Package org.apache.sling.jcr.jackrabbit.accessmanager.post

# Class ModifyPrincipalAceServlet

java.lang.Object
jakarta.servlet.GenericServlet
org.apache.sling.api.servlets.SlingJakartaSafeMethodsServlet
org.apache.sling.api.servlets.SlingJakartaAllMethodsServlet
org.apache.sling.jcr.jackrabbit.accessmanager.post.AbstractAccessServlet
org.apache.sling.jcr.jackrabbit.accessmanager.post.AbstractAccessPostServlet
org.apache.sling.jcr.jackrabbit.accessmanager.post.ModifyAceServlet
org.apache.sling.jcr.jackrabbit.accessmanager.post.ModifyPrincipalAceServlet

All Implemented Interfaces:
  `jakarta.servlet.Servlet`, `jakarta.servlet.ServletConfig`, `Serializable`, `ModifyAce`, `ModifyPrincipalAce`

public class ModifyPrincipalAceServlet extends ModifyAceServlet implements ModifyPrincipalAce

Sling Post Servlet implementation for modifying the principalbased ACE for a principal on a JCR resource.

## Rest Service Description

Modify a principal's ACEs for the node identified as a resource by the request URL >resource<.modifyPAce.html

### Transport Details:

#### Methods

- POST

#### Post Parameters

principalId
  The principal of the ACEs to modify in the ACL specified by the path.
privilege@[privilege_name]
  One or more privileges which will be applied to the ACE. Any permissions that are present in an existing ACE for the principal but not in the request are left untouched. The parameter value must be either 'allow' or 'all'. For backward compatibility, 'granted' may also be used for the parameter value as an alias for 'allow'.
restriction@[restriction_name]
  One or more restrictions which will be applied to the ACE. The value is the target value of the restriction to be set.
restriction@[restriction_name]@Delete
  One or more restrictions which will be removed from the ACE
privilege@[privilege_name]@Delete
  One param for each privilege to delete. The parameter value must be either 'allow' or 'all' to specify which state to delete from
restriction@[privilege_name]@[restriction_name]@Allow
restriction@[privilege_name]@[restriction_name]@Deny
  One param for each restriction value. The same parameter name may be used again for multi-value restrictions. The @Allow suffix specifies whether to apply the restriction to the 'allow' privilege. The value is the target value of the restriction to be set.
restriction@[privilege_name]@[restriction_name]@Delete
  One param for each restriction to delete. The parameter value must be either 'allow' or 'all' to specify which state to delete from.

#### Response

200
  Success.
404
  The resource was not found.
500
  Failure. HTML explains the failure.

#### Notes

The principalId is assumed to refer directly to an Authorizable, that comes direct from the UserManager. This can be a group or a user, but if its a group, denied permissions will not be added to the group. The group will only contain granted privileges.

See Also:
  - Serialized Form

## Constructor Summary

Constructors
Constructor
Description
`ModifyPrincipalAceServlet()`

## Method Summary

Modifier and Type
Method
Description
`protected void`
`addAces(@NotNull String resourcePath, @NotNull Principal principal, @NotNull Map<Set<LocalRestriction>,List<LocalPrivilege>> restrictionsToLocalPrivilegesMap, boolean isAllow, @NotNull org.apache.jackrabbit.api.security.JackrabbitAccessControlList acl, Map<javax.jcr.security.Privilege,Integer> privilegeLongestDepthMap)`
Override to ensure we do not add enty that denies privileges which is not allowed in a principal ACE
`protected boolean`
`allowNonExistingPaths()`
Returns whether this operation can operate on paths that do not exist yet
`protected org.apache.jackrabbit.api.security.JackrabbitAccessControlList`
`getAcl(@NotNull javax.jcr.security.AccessControlManager acm, String resourcePath, Principal principal)`
Override to ensure that we get the policy that implements `PrincipalAccessControlList`
`protected @Nullable org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry`
`getJackrabbitAccessControlEntry(@NotNull javax.jcr.security.AccessControlEntry entry, @NotNull String resourcePath, @NotNull Principal forPrincipal)`
Override to ensure that we only return the entries that have an effectivePath that matches the current resourcePath
`void`
`modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Collection<LocalPrivilege> localPrivileges, boolean autoSave)`
Add or modify the access control entry for the specified user or group.
`void`
`modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Map<String,String> privileges, boolean autoSave)`
Add or modify the access control entry for the specified user or group.
`void`
`modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Map<String,String> privileges, Map<String,javax.jcr.Value> restrictions, Map<String,javax.jcr.Value[]> mvRestrictions, Set<String> removeRestrictionNames, boolean autoSave)`
Add or modify the access control entry for the specified user or group.
`protected String`
`removeAces(@NotNull String resourcePath, @Nullable String order, @NotNull Principal principal, @NotNull org.apache.jackrabbit.api.security.JackrabbitAccessControlList acl)`
Override to ensure that we only remove the entries that have an effectivePath that matches the current resourcePath

### Methods inherited from class org.apache.sling.jcr.jackrabbit.accessmanager.post.ModifyAceServlet

`applyPrivilegeAndRestrictions, buildRestrictionNameToDefinitionMap, getMatchedRequestParameterNames, handleOperation, loadStoredAce, modifyAce, modifyAce, modifyAce, modifyAce, modifyAce, modifyAce, modifyAce, postedRestrictionsForPrivilege, processPostedPrivilegeAndRestrictionParams, processPostedPrivilegeDeleteParams, processPostedRestrictionDeleteParams, toLocalRestriction, validateArgs`

### Methods inherited from class org.apache.sling.jcr.jackrabbit.accessmanager.post.AbstractAccessPostServlet

`bindPostResponseCreator, doPost, externalizePath, getAccessControlList, getAccessControlListOrNull, getItemPath, getParentPath, getRedirectUrl, isSetStatus, unbindPostResponseCreator, validateResourcePath`

### Methods inherited from class org.apache.sling.jcr.jackrabbit.accessmanager.post.AbstractAccessServlet

`bindRestrictionProvider, getRestrictionProvider, unbindRestrictionProvider`

### Methods inherited from class org.apache.sling.api.servlets.SlingJakartaAllMethodsServlet

`doDelete, doPut, getAllowedRequestMethods, isMethodValid, mayService`

### Methods inherited from class org.apache.sling.api.servlets.SlingJakartaSafeMethodsServlet

`doGeneric, doGet, doHead, doOptions, doTrace, getServletInfo, handleMethodNotImplemented, service, service`

### Methods inherited from class jakarta.servlet.GenericServlet

`destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletName, init, init, log, log`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### ModifyPrincipalAceServlet

public ModifyPrincipalAceServlet()

## Method Details

### allowNonExistingPaths

protected boolean allowNonExistingPaths()
Description copied from class: `AbstractAccessPostServlet`
Returns whether this operation can operate on paths that do not exist yet

Overrides:
  `allowNonExistingPaths` in class `AbstractAccessPostServlet`
Returns:
  true if the resourcePath must exist, false otherwise

### modifyPrincipalAce

public void modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Map<String,String> privileges, boolean autoSave) throws javax.jcr.RepositoryException
Description copied from interface: `ModifyPrincipalAce`
Add or modify the access control entry for the specified user or group.

Specified by:
  `modifyPrincipalAce` in interface `ModifyPrincipalAce`
Parameters:
  `jcrSession` - the JCR session of the user updating the user
  `resourcePath` - The absolute path of the resource to apply the ACE to (required)
  `principalId` - The name of the user/group to provision (required)
  `privileges` - Map of privileges to apply. (optional)
  `autoSave` - true to automatically save changes to the JCR session, false otherwise
Throws:
  `javax.jcr.RepositoryException` - if any errors applying the changes

### modifyPrincipalAce

public void modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Map<String,String> privileges, Map<String,javax.jcr.Value> restrictions, Map<String,javax.jcr.Value[]> mvRestrictions, Set<String> removeRestrictionNames, boolean autoSave) throws javax.jcr.RepositoryException
Description copied from interface: `ModifyPrincipalAce`
Add or modify the access control entry for the specified user or group.

Specified by:
  `modifyPrincipalAce` in interface `ModifyPrincipalAce`
Parameters:
  `jcrSession` - the JCR session of the user updating the user
  `resourcePath` - The absolute path of the resource to apply the ACE to (required)
  `principalId` - The name of the user/group to provision (required)
  `privileges` - Map of privileges to apply. (optional)
  `restrictions` - Map of single-value restrictions to apply. (optional)
  `mvRestrictions` - Map of multi-value restrictions to apply. (optional)
  `removeRestrictionNames` - Set of existing restriction names to remove (optional)
  `autoSave` - true to automatically save changes to the JCR session, false otherwise
Throws:
  `javax.jcr.RepositoryException` - if any errors applying the changes

### modifyPrincipalAce

public void modifyPrincipalAce(javax.jcr.Session jcrSession, String resourcePath, String principalId, Collection<LocalPrivilege> localPrivileges, boolean autoSave) throws javax.jcr.RepositoryException
Description copied from interface: `ModifyPrincipalAce`
Add or modify the access control entry for the specified user or group.

Specified by:
  `modifyPrincipalAce` in interface `ModifyPrincipalAce`
Parameters:
  `jcrSession` - the JCR session of the user updating the user
  `resourcePath` - The absolute path of the resource to apply the ACE to (required)
  `principalId` - The name of the user/group to provision (required)
  `localPrivileges` - collection of privileges to apply.
  `autoSave` - true to automatically save changes to the JCR session, false otherwise
Throws:
  `javax.jcr.RepositoryException` - if any errors applying the changes

### getAcl

protected org.apache.jackrabbit.api.security.JackrabbitAccessControlList getAcl(@NotNull @NotNull javax.jcr.security.AccessControlManager acm, String resourcePath, Principal principal) throws javax.jcr.RepositoryException
Override to ensure that we get the policy that implements `PrincipalAccessControlList`

Overrides:
  `getAcl` in class `ModifyAceServlet`
Parameters:
  `acm` - the access control manager
  `resourcePath` - the resource path
  `principal` - the principal for principalbased ACL
Returns:
  the found ACL object
Throws:
  `javax.jcr.RepositoryException`

### removeAces

protected String removeAces(@NotNull @NotNull String resourcePath, @Nullable @Nullable String order, @NotNull @NotNull Principal principal, @NotNull @NotNull org.apache.jackrabbit.api.security.JackrabbitAccessControlList acl) throws javax.jcr.RepositoryException
Override to ensure that we only remove the entries that have an effectivePath that matches the current resourcePath

Overrides:
  `removeAces` in class `ModifyAceServlet`
  `order` - the requested order (may be null)
  `principal` - the principal whose aces should be removed
  `acl` - the access control list to update
Returns:
  the original order if it was supplied, otherwise the order of the first ACE
Throws:
  `javax.jcr.RepositoryException`

### addAces

protected void addAces(@NotNull @NotNull String resourcePath, @NotNull @NotNull Principal principal, @NotNull @NotNull Map<Set<LocalRestriction>,List<LocalPrivilege>> restrictionsToLocalPrivilegesMap, boolean isAllow, @NotNull @NotNull org.apache.jackrabbit.api.security.JackrabbitAccessControlList acl, Map<javax.jcr.security.Privilege,Integer> privilegeLongestDepthMap) throws javax.jcr.RepositoryException
Override to ensure we do not add enty that denies privileges which is not allowed in a principal ACE

Overrides:
  `addAces` in class `ModifyAceServlet`
Parameters:
  `resourcePath` - the path of the resource
  `principal` - the principal whose aces should be added
  `restrictionsToLocalPrivilegesMap` - the map containing the restrictions mapped to the LocalPrivlege items with those resrictions
  `isAllow` - true for 'allow' ACE, false for 'deny' ACE
  `acl` - the access control list to update
Throws:
  `javax.jcr.RepositoryException`

### getJackrabbitAccessControlEntry

@Nullable protected @Nullable org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry getJackrabbitAccessControlEntry(@NotNull @NotNull javax.jcr.security.AccessControlEntry entry, @NotNull @NotNull String resourcePath, @NotNull @NotNull Principal forPrincipal)
Override to ensure that we only return the entries that have an effectivePath that matches the current resourcePath

Overrides:
  `getJackrabbitAccessControlEntry` in class `ModifyAceServlet`