Monotone-Parent: a084cda52b54dea2be32b37d71aefe6f27b1af33

Monotone-Revision: 8e81030e83aa6ed594c40a5f56274b5ba292f47c Monotone-Author: wsourdeau@inverse.ca Monotone-Date: 2008-05-02T23:08:15 Monotone-Branch: ca.inverse.sogo
2026-10-06 04:20:33 +00:00 · 2008-05-02 23:08:15 +00:00
parent 4f76b2ee5f
commit 5c2c26e0db
12 changed files with 1286 additions and 423 deletions
@@ -0,0 +1,262 @@
+/* SOGoWebDAVAclManager.m - this file is part of SOGo
+ *
+ * Copyright (C) 2008 Inverse groupe conseil
+ *
+ * Author: Wolfgang Sourdeau <wsourdeau@inverse.ca>
+ *
+ * This file is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This file is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; see the file COPYING.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#import <Foundation/NSArray.h>
+#import <Foundation/NSString.h>
+#import <Foundation/NSValue.h>
+
+#import <NGObjWeb/SoClass.h>
+#import <NGObjWeb/SoClassSecurityInfo.h>
+#import <NGExtensions/NSObject+Logs.h>
+
+#import "NSDictionary+Utilities.h"
+#import "NSObject+DAV.h"
+#import "SOGoObject.h"
+#import "SOGoUser.h"
+#import "SOGoWebDAVValue.h"
+
+#import "SOGoWebDAVAclManager.h"
+
+static NSNumber *yesObject = nil;
+
+@interface SoClass (SOGoDAVPermissions)
+
+- (BOOL) userRoles: (NSArray *) userRoles
+    havePermission: (NSString *) permission;
+
+@end
+
+@implementation SoClass (SOGoDAVPermissions)
+
+- (BOOL) userRoles: (NSArray *) userRoles
+    havePermission: (NSString *) permission
+{
+  BOOL result;
+  SoClass *currentClass;
+  NSArray *roles;
+
+  result = NO;
+
+  currentClass = self;
+  while (!result && currentClass)
+    {
+      roles = [[currentClass soClassSecurityInfo]
+		defaultRolesForPermission: permission];
+      if ([roles firstObjectCommonWithArray: userRoles])
+	{
+	  NSLog (@"matched '%@': %@", permission, roles);
+	  result = YES;
+	}
+      else
+	currentClass = [currentClass soSuperClass];
+    }
+
+  return result;
+}
+
+@end
+
+@implementation SOGoWebDAVAclManager
+
+ (void) initialize
+{
+  if (!yesObject)
+    {
+      yesObject = [NSNumber numberWithBool: YES];
+      [yesObject retain];
+    }
+}
+
+- (id) init
+{
+  if ((self = [super init]))
+    {
+      aclTree = [NSMutableDictionary new];
+      [self registerDAVPermission: davElement (@"all", @"DAV:")
+	    abstract: YES
+	    withEquivalent: nil
+	    asChildOf: nil];
+    }
+
+  return self;
+}
+
+- (void) dealloc
+{
+  [aclTree release];
+  [super dealloc];
+}
+
+- (void) _registerChild: (NSMutableDictionary *) newEntry
+		     of: (NSDictionary *) parentPermission
+{
+  NSString *identifier;
+  NSMutableDictionary *parentEntry;
+  NSMutableArray *children;
+
+  identifier = [parentPermission keysWithFormat: @"{%{ns}}%{method}"];
+  parentEntry = [aclTree objectForKey: identifier];
+  if (!parentEntry)
+    [self warnWithFormat: @"parent entry '%@' does not exist in DAV"
+	  @" permissions table", identifier];
+  children = [parentEntry objectForKey: @"children"];
+  if (!children)
+    {
+      children = [NSMutableArray new];
+      [parentEntry setObject: children forKey: @"children"];
+      [children release];
+    }
+  [children addObject: newEntry];
+  [newEntry setObject: parentEntry forKey: @"parent"];
+}
+
+- (void) registerDAVPermission: (NSDictionary *) davPermission
+	 	      abstract: (BOOL) abstract
+		withEquivalent: (NSString *) sogoPermission
+		     asChildOf: (NSDictionary *) otherDAVPermission
+{
+  NSMutableDictionary *newEntry;
+  NSString *identifier;
+
+  newEntry = [NSMutableDictionary new];
+  identifier = [davPermission keysWithFormat: @"{%{ns}}%{method}"];
+  if ([aclTree objectForKey: identifier])
+    [self warnWithFormat:
+	    @"entry '%@' already exists in DAV permissions table",
+	  identifier];
+  [aclTree setObject: newEntry forKey: identifier];
+  [newEntry setObject: davPermission forKey: @"permission"];
+  if (abstract)
+    [newEntry setObject: yesObject forKey: @"abstract"];
+  if (sogoPermission)
+    [newEntry setObject: sogoPermission forKey: @"equivalent"];
+
+  if (otherDAVPermission)
+    [self _registerChild: newEntry of: otherDAVPermission];
+
+  [newEntry release];
+}
+
+#warning this method should be simplified!
+/* We add the permissions that fill those conditions:
+   - should match the sogo permissions implied by the user roles
+   If all the child permissions of a permission are included, then this
+   permission will be included too. Conversely, if a permission is included,
+   all the child permissions will be included too. */
+
+- (BOOL) _fillArray: (NSMutableArray *) davPermissions
+     withPermission: (NSDictionary *) permission
+       forUserRoles: (NSArray *) userRoles
+	withSoClass: (SoClass *) soClass
+     matchSOGoPerms: (BOOL) matchSOGoPerms
+{
+  NSString *sogoPermission;
+  NSDictionary *childPermission;
+  NSEnumerator *children;
+  BOOL appended, childrenAppended;
+
+  appended = YES;
+  if (matchSOGoPerms)
+    {
+      sogoPermission = [permission objectForKey: @"equivalent"];
+      if (sogoPermission
+	  && [soClass userRoles: userRoles havePermission: sogoPermission])
+	{
+	  [davPermissions
+	    addObject: [permission objectForKey: @"permission"]];
+	}
+      else
+	appended = NO;
+    }
+  else
+    [davPermissions
+      addObject: [permission objectForKey: @"permission"]];
+
+  children = [[permission objectForKey: @"children"] objectEnumerator];
+  if (children)
+    {
+      childrenAppended = YES;
+      while ((childPermission = [children nextObject]))
+	childrenAppended = (childrenAppended
+			    && [self _fillArray: davPermissions
+				     withPermission: childPermission
+				     forUserRoles: userRoles
+				     withSoClass: soClass
+				     matchSOGoPerms: (matchSOGoPerms && !appended)]);
+      if (childrenAppended && !appended)
+	{
+	  [davPermissions
+	    addObject: [permission objectForKey: @"permission"]];
+	  appended = YES;
+	}
+    }
+
+  return appended;
+}
+
+- (NSArray *) davPermissionsForRoles: (NSArray *) roles
+			    onObject: (SOGoObject *) object
+{
+  NSMutableArray *davPermissions;
+  SoClass *soClass;
+
+  davPermissions = [NSMutableArray array];
+  soClass = [[object class] soClass];
+  [self _fillArray: davPermissions
+	withPermission: [aclTree objectForKey: @"{DAV:}all"]
+	forUserRoles: roles
+	withSoClass: soClass
+	matchSOGoPerms: YES];
+
+  return davPermissions;
+}
+
+- (SOGoWebDAVValue *)
+    _supportedPrivilegeSetFromPermission: (NSDictionary *) perm
+{
+  NSMutableArray *privilege;
+  NSEnumerator *children;
+  NSDictionary *currentPerm;
+
+  privilege = [NSMutableArray array];
+  [privilege addObject:
+	       davElementWithContent (@"privilege",
+				      @"DAV:",
+				      [perm objectForKey: @"permission"])];
+  if ([[perm objectForKey: @"abstract"] boolValue])
+    [privilege addObject: davElement (@"abstract", @"DAV:")];
+  children = [[perm objectForKey: @"children"] objectEnumerator];
+  while ((currentPerm = [children nextObject]))
+    [privilege addObject:
+		 [self _supportedPrivilegeSetFromPermission: currentPerm]];
+
+  return davElementWithContent (@"supported-privilege",
+				@"DAV:", privilege);
+}
+
+- (SOGoWebDAVValue *) treeAsWebDAVValue
+{
+  return [self _supportedPrivilegeSetFromPermission:
+		 [aclTree objectForKey: @"{DAV:}all"]];
+}
+
+@end