boolean isAcItem = isAcItem(absPath);
// retrieve all ACEs at path or at the direct ancestor of path that
// apply for the principal names.
AccessControlEntryIterator entries = new Entries(getNode(node), principalNames).iterator();
// build a list of ACEs that are defined locally at the node
List localACEs;
if (existingNode && isAccessControlled(node)) {
NodeImpl aclNode = node.getNode(N_POLICY);
localACEs = Arrays.asList(systemEditor.getACL(aclNode).getAccessControlEntries());
} else {
localACEs = Collections.EMPTY_LIST;
}
/*
Calculate privileges and permissions:
Since the ACEs only define privileges on a node and do not allow
to add additional restrictions, the permissions can be determined
without taking the given target name or target item into account.
*/
int allows = Permission.NONE;
int denies = Permission.NONE;
int allowPrivileges = PrivilegeRegistry.NO_PRIVILEGE;
int denyPrivileges = PrivilegeRegistry.NO_PRIVILEGE;
int parentAllows = PrivilegeRegistry.NO_PRIVILEGE;
int parentDenies = PrivilegeRegistry.NO_PRIVILEGE;
while (entries.hasNext() && allows != PrivilegeRegistry.ALL) {
JackrabbitAccessControlEntry ace = (JackrabbitAccessControlEntry) entries.next();
// Determine if the ACE is defined on the node at absPath (locally):
// Except for READ-privileges the permissions must be determined
// from privileges defined for the parent. Consequently aces
// defined locally must be treated different than inherited entries.
int entryBits = ace.getPrivilegeBits();