Package com.atlassian.confluence.impl.security.content

Class DefaultContentPermissionManager

java.lang.Object

com.atlassian.confluence.impl.security.content.DefaultContentPermissionManager

All Implemented Interfaces:

ContentPermissionManager, ContentPermissionManagerInternal

public class DefaultContentPermissionManager
extends Object
implements ContentPermissionManagerInternal

Field Summary

Fields

Modifier and Type	Field	Description
protected ContentPermissionDao	contentPermissionDao

Constructor Summary

Constructors

Constructor	Description
DefaultContentPermissionManager()

Method Summary

Modifier and Type	Method	Description
void	addContentPermission(ContentPermission permission, ContentEntityObject content)	Adds a new current content permission to the CEO if it doesn't have it already.
void	copyContentPermissions(ContentEntityObject from, ContentEntityObject to)	Copies all content permissions from one content entity to another.
void	copyContentPermissions(AbstractPage from, AbstractPage to)	Copies all content permissions from one page to another.
AttachmentManager	getAttachmentManager()
List<ContentPermissionSet>	getContentPermissionSets(ContentEntityObject ceo, String type)	Get the ContentPermissionSets that affect this ceo, both inherited and directly.
Map<Long,InheritedContentPermissionSet>	getContentPermissionSetsIncludingInherited(Collection<Long> contentIds)	Return inherited permission for particular content.
List<ContentPermissionSet>	getInheritedContentPermissionSets(ContentEntityObject contentEntityObject)
List<ContentPermissionSet>	getInheritedContentPermissionSets(ContentEntityObject contentEntityObject, boolean includeEditPermissions)	Get the inherited ContentPermissionSets that affect this ceo.
List<ContentPermission>	getInheritedContentUserPermissions(ContentEntityObject contentEntityObject)	Filters the inherited content permission sets of a page for a list of inherited user permissions (of type ContentPermission.VIEW_PERMISSION)
Map<Long,Boolean>	getPermissionSets(ConfluenceUser user, Space space)	Retrieves the configured permissions regarding whether the specified user can view the pages inside a space.
List<Page>	getPermittedChildren(Page page, ConfluenceUser user)	Returns a list of Page objects that are direct children of the passed in page.
List<Page>	getPermittedChildrenIgnoreInheritedPermissions(Page page, ConfluenceUser user)	Gets the list of child pages under the given page that are visible to the given user.
List<Page>	getPermittedPagesIgnoreInheritedPermissions(List<Page> contentList, ConfluenceUser user, String permission)	Check permissions for a collection of objects without checking permissions of ancestors and spaces.
Map<ContentId,PageResponse<ContentPermissionSet>>	getRelevantViewRestrictionsForContent(LimitedRequest pageRequest, Map<Long,Long> contentIdToParentIdMap)	Return RelevantViewRestrictions per content where it will contain the direct and inherited permission set required to view the content
Set<ContentPermission>	getViewContentPermissions(Page page)	Get view permissions on this page and its ancestors.
boolean	hasContentLevelPermission(ConfluenceUser user, String permissionType, ContentEntityObject contentEntityObject)	fetches the inherited and explicit content level permissions for this content object and determines whether the user has access.
Map<Long,ValidationResult>	hasContentLevelPermission(ConfluenceUser user, String permissionType, Collection<Long> contentIds)	Check permission for a collection of content at once.
boolean	hasPermittedChildrenIgnoreInheritedPermissions(Page page, ConfluenceUser user)	Does the given page have children visible to the given user.
boolean	hasVisibleChildren(Page page, ConfluenceUser user)	Returns true if at least one child is visible This method does not check all children, it stops working when the first visible children is found
boolean	isPermissionInherited(Page childPage)	Does the child page get its permissions from any ancestor?
boolean	isSharedAccessAllowed(ConfluenceUser user, ContentEntityObject contentEntity)	Checks if this draft can be accessed by users other than the creator (shared access)
void	onContentPermissionEvent(ContentPermissionEvent contentPermissionEvent)
void	removeAllGroupPermissions(String groupName)	Remove all content permission associated with a given group.
void	removeAllUserPermissions(ConfluenceUser user)	Remove all content permission associated with a given user.
void	removeContentPermission(ContentPermission contentPermission)
void	setAuditingContext(AuditingContext auditingContext)
void	setBackgroundJobService(BackgroundJobService backgroundJobService)
void	setContentPermissionDao(ContentPermissionDao contentPermissionDao)
void	setContentPermissions(@NonNull Map<String,Collection<ContentPermission>> requiredPermissionsMap, ContentEntityObject content)	Set the Content Permissions on the CEO to be the list of ContentPermissions passed.
void	setContentPermissions(Collection<ContentPermission> requiredPermissions, ContentEntityObject content, String type)	Set the Content Permissions on the CEO to be the list of ContentPermissions passed.
void	setContentPermissionSetDao(ContentPermissionSetDao contentPermissionSetDao)
void	setDefaultPermissionOverrideExtensionProvider(DefaultPermissionOverrideExtensionProvider defaultPermissionOverrideExtensionProvider)
void	setEventPublisher(com.atlassian.event.api.EventPublisher eventPublisher)
void	setInheritedContentPermissionManager(InheritedContentPermissionManager inheritedContentPermissionManager)
void	setPageDao(PageDaoInternal pageDao)
void	setPermissionsTester(ContentPermissionTester permissionsTester)
void	setScopesRequestCacheDelegate(ScopesRequestCacheDelegate scopesRequestCacheDelegate)
void	setServiceAccountPermissionManager(ServiceAccountPermissionManager serviceAccountPermissionManager)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

contentPermissionDao

protected ContentPermissionDao contentPermissionDao

Constructor Details

DefaultContentPermissionManager

public DefaultContentPermissionManager()

Method Details

onContentPermissionEvent

@EventListener
public void onContentPermissionEvent(ContentPermissionEvent contentPermissionEvent)

getInheritedContentUserPermissions

public List<ContentPermission> getInheritedContentUserPermissions(ContentEntityObject contentEntityObject)

Filters the inherited content permission sets of a page for a list of inherited user permissions (of type ContentPermission.VIEW_PERMISSION)

Specified by:

getInheritedContentUserPermissions in interface ContentPermissionManager

getInheritedContentPermissionSets

public List<ContentPermissionSet> getInheritedContentPermissionSets(ContentEntityObject contentEntityObject)

Specified by:

getInheritedContentPermissionSets in interface ContentPermissionManager

Returns:

a list of ContentPermissionSets of type ContentPermission.VIEW_PERMISSION of all ancestors of contentEntityObject

getInheritedContentPermissionSets

public List<ContentPermissionSet> getInheritedContentPermissionSets(ContentEntityObject contentEntityObject,
 boolean includeEditPermissions)

Description copied from interface: ContentPermissionManager

Get the inherited ContentPermissionSets that affect this ceo. Note that EDIT Permissions are not currently inherited, however edit permissions are treated as view permissions when considering inheritance, unless the boolean 'includeEditPermissions' is set to false.

Specified by:

getInheritedContentPermissionSets in interface ContentPermissionManager

Parameters:

contentEntityObject - whose permissions will be returned. Not null.

includeEditPermissions - which specifies whether or not edit permissions should be additionally treated as view permissions.

Returns:

a list of ContentPermissionSets. Not null, but can be empty.

getContentPermissionSets

public List<ContentPermissionSet> getContentPermissionSets(ContentEntityObject ceo,
 String type)

Description copied from interface: ContentPermissionManager

Get the ContentPermissionSets that affect this ceo, both inherited and directly. Note that EDIT Permissions are not currently inherited, so calling this method with EDIT will return only the direct ContentPermissionSet.

Specified by:

getContentPermissionSets in interface ContentPermissionManager

Parameters:

ceo - whose permissions will be returned. Not null.

type - one of ContentPermission.VIEW_PERMISSION or ContentPermission.EDIT_PERMISSION

Returns:

a list of ContentPermissionSets. Not null, but can be empty.

hasContentLevelPermission

public boolean hasContentLevelPermission(ConfluenceUser user,
 String permissionType,
 ContentEntityObject contentEntityObject)

Description copied from interface: ContentPermissionManager

fetches the inherited and explicit content level permissions for this content object and determines whether the user has access.

Specified by:

hasContentLevelPermission in interface ContentPermissionManager

Parameters:

permissionType - ContentPermission.VIEW_PERMISSION or ContentPermission.EDIT_PERMISSION

Returns:

true if the user has the specified type of permission on the given content

removeContentPermission

public void removeContentPermission(ContentPermission contentPermission)

Specified by:

removeContentPermission in interface ContentPermissionManager

removeAllGroupPermissions

public void removeAllGroupPermissions(String groupName)

Description copied from interface: ContentPermissionManager

Remove all content permission associated with a given group.

Specified by:

removeAllGroupPermissions in interface ContentPermissionManager

Parameters:

groupName -

removeAllUserPermissions

public void removeAllUserPermissions(ConfluenceUser user)

Description copied from interface: ContentPermissionManager

Remove all content permission associated with a given user.

Specified by:

removeAllUserPermissions in interface ContentPermissionManager

Parameters:

user -

addContentPermission

public void addContentPermission(ContentPermission permission,
 ContentEntityObject content)

Adds a new current content permission to the CEO if it doesn't have it already.

Specified by:

addContentPermission in interface ContentPermissionManager

Parameters:

permission -

content -

Throws:

IllegalArgumentException - if content object does not correspond to the latest version of the content. Permissions can only be added to the latest version of a ContentEntityObject.

setContentPermissions

public void setContentPermissions(@NonNull Map<String,Collection<ContentPermission>> requiredPermissionsMap,
 ContentEntityObject content)

Description copied from interface: ContentPermissionManager

Set the Content Permissions on the CEO to be the list of ContentPermissions passed. Passing an empty list removes all permissions. Passing a list containing just the existing permissions does nothing. It is recommended to use this method for setting different types of content permissions in a batch, because it performs more smart and performant caching updates than ContentPermissionManager.setContentPermissions(java.util.Collection, ContentEntityObject, String) does

Specified by:

setContentPermissions in interface ContentPermissionManager

Parameters:

requiredPermissionsMap - - map of ContentPermissions for each type

content -

setContentPermissions

public void setContentPermissions(Collection<ContentPermission> requiredPermissions,
 ContentEntityObject content,
 String type)

Description copied from interface: ContentPermissionManager

Set the Content Permissions on the CEO to be the list of ContentPermissions passed. Passing an empty list removes all permissions. Passing a list containing just the existing permissions does nothing.

Specified by:

setContentPermissions in interface ContentPermissionManager

Parameters:

requiredPermissions - set of ContentPermissions

content -

type -

getPermittedChildren

public List<Page> getPermittedChildren(Page page,
 ConfluenceUser user)

Returns a list of Page objects that are direct children of the passed in page. This method will only return the children the passed in user has permission to view.

Specified by:

getPermittedChildren in interface ContentPermissionManager

getPermittedChildrenIgnoreInheritedPermissions

public List<Page> getPermittedChildrenIgnoreInheritedPermissions(Page page,
 ConfluenceUser user)

Description copied from interface: ContentPermissionManager

Gets the list of child pages under the given page that are visible to the given user. This method assumes that the given page is already visible to the given user and does not check the inherited permissions.

Specified by:

getPermittedChildrenIgnoreInheritedPermissions in interface ContentPermissionManager

hasPermittedChildrenIgnoreInheritedPermissions

public boolean hasPermittedChildrenIgnoreInheritedPermissions(Page page,
 ConfluenceUser user)

Description copied from interface: ContentPermissionManager

Does the given page have children visible to the given user. This method assumes that the given page is already visible to the given user and does not check the inherited permissions.

Specified by:

hasPermittedChildrenIgnoreInheritedPermissions in interface ContentPermissionManager

getViewContentPermissions

public Set<ContentPermission> getViewContentPermissions(Page page)

Description copied from interface: ContentPermissionManager

Get view permissions on this page and its ancestors.

Specified by:

getViewContentPermissions in interface ContentPermissionManager

Parameters:

page -

Returns:

a list of ContentPermission instances

setAuditingContext

public void setAuditingContext(AuditingContext auditingContext)

setContentPermissionDao

public void setContentPermissionDao(ContentPermissionDao contentPermissionDao)

setPageDao

public void setPageDao(PageDaoInternal pageDao)

setContentPermissionSetDao

public void setContentPermissionSetDao(ContentPermissionSetDao contentPermissionSetDao)

setEventPublisher

public void setEventPublisher(com.atlassian.event.api.EventPublisher eventPublisher)

setInheritedContentPermissionManager

public void setInheritedContentPermissionManager(InheritedContentPermissionManager inheritedContentPermissionManager)

setScopesRequestCacheDelegate

public void setScopesRequestCacheDelegate(ScopesRequestCacheDelegate scopesRequestCacheDelegate)

getAttachmentManager

public AttachmentManager getAttachmentManager()

isPermissionInherited

public boolean isPermissionInherited(Page childPage)

Description copied from interface: ContentPermissionManager

Does the child page get its permissions from any ancestor?

Specified by:

isPermissionInherited in interface ContentPermissionManager

Parameters:

childPage -

Returns:

boolean True if the child page does not have a view permission set, and an ancestor does.

copyContentPermissions

public void copyContentPermissions(AbstractPage from,
 AbstractPage to)

Description copied from interface: ContentPermissionManager

Copies all content permissions from one page to another.

Specified by:

copyContentPermissions in interface ContentPermissionManager

copyContentPermissions

public void copyContentPermissions(ContentEntityObject from,
 ContentEntityObject to)

Description copied from interface: ContentPermissionManager

Copies all content permissions from one content entity to another.

Specified by:

copyContentPermissions in interface ContentPermissionManager

getPermissionSets

public Map<Long,Boolean> getPermissionSets(ConfluenceUser user,
 Space space)

Description copied from interface: ContentPermissionManager

Retrieves the configured permissions regarding whether the specified user can view the pages inside a space. If a page is not configured in the tables - CONTENT_PERM_SET and CONTENT_PERM, then the permission of that page will not be included here. Note: the permission returned here does not consider the inherited permission from parent page.

Specified by:

getPermissionSets in interface ContentPermissionManager

Parameters:

user - - confluence user to be checked

space - - confluence space

Returns:

a Map where the key is the page id and the value indicates the view permission.

hasContentLevelPermission

public Map<Long,ValidationResult> hasContentLevelPermission(ConfluenceUser user,
 String permissionType,
 Collection<Long> contentIds)

Description copied from interface: ContentPermissionManagerInternal

Check permission for a collection of content at once.

• if contentIds belong to same page hierarchy then it will base on the permission set of that hierarchy to check permisssion for all hierarchy => Best performance
• if contentIds does not belong to same page hierarchy then it will load page list (at once) and call permission check for each page => better performance

Specified by:

hasContentLevelPermission in interface ContentPermissionManagerInternal

Parameters:

user -

permissionType - string needs to be one of the permission constants in ContentPermission

contentIds -

Returns:

a map of validation result

getPermittedPagesIgnoreInheritedPermissions

public List<Page> getPermittedPagesIgnoreInheritedPermissions(List<Page> contentList,
 ConfluenceUser user,
 String permission)

Description copied from interface: ContentPermissionManagerInternal

Check permissions for a collection of objects without checking permissions of ancestors and spaces.

Specified by:

getPermittedPagesIgnoreInheritedPermissions in interface ContentPermissionManagerInternal

Parameters:

contentList -

user -

permission -

Returns:

a list of permitted objects

hasVisibleChildren

public boolean hasVisibleChildren(Page page,
 ConfluenceUser user)

Description copied from interface: ContentPermissionManagerInternal

Returns true if at least one child is visible This method does not check all children, it stops working when the first visible children is found

Specified by:

hasVisibleChildren in interface ContentPermissionManagerInternal

Parameters:

page -

user -

Returns:

false if 0 children visible, true of at least one child is visible

getContentPermissionSetsIncludingInherited

public Map<Long,InheritedContentPermissionSet> getContentPermissionSetsIncludingInherited(Collection<Long> contentIds)

Description copied from interface: ContentPermissionManagerInternal

Return inherited permission for particular content. This will include permission from current content and permission from ancestor

Specified by:

getContentPermissionSetsIncludingInherited in interface ContentPermissionManagerInternal

getRelevantViewRestrictionsForContent

public Map<ContentId,PageResponse<ContentPermissionSet>> getRelevantViewRestrictionsForContent(LimitedRequest pageRequest,
 Map<Long,Long> contentIdToParentIdMap)

Description copied from interface: ContentPermissionManagerInternal

Return RelevantViewRestrictions per content where it will contain the direct and inherited permission set required to view the content

Specified by:

getRelevantViewRestrictionsForContent in interface ContentPermissionManagerInternal

Parameters:

pageRequest -

contentIdToParentIdMap - map from contentId to parent contentId

Returns:

a map between content Id and it's RelevantViewRestrictions

isSharedAccessAllowed

public boolean isSharedAccessAllowed(ConfluenceUser user,
 ContentEntityObject contentEntity)

Description copied from interface: ContentPermissionManager

Checks if this draft can be accessed by users other than the creator (shared access)

IMPORTANT NOTE: if shared access is disallowed it prevails over permissions (only creator has access), BUT if it is allowed normal permissions still need to be checked

Drafts for existing objects are considered automatically shared according to the permissions set, but drafts that have never been published are considered private even without permissions set, so if a user if trying to access one of them it should be verified that is doing so with the proper share id in addition to permissions.

Specified by:

isSharedAccessAllowed in interface ContentPermissionManager

Parameters:

user - User to check

Returns:

true if this draft can be accessed given a share id, false otherwise

See Also:

• SharedAccessInterceptor

setBackgroundJobService

public void setBackgroundJobService(BackgroundJobService backgroundJobService)

setPermissionsTester

public void setPermissionsTester(ContentPermissionTester permissionsTester)

setDefaultPermissionOverrideExtensionProvider

public void setDefaultPermissionOverrideExtensionProvider(DefaultPermissionOverrideExtensionProvider defaultPermissionOverrideExtensionProvider)

setServiceAccountPermissionManager

public void setServiceAccountPermissionManager(ServiceAccountPermissionManager serviceAccountPermissionManager)