import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
/**
 * Add a user or another group as a member of a specified group.
 *
 * Function will log an error and do nothing if either the specified group
 * or group member cannot be found, or if the specified group is not actually
 * a group (i.e. a user).
 *
 * @param groupName The name of the group to add the member to.
 * @param memberName The name of the user or group to add as a member.
 * @throws RepositoryException
 */
protected void addUserGroupMember(String groupName, String memberName) throws RepositoryException {
    UserManager userManager = AccessControlUtil.getUserManager(session);
    Authorizable group = userManager.getAuthorizable(groupName);
    Authorizable member = userManager.getAuthorizable(memberName);

    if (group == null) {
        logger.error("Cannot add member '{}' to group '{}' because '{}' does not exist", memberName, groupName, groupName);
    } else if (!group.isGroup()) {
        logger.error("Cannot add member '{}' to group '{}' because '{}' is not a group", memberName, groupName, groupName);
    } else if (member == null) {
        logger.error("Cannot add member '{}' to group '{}' because '{}' does not exist", memberName, groupName, memberName);
    } else {
        logger.info("Adding member '{}' to group '{}'", memberName, groupName);
        ((Group) group).addMember(member);
    }
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public static Group getGroupIfExists(Context context, String id)
		throws RepositoryException, ActionExecutionException {
	if (checkIfRemoved(context, id)) {
		return null;
	}

	Authorizable authorizable = context.getAuthorizables().get(id);

	if (authorizable == null) {
		authorizable = context.getUserManager().getAuthorizable(id);
	}

	if (authorizable == null) {
		return null;
	}

	if (authorizable instanceof User) {
		throw new ActionExecutionException(
				"Authorizable with id " + id + " exists but is a user not a group");
	}

	context.getAuthorizables().put(id, authorizable);
	return (Group) authorizable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public static Group getGroup(Context context, String id)
		throws ActionExecutionException, RepositoryException {
	if (checkIfRemoved(context, id)) {
		throw new ActionExecutionException("Group with id " + id + " not found");
	}

	Authorizable authorizable = context.getAuthorizables().get(id);

	if (authorizable == null) {
		authorizable = context.getUserManager().getAuthorizable(id);
	}

	if (authorizable == null) {
		throw new ActionExecutionException("Group with id " + id + " not found");
	}

	if (authorizable instanceof User) {
		throw new ActionExecutionException(
				"Authorizable with id " + id + " exists but is a user not a group");
	}

	context.getAuthorizables().put(id, authorizable);
	return (Group) authorizable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public static User getUserIfExists(Context context, String id)
		throws ActionExecutionException, RepositoryException {
	if (checkIfRemoved(context, id)) {
		return null;
	}

	Authorizable authorizable = context.getAuthorizables().get(id);

	if (authorizable == null) {
		authorizable = context.getUserManager().getAuthorizable(id);
	}

	if (authorizable == null) {
		return null;
	}

	if (authorizable instanceof Group) {
		throw new ActionExecutionException(
				"Authorizable with id " + id + " exists but is a group not a user");
	}

	context.getAuthorizables().put(id, authorizable);
	return (User) authorizable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public static User getUser(Context context, String id)
		throws ActionExecutionException, RepositoryException {
	if (checkIfRemoved(context, id)) {
		throw new ActionExecutionException("User with id " + id + " not found");
	}

	Authorizable authorizable = context.getAuthorizables().get(id);

	if (authorizable == null) {
		authorizable = context.getUserManager().getAuthorizable(id);
	}

	if (authorizable == null) {
		throw new ActionExecutionException("User with id " + id + " not found");
	}

	if (authorizable instanceof Group) {
		throw new ActionExecutionException(
				"Authorizable with id " + id + " exists but is a group not a user");
	}

	context.getAuthorizables().put(id, authorizable);
	return (User) authorizable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
private ActionResult process(final Context context, boolean execute) {

		ActionResult actionResult = new ActionResult();
		Group group = tryGetGroup(context, actionResult);
		if (group == null) {
			return actionResult;
		}

		List<String> errors = new ArrayList<>();

		boolean checkFailed = checkMembers(context, actionResult, group, errors);

		if (execute && checkFailed) {
			actionResult.logError(ActionUtils.ASSERTION_FAILED_MSG);
			return actionResult;
		}

		ActionUtils.logErrors(errors, actionResult);

		return actionResult;
	}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
private boolean checkMembers(final Context context, final ActionResult actionResult, final Group group,
		final List<String> errors) {
	boolean checkFailed = false;
	for (String authorizableId : authorizableIds) {
		try {
			Authorizable authorizable = AuthorizablesUtils
					.getAuthorizableIfExists(context, authorizableId);
			if (authorizable == null) {
				actionResult.logWarning(MessagingUtils.authorizableNotExists(authorizableId));
				continue;
			}
			if (group.isMember(authorizable)) {
				actionResult.logError(authorizable.getID() + " belongs to group " + groupId);
				checkFailed = true;
			}
		} catch (RepositoryException e) {
			errors.add(MessagingUtils.createMessage(e));
		}
	}
	return checkFailed;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
private ActionResult process(final Context context, boolean execute) {
	ActionResult actionResult = new ActionResult();
	Group authorizable = tryGetGroup(context, actionResult);
	if (authorizable == null) {
		return actionResult;
	}

	List<String> errors = new ArrayList<>();

	boolean checkFailed = checkMembers(context, actionResult, authorizable, errors);

	if (execute && checkFailed) {
		actionResult.logError(ActionUtils.ASSERTION_FAILED_MSG);
		return actionResult;
	}

	ActionUtils.logErrors(errors, actionResult);

	return actionResult;

}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
private boolean checkMembers(final Context context, final ActionResult actionResult,
		final Group authorizable, final List<String> errors) {
	boolean checkFailed = false;
	for (String id : groupIds) {
		try {
			Authorizable group = AuthorizablesUtils.getAuthorizable(context, id);

			if (!authorizable.isMember(group)) {
				actionResult.logError(id + " is excluded from group " + authorizableId);
				checkFailed = true;
			}
			actionResult.logMessage(id + " is a member of group " + authorizableId);
		} catch (RepositoryException | ActionExecutionException e) {
			errors.add(MessagingUtils.createMessage(e));
		}
	}
	return checkFailed;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public ActionResult process(final Context context) {
	ActionResult actionResult = new ActionResult();
	try {

		if (shouldBeGroup) {
			Group group = AuthorizablesUtils.getGroup(context, id);
			context.setCurrentAuthorizable(group);
			actionResult.logMessage("Group with id: " + group.getID() + " set as current authorizable");
		} else {
			User user = AuthorizablesUtils.getUser(context, id);
			context.setCurrentAuthorizable(user);
			actionResult.logMessage("User with id: " + user.getID() + " set as current authorizable");
		}

	} catch (RepositoryException | ActionExecutionException e) {
		actionResult.logError(MessagingUtils.createMessage(e));
	}
	return actionResult;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
public ActionResult detachMembersFromGroup() {
	ActionResult actionResult = new ActionResult();

	try {
		Authorizable authorizable = context.getCurrentAuthorizable();

		if (authorizable.isGroup()) {
			final Group group = context.getCurrentGroup();
			LOGGER.info(String.format("Removing all members of group with id = %s", group.getID()));
			Iterator<Authorizable> groupMembers = getGroupMembers(actionResult, group);

			detachAllMembers(actionResult, group, groupMembers);
		} else {
			actionResult.logError("Child members can only be removed from groups");
		}
	} catch (RepositoryException | ActionExecutionException e) {
		actionResult.logError(MessagingUtils.createMessage(e));
	}
	return actionResult;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
/**
 * Get the authorable status of the current user.
 *
 * @param session The current session.
 * @return true if the current user is an admin or author.
 */
public boolean isAuthorable(Session session) {
    boolean authorable = false;

    JackrabbitSession js = (JackrabbitSession)session;

    try {
        Group authors = (Group)js.getUserManager().getAuthorizable(PublickConstants.GROUP_ID_AUTHORS);
        User user = (User)js.getUserManager().getAuthorizable(js.getUserID());

        authorable = user.isAdmin() || authors.isMember(user);
    } catch (RepositoryException e) {
        LOGGER.error("Could not determine group membership", e);
    }

    return authorable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
/**
 * Get the authorable status of the current user.
 * TODO: remove and use UserService
 *
 * @return true if the current user is an admin or author.
 */
public boolean isAuthorable() {
    boolean authorable = false;

    JackrabbitSession js = (JackrabbitSession)getSession();

    try {
        Group authors = (Group)js.getUserManager().getAuthorizable(PublickConstants.GROUP_ID_AUTHORS);
        User user = (User)js.getUserManager().getAuthorizable(js.getUserID());

        authorable = user.isAdmin() || authors.isMember(user);
    } catch (RepositoryException e) {
        LOGGER.error("Could not determine group membership", e);
    }

    return authorable;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
/**
 * Retrieve the group membership of this authorizable.
 *
 * @param includeInherited Flag indicating whether the resulting iterator only
 * contains groups this authorizable is declared member of or if inherited
 * group membership is respected.
 *
 * @return Iterator of groups this authorizable is (declared) member of.
 * @throws RepositoryException If an error occurs.
 */
@Nonnull
private Iterator<Group> getMembership(boolean includeInherited) throws RepositoryException {
    if (isEveryone()) {
        return Collections.<Group>emptySet().iterator();
    }

    MembershipProvider mMgr = getMembershipProvider();
    Iterator<String> oakPaths = mMgr.getMembership(getTree(), includeInherited);

    Authorizable everyoneGroup = userManager.getAuthorizable(EveryonePrincipal.getInstance());
    if (everyoneGroup instanceof GroupImpl) {
        String everyonePath = ((GroupImpl) everyoneGroup).getTree().getPath();
        oakPaths = Iterators.concat(oakPaths, ImmutableSet.of(everyonePath).iterator());
    }
    if (oakPaths.hasNext()) {
        AuthorizableIterator groups = AuthorizableIterator.create(oakPaths, userManager, AuthorizableType.GROUP);
        return new RangeIteratorAdapter(groups, groups.getSize());
    } else {
        return RangeIteratorAdapter.EMPTY;
    }
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Override
public Group createGroup(String groupID, Principal principal, @Nullable String intermediatePath) throws RepositoryException {
    checkValidID(groupID);
    checkValidPrincipal(principal, true);

    if (intermediatePath != null) {
        intermediatePath = namePathMapper.getOakPathKeepIndex(intermediatePath);
    }
    Tree groupTree = userProvider.createGroup(groupID, intermediatePath);
    setPrincipal(groupTree, principal);

    Group group = new GroupImpl(groupID, groupTree, this);
    onCreate(group);

    log.debug("Group created: " + groupID);
    return group;
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Test
public void testAuthenticateResolvesToGroup() throws Exception {
    Group g = getUserManager(root).createGroup("g1");
    SimpleCredentials sc = new SimpleCredentials(g.getID(), "pw".toCharArray());
    Authentication a = new UserAuthentication(sc.getUserID(), getUserManager(root));

    try {
        a.authenticate(sc);
        fail("Authenticating Group should fail");
    } catch (LoginException e) {
        // success
    } finally {
        if (g != null) {
            g.remove();
            root.commit();
        }
    }
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Test
public void testManyMemberships() throws Exception {
    Set<String> memberships = new HashSet<String>();
    User usr = createUser();
    for (int i=0; i<NUM_GROUPS; i++) {
        Group grp = createGroup();
        grp.addMember(usr);
        memberships.add(grp.getID());
    }
    root.commit();

    Iterator<Group> iter = usr.declaredMemberOf();
    while (iter.hasNext()) {
        Group group = iter.next();
        Assert.assertTrue(memberships.remove(group.getID()));
    }
    assertEquals(0, memberships.size());
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Test
public void testNestedMemberships() throws Exception {
    Set<String> memberships = new HashSet<String>();
    User user  = createUser();
    Group grp = createGroup();
    memberships.add(grp.getID());
    for (int i=0; i<10; i++) {
        Group g1 = createGroup();
        grp.addMember(g1);
        memberships.add(g1.getID());
        for (int j=0; j<10; j++) {
            Group g2 = createGroup();
            g1.addMember(g2);
            memberships.add(g2.getID());
            g2.addMember(user);
        }
    }
    root.commit();

    Iterator<Group> iter = user.memberOf();
    while (iter.hasNext()) {
        Group group = iter.next();
        Assert.assertTrue(memberships.remove(group.getID()));
    }
    assertEquals(0, memberships.size());
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Test
public void testDeclaredMemberOf() throws Exception {
    User u = mgr.createUser("u", "u");
    Group g = mgr.createGroup("g");

    assertTrue(g.addMember(u));

    Iterator<Group> groups = u.declaredMemberOf();
    assertTrue(groups.hasNext());

    Group gAgain = groups.next();
    assertTrue(gAgain instanceof GroupImpl);
    assertTrue(gAgain.removeMember(u));
    assertFalse(root.hasPendingChanges());
    assertFalse(u.declaredMemberOf().hasNext());
}
 

import org.apache.jackrabbit.api.security.user.Group; //导入依赖的package包/类
@Test
public void testMemberOf() throws Exception {
    User u = mgr.createUser("u", "u");
    Group g = mgr.createGroup("g");

    assertTrue(g.addMember(u));

    Iterator<Group> groups = u.memberOf();
    assertTrue(groups.hasNext());

    Group gAgain = groups.next();
    assertTrue(gAgain instanceof GroupImpl);
    assertTrue(gAgain.removeMember(u));
    assertFalse(root.hasPendingChanges());
    assertFalse(u.declaredMemberOf().hasNext());
}