org.eclipse.stardust.engine.core.runtime.utils

Class PermissionHelper

java.lang.Object

org.eclipse.stardust.engine.core.runtime.utils.PermissionHelper

public class PermissionHelper
extends Object

Client side utility class that computes the permissions the user has to invoke the service methods.

Since permission computations may be expensive, the class by default is caching the results of those computations. Because of that, it is important to maintain the consistency of the cache by always using services obtained from the same instance of a ServiceFactory. If the client needs to check permissions using two (or more) service factories, it is required to instantiate separate PermissionHelpers, one for each ServiceFactory.

Example:

 ServiceFactory factory = ... // obtained somehow.
 WorkflowService wfs = factory.getWorkflowService();
 DeployedModel model = wfs.getModel();
 
 PermissionHelper helper = new PermissionHelper();
 boolean canReadModelData = helper.hasPermission(wfs, Permissions.MODEL_READ_MODEL_DATA, model);
 if (canReadModelData)
 {
     List pds = wfs.getStartableProcessDefinitions();
 }
 

Version:

$Revision: $

Author:

Florin.Herinean

Constructor Summary

Constructors

Constructor and Description
PermissionHelper() Default constructor.
PermissionHelper(boolean useCaches) Constructor used when caching should be disabled.
PermissionHelper(User user, Set<String> startableProcesses) Constructor that enable caching and optionally provides an already fetched User or the set of startable process IDs.

Method Summary

Methods

Modifier and Type	Method and Description
boolean	canPerformActivity(User user, Activity activity) Checks if the user can perform the activity (activate, complete).
boolean	canStartProcess(WorkflowService service, ProcessDefinition process) Checks if the user can start the given process definition (and create a new process instance).
List<Activity>	filterActivityAccess(WorkflowService service, List<Activity> activities) Filters a list of activities based on the activity.readActivityInstanceData permission.
List<ProcessDefinition>	filterProcessAccess(WorkflowService service, List<ProcessDefinition> processes) Filters a list of process definitions based on the processDefinition.readProcessInstanceData permission.
boolean	hasPermission(org.eclipse.stardust.engine.api.runtime.Service service, String permissionId, Activity activity) Checks if the Activity is granting the specific permission to the user.
boolean	hasPermission(org.eclipse.stardust.engine.api.runtime.Service service, String permissionId, DeployedModelDescription model) Checks if the DeployedModelDescription is granting the specific permission to the user.
boolean	hasPermission(org.eclipse.stardust.engine.api.runtime.Service service, String permissionId, ProcessDefinition process) Checks if the ProcessDefinition is granting the specific permission to the user.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PermissionHelper

public PermissionHelper()

Default constructor. Identical with PermissionHelper(true).

PermissionHelper

public PermissionHelper(boolean useCaches)

Constructor used when caching should be disabled. In this case, each permission check will fetch the permissions new from the engine.

Parameters:

useCaches - false if you want to disable caching.

PermissionHelper

public PermissionHelper(User user,
                Set<String> startableProcesses)

Constructor that enable caching and optionally provides an already fetched User or the set of startable process IDs. If the User is provided, then calls to filter access methods will use the provided user instead of fetching it from the service. Similarly, invocations of canStartProcess will use the provided set of startable process IDs.

Parameters:

user - the User corresponding to the used ServiceFactory.

startableProcesses - a Set containing the IDs of the startable processes.

Method Detail

filterProcessAccess

public List<ProcessDefinition> filterProcessAccess(WorkflowService service,
                                          List<ProcessDefinition> processes)

Filters a list of process definitions based on the processDefinition.readProcessInstanceData permission. The filtering operation will create a new list leaving the raw list unmodified.

Parameters:

service - an instance of the WorkflowService from which permissions can be fetched.

processes - the raw list of process definitions.

Returns:

the filtered list containing only process definitions that grants the user access to it's process instances.

filterActivityAccess

public List<Activity> filterActivityAccess(WorkflowService service,
                                  List<Activity> activities)

Filters a list of activities based on the activity.readActivityInstanceData permission. The filtering operation will create a new list leaving the raw list unmodified. The actual grant requires both the activity.readActivityInstanceData on the Activity and the processDefinition.readProcessInstanceData on the ProcessDefinition containing the Activity.

Parameters:

service - an instance of the WorkflowService from which permissions can be fetched.

activities - the raw list of activities.

Returns:

the filtered list containing only activities that grants the user access to it's activity instances.

hasPermission

public boolean hasPermission(org.eclipse.stardust.engine.api.runtime.Service service,
                    String permissionId,
                    Activity activity)

Checks if the Activity is granting the specific permission to the user.

Parameters:

service - an instance of a Service from which permissions can be fetched.

permissionId - the permission to be checked, i.e. activity.readActivityInstanceData.

activity - the Activity on which the permission is defined.

Returns:

true if the user has the permission granted.

hasPermission

public boolean hasPermission(org.eclipse.stardust.engine.api.runtime.Service service,
                    String permissionId,
                    ProcessDefinition process)

Checks if the ProcessDefinition is granting the specific permission to the user.

Parameters:

service - an instance of a Service from which permissions can be fetched.

permissionId - the permission to be checked, i.e. processDefinition.readProcessInstanceData.

process - the ProcessDefinition on which the permission is defined.

Returns:

true if the user has the permission granted.

hasPermission

public boolean hasPermission(org.eclipse.stardust.engine.api.runtime.Service service,
                    String permissionId,
                    DeployedModelDescription model)

Checks if the DeployedModelDescription is granting the specific permission to the user.

Parameters:

service - an instance of a Service from which permissions can be fetched.

permissionId - the permission to be checked, i.e. model.readModelData.

model - the DeployedModelDescription on which the permission is defined.

Returns:

true if the user has the permission granted.

canStartProcess

public boolean canStartProcess(WorkflowService service,
                      ProcessDefinition process)

Checks if the user can start the given process definition (and create a new process instance).

Parameters:

service - an instance of the WorkflowService from which permissions can be fetched.

process - the ProcessDefinition that will be started.

Returns:

true if the user is allowed to start the process definition.

canPerformActivity

public boolean canPerformActivity(User user,
                         Activity activity)

Checks if the user can perform the activity (activate, complete).

Parameters:

user - the User that defines the grants.

activity - the Activity to be performed.

Returns:

true if the user can perform the activity.