[Home]	[About]
[Screenshots]	[Download]
[News]	[Community]
[Documentation]	[Manual]
[Bugs & Requests]	[Wiki]

/home/tetron/hack/vos/libs/vos/vos/accesscontrolstate.hh

Go to the documentation of this file.

#ifndef _ACCESSCONTROLSTATE_HH_
#define _ACCESSCONTROLSTATE_HH_

#include <vos/vos/acl.hh>
#include <vos/vutil/readwritemutex.hh>

namespace VOS {
    class VobjectBase;

/** @class AccessControlState accesscontrolstate.hh vos/vos/accesscontrolstate.hh
    @ingroup libvos

    This class stores and manages the access control lists for a
    particular local Vobject.
*/
class VOS_API AccessControlState
{
private:
    VobjectBase* myvobject;

    VUtil::read_write_mutex accessControlLists_mutex;
    std::map<std::string, AccessControlList*> accessControlLists;

    VUtil::read_write_mutex default_AC_policies_mutex;
    std::map<std::string, std::string> default_AC_policies;

public:
    /** Constructor.
        @param myvobject the Vobject to be managed by this
        AccessControlState object.
    */
    AccessControlState(VobjectBase* myvobject);

    /** Destructor. */
    ~AccessControlState();

    /** @return the Vobject that these access control policies are
        applied to. */
    VUtil::vRef<VobjectBase> getBase();

    /** Do an access control lookup; for some identity requesting
        access, this will return the appropriate policy in some domain
        based on the current access control lists.

        Access control lookup works like this:

          -# Check each ACL to see if it lists this Identity.  If so,
          we use that ACL's policy.
          -# Otherwise, check each ACL for groups that this Identity
          belongs to.  If the Identity is a member of several Groups
          that are in different ACLs, then return the policy for each
          relevant ACL.  The caller should check *every* policy to
          determine pass or fail -- this is up to the caller, but
          commonly in VOS code if any policy grants permission then
          permission is given.  This means that groups can be used to
          add permissions, but not take them away!  Design you access
          control scheme accordingly (and make the default permissions
          as restrictive as possible).
          -# Otherwise, because neither the Identity nor any Group it
          is a member of appear in any ACL, the default access control
          is returned.

        @param domain the policy domain of interest
        @param id the identity requesting access
    */
    StringIterator getPolicy(const std::string& domain, Identity* id);

    /** @return all policies in a particular policy domain that are
        available for use.
     */
    StringIterator getAvailablePolicies(const std::string& domain);

    /** Add an identity to an access control list (ACL).  If this identity
        exists in another ACL, it will be removed from that ACL first.

        @param ACLname the name of the ACL.  This is a comma-separated
        list of the access control policies to apply for each domain.
        For example "core:read-only,property:accept-all".  Order does
        not matter (it will be sorted) but this access control list name is
        distict from just "core:read-only"!
        @param id the Identity to add
    */
    void addToACL(const std::string& ACLname, Identity* id);


    /** Add a group to an access control list (ACL).  If this group
        exists in another ACL, it will be removed from that ACL first.
        @param ACLname the name of the ACL.  This is a comma-separated
        list of the access control policies to apply for each domain.
        For example "core:read-only,property:accept-all".  Order does
        not matter (it will be sorted) but this access control list name is
        distict from just "core:read-only"!
        @param grp the Group to add
    */
    void addToACL(const std::string& ACLname, Group* grp);

    /** Remove an Identity from an access control list (ACL).  The ACL
        will be deleted when the last member is removed.

        @param ACLname the name of the ACL.  This is a comma-separated
        list of the access control policies to apply for each domain.
        For example "core:read-only,property:accept-all".  Order does
        not matter (it will be sorted) but this access control list name is
        distict from just "core:read-only"!
        @param id the Identity to add
     */
    void removeFromACL(const std::string& ACLname, Identity* id);

    /** Remove a Group from an access control list (ACL).  The ACL
        will be deleted when the last member is removed.

        @param ACLname the name of the ACL.  This
        is a comma-separated list of the access control policies to
        apply for each domain.  For example
        "core:read-only,property:accept-all".  Order does not matter
        (it will be sorted) but this access control list name is
        distict from just "core:read-only"!  @param grp the Group to
        add
     */
    void removeFromACL(const std::string& ACLname, Group* grp);

    /** Completely delete an ACL.
        @param policies the name of the ACL.  This is a comma-separated
        list of the access control policies to apply for each domain.
        For example "core:read-only,property:accept-all".  Order does
        not matter (it will be sorted) but this access control list name is
        distict from just "core:read-only"!
     */
    void deleteACL(const std::string& policies);

    /** Get the policy that is applied by default if the requester's
        identity or groups were not found in any ACL.  This is also
        the policy applied to anonymous users (users with no
        identity.)

        @param domain the policy domain you are interested in.  If
        blank, returns a comma-separated list of the policy in each
        domain.
    */
    std::string getDefaultPolicy(const std::string& domain = "");

    /** Set the default policy.

        @param policy the policy.  This only affects the domains
        listed.  For example, if your current default policy is
        "core:read-only,property:accept-all" and you call
        setDefaultPolicy("property:read-only") the resulting default
        policy will be "core:read-only,property:read-only".
     */
    void setDefaultPolicy(const std::string& policy);

    /** Get the access control list (ACL) associated with a particular
        name.

        @param policies the ACL name, a comma-separated list of domain:policy
        pairs, the same as used by addToACL(), removeFromACL() and
        deleteACL().
    */
    VUtil::vRef<AccessControlList> getACL(const std::string& policies);

    /** @return all access control lists (ACL) that have been set.
     */
    ACLIterator getAllACLs();
};
};

#endif