[OAK-527] Implement Permission evaluation

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.18
• Component/s: core, jcr
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 14/Dec/12 16:04
• Updated: 11/Mar/14 09:51
• Resolved: 26/Feb/14 18:10

Description

this subtasks goes along with OAK-526: for efficient permission
evaluation the compiledpermission implementation should not attempt
to collect the relevant ac-content such as looked at and written by
the jcr ac-mgt implementation. instead it should make use of the
persisted effective permission for the dedicated set of principals
that forms the subject of a given contentsession.

tbd:

• privileged access to the effective permission store (independent of
  the content sessions permission)
• ability to read all required information from the target tree/property
  that is passed to the hasPermission/canRead call.
• efficient handling of pluggable restrictions
• special handling for access control content an items residing inside
  the version store.

Issue Links

• blocks: OAK-942 Permissions: Document changes wrt Jackrabbit
• is blocked by: OAK-920 Proper permission handling upon Workspace#copy
• is blocked by: OAK-1115 Remove of Subtree after Move is not subjected to permission validation
• is blocked by: OAK-842 Incorrect interaction of orderable child nodes with permission evaluation
• relates to: OAK-753 TreeImpl exposes hidden child trees

Sub-Tasks

• TreeImpl#canRead: pass ImmutableTree to permission provider: Closed
• Redefine PermissionProvider#canRead: Closed
• Make workspace name available with the permission provider: Closed
• Review interaction between AccessControlManager and PermissionManager: Closed
• SecureNodeState#getChildNodeCount and #getPropertyCount: don't respect read permissions: Closed
• Consider moving permission evaluation to the node state level: Closed
• Authorization for the jcr version store: Closed
• PermissionValidator: Backwards compatible permission evaluation for moving/renaming nodes: Closed
• PermissionValidator: Proper permission handling for jcr:nodetypeManagement privilege: Closed
• Implement AC-Postprocessing in PermissionHook: Closed
• Calculate readstatus: Resolved
• PermissionValidator: add compatibility flag to ignore USER_MGT permission: Closed
• Accessibility of NodeTypes, Namespaces and Privileges: Closed
• PermissionValidator: proper check for jcr:uuid modifications.: Closed
• Review remove permissions: Closed
• Performance measurement: Closed
• Faster anonymous read operations: Resolved
• Revisit/Improve CompiledPermissionImpl.getTreePermission(): Closed
• Implement global per principal permission entry cache: Closed
• Inconsistent entry filtering for ADD_NODE and REMOVE_NODE permission: Closed