HttpSession session = req.getSession(false);
if (session == null) {
throw new AuthenticationException("No user session");
}
// Check that user is properly authenticated
User user = (User) session.getAttribute(Configuration.userAttribute);
if (user == null) {
throw new AuthenticationException("No authenticated user");
}
if (path == null) {
throw new BadRequestException("Invalid resource path");
}
// Check if that directory path is indexed
Directory directory;
boolean closeEm = false;
if (em == null) {
em = ModelFactory.getEntityManager();
closeEm = true;
}
try {
try {
directory = em
.createQuery(
"select directory from Directory directory where directory.path = ?1",
Directory.class).setParameter(1, path)
.getSingleResult();
} catch (NoResultException ex) {
// non indexed directories are public (to allow navigation)
return;
}
// Refresh user and roles assignment
List<RoleAssignment> roles;
try {
user = em.find(User.class, user.getUserName());
roles = user.getRoleAssignments();
} catch (NoResultException ex) {
// User is no longer registered,
throw new AuthenticationException("Unknown user");
}
// Check if directory group can be accessed by this user
for (RoleAssignment roleAssignment : roles) {
if (!roleAssignment.getGroupName().equals(directory.getGroup().getGroupName())) {
continue;
}
Role.isPermitted(roleAssignment.getRole(), action);
return;
}
} finally {
if (closeEm) {
// Close method managed EntityManager
em.close();
}
}
throw new AuthorizationException("Unauthorized user " + user.getUserName() + " for path " + path);
}