@Override
public Sequence eval(final Sequence[] args, final Sequence contextSequence) throws XPathException {
final DBBroker broker = getContext().getBroker();
final Subject currentUser = broker.getSubject();
final SecurityManager securityManager = broker.getBrokerPool().getSecurityManager();
final String username = args[0].getStringValue();
try {
if(isCalledAs(qnRemoveAccount.getLocalName())) {
/* remove account */
if(!currentUser.hasDbaRole()) {
throw new XPathException("Only a DBA user may remove accounts.");
}
if(!securityManager.hasAccount(username)) {
throw new XPathException("The user account with username " + username + " does not exist.");
}
if(currentUser.getName().equals(username)) {
throw new XPathException("You cannot remove yourself i.e. the currently logged in user.");
}
securityManager.deleteAccount(username);
} else {
final String password = args[1].getStringValue();
if(isCalledAs(qnPasswd.getLocalName())) {
/* change password */
if(!(currentUser.getName().equals(username) || currentUser.hasDbaRole())) {
throw new XPathException("You may only change your own password, unless you are a DBA.");
}
final Account account = securityManager.getAccount(username);
account.setPassword(password);
securityManager.updateAccount(account);
} else if(isCalledAs(qnCreateAccount.getLocalName())) {
/* create account */
if(!currentUser.hasDbaRole()) {
throw new XPathException("You must be a DBA to create a User Account.");
}
if(securityManager.hasAccount(username)) {
throw new XPathException("The user account with username " + username + " already exists.");
}
final Account user = new UserAider(username);
user.setPassword(password);
if(getSignature().getArgumentCount() >= 5) {
//set metadata values if present
user.setMetadataValue(AXSchemaType.FULLNAME, args[getSignature().getArgumentCount() - 2].toString());
user.setMetadataValue(EXistSchemaType.DESCRIPTION, args[getSignature().getArgumentCount() - 1].toString());
}
final String[] subGroups;
if(getSignature().getArgumentCount() == 3 || getSignature().getArgumentCount() == 5) {
//create the personal group
final Group group = new GroupAider(username);
group.setMetadataValue(EXistSchemaType.DESCRIPTION, "Personal group for " + username);
group.addManager(currentUser);
securityManager.addGroup(group);
//add the personal group as the primary group
user.addGroup(username);
subGroups = getGroups(args[2]);
} else {
//add the primary group as the primary group
user.addGroup(args[2].getStringValue());
subGroups = getGroups(args[3]);
}
for(int i = 0; i < subGroups.length; i++) {
user.addGroup(subGroups[i]);
}
//create the account
securityManager.addAccount(user);
//if we created a personal group, then add the new account as a manager of their personal group
if(getSignature().getArgumentCount() == 3 || getSignature().getArgumentCount() == 5) {
final Group group = securityManager.getGroup(username);
group.addManager(securityManager.getAccount(username));
securityManager.updateGroup(group);
}
} else {
throw new XPathException("Unknown function call: " + getSignature());
}
}