topic Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo? in Nuxeo Forum

Is it possible to know if a particular permission is grant anywhere in Nuxeo?

maxr_ — Thu, 25 Oct 2012 21:55:13 GMT

In our developpement in Nuxeo, we added some new permissions. We want to know if a particular permission is grant anywhere in Nuxeo for a specific user or group. Is it possible? If we look directly into the database, it's really easy to answer to the question with a simple query on acl table.

In Nxql, we would like to see something like that: Select * From Document WHERE ecm:acl='Our new permission' In this example, if this query returns result, we have at least one document where permission apply.

Thanks

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

Florent_Guillau — Fri, 09 Nov 2012 17:25:03 GMT

Nuxeo doesn't support this at the moment.

Edit: You're describing two different use cases for what you call a permisison.

The first use case is checking if a user has a global setting that enables him to see or not a report. That's the notion of a Role, which you can easily apply to Nuxeo using a user group.

The second use case is doing a query and filtering on a permission other than Browse, and that's not supported, queries are only done on Browse by definition. If you want to filter documents by some kind of attribute, then just add a flag or attribute on the document. Don't use permissions for that.

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

adam_bo_ — Fri, 09 Nov 2012 18:19:19 GMT

what exactly do you want to do with the result or where do you plan to use it?

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

maxr_ — Fri, 09 Nov 2012 19:26:07 GMT

I don't want to enter in details. I will try to summarize our needs.

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

patrek — Fri, 09 Nov 2012 20:05:18 GMT

The code below works in test context (mvn test) when we use the embeded database.

Does not work with the Postgresql database because the NXQLQueryMaker.buildQuery() internals don't take into account the permissions array when the dialect.supportsReadAcl() is true.

Should we fill a bug for this?

@Test
public void testQuery() throws Exception {

    String permission = "AM_CLASSIFY";
    SecurityService securityService = NXCore.getSecurityService();

    Principal principal = new PrincipalImpl(TEST_USER);

    String[] principalsToCheck = SecurityService
            .getPrincipalsToCheck(principal);
    QueryFilter qfilter = new QueryFilter(principal, principalsToCheck,
            new String[] { permission }, null,
            securityService.getPoliciesQueryTransformers(session
                    .getRepositoryName()), 1, 0); 

    Query query = ((AbstractSession) session).getSession().createQuery(
            "SELECT * FROM Document", Query.Type.NXQL);

    FilterableQuery filterableQuery = (FilterableQuery) query;
    QueryResult results = filterableQuery.execute(qfilter, false);
    assertTrue("No document matches", results.count() > 0); 

    principal = new PrincipalImpl(TEST_USER + "2");
    permission = "AM_DECLARE";
    principalsToCheck = SecurityService.getPrincipalsToCheck(principal);
    qfilter = new QueryFilter(principal, principalsToCheck,
            new String[] { permission }, null,
            securityService.getPoliciesQueryTransformers(session
                    .getRepositoryName()), 1, 0); 

    results = filterableQuery.execute(qfilter, false);
    assertTrue(results.count() > 0); 

}

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

adam_bo_ — Sat, 10 Nov 2012 00:04:58 GMT

For instance you can create your ActionsBean class with proper functions. Then you should choose a xhtml context with your functions.

In your example probably you can use a standard query to execute your SQL, so it is easy to do. It will be a bit more complicated if your query have to be pure (without a permission filtration).

Re: Is it possible to know if a particular permission is grant anywhere in Nuxeo?

Florent_Guillau — Mon, 12 Nov 2012 11:30:52 GMT

When the "read acl" optimizations are enabled, it is assumed that all queries are done only on the Browse permission, so it's not really a bug. As these optimizations are necessary for any large volume, let's just say that using the low-level Session APIs directly and doing your own QueryFilter filtering is not supported. Only CoreSession is a supported API.