/*
* Copyright (c) 2002-2012 Alibaba Group Holding Limited.
* All rights reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package com.alibaba.citrus.turbine.auth.impl;
import static com.alibaba.citrus.util.ArrayUtil.*;
import static com.alibaba.citrus.util.BasicConstant.*;
import static com.alibaba.citrus.util.CollectionUtil.*;
import static com.alibaba.citrus.util.ObjectUtil.*;
import static com.alibaba.citrus.util.StringUtil.*;
import java.util.List;
import java.util.Set;
import com.alibaba.citrus.util.ToStringBuilder;
import com.alibaba.citrus.util.ToStringBuilder.CollectionBuilder;
import com.alibaba.citrus.util.ToStringBuilder.MapBuilder;
/**
* 代表一个授权，可以对role和user进行授权。
*
* @author Michael Zhou
*/
public class AuthGrant {
/** MATCH_EVERYTHING代表所有用户和role，但不包含匿名用户 */
public final static String MATCH_EVERYTHING = "*";
/** 特例用户名：匿名用户 */
public final static String ANONYMOUS_USER = "anonymous";
private String[] users;
private String[] roles;
private Set<AuthPattern> allowedActions = createLinkedHashSet();
private Set<AuthPattern> deniedActions = createLinkedHashSet();
public String[] getUsers() {
return users;
}
public void setUsers(String[] users) {
this.users = trim(users, MATCH_EVERYTHING, ANONYMOUS_USER);
}
public String[] getRoles() {
return roles;
}
public void setRoles(String[] roles) {
this.roles = trim(roles, MATCH_EVERYTHING);
}
private String[] trim(String[] array, String... canonicals) {
List<String> list = createLinkedList();
if (!isEmptyArray(array)) {
for (String item : array) {
item = trimToNull(item);
if (item != null) {
// 优化性能，避免字符串的比较，只需要用==比较即可。
if (canonicals != null) {
int i = arrayIndexOf(canonicals, item);
if (i >= 0) {
item = canonicals[i];
}
}
list.add(item);
}
}
}
if (!list.isEmpty()) {
return list.toArray(new String[list.size()]);
} else {
return null;
}
}
public boolean isUserMatched(String userName) {
if (!isEmptyArray(users)) {
for (String grantUser : users) {
if (grantUser == ANONYMOUS_USER) {
if (userName == null) {
return true;
}
} else if (grantUser == MATCH_EVERYTHING) {
if (userName != null) {
return true;
}
} else {
if (grantUser.equals(userName)) {
return true;
}
}
}
}
return false;
}
public boolean areRolesMatched(String[] roleNames) {
if (!isEmptyArray(roles)) {
for (String grantRole : roles) {
if (grantRole == MATCH_EVERYTHING) {
boolean emptyRoleNames = true;
if (!isEmptyArray(roleNames)) {
for (String roleName : roleNames) {
if (roleName != null) {
emptyRoleNames = false;
break;
}
}
}
if (!emptyRoleNames) {
return true;
}
} else {
if (arrayContains(roleNames, grantRole)) {
return true;
}
}
}
}
return false;
}
public Set<AuthPattern> getAllowedActions() {
return allowedActions;
}
public boolean isActionAllowed(String action) {
return matches(allowedActions, action);
}
public void setAllow(String... allow) {
setActions(allowedActions, allow);
}
public Set<AuthPattern> getDeniedActions() {
return deniedActions;
}
public boolean isActionDenied(String action) {
return matches(deniedActions, action);
}
public void setDeny(String... deny) {
setActions(deniedActions, deny);
}
private void setActions(Set<AuthPattern> actionSet, String[] actions) {
actionSet.clear();
for (String action : defaultIfNull(actions, EMPTY_STRING_ARRAY)) {
actionSet.add(new AuthActionPattern(action));
}
}
private boolean matches(Set<AuthPattern> actionSet, String action) {
for (AuthPattern pattern : actionSet) {
if (pattern.matcher(action).find()) {
return true;
}
}
return false;
}
@Override
public String toString() {
MapBuilder mb = new MapBuilder();
if (!isEmptyArray(users)) {
mb.append("users", new CollectionBuilder().appendAll(users).setOneLine(true));
}
if (!isEmptyArray(roles)) {
mb.append("roles", new CollectionBuilder().appendAll(roles).setOneLine(true));
}
if (!allowedActions.isEmpty()) {
mb.append("allow", new CollectionBuilder().appendAll(allowedActions).setOneLine(true));
}
if (!deniedActions.isEmpty()) {
mb.append("deny", new CollectionBuilder().appendAll(deniedActions).setOneLine(true));
}
return new ToStringBuilder().append("Grant").append(mb).toString();
}
}