From 027fb64b0147be6734f83d44531a8400fe5b0235 Mon Sep 17 00:00:00 2001
From: Axel Uhl <axel.uhl@sap.com>
Date: Fri, 31 Jul 2020 17:05:21 +0200
Subject: [PATCH] bug5239: moved AclResolver implementation from
 SecurityServiceImpl into separate class

---
 .../impl/SecurityServiceAclResolver.java      | 56 +++++++++++++++++++
 .../security/impl/SecurityServiceImpl.java    | 40 +------------
 2 files changed, 59 insertions(+), 37 deletions(-)
 create mode 100755 java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceAclResolver.java

diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceAclResolver.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceAclResolver.java
new file mode 100755
index 00000000000..90dbb6d6728
--- /dev/null
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceAclResolver.java
@@ -0,0 +1,56 @@
+package com.sap.sse.security.impl;
+
+import java.util.HashSet;
+import java.util.Set;
+
+import com.sap.sse.common.Util;
+import com.sap.sse.security.interfaces.AccessControlStore;
+import com.sap.sse.security.shared.AccessControlListAnnotation;
+import com.sap.sse.security.shared.OwnershipAnnotation;
+import com.sap.sse.security.shared.PermissionChecker.AclResolver;
+import com.sap.sse.security.shared.impl.AccessControlList;
+import com.sap.sse.security.shared.impl.Ownership;
+import com.sap.sse.security.shared.impl.User;
+import com.sap.sse.security.shared.impl.UserGroup;
+
+// TODO Bug 5239: a more efficient implementation is possible using reverse mappings in AccessControlStore
+public class SecurityServiceAclResolver implements AclResolver<AccessControlList, Ownership> {
+    private final AccessControlStore accessControlStore;
+
+    SecurityServiceAclResolver(AccessControlStore accessControlStore) {
+        this.accessControlStore = accessControlStore;
+    }
+
+    @Override
+    public Iterable<AccessControlList> resolveAcls(
+            Ownership ownership, String type, Iterable<String> objectIdentifiersAsString) {
+        final Set<AccessControlList> result = new HashSet<>();
+        for (AccessControlListAnnotation annotation : accessControlStore.getAccessControlLists()) {
+            // TODO bug5239: introduce shadow hash maps for ACLs that map by object type
+            if (!annotation.getIdOfAnnotatedObject().getTypeIdentifier().equals(type)) {
+                continue;
+            }
+            // TODO bug5239: if object IDs are provided, ACLs should be looked up straight from the combination of type and object ID through accessControlStore.getAccessControlList(QualifiedObjectIdentifier)
+            if (objectIdentifiersAsString != null && !Util.contains(objectIdentifiersAsString, annotation.getIdOfAnnotatedObject().getTypeRelativeObjectIdentifier().toString())) {
+                continue;
+            }
+            // If ownership is given, we can exclude objects not owned by the user or group
+            // TODO bug5239: introduce shadow hash maps for ACLs that map by ownership
+            if (ownership != null) {
+                final OwnershipAnnotation ownershipOfObject = accessControlStore.getOwnership(annotation.getIdOfAnnotatedObject());
+                if (ownershipOfObject != null) {
+                    final User userOwner = ownership.getUserOwner();
+                    final UserGroup tenantOwner = ownership.getTenantOwner();
+                    if (!(userOwner != null && userOwner
+                            .equals(ownershipOfObject.getAnnotation().getUserOwner()))
+                            && !(tenantOwner != null && tenantOwner.equals(
+                                    ownershipOfObject.getAnnotation().getTenantOwner()))) {
+                        continue;
+                    }
+                }
+            }
+            result.add(annotation.getAnnotation());
+        }
+        return result;
+    }
+}
\ No newline at end of file
diff --git a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
index 0af35a1ced8..45cf3cb092d 100755
--- a/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
+++ b/java/com.sap.sse.security/src/com/sap/sse/security/impl/SecurityServiceImpl.java
@@ -238,42 +238,7 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
     
     private final transient Set<SecurityInitializationCustomizer> customizers = ConcurrentHashMap.newKeySet();
     
-    // TODO Bug 5239: a more efficient implementation is possible using reverse mappings in AccessControlStore
-    private AclResolver<AccessControlList, Ownership> aclResolver = new AclResolver<AccessControlList, Ownership>() {
-        @Override
-        public Iterable<AccessControlList> resolveAcls(
-                Ownership ownership, String type, Iterable<String> objectIdentifiersAsString) {
-            final Set<AccessControlList> result = new HashSet<>();
-            for (AccessControlListAnnotation annotation : accessControlStore.getAccessControlLists()) {
-                // TODO bug5239: introduce shadow hash maps for ACLs that map by object type
-                if (!annotation.getIdOfAnnotatedObject().getTypeIdentifier().equals(type)) {
-                    continue;
-                }
-                // TODO bug5239: if object IDs are provided, ACLs should be looked up straight from the combination of type and object ID through accessControlStore.getAccessControlList(QualifiedObjectIdentifier)
-                if (objectIdentifiersAsString != null && !Util.contains(objectIdentifiersAsString, annotation.getIdOfAnnotatedObject().getTypeRelativeObjectIdentifier().toString())) {
-                    continue;
-                }
-                // If ownership is given, we can exclude objects not owned by the user or group
-                // TODO bug5239: introduce shadow hash maps for ACLs that map by ownership
-                if (ownership != null) {
-                    final OwnershipAnnotation ownershipOfObject = accessControlStore
-                            .getOwnership(annotation.getIdOfAnnotatedObject());
-                    if (ownershipOfObject != null) {
-                        final User userOwner = ownership.getUserOwner();
-                        final UserGroup tenantOwner = ownership.getTenantOwner();
-                        if (!(userOwner != null && userOwner
-                                .equals(ownershipOfObject.getAnnotation().getUserOwner()))
-                                && !(tenantOwner != null && tenantOwner.equals(
-                                        ownershipOfObject.getAnnotation().getTenantOwner()))) {
-                            continue;
-                        }
-                    }
-                }
-                result.add(annotation.getAnnotation());
-            }
-            return result;
-        }
-    };
+    private final AclResolver<AccessControlList, Ownership> aclResolver;
     
     static {
         shiroConfiguration = new Ini();
@@ -349,8 +314,9 @@ public class SecurityServiceImpl implements ReplicableSecurityService, ClearStat
         logger.info("Created: " + securityManager);
         SecurityUtils.setSecurityManager(securityManager);
         this.securityManager = securityManager;
+        aclResolver = new SecurityServiceAclResolver(accessControlStore);
     }
-
+    
     private ReplicatingCacheManager loadReplicationCacheManagerContents() {
         logger.info("Loading session cache manager contents");
         int count = 0;