NIHVIVO-2254 Create a helper for dealing with property restrictions.
This commit is contained in:
j2blake
parent
e8a3cc1dd3
commit
f746534279
3 changed files with 703 additions and 0 deletions
|
|
@ -0,0 +1,96 @@
|
|||
/* $This file is distributed under the terms of the license in /doc/license.txt$ */
|
||||
|
||||
package edu.cornell.mannlib.vitro.webapp.auth.policy.bean;
|
||||
|
||||
import javax.servlet.ServletContext;
|
||||
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
|
||||
import com.hp.hpl.jena.ontology.OntModel;
|
||||
|
||||
import edu.cornell.mannlib.vedit.beans.EditProcessObject;
|
||||
import edu.cornell.mannlib.vedit.listener.ChangeListener;
|
||||
import edu.cornell.mannlib.vitro.webapp.beans.Property;
|
||||
import edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel;
|
||||
|
||||
/**
|
||||
* Add this ChangeListener to your EditProcessObject when modifying the
|
||||
* ontology, and we will refresh the PropertyRestrictionPolicyHelper bean as
|
||||
* appropriate.
|
||||
*/
|
||||
public class PropertyRestrictionListener implements ChangeListener {
|
||||
private static final Log log = LogFactory
|
||||
.getLog(PropertyRestrictionListener.class);
|
||||
|
||||
private final ServletContext ctx;
|
||||
|
||||
public PropertyRestrictionListener(ServletContext ctx) {
|
||||
this.ctx = ctx;
|
||||
}
|
||||
|
||||
/**
|
||||
* If the deleted property had a non-null restriction, rebuild the bean.
|
||||
*/
|
||||
@Override
|
||||
public void doDeleted(Object oldObj, EditProcessObject epo) {
|
||||
Property p = (Property) oldObj;
|
||||
if (eitherRoleChanged(p.getHiddenFromDisplayBelowRoleLevel(),
|
||||
p.getProhibitedFromUpdateBelowRoleLevel(), null, null)) {
|
||||
log.debug("replacing all prohibition policies after deletion");
|
||||
createAndSetBean();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* If the inserted property has a non-null restriction, rebuild the bean.
|
||||
*/
|
||||
@Override
|
||||
public void doInserted(Object newObj, EditProcessObject epo) {
|
||||
Property p = (Property) newObj;
|
||||
if (eitherRoleChanged(null, null,
|
||||
p.getHiddenFromDisplayBelowRoleLevel(),
|
||||
p.getProhibitedFromUpdateBelowRoleLevel())) {
|
||||
log.debug("replacing all prohibition policies after insertion");
|
||||
createAndSetBean();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* If the updated property has changed its restrictions, rebuild the bean.
|
||||
*/
|
||||
@Override
|
||||
public void doUpdated(Object oldObj, Object newObj, EditProcessObject epo) {
|
||||
Property oldP = (Property) oldObj;
|
||||
Property newP = (Property) newObj;
|
||||
if (eitherRoleChanged(oldP.getHiddenFromDisplayBelowRoleLevel(),
|
||||
oldP.getProhibitedFromUpdateBelowRoleLevel(),
|
||||
newP.getHiddenFromDisplayBelowRoleLevel(),
|
||||
newP.getProhibitedFromUpdateBelowRoleLevel())) {
|
||||
log.debug("replacing all prohibition policies after update");
|
||||
createAndSetBean();
|
||||
}
|
||||
}
|
||||
|
||||
private boolean eitherRoleChanged(RoleLevel oldDisplayRole,
|
||||
RoleLevel oldUpdateRole, RoleLevel newDisplayRole,
|
||||
RoleLevel newUpdateRole) {
|
||||
return (!isTheSame(oldDisplayRole, newDisplayRole))
|
||||
|| (!isTheSame(oldUpdateRole, newUpdateRole));
|
||||
}
|
||||
|
||||
private boolean isTheSame(RoleLevel oldRole, RoleLevel newRole) {
|
||||
if ((oldRole == null) && (newRole == null)) {
|
||||
return true;
|
||||
} else if ((oldRole == null) || (newRole == null)) {
|
||||
return false;
|
||||
} else {
|
||||
return oldRole.compareTo(newRole) == 0;
|
||||
}
|
||||
}
|
||||
|
||||
private void createAndSetBean() {
|
||||
OntModel model = (OntModel) ctx.getAttribute("jenaOntModel");
|
||||
PropertyRestrictionPolicyHelper.createAndSetBean(ctx, model);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,360 @@
|
|||
/* $This file is distributed under the terms of the license in /doc/license.txt$ */
|
||||
|
||||
package edu.cornell.mannlib.vitro.webapp.auth.policy.bean;
|
||||
|
||||
import java.util.Collection;
|
||||
import java.util.Collections;
|
||||
import java.util.HashMap;
|
||||
import java.util.HashSet;
|
||||
import java.util.Map;
|
||||
import java.util.Set;
|
||||
|
||||
import javax.servlet.ServletContext;
|
||||
import javax.servlet.ServletContextEvent;
|
||||
import javax.servlet.ServletContextListener;
|
||||
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
|
||||
import com.hp.hpl.jena.ontology.OntModel;
|
||||
import com.hp.hpl.jena.rdf.model.Property;
|
||||
import com.hp.hpl.jena.rdf.model.RDFNode;
|
||||
import com.hp.hpl.jena.rdf.model.Resource;
|
||||
import com.hp.hpl.jena.rdf.model.Statement;
|
||||
import com.hp.hpl.jena.rdf.model.StmtIterator;
|
||||
import com.hp.hpl.jena.rdf.model.impl.Util;
|
||||
import com.hp.hpl.jena.shared.Lock;
|
||||
|
||||
import edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel;
|
||||
import edu.cornell.mannlib.vitro.webapp.dao.VitroVocabulary;
|
||||
|
||||
/**
|
||||
* Assists the role-based policies in determining whether a property or resource
|
||||
* may be displayed or modified.
|
||||
*/
|
||||
public class PropertyRestrictionPolicyHelper {
|
||||
private static final Log log = LogFactory
|
||||
.getLog(PropertyRestrictionPolicyHelper.class);
|
||||
|
||||
private static final Collection<String> PROHIBITED_NAMESPACES = setProhibitedNamespaces();
|
||||
private static final Collection<String> PERMITTED_EXCEPTIONS = setPermittedExceptions();
|
||||
|
||||
private static Collection<String> setProhibitedNamespaces() {
|
||||
Set<String> prohibitedNs = new HashSet<String>();
|
||||
prohibitedNs.add(VitroVocabulary.vitroURI);
|
||||
prohibitedNs.add(VitroVocabulary.OWL);
|
||||
prohibitedNs.add("");
|
||||
return Collections.unmodifiableSet(prohibitedNs);
|
||||
}
|
||||
|
||||
private static Collection<String> setPermittedExceptions() {
|
||||
Set<String> editableVitroUris = new HashSet<String>();
|
||||
|
||||
editableVitroUris.add(VitroVocabulary.MONIKER);
|
||||
editableVitroUris.add(VitroVocabulary.BLURB);
|
||||
editableVitroUris.add(VitroVocabulary.DESCRIPTION);
|
||||
editableVitroUris.add(VitroVocabulary.MODTIME);
|
||||
editableVitroUris.add(VitroVocabulary.TIMEKEY);
|
||||
|
||||
editableVitroUris.add(VitroVocabulary.CITATION);
|
||||
editableVitroUris.add(VitroVocabulary.IND_MAIN_IMAGE);
|
||||
|
||||
editableVitroUris.add(VitroVocabulary.LINK);
|
||||
editableVitroUris.add(VitroVocabulary.PRIMARY_LINK);
|
||||
editableVitroUris.add(VitroVocabulary.ADDITIONAL_LINK);
|
||||
editableVitroUris.add(VitroVocabulary.LINK_ANCHOR);
|
||||
editableVitroUris.add(VitroVocabulary.LINK_URL);
|
||||
|
||||
editableVitroUris.add(VitroVocabulary.KEYWORD_INDIVIDUALRELATION);
|
||||
editableVitroUris
|
||||
.add(VitroVocabulary.KEYWORD_INDIVIDUALRELATION_INVOLVESKEYWORD);
|
||||
editableVitroUris
|
||||
.add(VitroVocabulary.KEYWORD_INDIVIDUALRELATION_INVOLVESINDIVIDUAL);
|
||||
editableVitroUris.add(VitroVocabulary.KEYWORD_INDIVIDUALRELATION_MODE);
|
||||
|
||||
return Collections.unmodifiableSet(editableVitroUris);
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------
|
||||
// static methods
|
||||
// ----------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
* The bean is attached to the ServletContext using this attribute name.
|
||||
*/
|
||||
private static final String ATTRIBUTE_NAME = PropertyRestrictionPolicyHelper.class
|
||||
.getName();
|
||||
|
||||
public static PropertyRestrictionPolicyHelper getBean(ServletContext ctx) {
|
||||
Object attribute = ctx.getAttribute(ATTRIBUTE_NAME);
|
||||
if (!(attribute instanceof PropertyRestrictionPolicyHelper)) {
|
||||
throw new IllegalStateException(
|
||||
"PropertyRestrictionPolicyHelper has not been initialized.");
|
||||
}
|
||||
return (PropertyRestrictionPolicyHelper) attribute;
|
||||
}
|
||||
|
||||
private static void removeBean(ServletContext ctx) {
|
||||
ctx.removeAttribute(ATTRIBUTE_NAME);
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize the bean with the standard prohibitions and exceptions, and
|
||||
* with the thresholds obtained from the model.
|
||||
*/
|
||||
public static void createAndSetBean(ServletContext ctx, OntModel model) {
|
||||
Map<String, RoleLevel> displayThresholdMap = new HashMap<String, RoleLevel>();
|
||||
Map<String, RoleLevel> modifyThresholdMap = new HashMap<String, RoleLevel>();
|
||||
|
||||
if (model != null) {
|
||||
populateThresholdMap(model, displayThresholdMap,
|
||||
VitroVocabulary.HIDDEN_FROM_DISPLAY_BELOW_ROLE_LEVEL_ANNOT);
|
||||
populateThresholdMap(
|
||||
model,
|
||||
modifyThresholdMap,
|
||||
VitroVocabulary.PROHIBITED_FROM_UPDATE_BELOW_ROLE_LEVEL_ANNOT);
|
||||
}
|
||||
|
||||
PropertyRestrictionPolicyHelper bean = new PropertyRestrictionPolicyHelper(
|
||||
PROHIBITED_NAMESPACES, PERMITTED_EXCEPTIONS,
|
||||
displayThresholdMap, modifyThresholdMap);
|
||||
|
||||
ctx.setAttribute(ATTRIBUTE_NAME, bean);
|
||||
}
|
||||
|
||||
/**
|
||||
* Find all the resources that possess this property, and map the resource
|
||||
* URI to the require RoleLevel.
|
||||
*/
|
||||
private static void populateThresholdMap(OntModel model,
|
||||
Map<String, RoleLevel> map, String propertyUri) {
|
||||
model.enterCriticalSection(Lock.READ);
|
||||
try {
|
||||
Property property = model.getProperty(propertyUri);
|
||||
StmtIterator stmts = model.listStatements((Resource) null,
|
||||
property, (Resource) null);
|
||||
while (stmts.hasNext()) {
|
||||
Statement stmt = stmts.next();
|
||||
Resource subject = stmt.getSubject();
|
||||
RDFNode objectNode = stmt.getObject();
|
||||
if ((subject == null) || (!(objectNode instanceof Resource))) {
|
||||
continue;
|
||||
}
|
||||
Resource object = (Resource) objectNode;
|
||||
RoleLevel role = RoleLevel.getRoleByUri(object.getURI());
|
||||
map.put(subject.getURI(), role);
|
||||
}
|
||||
stmts.close();
|
||||
} finally {
|
||||
model.leaveCriticalSection();
|
||||
}
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------
|
||||
// the bean
|
||||
// ----------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
* URIs in these namespaces can't be modified, unless they are listed in the
|
||||
* exceptions.
|
||||
*/
|
||||
private final Collection<String> modifyProhibitedNamespaces;
|
||||
|
||||
/**
|
||||
* These URIs can be modified, even if they are in the prohibited
|
||||
* namespaces.
|
||||
*/
|
||||
private final Collection<String> modifyExceptionsAllowedUris;
|
||||
|
||||
/**
|
||||
* URIs in here can be displayed only if the user's role is at least as high
|
||||
* as the threshold role.
|
||||
*/
|
||||
private final Map<String, RoleLevel> displayThresholdMap;
|
||||
|
||||
/**
|
||||
* URIs in here can be modified only if the user's role is at least as high
|
||||
* as the threshold role.
|
||||
*/
|
||||
private final Map<String, RoleLevel> modifyThresholdMap;
|
||||
|
||||
/**
|
||||
* Store unmodifiable versions of the inputs.
|
||||
*
|
||||
* Protected access: should only be created by the static methods, or by
|
||||
* unit tests.
|
||||
*/
|
||||
protected PropertyRestrictionPolicyHelper(
|
||||
Collection<String> modifyProhibitedNamespaces,
|
||||
Collection<String> modifyExceptionsAllowedUris,
|
||||
Map<String, RoleLevel> displayThresholdMap,
|
||||
Map<String, RoleLevel> modifyThresholdMap) {
|
||||
this.modifyProhibitedNamespaces = unmodifiable(modifyProhibitedNamespaces);
|
||||
this.modifyExceptionsAllowedUris = unmodifiable(modifyExceptionsAllowedUris);
|
||||
this.displayThresholdMap = unmodifiable(displayThresholdMap);
|
||||
this.modifyThresholdMap = unmodifiable(modifyThresholdMap);
|
||||
|
||||
if (log.isDebugEnabled()) {
|
||||
log.debug("prohibited namespaces: " + this.modifyProhibitedNamespaces);
|
||||
log.debug("exceptions: " + this.modifyExceptionsAllowedUris);
|
||||
log.debug("display thresholds: " + this.displayThresholdMap);
|
||||
log.debug("modify thresholds: " + this.modifyThresholdMap);
|
||||
}
|
||||
}
|
||||
|
||||
private Collection<String> unmodifiable(Collection<String> raw) {
|
||||
if (raw == null) {
|
||||
return Collections.emptyList();
|
||||
} else {
|
||||
return Collections.unmodifiableCollection(new HashSet<String>(raw));
|
||||
}
|
||||
}
|
||||
|
||||
private Map<String, RoleLevel> unmodifiable(Map<String, RoleLevel> raw) {
|
||||
if (raw == null) {
|
||||
return Collections.emptyMap();
|
||||
} else {
|
||||
return Collections.unmodifiableMap(new HashMap<String, RoleLevel>(
|
||||
raw));
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Any resource can be displayed.
|
||||
*
|
||||
* (Someday we may want to implement display restrictions based on VClass.)
|
||||
*/
|
||||
@SuppressWarnings("unused")
|
||||
public boolean canDisplayResource(String resourceUri, RoleLevel userRole) {
|
||||
if (resourceUri == null) {
|
||||
log.debug("can't display resource: resourceUri was null");
|
||||
return false;
|
||||
}
|
||||
|
||||
log.debug("can display resource '" + resourceUri + "'");
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* A resource cannot be modified if its namespace is in the prohibited list
|
||||
* (but some exceptions are allowed).
|
||||
*
|
||||
* (Someday we may want to implement modify restrictions based on VClass.)
|
||||
*/
|
||||
@SuppressWarnings("unused")
|
||||
public boolean canModifyResource(String resourceUri, RoleLevel userRole) {
|
||||
if (resourceUri == null) {
|
||||
log.debug("can't modify resource: resourceUri was null");
|
||||
return false;
|
||||
}
|
||||
|
||||
if (modifyProhibitedNamespaces.contains(namespace(resourceUri))) {
|
||||
if (modifyExceptionsAllowedUris.contains(resourceUri)) {
|
||||
log.debug("'" + resourceUri + "' is a permitted exception");
|
||||
} else {
|
||||
log.debug("can't modify resource '" + resourceUri
|
||||
+ "': prohibited namespace: '" + namespace(resourceUri)
|
||||
+ "'");
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
log.debug("can modify resource '" + resourceUri + "'");
|
||||
return true;
|
||||
}
|
||||
|
||||
/**
|
||||
* If display of a predicate is restricted, the user's role must be at least
|
||||
* as high as the restriction level.
|
||||
*/
|
||||
public boolean canDisplayPredicate(String predicateUri, RoleLevel userRole) {
|
||||
if (predicateUri == null) {
|
||||
log.debug("can't display predicate: predicateUri was null");
|
||||
return false;
|
||||
}
|
||||
|
||||
RoleLevel displayThreshold = displayThresholdMap.get(predicateUri);
|
||||
if (isAuthorized(userRole, displayThreshold)) {
|
||||
log.debug("can display predicate: '" + predicateUri
|
||||
+ "', userRole=" + userRole + ", thresholdRole="
|
||||
+ displayThreshold);
|
||||
return true;
|
||||
}
|
||||
|
||||
log.debug("can't display predicate: '" + predicateUri + "', userRole="
|
||||
+ userRole + ", thresholdRole=" + displayThreshold);
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* A predicate cannot be modified if its namespace is in the prohibited list
|
||||
* (some exceptions are allowed).
|
||||
*
|
||||
* If modification of a predicate is restricted, the user's role must be at
|
||||
* least as high as the restriction level.
|
||||
*/
|
||||
public boolean canModifyPredicate(String predicateUri, RoleLevel userRole) {
|
||||
if (predicateUri == null) {
|
||||
log.debug("can't modify predicate: predicateUri was null");
|
||||
return false;
|
||||
}
|
||||
|
||||
if (modifyProhibitedNamespaces.contains(namespace(predicateUri))) {
|
||||
if (modifyExceptionsAllowedUris.contains(predicateUri)) {
|
||||
log.debug("'" + predicateUri + "' is a permitted exception");
|
||||
} else {
|
||||
log.debug("can't modify resource '" + predicateUri
|
||||
+ "': prohibited namespace: '"
|
||||
+ namespace(predicateUri) + "'");
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
RoleLevel modifyThreshold = modifyThresholdMap.get(predicateUri);
|
||||
if (isAuthorized(userRole, modifyThreshold)) {
|
||||
log.debug("can modify predicate: '" + predicateUri + "', userRole="
|
||||
+ userRole + ", thresholdRole=" + modifyThreshold);
|
||||
return true;
|
||||
}
|
||||
|
||||
log.debug("can't modify predicate: '" + predicateUri + "', userRole="
|
||||
+ userRole + ", thresholdRole=" + modifyThreshold);
|
||||
return false;
|
||||
}
|
||||
|
||||
private boolean isAuthorized(RoleLevel userRole, RoleLevel thresholdRole) {
|
||||
if (userRole == null) {
|
||||
return false;
|
||||
}
|
||||
if (thresholdRole == null) {
|
||||
return true;
|
||||
}
|
||||
return userRole.compareTo(thresholdRole) >= 0;
|
||||
}
|
||||
|
||||
private String namespace(String uri) {
|
||||
return uri.substring(0, Util.splitNamespace(uri));
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------
|
||||
// Setup class
|
||||
// ----------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
* Create the bean at startup and remove it at shutdown.
|
||||
*/
|
||||
public static class Setup implements ServletContextListener {
|
||||
@Override
|
||||
public void contextInitialized(ServletContextEvent sce) {
|
||||
ServletContext ctx = sce.getServletContext();
|
||||
OntModel model = (OntModel) ctx.getAttribute("jenaOntModel");
|
||||
createAndSetBean(ctx, model);
|
||||
}
|
||||
|
||||
@Override
|
||||
public void contextDestroyed(ServletContextEvent sce) {
|
||||
removeBean(sce.getServletContext());
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,247 @@
|
|||
/* $This file is distributed under the terms of the license in /doc/license.txt$ */
|
||||
|
||||
package edu.cornell.mannlib.vitro.webapp.auth.policy.bean;
|
||||
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.CURATOR;
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.DB_ADMIN;
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.EDITOR;
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.NOBODY;
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.PUBLIC;
|
||||
import static edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel.SELF;
|
||||
import static org.junit.Assert.assertEquals;
|
||||
import static org.junit.Assert.fail;
|
||||
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Arrays;
|
||||
import java.util.HashMap;
|
||||
import java.util.Map;
|
||||
|
||||
import org.apache.commons.logging.Log;
|
||||
import org.apache.commons.logging.LogFactory;
|
||||
import org.apache.log4j.Level;
|
||||
import org.junit.Before;
|
||||
import org.junit.Test;
|
||||
|
||||
import com.hp.hpl.jena.ontology.OntModel;
|
||||
import com.hp.hpl.jena.ontology.OntModelSpec;
|
||||
import com.hp.hpl.jena.rdf.model.ModelFactory;
|
||||
import com.hp.hpl.jena.rdf.model.Property;
|
||||
import com.hp.hpl.jena.rdf.model.Resource;
|
||||
|
||||
import edu.cornell.mannlib.vitro.testing.AbstractTestClass;
|
||||
import edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean;
|
||||
import edu.cornell.mannlib.vitro.webapp.beans.BaseResourceBean.RoleLevel;
|
||||
import edu.cornell.mannlib.vitro.webapp.dao.VitroVocabulary;
|
||||
|
||||
/**
|
||||
* Check that the bean gets built properly, and check that the bean works properly.
|
||||
*/
|
||||
public class PropertyRestrictionPolicyHelperTest extends AbstractTestClass {
|
||||
private static final Log log = LogFactory
|
||||
.getLog(PropertyRestrictionPolicyHelperTest.class);
|
||||
|
||||
private static final String PROPERTY_DISPLAY_THRESHOLD = VitroVocabulary.HIDDEN_FROM_DISPLAY_BELOW_ROLE_LEVEL_ANNOT;
|
||||
private static final String PROPERTY_MODIFY_THRESHOLD = VitroVocabulary.PROHIBITED_FROM_UPDATE_BELOW_ROLE_LEVEL_ANNOT;
|
||||
|
||||
private static final String[] PROHIBITED_NAMESPACES = new String[] {
|
||||
VitroVocabulary.vitroURI, "" };
|
||||
|
||||
private static final String[] PERMITTED_EXCEPTIONS = new String[] {
|
||||
VitroVocabulary.MONIKER, VitroVocabulary.BLURB };
|
||||
|
||||
private OntModel ontModel;
|
||||
private ModelWrapper wrapper;
|
||||
private PropertyRestrictionPolicyHelper bean;
|
||||
|
||||
@Before
|
||||
public void setLoggingLevel() {
|
||||
// setLoggerLevel(PropertyRestrictionPolicyHelper.class, Level.DEBUG);
|
||||
}
|
||||
|
||||
@Before
|
||||
public void createTheBean() {
|
||||
Map<String, RoleLevel> displayLevels = new HashMap<String, BaseResourceBean.RoleLevel>();
|
||||
displayLevels.put("http://predicates#display_self", SELF);
|
||||
displayLevels.put("http://predicates#display_curator", CURATOR);
|
||||
displayLevels.put("http://predicates#display_hidden", NOBODY);
|
||||
|
||||
Map<String, RoleLevel> modifyLevels = new HashMap<String, BaseResourceBean.RoleLevel>();
|
||||
modifyLevels.put("http://predicates#modify_self", SELF);
|
||||
modifyLevels.put("http://predicates#modify_curator", CURATOR);
|
||||
modifyLevels.put("http://predicates#modify_hidden", NOBODY);
|
||||
|
||||
bean = new PropertyRestrictionPolicyHelper(
|
||||
Arrays.asList(PROHIBITED_NAMESPACES),
|
||||
Arrays.asList(PERMITTED_EXCEPTIONS), displayLevels,
|
||||
modifyLevels);
|
||||
}
|
||||
|
||||
@Before
|
||||
public void createTheModel() {
|
||||
ontModel = ModelFactory.createOntologyModel(OntModelSpec.OWL_DL_MEM);
|
||||
|
||||
wrapper = new ModelWrapper(ontModel);
|
||||
|
||||
wrapper.add("http://thresholds#display_public",
|
||||
PROPERTY_DISPLAY_THRESHOLD, PUBLIC.getURI());
|
||||
wrapper.add("http://thresholds#display_hidden",
|
||||
PROPERTY_DISPLAY_THRESHOLD, NOBODY.getURI());
|
||||
|
||||
wrapper.add("http://thresholds#modify_editor",
|
||||
PROPERTY_MODIFY_THRESHOLD, EDITOR.getURI());
|
||||
wrapper.add("http://thresholds#modify_curator",
|
||||
PROPERTY_MODIFY_THRESHOLD, CURATOR.getURI());
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------
|
||||
// test the bean
|
||||
// ----------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
public void displayResource() {
|
||||
assertEquals("display a random resource", true,
|
||||
bean.canDisplayResource("http://someRandom#string", null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyResourceNoRestriction() {
|
||||
assertEquals("modify a random resource", true,
|
||||
bean.canModifyResource("http://someRandom#string", null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyResourceProhibitedNamespace() {
|
||||
assertEquals("modify a prohibited resource", false,
|
||||
bean.canModifyResource(PROHIBITED_NAMESPACES[0] + "random",
|
||||
null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyResourcePermittedException() {
|
||||
assertEquals("modify a exception resource", true,
|
||||
bean.canModifyResource(PERMITTED_EXCEPTIONS[0], null));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void displayPredicateNoRestriction() {
|
||||
assertEquals("displayPredicate: open", true,
|
||||
bean.canDisplayPredicate("http://predicates#open", PUBLIC));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void displayPredicateRestrictionLower() {
|
||||
assertEquals("displayPredicate: lower restriction", true,
|
||||
bean.canDisplayPredicate("http://predicates#display_self",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void displayPredicateRestrictionEqual() {
|
||||
assertEquals("displayPredicate: equal restriction", true,
|
||||
bean.canDisplayPredicate("http://predicates#display_curator",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void displayPredicateRestrictionHigher() {
|
||||
assertEquals("displayPredicate: higher restriction", false,
|
||||
bean.canDisplayPredicate("http://predicates#display_hidden",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicateNoRestriction() {
|
||||
assertEquals("modifyPredicate: open", true,
|
||||
bean.canModifyPredicate("http://predicates#open", PUBLIC));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicateRestrictionLower() {
|
||||
assertEquals("modifyPredicate: lower restriction", true,
|
||||
bean.canModifyPredicate("http://predicates#modify_self",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicateRestrictionEqual() {
|
||||
assertEquals("modifyPredicate: equal restriction", true,
|
||||
bean.canModifyPredicate("http://predicates#modify_curator",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicateRestrictionHigher() {
|
||||
assertEquals("modifyPredicate: higher restriction", false,
|
||||
bean.canModifyPredicate("http://predicates#modify_hidden",
|
||||
CURATOR));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicateProhibitedNamespace() {
|
||||
assertEquals("modifyPredicate: prohibited namespace", false,
|
||||
bean.canModifyPredicate(PROHIBITED_NAMESPACES[0] + "randoom",
|
||||
DB_ADMIN));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void modifyPredicatePermittedException() {
|
||||
assertEquals("modifyPredicate: permitted exception", true,
|
||||
bean.canModifyPredicate(PERMITTED_EXCEPTIONS[0], DB_ADMIN));
|
||||
}
|
||||
|
||||
// ----------------------------------------------------------------------
|
||||
// test the bean builder
|
||||
// ----------------------------------------------------------------------
|
||||
|
||||
@Test
|
||||
public void buildDisplayThresholds() {
|
||||
Map<String, RoleLevel> expectedMap = new HashMap<String, BaseResourceBean.RoleLevel>();
|
||||
expectedMap.put("http://thresholds#display_public", PUBLIC);
|
||||
expectedMap.put("http://thresholds#display_hidden", NOBODY);
|
||||
|
||||
Map<String, RoleLevel> actualMap = populateThresholdMap(PROPERTY_DISPLAY_THRESHOLD);
|
||||
assertEquals("display thresholds", expectedMap, actualMap);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void buildModifyThresholds() {
|
||||
Map<String, RoleLevel> expectedMap = new HashMap<String, BaseResourceBean.RoleLevel>();
|
||||
expectedMap.put("http://thresholds#modify_editor", EDITOR);
|
||||
expectedMap.put("http://thresholds#modify_curator", CURATOR);
|
||||
|
||||
Map<String, RoleLevel> actualMap = populateThresholdMap(PROPERTY_MODIFY_THRESHOLD);
|
||||
assertEquals("modify thresholds", expectedMap, actualMap);
|
||||
}
|
||||
|
||||
/** Invoke the private static method "populateThresholdMap" */
|
||||
private Map<String, RoleLevel> populateThresholdMap(String propertyUri) {
|
||||
Map<String, RoleLevel> map = new HashMap<String, BaseResourceBean.RoleLevel>();
|
||||
try {
|
||||
Class<?> clazz = PropertyRestrictionPolicyHelper.class;
|
||||
Method method = clazz.getDeclaredMethod("populateThresholdMap",
|
||||
OntModel.class, Map.class, String.class);
|
||||
method.setAccessible(true);
|
||||
method.invoke(null, ontModel, map, propertyUri);
|
||||
return map;
|
||||
} catch (Exception e) {
|
||||
fail("failed to populate the map: propertyUri='" + propertyUri
|
||||
+ "', " + e);
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
private static class ModelWrapper {
|
||||
private final OntModel model;
|
||||
|
||||
public ModelWrapper(OntModel model) {
|
||||
this.model = model;
|
||||
}
|
||||
|
||||
public void add(String subjectUri, String propertyUri, String objectUri) {
|
||||
Resource subject = model.getResource(subjectUri);
|
||||
Property property = model.getProperty(propertyUri);
|
||||
Resource object = model.getResource(objectUri);
|
||||
model.add(subject, property, object);
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Reference in a new issue