//------------------------------------< AbstractCompiledPermissions >---
/**
* @see AbstractCompiledPermissions#buildResult(Path)
*/
protected Result buildResult(Path path) throws RepositoryException {
NodeImpl userNode = null;
try {
if (session.nodeExists(userNodePath)) {
userNode = (NodeImpl) session.getNode(userNodePath);
}
} catch (RepositoryException e) {
// ignore
}
if (userNode == null) {
// no Node corresponding to user for which the permissions are
// calculated -> no permissions/privileges.
log.debug("No node at " + userNodePath);
return new Result(Permission.NONE, Permission.NONE, PrivilegeRegistry.NO_PRIVILEGE, PrivilegeRegistry.NO_PRIVILEGE);
}
// no explicit denied permissions:
int denies = Permission.NONE;
// default allow permission and default privileges
int allows = Permission.READ;
int privs;
// Determine if for path, the set of privileges must be calculated:
// Generally, privileges can only be determined for existing nodes.
String jcrPath = resolver.getJCRPath(path.getNormalizedPath());
boolean calcPrivs = session.nodeExists(jcrPath);
if (calcPrivs) {
privs = getPrivilegeBits(Privilege.JCR_READ);
} else {
privs = PrivilegeRegistry.NO_PRIVILEGE;
}
if (Text.isDescendant(usersPath, jcrPath)) {
/*
below the user-tree
- determine position of target relative to the editing user
- target may not be below an existing user but only below an
authorizable folder.
- determine if the editing user is user-admin
*/
NodeImpl node = (NodeImpl) getExistingNode(path);
if (node.isNodeType(NT_REP_AUTHORIZABLE_FOLDER)) {
// an authorizable folder -> must be user admin in order
// to have permission to write.
if (isUserAdmin) {
allows |= (Permission.ADD_NODE | Permission.REMOVE_NODE | Permission.SET_PROPERTY | Permission.REMOVE_PROPERTY | Permission.NODE_TYPE_MNGMT);
if (calcPrivs) {
// grant WRITE privilege
// note: ac-read/modification is not included
privs |= getPrivilegeBits(PrivilegeRegistry.REP_WRITE);
}
}
} else {
// rep:User node or some other custom node below an existing user.
// as the auth-folder doesn't allow other residual child nodes.
boolean editingOwnUser = node.isSame(userNode);
if (editingOwnUser) {
// user can only read && write his own props
allows |= (Permission.SET_PROPERTY | Permission.REMOVE_PROPERTY);
if (calcPrivs) {
privs |= getPrivilegeBits(Privilege.JCR_MODIFY_PROPERTIES);