core/src/main/java/org/sakaiproject/nakamura/lite/accesscontrol/AccessControlManagerImpl.java
public PropertyAcl getPropertyAcl(String objectType, String objectPath) throws AccessDeniedException, StorageClientException {
        long t = System.currentTimeMillis();
        checkOpen();
        compilingPermissions.inc();
        try {
            String key = this.getAclKey(objectType, objectPath);
            Map<String, Object> objectAcl = getCached(keySpace, aclColumnFamily, key);
            Set<String> orderedPrincipals = Sets.newLinkedHashSet();
            {
                String principal = user.getId();
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            for (String principal : getPrincipals(user)) {
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            // Everyone must be the last principal to be applied
            if (!User.ANON_USER.equals(user.getId())) {
                orderedPrincipals.add(Group.EVERYONE);
            }
            // go through each principal
            Map<String, Integer> grants = Maps.newHashMap();
            Map<String, Integer> denies = Maps.newHashMap();
            for (String principal : orderedPrincipals) {
                // got through each property
                String ppk = PROPERTY_PRINCIPAL_STEM + principal;
                for (Entry<String, Object> e : objectAcl.entrySet()) {
                    String k = e.getKey();
                    if (k.startsWith(ppk)) {
                        String[] parts = StringUtils.split(k.substring(PROPERTY_PRINCIPAL_STEM.length()), "@");
                        String propertyName = parts[1];
                        if (AclModification.isDeny(k)) {
                            int td = toInt(e.getValue());
                            denies.put(propertyName, toInt(denies.get(propertyName)) | td);
                        } else if (AclModification.isGrant(k)) {
                            int tg = toInt(e.getValue());
                            grants.put(propertyName, toInt(grants.get(propertyName)) | tg);
                        }
                    }
                }
            }
            // if the property has been granted, then that should remove the
            // deny
            for (Entry<String, Integer> g : grants.entrySet()) {
                String k = g.getKey();
                if (denies.containsKey(k)) {
                    denies.put(k, toInt(denies.get(k)) & ~g.getValue());
                }
            }
            return new PropertyAcl(denies);
        } finally {
            compilingPermissions.dec();
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "getPropertyAcl", System.currentTimeMillis() - t);
        }

    }
public PropertyAcl getPropertyAcl(String objectType, String objectPath) throws AccessDeniedException, StorageClientException {
        long t = System.currentTimeMillis();
        checkOpen();
        compilingPermissions.inc();
        try {
            String key = this.getAclKey(objectType, objectPath);
            Map<String, Object> objectAcl = getCached(keySpace, aclColumnFamily, key);
            Set<String> orderedPrincipals = Sets.newLinkedHashSet();
            {
                String principal = user.getId();
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            for (String principal : getPrincipals(user)) {
                if (principal.startsWith("_")) {
                    throw new StorageClientException("Princials may not start with _ ");
                }
                orderedPrincipals.add(principal);
            }
            // Everyone must be the last principal to be applied
            if (!User.ANON_USER.equals(user.getId())) {
                orderedPrincipals.add(Group.EVERYONE);
            }
            // go through each principal
            Map<String, Integer> grants = Maps.newHashMap();
            Map<String, Integer> denies = Maps.newHashMap();
            for (String principal : orderedPrincipals) {
                // got through each property
                String ppk = PROPERTY_PRINCIPAL_STEM + principal;
                for (Entry<String, Object> e : objectAcl.entrySet()) {
                    String k = e.getKey();
                    if (k.startsWith(ppk)) {
                        String[] parts = StringUtils.split(k.substring(PROPERTY_PRINCIPAL_STEM.length()), "@");
                        String propertyName = parts[1];
                        if (AclModification.isDeny(k)) {
                            int td = toInt(e.getValue());
                            denies.put(propertyName, toInt(denies.get(propertyName)) | td);
                        } else if (AclModification.isGrant(k)) {
                            int tg = toInt(e.getValue());
                            grants.put(propertyName, toInt(grants.get(propertyName)) | tg);
                        }
                    }
                }
            }
            // if the property has been granted, then that should remove the
            // deny
            for (Entry<String, Integer> g : grants.entrySet()) {
                String k = g.getKey();
                if (denies.containsKey(k)) {
                    denies.put(k, toInt(denies.get(k)) & ~g.getValue());
                }
            }
            return new PropertyAcl(denies);
        } finally {
            compilingPermissions.dec();
            statsService.apiCall(AccessControlManagerImpl.class.getName(), "getPropertyAcl", System.currentTimeMillis() - t);
        }

    }
public PropertyAcl getPropertyAcl ( String objectType , String objectPath ) throws AccessDeniedException , StorageClientException { long t = System . currentTimeMillis ( ) ; checkOpen ( ) ; compilingPermissions . inc ( ) ; try { String key = this . getAclKey ( objectType , objectPath ) ; Map < String , Object > objectAcl = getCached ( keySpace , aclColumnFamily , key ) ; Set < String > orderedPrincipals = Sets . newLinkedHashSet ( ) ; { String principal = user . getId ( ) ; if ( principal . startsWith ( "_" ) ) { throw new StorageClientException ( "Princials may not start with _ " ) ; } orderedPrincipals . add ( principal ) ; } for ( String principal : getPrincipals ( user ) ) { if ( principal . startsWith ( "_" ) ) { throw new StorageClientException ( "Princials may not start with _ " ) ; } orderedPrincipals . add ( principal ) ; } // Everyone must be the last principal to be applied if ( ! User . ANON_USER . equals ( user . getId ( ) ) ) { orderedPrincipals . add ( Group . EVERYONE ) ; } // go through each principal Map < String , Integer > grants = Maps . newHashMap ( ) ; Map < String , Integer > denies = Maps . newHashMap ( ) ; for ( String principal : orderedPrincipals ) { // got through each property String ppk = PROPERTY_PRINCIPAL_STEM + principal ; for ( Entry < String , Object > e : objectAcl . entrySet ( ) ) { String k = e . getKey ( ) ; if ( k . startsWith ( ppk ) ) { String [ ] parts = StringUtils . split ( k . substring ( PROPERTY_PRINCIPAL_STEM . length ( ) ) , "@" ) ; String propertyName = parts [ 1 ] ; if ( AclModification . isDeny ( k ) ) { int td = toInt ( e . getValue ( ) ) ; denies . put ( propertyName , toInt ( denies . get ( propertyName ) ) | td ) ; } else if ( AclModification . isGrant ( k ) ) { int tg = toInt ( e . getValue ( ) ) ; grants . put ( propertyName , toInt ( grants . get ( propertyName ) ) | tg ) ; } } } } // if the property has been granted, then that should remove the // deny for ( Entry < String , Integer > g : grants . entrySet ( ) ) { String k = g . getKey ( ) ; if ( denies . containsKey ( k ) ) { denies . put ( k , toInt ( denies . get ( k ) ) & ~ g . getValue ( ) ) ; } } return new PropertyAcl ( denies ) ; } finally { compilingPermissions . dec ( ) ; statsService . apiCall ( AccessControlManagerImpl . class . getName ( ) , "getPropertyAcl" , System . currentTimeMillis ( ) - t ) ; } }
Property principals are stored with keys of the form
_pp_<principal>@<property>@<g|d> where principal is a principal. For the
acl to be selected for the used of this session, they must have that
principal. property is the name of the property. g or d is grant or deny.
The value of the ACE is the bitmap for the ACE. All ACEs are selected and
processed to form the ACE for the user, returned as a PropertyAcl.
Property principals are stored with keys of the form _pp_<principal >