From 9c9129a796e7dc4e4d75da6fa1e73babcfd69e49 Mon Sep 17 00:00:00 2001 From: Michael Bayne Date: Tue, 30 Nov 2010 18:35:58 +0000 Subject: [PATCH] We can't use the type systesm to enforce our requirements, but we can use obtain containment and a stack of specifically typed outer class references to accomplish what we need without misleading casts. This will require changes to Yohoho which I shall make forthwith. git-svn-id: svn+ssh://src.earth.threerings.net/narya/trunk@6320 542714f4-19e9-0310-aa3c-eee0fc999fb1 --- .../com/threerings/crowd/data/BodyObject.java | 22 +++++++++ .../crowd/data/CrowdPermissionPolicy.java | 49 ------------------- .../com/threerings/crowd/data/TokenRing.java | 2 +- .../crowd/server/CrowdClientResolver.java | 8 --- .../presents/data/ClientObject.java | 41 ++++++++++++---- .../presents/data/PermissionPolicy.java | 48 ------------------ .../presents/server/ClientManager.java | 1 - .../presents/server/ClientResolver.java | 9 ---- 8 files changed, 54 insertions(+), 126 deletions(-) delete mode 100644 src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java delete mode 100644 src/main/java/com/threerings/presents/data/PermissionPolicy.java diff --git a/src/main/java/com/threerings/crowd/data/BodyObject.java b/src/main/java/com/threerings/crowd/data/BodyObject.java index 449bebc7f..087495dda 100644 --- a/src/main/java/com/threerings/crowd/data/BodyObject.java +++ b/src/main/java/com/threerings/crowd/data/BodyObject.java @@ -25,7 +25,9 @@ import javax.annotation.Generated; import com.threerings.util.Name; import com.threerings.presents.data.ClientObject; +import com.threerings.presents.data.Permission; +import com.threerings.crowd.chat.data.ChatCodes; import com.threerings.crowd.chat.data.SpeakObject; /** @@ -210,6 +212,26 @@ public class BodyObject extends ClientObject return OccupantInfo.X_STATUS[status]; } + @Override + protected PermissionPolicy createPermissionPolicy () + { + return new CrowdPermissionPolicy(); + } + + protected class CrowdPermissionPolicy extends PermissionPolicy + { + @Override // from PermissionPolicy + public String checkAccess (Permission perm, Object context) { + if (perm == ChatCodes.BROADCAST_ACCESS) { + return getTokens().isAdmin() ? null : ACCESS_DENIED; + } else if (perm == ChatCodes.CHAT_ACCESS) { + return null; + } else { + return super.checkAccess(perm, context); + } + } + } + /** The default (no tokens) access control. */ protected static final TokenRing EMPTY_TOKENS = new TokenRing(); } diff --git a/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java b/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java deleted file mode 100644 index 7c6387c4d..000000000 --- a/src/main/java/com/threerings/crowd/data/CrowdPermissionPolicy.java +++ /dev/null @@ -1,49 +0,0 @@ -// -// $Id$ -// -// Narya library - tools for developing networked games -// Copyright (C) 2002-2010 Three Rings Design, Inc., All Rights Reserved -// http://code.google.com/p/narya/ -// -// This library is free software; you can redistribute it and/or modify it -// under the terms of the GNU Lesser General Public License as published -// by the Free Software Foundation; either version 2.1 of the License, or -// (at your option) any later version. -// -// This library is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// Lesser General Public License for more details. -// -// You should have received a copy of the GNU Lesser General Public -// License along with this library; if not, write to the Free Software -// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -package com.threerings.crowd.data; - -import com.threerings.presents.data.ClientObject; -import com.threerings.presents.data.Permission; -import com.threerings.presents.data.PermissionPolicy; - -import com.threerings.crowd.chat.data.ChatCodes; - -/** - * Implements some Crowd permissions. Note: this is stored inside a {@link BodyObject} and - * will only ever be called by a BodyObject. It is sent over the wire and must be usable on the - * client and server. - */ -public class CrowdPermissionPolicy extends PermissionPolicy -{ - @Override // from PermissionPolicy - public String checkAccess (ClientObject clobj, Permission perm, Object context) - { - BodyObject body = (BodyObject)clobj; - if (perm == ChatCodes.BROADCAST_ACCESS) { - return body.getTokens().isAdmin() ? null : ACCESS_DENIED; - } else if (perm == ChatCodes.CHAT_ACCESS) { - return null; - } else { - return super.checkAccess(clobj, perm, context); - } - } -} diff --git a/src/main/java/com/threerings/crowd/data/TokenRing.java b/src/main/java/com/threerings/crowd/data/TokenRing.java index cec0f3f79..5a28065ad 100644 --- a/src/main/java/com/threerings/crowd/data/TokenRing.java +++ b/src/main/java/com/threerings/crowd/data/TokenRing.java @@ -26,7 +26,7 @@ import com.threerings.io.SimpleStreamableObject; /** * Defines access control tokens that convey certain privileges to users. * - * @see CrowdPermissionPolicy + * @see BodyObject#CrowdPermissionPolicy */ public class TokenRing extends SimpleStreamableObject { diff --git a/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java b/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java index 1a087a904..c1c404fa0 100644 --- a/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java +++ b/src/main/java/com/threerings/crowd/server/CrowdClientResolver.java @@ -22,12 +22,10 @@ package com.threerings.crowd.server; import com.threerings.presents.data.ClientObject; -import com.threerings.presents.data.PermissionPolicy; import com.threerings.presents.server.ClientLocal; import com.threerings.presents.server.ClientResolver; import com.threerings.crowd.data.BodyObject; -import com.threerings.crowd.data.CrowdPermissionPolicy; /** * Used to configure crowd-specific client object data. @@ -45,10 +43,4 @@ public class CrowdClientResolver extends ClientResolver { return new BodyLocal(); } - - @Override // from ClientResolver - public PermissionPolicy createPermissionPolicy () - { - return new CrowdPermissionPolicy(); - } } diff --git a/src/main/java/com/threerings/presents/data/ClientObject.java b/src/main/java/com/threerings/presents/data/ClientObject.java index fc7cd73fb..655c780b5 100644 --- a/src/main/java/com/threerings/presents/data/ClientObject.java +++ b/src/main/java/com/threerings/presents/data/ClientObject.java @@ -54,14 +54,6 @@ public class ClientObject extends DObject /** Used to publish all invocation service receivers registered on this client. */ public DSet receivers = DSet.newDSet(); - /** - * Configures this client with a permissions policy. This is done during client resolution. - */ - public void setPermissionPolicy (PermissionPolicy policy) - { - _permPolicy = policy; - } - /** * Returns a short string identifying this client. */ @@ -80,7 +72,10 @@ public class ClientObject extends DObject */ public String checkAccess (Permission perm, Object context) { - return _permPolicy.checkAccess(this, perm, context); + if (_permPolicy == null) { + _permPolicy = createPermissionPolicy(); + } + return _permPolicy.checkAccess(perm, context); } /** @@ -203,8 +198,34 @@ public class ClientObject extends DObject } // AUTO-GENERATED: METHODS END + protected PermissionPolicy createPermissionPolicy () + { + return new PermissionPolicy(); + } + + /** + * ClientObject derived classes can extend this class to provide more sophisticated permission + * policies, and should return their customized classes from {@link #createPermissionPolicy}. + * This class, and its children must only make use of data available in the + * ClientObject (and its children). Permissions may be checked on the client or server. + */ + protected class PermissionPolicy implements InvocationCodes + { + /** + * Returns null if the specified client has the specified permission, an error code + * explaining the lack of access if they do not. {@link InvocationCodes#ACCESS_DENIED} + * should be returned if no more specific explanation is available. + * + * @param perm the permission to be checked. + * @param context a potential context for the request, if any. + */ + public String checkAccess (Permission perm, Object context) { + return ACCESS_DENIED; // by default, you can't do it! + } + } + /** Handles our fine-grained permissions. */ - protected PermissionPolicy _permPolicy; + protected transient PermissionPolicy _permPolicy; /** Used to reference count resolved client objects. */ protected transient int _references; diff --git a/src/main/java/com/threerings/presents/data/PermissionPolicy.java b/src/main/java/com/threerings/presents/data/PermissionPolicy.java deleted file mode 100644 index 90501a3ce..000000000 --- a/src/main/java/com/threerings/presents/data/PermissionPolicy.java +++ /dev/null @@ -1,48 +0,0 @@ -// -// $Id$ -// -// Narya library - tools for developing networked games -// Copyright (C) 2002-2010 Three Rings Design, Inc., All Rights Reserved -// http://code.google.com/p/narya/ -// -// This library is free software; you can redistribute it and/or modify it -// under the terms of the GNU Lesser General Public License as published -// by the Free Software Foundation; either version 2.1 of the License, or -// (at your option) any later version. -// -// This library is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// Lesser General Public License for more details. -// -// You should have received a copy of the GNU Lesser General Public -// License along with this library; if not, write to the Free Software -// Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA - -package com.threerings.presents.data; - -import com.threerings.io.Streamable; - -/** - * Encapsulates a fine-grained permissions policy. The default policy is to deny access to - * everything, systems using fine-grained permissions should create a custom policy and provide it - * at client resolution time via the ClientResolver. - */ -public class PermissionPolicy - implements Streamable, InvocationCodes -{ - /** - * Returns null if the specified client has the specified permission, an error code explaining - * the lack of access if they do not. {@link InvocationCodes#ACCESS_DENIED} should be returned - * if no more specific explanation is available. - * - * @param clobj the client - * @param perm what permission they'd like to know if they have - * @param context potential context for the request, if that matters - */ - public String checkAccess (ClientObject clobj, Permission perm, Object context) - { - // by default, you can't do it! - return ACCESS_DENIED; - } -} diff --git a/src/main/java/com/threerings/presents/server/ClientManager.java b/src/main/java/com/threerings/presents/server/ClientManager.java index 3adf71c6c..dc586ec98 100644 --- a/src/main/java/com/threerings/presents/server/ClientManager.java +++ b/src/main/java/com/threerings/presents/server/ClientManager.java @@ -298,7 +298,6 @@ public class ClientManager public void run () { ClientObject clobj = fclr.createClientObject(); clobj.setLocal(ClientLocal.class, fclr.createLocalAttribute()); - clobj.setPermissionPolicy(fclr.createPermissionPolicy()); fclr.objectAvailable(_omgr.registerObject(clobj)); } }); diff --git a/src/main/java/com/threerings/presents/server/ClientResolver.java b/src/main/java/com/threerings/presents/server/ClientResolver.java index 8a650ed41..3e6cfe2bb 100644 --- a/src/main/java/com/threerings/presents/server/ClientResolver.java +++ b/src/main/java/com/threerings/presents/server/ClientResolver.java @@ -32,7 +32,6 @@ import com.threerings.util.Name; import com.threerings.presents.annotation.MainInvoker; import com.threerings.presents.data.ClientObject; -import com.threerings.presents.data.PermissionPolicy; import com.threerings.presents.dobj.RootDObjectManager; import static com.threerings.presents.Log.log; @@ -87,14 +86,6 @@ public class ClientResolver extends Invoker.Unit return new ClientLocal(); } - /** - * Creates a permission policy for use by our client. - */ - public PermissionPolicy createPermissionPolicy () - { - return new PermissionPolicy(); - } - /** * Called once our client object is registered with the distributed object system. */