}
}
try {
AccessControlManager accessControlManager = AccessControlUtil.getAccessControlManager(session);
AccessControlList updatedAcl = null;
AccessControlPolicyIterator applicablePolicies = accessControlManager.getApplicablePolicies(resourcePath);
while (applicablePolicies.hasNext()) {
AccessControlPolicy policy = applicablePolicies.nextAccessControlPolicy();
if (policy instanceof AccessControlList) {
updatedAcl = (AccessControlList)policy;
break;
}
}
if (updatedAcl == null) {
throw new RepositoryException("Unable to find an access conrol policy to update.");
}
StringBuilder oldPrivileges = null;
StringBuilder newPrivileges = null;
if (log.isDebugEnabled()) {
oldPrivileges = new StringBuilder();
newPrivileges = new StringBuilder();
}
//keep track of the existing Aces for the target principal
AccessControlEntry[] accessControlEntries = updatedAcl.getAccessControlEntries();
List<AccessControlEntry> oldAces = new ArrayList<AccessControlEntry>();
for (AccessControlEntry ace : accessControlEntries) {
if (principalId.equals(ace.getPrincipal().getName())) {
if (log.isDebugEnabled()) {
log.debug("Found Existing ACE for principal {0} on resource: ", new Object[] {principalId, resourcePath});
}
oldAces.add(ace);
if (log.isDebugEnabled()) {
//collect the information for debug logging
boolean isAllow = AccessControlUtil.isAllow(ace);
Privilege[] privileges = ace.getPrivileges();
for (Privilege privilege : privileges) {
if (oldPrivileges.length() > 0) {
oldPrivileges.append(", "); //separate entries by commas
}
if (isAllow) {
oldPrivileges.append("granted=");
} else {
oldPrivileges.append("denied=");
}
oldPrivileges.append(privilege.getName());
}
}
}
}
//remove the old aces
if (!oldAces.isEmpty()) {
for (AccessControlEntry ace : oldAces) {
updatedAcl.removeAccessControlEntry(ace);
}
}
//add a fresh ACE with the granted privileges
List<Privilege> grantedPrivilegeList = new ArrayList<Privilege>();
for (String name : grantedPrivilegeNames) {
if (name.length() == 0) {
continue; //empty, skip it.
}
Privilege privilege = accessControlManager.privilegeFromName(name);
grantedPrivilegeList.add(privilege);
if (log.isDebugEnabled()) {
if (newPrivileges.length() > 0) {
newPrivileges.append(", "); //separate entries by commas
}
newPrivileges.append("granted=");
newPrivileges.append(privilege.getName());
}
}
if (grantedPrivilegeList.size() > 0) {
Principal principal = authorizable.getPrincipal();
updatedAcl.addAccessControlEntry(principal, grantedPrivilegeList.toArray(new Privilege[grantedPrivilegeList.size()]));
}
//if the authorizable is a user (not a group) process any denied privileges
if (!authorizable.isGroup()) {
//add a fresh ACE with the denied privileges