This is an automated email from the ASF dual-hosted git repository. joerghoh pushed a commit to branch SLING-12642-cache-privileges in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-jcr-repoinit.git
commit a6cfe20aeb4658ec676c735e8c74d86a0fb969e4 Author: Joerg Hoh <[email protected]> AuthorDate: Sun Feb 9 19:55:46 2025 +0100 add principal caching --- .../org/apache/sling/jcr/repoinit/impl/AclUtil.java | 20 ++++++++++---------- .../impl/PrivilegeCachingSessionWrapper.java | 13 +++++++++++++ 2 files changed, 23 insertions(+), 10 deletions(-) diff --git a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java index 9d8d0af..e5f5ab9 100644 --- a/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java +++ b/src/main/java/org/apache/sling/jcr/repoinit/impl/AclUtil.java @@ -182,7 +182,7 @@ public class AclUtil { .map(o -> o.contains(AclVisitor.OPTION_IGNORE_MISSING_PRINCIPAL)) .orElse(false); for (String name : principals) { - final Principal principal = getPrincipal(pcsw.getSession(), name, ignoreMissingPrincipal); + final Principal principal = getPrincipal(pcsw, name, ignoreMissingPrincipal); LocalAccessControlEntry newAce = new LocalAccessControlEntry(pcsw, principal, jcrPriv, isAllow, localRestrictions); if (contains(existingAces, newAce)) { @@ -206,13 +206,13 @@ public class AclUtil { } @NotNull - private static Principal getPrincipal(Session session, String name, boolean ignoreMissingPrincipal) + private static Principal getPrincipal(PrivilegeCachingSessionWrapper pcsw, String name, boolean ignoreMissingPrincipal) throws RepositoryException { - Principal principal = AccessControlUtils.getPrincipal(session, name); + Principal principal = pcsw.getPrincipal(name); if (principal == null) { // backwards compatibility: fallback to original code treating principal name as authorizable ID (see // SLING-8604) - final Authorizable authorizable = UserUtil.getAuthorizable(session, name); + final Authorizable authorizable = UserUtil.getAuthorizable(pcsw.getSession(), name); if (!ignoreMissingPrincipal) { checkState(authorizable != null, "Authorizable not found: {0}", name); principal = authorizable.getPrincipal(); @@ -238,7 +238,7 @@ public class AclUtil { */ public static void removePolicy(@NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull final String principalName) throws RepositoryException { - Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + Principal principal = pcsw.getPrincipal(principalName); if (principal == null) { LOG.info("Principal {} does not exist.", principalName); // using PrincipalImpl will prevent 'removePolicy' from failing with AccessControlException @@ -371,12 +371,12 @@ public class AclUtil { PrivilegeCachingSessionWrapper pcsw, String principalName, Collection<AclLine> lines, boolean isStrict) throws RepositoryException { final JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); - Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + Principal principal = pcsw.getPrincipal(principalName); if (principal == null) { // due to transient nature of the repo-init the principal lookup may not succeed if completed through query // -> save transient changes and retry principal lookup pcsw.getSession().save(); - principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + principal = pcsw.getPrincipal(principalName); checkState(principal != null, PRINCIPAL_NOT_FOUND_PATTERN, principalName); } @@ -450,12 +450,12 @@ public class AclUtil { public static void removePrincipalEntries(@NotNull PrivilegeCachingSessionWrapper pcsw, String principalName, Collection<AclLine> lines) throws RepositoryException { final JackrabbitAccessControlManager acMgr = pcsw.getAccessControlManager(); - Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + Principal principal = pcsw.getPrincipal(principalName); if (principal == null) { // due to transient nature of the repo-init the principal lookup may not succeed if completed through query // -> save transient changes and retry principal lookup pcsw.getSession().save(); - principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + principal = pcsw.getPrincipal(principalName); checkState(principal != null, PRINCIPAL_NOT_FOUND_PATTERN, principalName); } @@ -500,7 +500,7 @@ public class AclUtil { */ public static void removePrincipalPolicy(@NotNull PrivilegeCachingSessionWrapper pcsw, @NotNull String principalName) throws RepositoryException { - Principal principal = AccessControlUtils.getPrincipal(pcsw.getSession(), principalName); + Principal principal = pcsw.getPrincipal(principalName); if (principal == null) { LOG.info("Cannot remove principal-based ACL. Principal {} does not exist.", principalName); return; diff --git a/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java b/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java index e38b10f..3708d90 100644 --- a/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java +++ b/src/main/java/org/apache/sling/jcr/repoinit/impl/PrivilegeCachingSessionWrapper.java @@ -18,6 +18,7 @@ */ package org.apache.sling.jcr.repoinit.impl; +import java.security.Principal; import java.util.Arrays; import java.util.HashMap; import java.util.HashSet; @@ -31,6 +32,7 @@ import javax.jcr.security.Privilege; import org.apache.jackrabbit.api.JackrabbitSession; import org.apache.jackrabbit.api.security.JackrabbitAccessControlManager; +import org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils; import com.google.common.collect.Lists; @@ -43,6 +45,7 @@ public class PrivilegeCachingSessionWrapper { JackrabbitAccessControlManager acMgr; Map<String,Privilege> nameToPrivilegeMap = new HashMap<>(); Map<Privilege,List<Privilege>> privilegeToAggreate = new HashMap<>(); + Map<String,Principal> idToPrincipal = new HashMap<>(); public PrivilegeCachingSessionWrapper (Session session) { AclUtil.checkState(session instanceof JackrabbitSession,"A Jackrabbit Session is required"); @@ -99,4 +102,14 @@ public class PrivilegeCachingSessionWrapper { } }); } + + public Principal getPrincipal (String principalName) throws RepositoryException { + if (idToPrincipal.containsKey(principalName)) { + return idToPrincipal.get(principalName); + } else { + Principal p = AccessControlUtils.getPrincipal(this.getSession(), principalName); + idToPrincipal.put(principalName, p); + return p; + } + } }
