agave-files/files-core/src/main/java/org/iplantc/service/io/permissions/PermissionManager.java
/**
	 * Verifies the user's permission to view the file or directory at the given URI.
	 * The URI is validated for an acceptable schema. If the schema is agave, the 
	 * hostname represents a system which is used with the path to check the user's 
	 * role on the system and permissions on the file.
	 *  
	 * @param username the user for which to check permissions.
	 * @param internalUsername internal user of the {@code username}
	 * @param inputUri the input {@link URI} for which to check the permissions
	 * @return true if the {@code inputUri} can be ready by the given {@code username}.
	 * @throws PermissionException if the permissions cannot be checked
	 */
Verifies the user's permission to view the file or directory at the given URI.
The URI is validated for an acceptable schema. If the schema is agave, the
hostname represents a system which is used with the path to check the user's
role on the system and permissions on the file.

@param username the user for which to check permissions.
@param internalUsername internal user of the  username
@param inputUri the input  URI for which to check the permissions
@return true if the  inputUri can be ready by the given  username.
@throws PermissionException if the permissions cannot be checked
Verifies the user ' s permission to view the file or directory at the given URI . The URI is validated for an acceptable schema . If the schema is agave the hostname represents a system which is used with the path to check the user ' s role on the system and permissions on the file . @param username the user for which to check permissions . @param internalUsername internal user of the username @param inputUri the input URI for which to check the permissions @return true if the inputUri can be ready by the given username . @throws PermissionException if the permissions cannot be checked
public static boolean canUserReadUri(String username, String internalUsername, URI inputUri) throws PermissionException 
	{
		RemoteDataClient remoteDataClient = null;
		try 
		{
			String scheme = inputUri.getScheme();
			RemoteSystem system = null;
			String path = null;
			if (AgaveUriUtil.isInternalURI(inputUri))
			{
				if (StringUtils.isEmpty(scheme)) {
					system = new SystemManager().getUserDefaultStorageSystem(username);
					if (system == null) {
						throw new PermissionException("No system was specified in the URL for the file "
								+ "or directory at " + inputUri + " and no default system is defined.");
					}
					if (StringUtils.isEmpty(inputUri.getPath()) || StringUtils.equals(inputUri.getPath(), "/")) {
						path = "";
					} else {
						path = StringUtils.substring(inputUri.getPath(), 1);
					}
				}
				else if (scheme.equalsIgnoreCase("agave"))
				{
					if (StringUtils.isEmpty(inputUri.getHost())) {
						system = new SystemManager().getUserDefaultStorageSystem(username);
						if (system == null) {
							throw new PermissionException("No system was specified in the URL for the file "
									+ "or directory at " + inputUri + " and no default system is defined.");
						}
					} else {
						system = new SystemDao().findBySystemId(inputUri.getHost());
						if (system == null) {
							throw new PermissionException("No system was found matching the hostname in the "
									+ "URL for the file or directory at " + inputUri);
						}
					}
					if (StringUtils.isEmpty(inputUri.getPath()) || StringUtils.equals(inputUri.getPath(), "/")) {
						path = "";
					} else {
						path = StringUtils.substring(inputUri.getPath(), 1);
					}
				}
				else if (AgaveUriRegex.JOBS_URI.matches(inputUri)) {
				    try {
				        ApiUriUtil.getRemoteSystem(username, inputUri);
				        return true;
				    } catch (SystemException e) {
				        throw new PermissionException("No storage system was found matching the "
				                + "one associated with the job output in " + inputUri);
				    }
				}
				else 
				{   
					String systemId = PathResolver.getSystemIdFromPath(inputUri.getPath(), username);
					if (systemId == null) {
						system = new SystemManager().getUserDefaultStorageSystem(username);
						if (system == null) {
							throw new PermissionException("No system was specified in the URL for the file "
									+ "or directory at " + inputUri + " and no default system is defined.");
						}
					}
					else if (StringUtils.isEmpty(systemId))
					{
						throw new PermissionException("No system was specified in the URL for the file "
								+ "or directory at " + inputUri + " and no default system is defined.");
					} 
					else 
					{
						system = new SystemDao().findBySystemId(systemId);
						if (system == null) {
							throw new PermissionException("No system was found matching the hostname in the "
									+ "URL for the file or directory at " + inputUri);
						}
					}
					path = PathResolver.resolve(null, inputUri.getPath());
				}
				remoteDataClient = system.getRemoteDataClient(internalUsername);
				LogicalFile lf = LogicalFileDao.findBySystemAndPath(system, remoteDataClient.resolvePath(path));
				PermissionManager pm = new PermissionManager(system, remoteDataClient, lf, username);
				return pm.canRead(remoteDataClient.resolvePath(path));
			}
			else if (RemoteDataClientFactory.isSchemeSupported(inputUri))
			{
				remoteDataClient = new RemoteDataClientFactory().getInstance(username, internalUsername, inputUri);
				remoteDataClient.authenticate();
				return true;
			}
			else { 
				return false;
			}
		}
		catch (AgaveNamespaceException e) {
			return false;
		}
		catch (PermissionException e) {
			throw e;
		}
		catch (RemoteCredentialException e) {
			throw new PermissionException(e.getMessage(), e);
		}
		catch (RemoteDataException e) {
			throw new PermissionException("The server experienced an error attempting to "
					+ "identify the file or directory at " + inputUri, e);
		}
		catch (Exception e) {
			throw new PermissionException("Unable to verify that the user has permission "
					+ "to access the file or directory at " + inputUri, e);
		}
		finally {
			try { if (remoteDataClient != null) remoteDataClient.disconnect();} catch (Exception ignored) {}
		}
	}
public static boolean canUserReadUri ( String username , String internalUsername , URI inputUri ) throws PermissionException { RemoteDataClient remoteDataClient = null ; try { String scheme = inputUri . getScheme ( ) ; RemoteSystem system = null ; String path = null ; if ( AgaveUriUtil . isInternalURI ( inputUri ) ) { if ( StringUtils . isEmpty ( scheme ) ) { system = new SystemManager ( ) . getUserDefaultStorageSystem ( username ) ; if ( system == null ) { throw new PermissionException ( "No system was specified in the URL for the file " + "or directory at " + inputUri + " and no default system is defined." ) ; } if ( StringUtils . isEmpty ( inputUri . getPath ( ) ) || StringUtils . equals ( inputUri . getPath ( ) , "/" ) ) { path = "" ; } else { path = StringUtils . substring ( inputUri . getPath ( ) , 1 ) ; } } else if ( scheme . equalsIgnoreCase ( "agave" ) ) { if ( StringUtils . isEmpty ( inputUri . getHost ( ) ) ) { system = new SystemManager ( ) . getUserDefaultStorageSystem ( username ) ; if ( system == null ) { throw new PermissionException ( "No system was specified in the URL for the file " + "or directory at " + inputUri + " and no default system is defined." ) ; } } else { system = new SystemDao ( ) . findBySystemId ( inputUri . getHost ( ) ) ; if ( system == null ) { throw new PermissionException ( "No system was found matching the hostname in the " + "URL for the file or directory at " + inputUri ) ; } } if ( StringUtils . isEmpty ( inputUri . getPath ( ) ) || StringUtils . equals ( inputUri . getPath ( ) , "/" ) ) { path = "" ; } else { path = StringUtils . substring ( inputUri . getPath ( ) , 1 ) ; } } else if ( AgaveUriRegex . JOBS_URI . matches ( inputUri ) ) { try { ApiUriUtil . getRemoteSystem ( username , inputUri ) ; return true ; } catch ( SystemException e ) { throw new PermissionException ( "No storage system was found matching the " + "one associated with the job output in " + inputUri ) ; } } else { String systemId = PathResolver . getSystemIdFromPath ( inputUri . getPath ( ) , username ) ; if ( systemId == null ) { system = new SystemManager ( ) . getUserDefaultStorageSystem ( username ) ; if ( system == null ) { throw new PermissionException ( "No system was specified in the URL for the file " + "or directory at " + inputUri + " and no default system is defined." ) ; } } else if ( StringUtils . isEmpty ( systemId ) ) { throw new PermissionException ( "No system was specified in the URL for the file " + "or directory at " + inputUri + " and no default system is defined." ) ; } else { system = new SystemDao ( ) . findBySystemId ( systemId ) ; if ( system == null ) { throw new PermissionException ( "No system was found matching the hostname in the " + "URL for the file or directory at " + inputUri ) ; } } path = PathResolver . resolve ( null , inputUri . getPath ( ) ) ; } remoteDataClient = system . getRemoteDataClient ( internalUsername ) ; LogicalFile lf = LogicalFileDao . findBySystemAndPath ( system , remoteDataClient . resolvePath ( path ) ) ; PermissionManager pm = new PermissionManager ( system , remoteDataClient , lf , username ) ; return pm . canRead ( remoteDataClient . resolvePath ( path ) ) ; } else if ( RemoteDataClientFactory . isSchemeSupported ( inputUri ) ) { remoteDataClient = new RemoteDataClientFactory ( ) . getInstance ( username , internalUsername , inputUri ) ; remoteDataClient . authenticate ( ) ; return true ; } else { return false ; } } catch ( AgaveNamespaceException e ) { return false ; } catch ( PermissionException e ) { throw e ; } catch ( RemoteCredentialException e ) { throw new PermissionException ( e . getMessage ( ) , e ) ; } catch ( RemoteDataException e ) { throw new PermissionException ( "The server experienced an error attempting to " + "identify the file or directory at " + inputUri , e ) ; } catch ( Exception e ) { throw new PermissionException ( "Unable to verify that the user has permission " + "to access the file or directory at " + inputUri , e ) ; } finally { try { if ( remoteDataClient != null ) remoteDataClient . disconnect ( ) ; } catch ( Exception ignored ) { } } }
Verifies the user's permission to view the file or directory at the given URI.
Verifies the user ' s permission to view the file or directory at the given URI .
// path is relative to the default storage system. Nothing to do. // path is relative to the default storage system. Nothing to do. // will throw an exception if the path isn't valid // since the system would have been resolved in the path resolution already. // forced authentication here will provide the sanity check on sftp and ftp URL that must have //value basic auth params in the URI to connect.