Merge branch 'apache:trunk' into trunk

oak-blob-plugins/src/main/java/org/apache/jackrabbit/oak/plugins/blob/FileCache.java

@@ -176,6 +176,9 @@ public static FileCache build(long maxSize /* bytes */, File root,
             return new FileCache(maxSize, root, loader, executor);
         }
         return new FileCache() {
+
+            private final Cache<?,?> cache = new CacheLIRS<>(0);
+
             @Override public void put(String key, File file) {
             }
 
@@ -195,7 +198,7 @@ public static FileCache build(long maxSize /* bytes */, File root,
             }
 
             @Override public DataStoreCacheStatsMBean getStats() {
-                return new FileCacheStats(this, weigher, memWeigher, 0);
+                return new FileCacheStats(cache, weigher, memWeigher, 0);
             }
 
             @Override public void close() {

oak-blob-plugins/src/test/java/org/apache/jackrabbit/oak/plugins/blob/FileCacheTest.java

@@ -108,6 +108,19 @@ public void zeroCache() throws Exception {
         assertNull(cache.getIfPresent(ID_PREFIX + 0));
         assertNull(cache.get(ID_PREFIX + 0));
         assertEquals(0, cache.getStats().getMaxTotalWeight());
+        assertEquals(0, cache.getStats().getElementCount());
+        assertEquals(0, cache.getStats().getEvictionCount());
+        assertEquals(0, cache.getStats().getTotalLoadTime());
+        assertEquals(0, cache.getStats().getLoadSuccessCount());
+        assertEquals(0.0, cache.getStats().getMissRate(), 0.0);
+        assertEquals(0, cache.getStats().getMissCount());
+        assertEquals(0, cache.getStats().getHitCount());
+        assertEquals(1.0, cache.getStats().getHitRate(), 0.0);
+        assertEquals(0.0, cache.getStats().getAverageLoadPenalty(), 0.0);
+        assertEquals(0, cache.getStats().getLoadCount());
+        assertEquals(0, cache.getStats().getLoadExceptionCount());
+        assertEquals(0.0, cache.getStats().getLoadExceptionRate(), 0.0);
+        assertEquals(0, cache.getStats().getRequestCount());
         cache.invalidate(ID_PREFIX + 0);
         assertFalse(cache.containsKey(ID_PREFIX + 0));
         cache.close();

oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/token/TokenConfigurationImpl.java

@@ -16,11 +16,6 @@
  */
 package org.apache.jackrabbit.oak.security.authentication.token;
 
-import java.security.Principal;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.ConcurrentHashMap;
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
@@ -29,6 +24,7 @@
 import org.apache.jackrabbit.oak.spi.commit.ValidatorProvider;
 import org.apache.jackrabbit.oak.spi.security.ConfigurationBase;
 import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
+import org.apache.jackrabbit.oak.spi.security.Context;
 import org.apache.jackrabbit.oak.spi.security.SecurityConfiguration;
 import org.apache.jackrabbit.oak.spi.security.SecurityProvider;
 import org.apache.jackrabbit.oak.spi.security.authentication.credentials.CompositeCredentialsSupport;
@@ -48,6 +44,12 @@
 import org.osgi.service.metatype.annotations.Designate;
 import org.osgi.service.metatype.annotations.ObjectClassDefinition;
 
+import java.security.Principal;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
 import static org.apache.jackrabbit.oak.spi.security.RegistrationConstants.OAK_SECURITY_NAME;
 
 /**
@@ -148,6 +150,11 @@ public List<? extends ValidatorProvider> getValidators(@NotNull String workspace
         return ImmutableList.of(vp);
     }
 
+    @Override
+    public @NotNull Context getContext() {
+        return TokenContext.getInstance();
+    }
+
     //-------------------------------------------------< TokenConfiguration >---
     /**
      * Returns a new instance of {@link org.apache.jackrabbit.oak.spi.security.authentication.token.TokenProvider}.

oak-core/src/main/java/org/apache/jackrabbit/oak/security/authentication/token/TokenContext.java

@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.jackrabbit.oak.security.authentication.token;
+
+import org.apache.jackrabbit.oak.api.PropertyState;
+import org.apache.jackrabbit.oak.api.Tree;
+import org.apache.jackrabbit.oak.plugins.tree.TreeLocation;
+import org.apache.jackrabbit.oak.plugins.tree.TreeUtil;
+import org.apache.jackrabbit.oak.spi.security.Context;
+import org.apache.jackrabbit.oak.spi.security.authentication.token.TokenConstants;
+import org.jetbrains.annotations.NotNull;
+
+import static org.apache.jackrabbit.oak.spi.security.authentication.token.TokenConstants.TOKEN_NT_NAME;
+
+final class TokenContext implements Context {
+
+    private static final Context INSTANCE = new TokenContext();
+
+    private TokenContext() {}
+
+    static Context getInstance() {
+        return INSTANCE;
+    }
+
+    @Override
+    public boolean definesProperty(@NotNull Tree parent, @NotNull PropertyState property) {
+        return isTokenNode(parent);
+    }
+
+    @Override
+    public boolean definesContextRoot(@NotNull Tree tree) {
+        return TokenConstants.TOKENS_NODE_NAME.equals(tree.getName());
+    }
+
+    @Override
+    public boolean definesTree(@NotNull Tree tree) {
+        return definesContextRoot(tree) || isTokenNode(tree);
+    }
+
+    @Override
+    public boolean definesLocation(@NotNull TreeLocation location) {
+        PropertyState ps = location.getProperty();
+        TreeLocation l = (ps != null) ? location.getParent() : location;
+        Tree t = l.getTree();
+        if (t == null) {
+            return false;
+        } else {
+            return (ps == null) ? definesTree(t) : definesProperty(t, ps);
+        }
+    }
+
+    @Override
+    public boolean definesInternal(@NotNull Tree tree) {
+        return false;
+    }
+
+    private static boolean isTokenNode(@NotNull Tree tree) {
+        return TOKEN_NT_NAME.equals(TreeUtil.getPrimaryTypeName(tree));
+    }
+}

oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProvider.java

@@ -38,7 +38,6 @@
 import org.jetbrains.annotations.Nullable;
 
 import java.util.List;
-import java.util.Set;
 import java.util.function.Function;
 
 /**

oak-core/src/main/java/org/apache/jackrabbit/oak/security/authorization/composite/CompositePermissionProviderOr.java

@@ -117,7 +117,7 @@ public boolean isGranted(@NotNull Tree parent, @Nullable PropertyState property,
         for (AggregatedPermissionProvider aggregatedPermissionProvider : getPermissionProviders()) {
             long supportedPermissions = aggregatedPermissionProvider.supportedPermissions(immParent, property, permissions);
             if (Util.doEvaluate(supportedPermissions)) {
-                for (long p : Permissions.aggregates(permissions)) {
+                for (long p : Permissions.aggregates(supportedPermissions)) {
                     if (aggregatedPermissionProvider.isGranted(immParent, property, p)) {
                         coveredPermissions |= p;
                         isGranted = true;
@@ -144,7 +144,7 @@ public boolean isGranted(@NotNull TreeLocation location, long permissions) {
             for (AggregatedPermissionProvider aggregatedPermissionProvider : getPermissionProviders()) {
                 long supportedPermissions = aggregatedPermissionProvider.supportedPermissions(location, permissions);
                 if (Util.doEvaluate(supportedPermissions)) {
-                    for (long p : Permissions.aggregates(permissions)) {
+                    for (long p : Permissions.aggregates(supportedPermissions)) {
                         if (aggregatedPermissionProvider.isGranted(location, p)) {
                             coveredPermissions |= p;
                             isGranted = true;
@@ -171,7 +171,7 @@ public boolean isGranted(long repositoryPermissions) {
                 long supportedPermissions = aggregatedPermissionProvider.supportedPermissions((Tree) null, null, repositoryPermissions);
                 if (Util.doEvaluate(supportedPermissions)) {
                     RepositoryPermission rp = aggregatedPermissionProvider.getRepositoryPermission();
-                    for (long p : Permissions.aggregates(repositoryPermissions)) {
+                    for (long p : Permissions.aggregates(supportedPermissions)) {
                         if (rp.isGranted(p)) {
                             coveredPermissions |= p;
                             isGranted = true;

oak-core/src/test/java/org/apache/jackrabbit/oak/security/authentication/token/TokenConfigurationImplTest.java

@@ -22,6 +22,7 @@
 import org.apache.jackrabbit.oak.spi.commit.MoveTracker;
 import org.apache.jackrabbit.oak.spi.commit.ValidatorProvider;
 import org.apache.jackrabbit.oak.spi.security.ConfigurationParameters;
+import org.apache.jackrabbit.oak.spi.security.Context;
 import org.apache.jackrabbit.oak.spi.security.authentication.credentials.CredentialsSupport;
 import org.apache.jackrabbit.oak.spi.security.authentication.credentials.SimpleCredentialsSupport;
 import org.apache.jackrabbit.oak.spi.security.authentication.token.TokenConfiguration;
@@ -30,7 +31,6 @@
 
 import javax.jcr.Credentials;
 import javax.jcr.SimpleCredentials;
-import java.security.Principal;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
@@ -160,6 +160,11 @@ public void testBindMultipleCredentialsSupport() {
 
         verify(cs, times(4)).getCredentialClasses();
         verify(cs, times(2)).getAttributes(creds);
-
+    }
+
+    @Test
+    public void testGetContext() {
+        Context ctx = tc.getContext();
+        assertTrue(ctx instanceof TokenContext);
     }
 }