AddObjectPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.DropDataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.DropDataPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.DropObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.DropObjectPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.controller.VitroRequest;
/** /**
* A collection of static methods to help determine whether requested actions * A collection of static methods to help determine whether requested actions
@ -63,15 +64,15 @@ public class PolicyHelper {
* Do the current policies authorize the current user to add all of the * Do the current policies authorize the current user to add all of the
* statements in this model? * statements in this model?
*/ */
public static boolean isAuthorizedToAdd(HttpServletRequest req, Model model) { public static boolean isAuthorizedToAdd(VitroRequest vreq, Model model) {
if ((req == null) || (model == null)) { if ((vreq == null) || (model == null)) {
return false; return false;
} }
StmtIterator stmts = model.listStatements(); StmtIterator stmts = model.listStatements();
try { try {
while (stmts.hasNext()) { while (stmts.hasNext()) {
if (!isAuthorizedToAdd(req, stmts.next())) { if (!isAuthorizedToAdd(vreq, stmts.next())) {
return false; return false;
} }
} }
@ -86,9 +87,8 @@ public class PolicyHelper {
* *
* The statement is expected to be fully-populated, with no null fields. * The statement is expected to be fully-populated, with no null fields.
*/ */
public static boolean isAuthorizedToAdd(HttpServletRequest req, public static boolean isAuthorizedToAdd(VitroRequest vreq, Statement stmt) {
Statement stmt) { if ((vreq == null) || (stmt == null)) {
if ((req == null) || (stmt == null)) {
return false; return false;
} }
@ -101,28 +101,29 @@ public class PolicyHelper {
RequestedAction action; RequestedAction action;
if (objectNode.isResource()) { if (objectNode.isResource()) {
action = new AddObjectPropertyStatement(subject.getURI(), action = new AddObjectPropertyStatement(vreq.getJenaOntModel(),
predicate.getURI(), objectNode.asResource().getURI()); subject.getURI(), predicate.getURI(), objectNode
.asResource().getURI());
} else { } else {
action = new AddDataPropertyStatement(subject.getURI(), action = new AddDataPropertyStatement(vreq.getJenaOntModel(),
predicate.getURI()); subject.getURI(), predicate.getURI());
} }
return isAuthorizedForActions(req, action); return isAuthorizedForActions(vreq, action);
} }
/** /**
* Do the current policies authorize the current user to drop all of the * Do the current policies authorize the current user to drop all of the
* statements in this model? * statements in this model?
*/ */
public static boolean isAuthorizedToDrop(HttpServletRequest req, Model model) { public static boolean isAuthorizedToDrop(VitroRequest vreq, Model model) {
if ((req == null) || (model == null)) { if ((vreq == null) || (model == null)) {
return false; return false;
} }
StmtIterator stmts = model.listStatements(); StmtIterator stmts = model.listStatements();
try { try {
while (stmts.hasNext()) { while (stmts.hasNext()) {
if (!isAuthorizedToDrop(req, stmts.next())) { if (!isAuthorizedToDrop(vreq, stmts.next())) {
return false; return false;
} }
} }
@ -138,9 +139,8 @@ public class PolicyHelper {
* *
* The statement is expected to be fully-populated, with no null fields. * The statement is expected to be fully-populated, with no null fields.
*/ */
public static boolean isAuthorizedToDrop(HttpServletRequest req, public static boolean isAuthorizedToDrop(VitroRequest vreq, Statement stmt) {
Statement stmt) { if ((vreq == null) || (stmt == null)) {
if ((req == null) || (stmt == null)) {
return false; return false;
} }
@ -153,13 +153,14 @@ public class PolicyHelper {
RequestedAction action; RequestedAction action;
if (objectNode.isResource()) { if (objectNode.isResource()) {
action = new DropObjectPropertyStatement(subject.getURI(), action = new DropObjectPropertyStatement(vreq.getJenaOntModel(),
predicate.getURI(), objectNode.asResource().getURI()); subject.getURI(), predicate.getURI(), objectNode
.asResource().getURI());
} else { } else {
action = new DropDataPropertyStatement(subject.getURI(), action = new DropDataPropertyStatement(vreq.getJenaOntModel(),
predicate.getURI()); subject.getURI(), predicate.getURI());
} }
return isAuthorizedForActions(req, action); return isAuthorizedForActions(vreq, action);
} }
/** /**

14
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/AbstractDataPropertyStatementAction.java
View file

@ -2,7 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAction; import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
/** /**
@ -10,17 +11,20 @@ import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
* data property statements from a model. * data property statements from a model.
*/ */
public abstract class AbstractDataPropertyStatementAction extends public abstract class AbstractDataPropertyStatementAction extends
RequestedAction { AbstractPropertyStatementAction {
private final String subjectUri; private final String subjectUri;
private final String predicateUri; private final String predicateUri;
public AbstractDataPropertyStatementAction(String subjectUri, public AbstractDataPropertyStatementAction(OntModel ontModel,
String predicateUri) { String subjectUri, String predicateUri) {
super(ontModel);
this.subjectUri = subjectUri; this.subjectUri = subjectUri;
this.predicateUri = predicateUri; this.predicateUri = predicateUri;
} }
public AbstractDataPropertyStatementAction(DataPropertyStatement dps) { public AbstractDataPropertyStatementAction(OntModel ontModel,
DataPropertyStatement dps) {
super(ontModel);
this.subjectUri = (dps.getIndividual() == null) ? dps this.subjectUri = (dps.getIndividual() == null) ? dps
.getIndividualURI() : dps.getIndividual().getURI(); .getIndividualURI() : dps.getIndividual().getURI();
this.predicateUri = dps.getDatapropURI(); this.predicateUri = dps.getDatapropURI();

8
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/AbstractObjectPropertyStatementAction.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement;
/** /**
@ -14,14 +16,16 @@ public abstract class AbstractObjectPropertyStatementAction extends
private final String predicateUri; private final String predicateUri;
private final String objectUri; private final String objectUri;
public AbstractObjectPropertyStatementAction(String subjectUri, public AbstractObjectPropertyStatementAction(OntModel ontModel, String subjectUri,
String predicateUri, String objectUri) { String predicateUri, String objectUri) {
super(ontModel);
this.subjectUri = subjectUri; this.subjectUri = subjectUri;
this.predicateUri = predicateUri; this.predicateUri = predicateUri;
this.objectUri = objectUri; this.objectUri = objectUri;
} }
public AbstractObjectPropertyStatementAction(ObjectPropertyStatement ops) { public AbstractObjectPropertyStatementAction(OntModel ontModel, ObjectPropertyStatement ops) {
super(ontModel);
this.subjectUri = (ops.getSubject() == null) ? ops.getSubjectURI() this.subjectUri = (ops.getSubject() == null) ? ops.getSubjectURI()
: ops.getSubject().getURI(); : ops.getSubject().getURI();
this.predicateUri = (ops.getProperty() == null) ? ops.getPropertyURI() this.predicateUri = (ops.getProperty() == null) ? ops.getPropertyURI()

10
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/AbstractPropertyStatementAction.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAction; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAction;
/** /**
@ -9,5 +11,13 @@ import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAct
* statements from a model. * statements from a model.
*/ */
public abstract class AbstractPropertyStatementAction extends RequestedAction { public abstract class AbstractPropertyStatementAction extends RequestedAction {
private final OntModel ontModel;
public AbstractPropertyStatementAction(OntModel ontModel) {
this.ontModel = ontModel;
}
public OntModel getOntModel() {
return ontModel;
}
} }

11
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/AddDataPropertyStatement.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
/** /**
@ -10,12 +12,13 @@ import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
public class AddDataPropertyStatement extends public class AddDataPropertyStatement extends
AbstractDataPropertyStatementAction { AbstractDataPropertyStatementAction {
public AddDataPropertyStatement(String subjectUri, String predicateUri) { public AddDataPropertyStatement(OntModel ontModel, String subjectUri,
super(subjectUri, predicateUri); String predicateUri) {
super(ontModel, subjectUri, predicateUri);
} }
public AddDataPropertyStatement(DataPropertyStatement dps) { public AddDataPropertyStatement(OntModel ontModel, DataPropertyStatement dps) {
super(dps); super(ontModel, dps);
} }
} }

13
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/AddObjectPropertyStatement.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement;
/** /**
@ -9,12 +11,13 @@ import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement;
*/ */
public class AddObjectPropertyStatement extends public class AddObjectPropertyStatement extends
AbstractObjectPropertyStatementAction { AbstractObjectPropertyStatementAction {
public AddObjectPropertyStatement(String uriOfSub, String uriOfPred, public AddObjectPropertyStatement(OntModel ontModel, String uriOfSub,
String uriOfObj) { String uriOfPred, String uriOfObj) {
super(uriOfSub, uriOfPred, uriOfObj); super(ontModel, uriOfSub, uriOfPred, uriOfObj);
} }
public AddObjectPropertyStatement(ObjectPropertyStatement ops) { public AddObjectPropertyStatement(OntModel ontModel,
super(ops); ObjectPropertyStatement ops) {
super(ontModel, ops);
} }
} }

12
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/DropDataPropertyStatement.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
/** /**
@ -11,11 +13,13 @@ import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
public class DropDataPropertyStatement extends public class DropDataPropertyStatement extends
AbstractDataPropertyStatementAction { AbstractDataPropertyStatementAction {
public DropDataPropertyStatement(String subjectUri, String predicateUri) { public DropDataPropertyStatement(OntModel ontModel, String subjectUri,
super(subjectUri, predicateUri); String predicateUri) {
super(ontModel, subjectUri, predicateUri);
} }
public DropDataPropertyStatement(DataPropertyStatement dps) { public DropDataPropertyStatement(OntModel ontModel,
super(dps); DataPropertyStatement dps) {
super(ontModel, dps);
} }
} }

15
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/DropObjectPropertyStatement.java
View file

@ -2,18 +2,23 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement;
/** /**
* Should we allow the user to delete this ObjectPropertyStatement from this * Should we allow the user to delete this ObjectPropertyStatement from this
* model? * model?
*/ */
public class DropObjectPropertyStatement extends AbstractObjectPropertyStatementAction { public class DropObjectPropertyStatement extends
public DropObjectPropertyStatement(String sub, String pred, String obj) { AbstractObjectPropertyStatementAction {
super(sub, pred, obj); public DropObjectPropertyStatement(OntModel ontModel, String sub,
String pred, String obj) {
super(ontModel, sub, pred, obj);
} }
public DropObjectPropertyStatement(ObjectPropertyStatement ops) { public DropObjectPropertyStatement(OntModel ontModel,
super(ops); ObjectPropertyStatement ops) {
super(ontModel, ops);
} }
} }

12
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/EditDataPropertyStatement.java
View file

@ -2,6 +2,8 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
/** /**
@ -9,11 +11,13 @@ import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
*/ */
public class EditDataPropertyStatement extends public class EditDataPropertyStatement extends
AbstractDataPropertyStatementAction { AbstractDataPropertyStatementAction {
public EditDataPropertyStatement(String subjectUri, String predicateUri) { public EditDataPropertyStatement(OntModel ontModel, String subjectUri,
super(subjectUri, predicateUri); String predicateUri) {
super(ontModel, subjectUri, predicateUri);
} }
public EditDataPropertyStatement(DataPropertyStatement dps) { public EditDataPropertyStatement(OntModel ontModel,
super(dps); DataPropertyStatement dps) {
super(ontModel, dps);
} }
} }

16
webapp/src/edu/cornell/mannlib/vitro/webapp/auth/requestedAction/propstmt/EditObjectPropertyStatement.java
View file

@ -2,18 +2,22 @@
package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt; package edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt;
import com.hp.hpl.jena.ontology.OntModel;
import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.beans.ObjectPropertyStatement;
/** /**
* Should we allow the user to edit this ObjectPropertyStatement in this model? * Should we allow the user to edit this ObjectPropertyStatement in this model?
*/ */
public class EditObjectPropertyStatement extends AbstractObjectPropertyStatementAction { public class EditObjectPropertyStatement extends
public EditObjectPropertyStatement(String subjectUri, String keywordPredUri, AbstractObjectPropertyStatementAction {
String objectUri) { public EditObjectPropertyStatement(OntModel ontModel, String subjectUri,
super(subjectUri, keywordPredUri, objectUri); String keywordPredUri, String objectUri) {
super(ontModel, subjectUri, keywordPredUri, objectUri);
} }
public EditObjectPropertyStatement(ObjectPropertyStatement ops) { public EditObjectPropertyStatement(OntModel ontModel,
super(ops); ObjectPropertyStatement ops) {
super(ontModel, ops);
} }
} }

3
webapp/src/edu/cornell/mannlib/vitro/webapp/controller/admin/ShowAuthController.java
View file

@ -89,7 +89,8 @@ public class ShowAuthController extends FreemarkerHttpServlet {
* this individual? * this individual?
*/ */
private boolean mayEditIndividual(VitroRequest vreq, String individualUri) { private boolean mayEditIndividual(VitroRequest vreq, String individualUri) {
RequestedAction action = new EditObjectPropertyStatement(individualUri, RequestedAction action = new EditObjectPropertyStatement(
vreq.getJenaOntModel(), individualUri,
RequestActionConstants.SOME_URI, RequestActionConstants.SOME_URI,
RequestActionConstants.SOME_URI); RequestActionConstants.SOME_URI);
return PolicyHelper.isAuthorizedForActions(vreq, action); return PolicyHelper.isAuthorizedForActions(vreq, action);

14
webapp/src/edu/cornell/mannlib/vitro/webapp/controller/freemarker/ImageUploadController.java
View file

@ -138,14 +138,16 @@ public class ImageUploadController extends FreemarkerHttpServlet {
RequestedAction ra; RequestedAction ra;
if (ACTION_DELETE.equals(action) if (ACTION_DELETE.equals(action)
|| ACTION_DELETE_EDIT.equals(action)) { || ACTION_DELETE_EDIT.equals(action)) {
ra = new DropObjectPropertyStatement(entity.getURI(), ra = new DropObjectPropertyStatement(vreq.getJenaOntModel(),
VitroVocabulary.IND_MAIN_IMAGE, imageUri); entity.getURI(), VitroVocabulary.IND_MAIN_IMAGE,
imageUri);
} else if (imageUri != null) { } else if (imageUri != null) {
ra = new EditObjectPropertyStatement(entity.getURI(), ra = new EditObjectPropertyStatement(vreq.getJenaOntModel(),
VitroVocabulary.IND_MAIN_IMAGE, imageUri); entity.getURI(), VitroVocabulary.IND_MAIN_IMAGE,
imageUri);
} else { } else {
ra = new AddObjectPropertyStatement(entity.getURI(), ra = new AddObjectPropertyStatement(vreq.getJenaOntModel(),
VitroVocabulary.IND_MAIN_IMAGE, entity.getURI(), VitroVocabulary.IND_MAIN_IMAGE,
RequestActionConstants.SOME_URI); RequestActionConstants.SOME_URI);
} }
return new Actions(ra); return new Actions(ra);

6
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/BaseIndividualTemplateModel.java
View file

@ -112,9 +112,11 @@ public abstract class BaseIndividualTemplateModel extends BaseTemplateModel {
* an object property to the Individual being shown. * an object property to the Individual being shown.
*/ */
public boolean isEditable() { public boolean isEditable() {
AddDataPropertyStatement adps = new AddDataPropertyStatement(individual.getURI(), AddDataPropertyStatement adps = new AddDataPropertyStatement(
vreq.getJenaOntModel(), individual.getURI(),
RequestActionConstants.SOME_URI); RequestActionConstants.SOME_URI);
AddObjectPropertyStatement aops = new AddObjectPropertyStatement(individual.getURI(), AddObjectPropertyStatement aops = new AddObjectPropertyStatement(
vreq.getJenaOntModel(), individual.getURI(),
RequestActionConstants.SOME_URI, RequestActionConstants.SOME_URI,
RequestActionConstants.SOME_URI); RequestActionConstants.SOME_URI);
return PolicyHelper.isAuthorizedForActions(vreq, new Actions(adps).or(aops)); return PolicyHelper.isAuthorizedForActions(vreq, new Actions(adps).or(aops));

4
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/DataPropertyStatementTemplateModel.java
View file

@ -41,7 +41,7 @@ public class DataPropertyStatementTemplateModel extends PropertyStatementTemplat
private String makeDeleteUrl() { private String makeDeleteUrl() {
// Determine whether the statement can be deleted // Determine whether the statement can be deleted
DataPropertyStatement dps = makeStatement(); DataPropertyStatement dps = makeStatement();
RequestedAction action = new DropDataPropertyStatement(dps); RequestedAction action = new DropDataPropertyStatement(vreq.getJenaOntModel(), dps);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return ""; return "";
} }
@ -66,7 +66,7 @@ public class DataPropertyStatementTemplateModel extends PropertyStatementTemplat
// Determine whether the statement can be edited // Determine whether the statement can be edited
DataPropertyStatement dps = makeStatement(); DataPropertyStatement dps = makeStatement();
RequestedAction action = new EditDataPropertyStatement(dps); RequestedAction action = new EditDataPropertyStatement(vreq.getJenaOntModel(), dps);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return ""; return "";
} }

3
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/DataPropertyTemplateModel.java
View file

@ -76,7 +76,8 @@ public class DataPropertyTemplateModel extends PropertyTemplateModel {
} }
// Determine whether a new statement can be added // Determine whether a new statement can be added
RequestedAction action = new AddDataPropertyStatement(subjectUri, propertyUri); RequestedAction action = new AddDataPropertyStatement(
vreq.getJenaOntModel(), subjectUri, propertyUri);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return; return;
} }

2
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/NameStatementTemplateModel.java
View file

@ -62,7 +62,7 @@ public class NameStatementTemplateModel extends PropertyStatementTemplateModel {
private String makeEditUrl(Literal literal) { private String makeEditUrl(Literal literal) {
// Determine whether the statement can be edited // Determine whether the statement can be edited
DataPropertyStatement dps = makeStatement(literal); DataPropertyStatement dps = makeStatement(literal);
RequestedAction action = new EditDataPropertyStatement(dps); RequestedAction action = new EditDataPropertyStatement(vreq.getJenaOntModel(), dps);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return ""; return "";
} }

5
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/ObjectPropertyStatementTemplateModel.java
View file

@ -55,7 +55,8 @@ public class ObjectPropertyStatementTemplateModel extends PropertyStatementTempl
} }
// Determine whether the statement can be deleted // Determine whether the statement can be deleted
RequestedAction action = new DropObjectPropertyStatement(subjectUri, propertyUri, objectUri); RequestedAction action = new DropObjectPropertyStatement(
vreq.getJenaOntModel(), subjectUri, propertyUri, objectUri);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return ""; return "";
} }
@ -96,7 +97,7 @@ public class ObjectPropertyStatementTemplateModel extends PropertyStatementTempl
} }
// Determine whether the statement can be edited // Determine whether the statement can be edited
RequestedAction action = new EditObjectPropertyStatement(ops); RequestedAction action = new EditObjectPropertyStatement(vreq.getJenaOntModel(), ops);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return ""; return "";
} }

4
webapp/src/edu/cornell/mannlib/vitro/webapp/web/templatemodels/individual/ObjectPropertyTemplateModel.java
View file

@ -108,7 +108,9 @@ public abstract class ObjectPropertyTemplateModel extends PropertyTemplateModel
} }
// Determine whether a new statement can be added // Determine whether a new statement can be added
RequestedAction action = new AddObjectPropertyStatement(subjectUri, propertyUri, RequestActionConstants.SOME_URI); RequestedAction action = new AddObjectPropertyStatement(
vreq.getJenaOntModel(), subjectUri, propertyUri,
RequestActionConstants.SOME_URI);
if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) { if ( ! PolicyHelper.isAuthorizedForActions(vreq, action) ) {
return; return;
} }

36
webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/PolicyHelper_StatementsTest.java
View file

@ -12,6 +12,7 @@ import stubs.javax.servlet.ServletContextStub;
import stubs.javax.servlet.http.HttpServletRequestStub; import stubs.javax.servlet.http.HttpServletRequestStub;
import stubs.javax.servlet.http.HttpSessionStub; import stubs.javax.servlet.http.HttpSessionStub;
import com.hp.hpl.jena.ontology.OntModelSpec;
import com.hp.hpl.jena.rdf.model.Model; import com.hp.hpl.jena.rdf.model.Model;
import com.hp.hpl.jena.rdf.model.ModelFactory; import com.hp.hpl.jena.rdf.model.ModelFactory;
import com.hp.hpl.jena.rdf.model.Property; import com.hp.hpl.jena.rdf.model.Property;
@ -26,6 +27,7 @@ import edu.cornell.mannlib.vitro.webapp.auth.policy.ifaces.PolicyIface;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAction; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.ifaces.RequestedAction;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AbstractDataPropertyStatementAction; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AbstractDataPropertyStatementAction;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AbstractObjectPropertyStatementAction; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AbstractObjectPropertyStatementAction;
import edu.cornell.mannlib.vitro.webapp.controller.VitroRequest;
/** /**
* Test the function of PolicyHelper in authorizing statements and models. * Test the function of PolicyHelper in authorizing statements and models.
@ -38,7 +40,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
private ServletContextStub ctx; private ServletContextStub ctx;
private HttpSessionStub session; private HttpSessionStub session;
private HttpServletRequestStub req; private VitroRequest vreq;
@Before @Before
public void setup() { public void setup() {
@ -47,8 +49,10 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
session = new HttpSessionStub(); session = new HttpSessionStub();
session.setServletContext(ctx); session.setServletContext(ctx);
req = new HttpServletRequestStub(); HttpServletRequestStub req = new HttpServletRequestStub();
req.setSession(session); req.setSession(session);
vreq = new VitroRequest(req);
vreq.setJenaOntModel(ModelFactory.createOntologyModel(OntModelSpec.OWL_MEM));
setLoggerLevel(ServletPolicyList.class, Level.WARN); setLoggerLevel(ServletPolicyList.class, Level.WARN);
ServletPolicyList.addPolicy(ctx, new MySimplePolicy()); ServletPolicyList.addPolicy(ctx, new MySimplePolicy());
@ -61,7 +65,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
@Test @Test
public void addNullStatement() { public void addNullStatement() {
assertEquals("null statement", false, assertEquals("null statement", false,
PolicyHelper.isAuthorizedToAdd(req, (Statement) null)); PolicyHelper.isAuthorizedToAdd(vreq, (Statement) null));
} }
@Test @Test
@ -77,7 +81,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
Statement stmt = dataStatement(APPROVED_SUBJECT_URI, Statement stmt = dataStatement(APPROVED_SUBJECT_URI,
APPROVED_PREDICATE_URI); APPROVED_PREDICATE_URI);
assertEquals("authorized", true, assertEquals("authorized", true,
PolicyHelper.isAuthorizedToAdd(req, stmt)); PolicyHelper.isAuthorizedToAdd(vreq, stmt));
} }
@Test @Test
@ -85,13 +89,13 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
Statement stmt = dataStatement(APPROVED_SUBJECT_URI, Statement stmt = dataStatement(APPROVED_SUBJECT_URI,
UNAPPROVED_PREDICATE_URI); UNAPPROVED_PREDICATE_URI);
assertEquals("not authorized", false, assertEquals("not authorized", false,
PolicyHelper.isAuthorizedToAdd(req, stmt)); PolicyHelper.isAuthorizedToAdd(vreq, stmt));
} }
@Test @Test
public void dropNullStatement() { public void dropNullStatement() {
assertEquals("null statement", false, assertEquals("null statement", false,
PolicyHelper.isAuthorizedToDrop(req, (Statement) null)); PolicyHelper.isAuthorizedToDrop(vreq, (Statement) null));
} }
@Test @Test
@ -107,7 +111,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
Statement stmt = dataStatement(APPROVED_SUBJECT_URI, Statement stmt = dataStatement(APPROVED_SUBJECT_URI,
APPROVED_PREDICATE_URI); APPROVED_PREDICATE_URI);
assertEquals("authorized", true, assertEquals("authorized", true,
PolicyHelper.isAuthorizedToDrop(req, stmt)); PolicyHelper.isAuthorizedToDrop(vreq, stmt));
} }
@Test @Test
@ -115,7 +119,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
Statement stmt = dataStatement(APPROVED_SUBJECT_URI, Statement stmt = dataStatement(APPROVED_SUBJECT_URI,
UNAPPROVED_PREDICATE_URI); UNAPPROVED_PREDICATE_URI);
assertEquals("not authorized", false, assertEquals("not authorized", false,
PolicyHelper.isAuthorizedToDrop(req, stmt)); PolicyHelper.isAuthorizedToDrop(vreq, stmt));
} }
// ---------------------------------------------------------------------- // ----------------------------------------------------------------------
@ -125,7 +129,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
@Test @Test
public void addNullModel() { public void addNullModel() {
assertEquals("null statement", false, assertEquals("null statement", false,
PolicyHelper.isAuthorizedToAdd(req, (Model) null)); PolicyHelper.isAuthorizedToAdd(vreq, (Model) null));
} }
@Test @Test
@ -137,7 +141,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
@Test @Test
public void addEmptyModel() { public void addEmptyModel() {
assertEquals("empty model", true, assertEquals("empty model", true,
PolicyHelper.isAuthorizedToAdd(req, model())); PolicyHelper.isAuthorizedToAdd(vreq, model()));
} }
@Test @Test
@ -147,7 +151,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI, objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI,
APPROVED_OBJECT_URI)); APPROVED_OBJECT_URI));
assertEquals("authorized model", true, assertEquals("authorized model", true,
PolicyHelper.isAuthorizedToAdd(req, model)); PolicyHelper.isAuthorizedToAdd(vreq, model));
} }
@Test @Test
@ -157,13 +161,13 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
objectStatement(APPROVED_SUBJECT_URI, UNAPPROVED_PREDICATE_URI, objectStatement(APPROVED_SUBJECT_URI, UNAPPROVED_PREDICATE_URI,
APPROVED_OBJECT_URI)); APPROVED_OBJECT_URI));
assertEquals("unauthorized model", false, assertEquals("unauthorized model", false,
PolicyHelper.isAuthorizedToAdd(req, model)); PolicyHelper.isAuthorizedToAdd(vreq, model));
} }
@Test @Test
public void dropNullModel() { public void dropNullModel() {
assertEquals("null statement", false, assertEquals("null statement", false,
PolicyHelper.isAuthorizedToDrop(req, (Model) null)); PolicyHelper.isAuthorizedToDrop(vreq, (Model) null));
} }
@Test @Test
@ -175,7 +179,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
@Test @Test
public void dropEmptyModel() { public void dropEmptyModel() {
assertEquals("empty model", true, assertEquals("empty model", true,
PolicyHelper.isAuthorizedToDrop(req, model())); PolicyHelper.isAuthorizedToDrop(vreq, model()));
} }
@Test @Test
@ -185,7 +189,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI, objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI,
APPROVED_OBJECT_URI)); APPROVED_OBJECT_URI));
assertEquals("authorized model", true, assertEquals("authorized model", true,
PolicyHelper.isAuthorizedToDrop(req, model)); PolicyHelper.isAuthorizedToDrop(vreq, model));
} }
@Test @Test
@ -195,7 +199,7 @@ public class PolicyHelper_StatementsTest extends AbstractTestClass {
objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI, objectStatement(APPROVED_SUBJECT_URI, APPROVED_PREDICATE_URI,
APPROVED_OBJECT_URI)); APPROVED_OBJECT_URI));
assertEquals("unauthorized model", false, assertEquals("unauthorized model", false,
PolicyHelper.isAuthorizedToDrop(req, model)); PolicyHelper.isAuthorizedToDrop(vreq, model));
} }
// ---------------------------------------------------------------------- // ----------------------------------------------------------------------

78
webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicyTest.java
View file

@ -13,6 +13,11 @@ import org.junit.Test;
import stubs.edu.cornell.mannlib.vitro.webapp.auth.policy.bean.PropertyRestrictionPolicyHelperStub; import stubs.edu.cornell.mannlib.vitro.webapp.auth.policy.bean.PropertyRestrictionPolicyHelperStub;
import stubs.javax.servlet.ServletContextStub; import stubs.javax.servlet.ServletContextStub;
import com.hp.hpl.jena.ontology.OntModel;
import com.hp.hpl.jena.ontology.OntModelSpec;
import com.hp.hpl.jena.rdf.model.ModelFactory;
import edu.cornell.mannlib.vitro.testing.AbstractTestClass; import edu.cornell.mannlib.vitro.testing.AbstractTestClass;
import edu.cornell.mannlib.vitro.webapp.auth.identifier.ArrayIdentifierBundle; import edu.cornell.mannlib.vitro.webapp.auth.identifier.ArrayIdentifierBundle;
import edu.cornell.mannlib.vitro.webapp.auth.identifier.IdentifierBundle; import edu.cornell.mannlib.vitro.webapp.auth.identifier.IdentifierBundle;
@ -58,6 +63,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
private SelfEditingPolicy policy; private SelfEditingPolicy policy;
private IdentifierBundle ids; private IdentifierBundle ids;
private RequestedAction whatToAuth; private RequestedAction whatToAuth;
private OntModel ontModel;
@Before @Before
public void setUp() throws Exception { public void setUp() throws Exception {
@ -73,6 +79,8 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
ind.setURI(SELFEDITOR_URI); ind.setURI(SELFEDITOR_URI);
ids = new ArrayIdentifierBundle(new HasProfile(SELFEDITOR_URI)); ids = new ArrayIdentifierBundle(new HasProfile(SELFEDITOR_URI));
ontModel = ModelFactory.createOntologyModel(OntModelSpec.OWL_MEM);
} }
@Test @Test
@ -86,72 +94,72 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
"http://mannlib.cornell.edu/bad#prp0020" }); "http://mannlib.cornell.edu/bad#prp0020" });
PropertyRestrictionPolicyHelper.setBean(ctx, prph); PropertyRestrictionPolicyHelper.setBean(ctx, prph);
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
"http://mannlib.cornell.edu/bad#prp234", SAFE_RESOURCE); "http://mannlib.cornell.edu/bad#prp234", SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new AddObjectPropertyStatement(ontModel, SAFE_RESOURCE,
"http://mannlib.cornell.edu/bad#prp234", SELFEDITOR_URI); "http://mannlib.cornell.edu/bad#prp234", SELFEDITOR_URI);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
"http://mannlib.cornell.edu/bad#prp999", SAFE_RESOURCE); "http://mannlib.cornell.edu/bad#prp999", SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new AddObjectPropertyStatement(ontModel, SAFE_RESOURCE,
"http://mannlib.cornell.edu/bad#prp999", SELFEDITOR_URI); "http://mannlib.cornell.edu/bad#prp999", SELFEDITOR_URI);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new AddObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SELFEDITOR_URI); SAFE_PREDICATE, SELFEDITOR_URI);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
UNSAFE_PREDICATE, SAFE_RESOURCE); UNSAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
// now with dataprop statements // now with dataprop statements
whatToAuth = new AddDataPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddDataPropertyStatement(ontModel, SELFEDITOR_URI,
"http://mannlib.cornell.edu/bad#prp234"); "http://mannlib.cornell.edu/bad#prp234");
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddDataPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddDataPropertyStatement(ontModel, SELFEDITOR_URI,
"http://mannlib.cornell.edu/bad#prp999"); "http://mannlib.cornell.edu/bad#prp999");
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddDataPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddDataPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE); SAFE_PREDICATE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddDataPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddDataPropertyStatement(ontModel, SELFEDITOR_URI,
UNSAFE_PREDICATE); UNSAFE_PREDICATE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@Test @Test
public void testVisitIdentifierBundleAddObjectPropStmt() { public void testVisitIdentifierBundleAddObjectPropStmt() {
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new AddObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SELFEDITOR_URI); SAFE_PREDICATE, SELFEDITOR_URI);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
// this is the case where the editor is not part of the stmt // this is the case where the editor is not part of the stmt
whatToAuth = new AddObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new AddObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
UNSAFE_PREDICATE, SAFE_RESOURCE); UNSAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new AddObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new AddObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, UNSAFE_RESOURCE); SAFE_PREDICATE, UNSAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@ -169,24 +177,24 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
// //
@Test @Test
public void testVisitIdentifierBundleDropObjectPropStmt() { public void testVisitIdentifierBundleDropObjectPropStmt() {
whatToAuth = new DropObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new DropObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new DropObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new DropObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SELFEDITOR_URI); SAFE_PREDICATE, SELFEDITOR_URI);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
// this is the case where the editor is not part of the stmt // this is the case where the editor is not part of the stmt
whatToAuth = new DropObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new DropObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new DropObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new DropObjectPropertyStatement(ontModel, SELFEDITOR_URI,
UNSAFE_PREDICATE, SAFE_RESOURCE); UNSAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new DropObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new DropObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, UNSAFE_RESOURCE); SAFE_PREDICATE, UNSAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@ -210,39 +218,39 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
// //
@Test @Test
public void testVisitIdentifierBundleEditDataPropStmt() { public void testVisitIdentifierBundleEditDataPropStmt() {
whatToAuth = new EditDataPropertyStatement(SELFEDITOR_URI,SAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, SELFEDITOR_URI,SAFE_PREDICATE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditDataPropertyStatement(SELFEDITOR_URI, UNSAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, SELFEDITOR_URI, UNSAFE_PREDICATE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditDataPropertyStatement(UNSAFE_RESOURCE, SAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, UNSAFE_RESOURCE, SAFE_PREDICATE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditDataPropertyStatement(SAFE_RESOURCE, SAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, SAFE_RESOURCE, SAFE_PREDICATE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@Test @Test
public void testVisitIdentifierBundleEditObjPropStmt() { public void testVisitIdentifierBundleEditObjPropStmt() {
whatToAuth = new EditObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new EditObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new EditObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SELFEDITOR_URI); SAFE_PREDICATE, SELFEDITOR_URI);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
// this is the case where the editor is not part of the stmt // this is the case where the editor is not part of the stmt
whatToAuth = new EditObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new EditObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new EditObjectPropertyStatement(ontModel, SELFEDITOR_URI,
UNSAFE_PREDICATE, SAFE_RESOURCE); UNSAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
whatToAuth = new EditObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new EditObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, UNSAFE_RESOURCE); SAFE_PREDICATE, UNSAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@ -254,7 +262,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
@Test @Test
public void twoSEIsFindObjectPropertySubject() { public void twoSEIsFindObjectPropertySubject() {
setUpTwoSEIs(); setUpTwoSEIs();
whatToAuth = new DropObjectPropertyStatement(SELFEDITOR_URI, whatToAuth = new DropObjectPropertyStatement(ontModel, SELFEDITOR_URI,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
} }
@ -262,7 +270,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
@Test @Test
public void twoSEIsFindObjectPropertyObject() { public void twoSEIsFindObjectPropertyObject() {
setUpTwoSEIs(); setUpTwoSEIs();
whatToAuth = new DropObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new DropObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SELFEDITOR_URI); SAFE_PREDICATE, SELFEDITOR_URI);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
} }
@ -270,7 +278,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
@Test @Test
public void twoSEIsDontFindInObjectProperty() { public void twoSEIsDontFindInObjectProperty() {
setUpTwoSEIs(); setUpTwoSEIs();
whatToAuth = new DropObjectPropertyStatement(SAFE_RESOURCE, whatToAuth = new DropObjectPropertyStatement(ontModel, SAFE_RESOURCE,
SAFE_PREDICATE, SAFE_RESOURCE); SAFE_PREDICATE, SAFE_RESOURCE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }
@ -279,7 +287,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
public void twoSEIsFindDataPropertySubject() { public void twoSEIsFindDataPropertySubject() {
setUpTwoSEIs(); setUpTwoSEIs();
whatToAuth = new EditDataPropertyStatement(SELFEDITOR_URI, SAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, SELFEDITOR_URI, SAFE_PREDICATE);
assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth)); assertDecision(AUTHORIZED, policy.isAuthorized(ids, whatToAuth));
} }
@ -287,7 +295,7 @@ public class SelfEditingPolicyTest extends AbstractTestClass {
public void twoSEIsDontFindInDataProperty() { public void twoSEIsDontFindInDataProperty() {
setUpTwoSEIs(); setUpTwoSEIs();
whatToAuth = new EditDataPropertyStatement(SAFE_RESOURCE, SAFE_PREDICATE); whatToAuth = new EditDataPropertyStatement(ontModel, SAFE_RESOURCE, SAFE_PREDICATE);
assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth)); assertDecision(INCONCLUSIVE, policy.isAuthorized(ids, whatToAuth));
} }

22
webapp/test/edu/cornell/mannlib/vitro/webapp/auth/policy/SelfEditingPolicy_2_Test.java
View file

@ -15,6 +15,7 @@ import stubs.edu.cornell.mannlib.vitro.webapp.auth.policy.bean.PropertyRestricti
import stubs.javax.servlet.ServletContextStub; import stubs.javax.servlet.ServletContextStub;
import com.hp.hpl.jena.ontology.OntModel; import com.hp.hpl.jena.ontology.OntModel;
import com.hp.hpl.jena.ontology.OntModelSpec;
import com.hp.hpl.jena.rdf.model.ModelFactory; import com.hp.hpl.jena.rdf.model.ModelFactory;
import com.hp.hpl.jena.rdf.model.impl.RDFDefaultErrorHandler; import com.hp.hpl.jena.rdf.model.impl.RDFDefaultErrorHandler;
@ -29,8 +30,6 @@ import edu.cornell.mannlib.vitro.webapp.auth.policy.ifaces.PolicyDecision;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AddObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.AddObjectPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.EditDataPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.EditDataPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.EditObjectPropertyStatement; import edu.cornell.mannlib.vitro.webapp.auth.requestedAction.propstmt.EditObjectPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatement;
import edu.cornell.mannlib.vitro.webapp.beans.DataPropertyStatementImpl;
import edu.cornell.mannlib.vitro.webapp.beans.Individual; import edu.cornell.mannlib.vitro.webapp.beans.Individual;
import edu.cornell.mannlib.vitro.webapp.beans.IndividualImpl; import edu.cornell.mannlib.vitro.webapp.beans.IndividualImpl;
import edu.cornell.mannlib.vitro.webapp.dao.VitroVocabulary; import edu.cornell.mannlib.vitro.webapp.dao.VitroVocabulary;
@ -69,6 +68,14 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
/** A bundle that contains a SelfEditing individual. */ /** A bundle that contains a SelfEditing individual. */
IdentifierBundle ids; IdentifierBundle ids;
/**
* An empty model that acts as a placeholder in the requested actions. The
* SelfEditingPolicy does not base its decisions on the contents of the
* model.
*/
private OntModel ontModel;
@Before @Before
public void setUp() throws Exception { public void setUp() throws Exception {
InputStream is = getClass().getResourceAsStream( InputStream is = getClass().getResourceAsStream(
@ -78,6 +85,7 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
// suppress the warning messages from loading the model. // suppress the warning messages from loading the model.
setLoggerLevel(RDFDefaultErrorHandler.class, Level.OFF); setLoggerLevel(RDFDefaultErrorHandler.class, Level.OFF);
// TODO This doesn't appear to be used for anything. Can it go away, along with the data file?
OntModel model = ModelFactory.createOntologyModel(); OntModel model = ModelFactory.createOntologyModel();
model.read(is, ""); model.read(is, "");
Assert.assertNotNull(model); Assert.assertNotNull(model);
@ -96,6 +104,8 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
ids = new ArrayIdentifierBundle(new HasProfile(SELFEDITOR_URI)); ids = new ArrayIdentifierBundle(new HasProfile(SELFEDITOR_URI));
ontModel = ModelFactory.createOntologyModel(OntModelSpec.OWL_MEM);
// setLoggerLevel(SelfEditingPolicySetupTest.class, Level.DEBUG); // setLoggerLevel(SelfEditingPolicySetupTest.class, Level.DEBUG);
} }
@ -113,7 +123,7 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
@Test @Test
public void nullIdentifierBundle() { public void nullIdentifierBundle() {
AddObjectPropertyStatement whatToAuth = new AddObjectPropertyStatement( AddObjectPropertyStatement whatToAuth = new AddObjectPropertyStatement(
SELFEDITOR_URI, SAFE_PREDICATE, SAFE_RESOURCE); ontModel, SELFEDITOR_URI, SAFE_PREDICATE, SAFE_RESOURCE);
PolicyDecision dec = policy.isAuthorized(null, whatToAuth); PolicyDecision dec = policy.isAuthorized(null, whatToAuth);
Assert.assertNotNull(dec); Assert.assertNotNull(dec);
Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized()); Assert.assertEquals(Authorization.INCONCLUSIVE, dec.getAuthorized());
@ -267,7 +277,7 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
private void assertAddObjectPropStmt(String uriOfSub, String uriOfPred, private void assertAddObjectPropStmt(String uriOfSub, String uriOfPred,
String uriOfObj, Authorization expectedAuthorization) { String uriOfObj, Authorization expectedAuthorization) {
AddObjectPropertyStatement whatToAuth = new AddObjectPropertyStatement( AddObjectPropertyStatement whatToAuth = new AddObjectPropertyStatement(
uriOfSub, uriOfPred, uriOfObj); ontModel, uriOfSub, uriOfPred, uriOfObj);
PolicyDecision dec = policy.isAuthorized(ids, whatToAuth); PolicyDecision dec = policy.isAuthorized(ids, whatToAuth);
log.debug(dec); log.debug(dec);
Assert.assertNotNull(dec); Assert.assertNotNull(dec);
@ -281,7 +291,7 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
private void assertEditObjPropStmt(String uriOfSub, String uriOfPred, private void assertEditObjPropStmt(String uriOfSub, String uriOfPred,
String uriOfObj, Authorization expectedAuthorization) { String uriOfObj, Authorization expectedAuthorization) {
EditObjectPropertyStatement whatToAuth = new EditObjectPropertyStatement( EditObjectPropertyStatement whatToAuth = new EditObjectPropertyStatement(
uriOfSub, uriOfPred, uriOfObj); ontModel, uriOfSub, uriOfPred, uriOfObj);
PolicyDecision dec = policy.isAuthorized(ids, whatToAuth); PolicyDecision dec = policy.isAuthorized(ids, whatToAuth);
log.debug(dec); log.debug(dec);
Assert.assertNotNull(dec); Assert.assertNotNull(dec);
@ -295,7 +305,7 @@ public class SelfEditingPolicy_2_Test extends AbstractTestClass {
private void assertEditDataPropStmt(String individualURI, private void assertEditDataPropStmt(String individualURI,
String datapropURI, String data, Authorization expectedAuthorization) { String datapropURI, String data, Authorization expectedAuthorization) {
EditDataPropertyStatement whatToAuth = new EditDataPropertyStatement( EditDataPropertyStatement whatToAuth = new EditDataPropertyStatement(
individualURI, datapropURI); ontModel, individualURI, datapropURI);
PolicyDecision dec = policy.isAuthorized(ids, whatToAuth); PolicyDecision dec = policy.isAuthorized(ids, whatToAuth);
log.debug(dec); log.debug(dec);
Assert.assertNotNull(dec); Assert.assertNotNull(dec);