private boolean hasPermission( String workspaceName,
                                   PathSupplier pathSupplier,
                                   String... actions ) {
        SecurityContext sec = context.getSecurityContext();
        final boolean checkAcl = repository.repositoryCache().isAccessControlEnabled();

        boolean hasPermission = true;

        final String repositoryName = this.repository.repositoryName();
        try {
            if (sec instanceof AuthorizationProvider) {
                // Delegate to the security context ...
                AuthorizationProvider authorizer = (AuthorizationProvider)sec;
                Path path = pathSupplier != null ? pathSupplier.getAbsolutePath() : null;
                if (path != null) {
                    assert path.isAbsolute() : "The path (if provided) must be absolute";
                    hasPermission = authorizer.hasPermission(context, repositoryName, repositoryName, workspaceName, path,
                                                             actions);

                    if (checkAcl && hasPermission) {
                        hasPermission = acm.hasPermission(path, actions);
                    }
                    return hasPermission;
                } else {
                    return authorizer.hasPermission(context, repositoryName, repositoryName, workspaceName, null,
                                                    actions);
                }
            }

            if (sec instanceof AdvancedAuthorizationProvider) {
                // Delegate to the security context ...
                AdvancedAuthorizationProvider authorizer = (AdvancedAuthorizationProvider)sec;
                Path path = pathSupplier != null ? pathSupplier.getAbsolutePath() : null;
                if (path != null) {
                    assert path.isAbsolute() : "The path (if provided) must be absolute";
                    hasPermission = authorizer.hasPermission(authorizerContext, path, actions);

                    if (checkAcl && hasPermission) {
                        hasPermission = acm.hasPermission(path, actions);
                    }
                    return hasPermission;
                } else {
                    return authorizer.hasPermission(authorizerContext, null, actions);
                }
            }

            // It is a role-based security context, so apply role-based authorization ...
            for (String action : actions) {
                if (ModeShapePermissions.READ.equals(action)) {
                    hasPermission &= hasRole(sec, ModeShapeRoles.READONLY, repositoryName, workspaceName)
                                     || hasRole(sec, ModeShapeRoles.READWRITE, repositoryName, workspaceName)
                                     || hasRole(sec, ModeShapeRoles.ADMIN, repositoryName, workspaceName);
                } else if (ModeShapePermissions.REGISTER_NAMESPACE.equals(action)
                           || ModeShapePermissions.REGISTER_TYPE.equals(action) || ModeShapePermissions.UNLOCK_ANY.equals(action)
                           || ModeShapePermissions.CREATE_WORKSPACE.equals(action)
                           || ModeShapePermissions.DELETE_WORKSPACE.equals(action) || ModeShapePermissions.MONITOR.equals(action)
                           || ModeShapePermissions.DELETE_WORKSPACE.equals(action)
                           || ModeShapePermissions.INDEX_WORKSPACE.equals(action)) {
                    hasPermission &= hasRole(sec, ModeShapeRoles.ADMIN, repositoryName, workspaceName);
                } else {
                    hasPermission &= hasRole(sec, ModeShapeRoles.ADMIN, repositoryName, workspaceName)
                                     || hasRole(sec, ModeShapeRoles.READWRITE, repositoryName, workspaceName);
                }
            }

            if (checkAcl && hasPermission) {
                Path path = pathSupplier != null ? pathSupplier.getAbsolutePath() : null;
                if (path != null) {
                    assert path.isAbsolute() : "The path (if provided) must be absolute";
                    hasPermission = acm.hasPermission(path, actions);
                }
            }

            return hasPermission;
        } catch (ItemNotFoundException err) {
            // The node was removed from this session
            return false;
        }
    }
private boolean hasPermission ( String workspaceName , PathSupplier pathSupplier , String ... actions ) { SecurityContext sec = context . getSecurityContext ( ) ; final boolean checkAcl = repository . repositoryCache ( ) . isAccessControlEnabled ( ) ; boolean hasPermission = true ; final String repositoryName = this . repository . repositoryName ( ) ; try { if ( sec instanceof AuthorizationProvider ) { AuthorizationProvider authorizer = ( AuthorizationProvider ) sec ; Path path = pathSupplier != null ? pathSupplier . getAbsolutePath ( ) : null ; if ( path != null ) { assert path . isAbsolute ( ) : "The path (if provided) must be absolute" ; hasPermission = authorizer . hasPermission ( context , repositoryName , repositoryName , workspaceName , path , actions ) ; if ( checkAcl && hasPermission ) { hasPermission = acm . hasPermission ( path , actions ) ; } return hasPermission ; } else { return authorizer . hasPermission ( context , repositoryName , repositoryName , workspaceName , null , actions ) ; } } if ( sec instanceof AdvancedAuthorizationProvider ) { AdvancedAuthorizationProvider authorizer = ( AdvancedAuthorizationProvider ) sec ; Path path = pathSupplier != null ? pathSupplier . getAbsolutePath ( ) : null ; if ( path != null ) { assert path . isAbsolute ( ) : "The path (if provided) must be absolute" ; hasPermission = authorizer . hasPermission ( authorizerContext , path , actions ) ; if ( checkAcl && hasPermission ) { hasPermission = acm . hasPermission ( path , actions ) ; } return hasPermission ; } else { return authorizer . hasPermission ( authorizerContext , null , actions ) ; } } for ( String action : actions ) { if ( ModeShapePermissions . READ . equals ( action ) ) { hasPermission &= hasRole ( sec , ModeShapeRoles . READONLY , repositoryName , workspaceName ) || hasRole ( sec , ModeShapeRoles . READWRITE , repositoryName , workspaceName ) || hasRole ( sec , ModeShapeRoles . ADMIN , repositoryName , workspaceName ) ; } else if ( ModeShapePermissions . REGISTER_NAMESPACE . equals ( action ) || ModeShapePermissions . REGISTER_TYPE . equals ( action ) || ModeShapePermissions . UNLOCK_ANY . equals ( action ) || ModeShapePermissions . CREATE_WORKSPACE . equals ( action ) || ModeShapePermissions . DELETE_WORKSPACE . equals ( action ) || ModeShapePermissions . MONITOR . equals ( action ) || ModeShapePermissions . DELETE_WORKSPACE . equals ( action ) || ModeShapePermissions . INDEX_WORKSPACE . equals ( action ) ) { hasPermission &= hasRole ( sec , ModeShapeRoles . ADMIN , repositoryName , workspaceName ) ; } else { hasPermission &= hasRole ( sec , ModeShapeRoles . ADMIN , repositoryName , workspaceName ) || hasRole ( sec , ModeShapeRoles . READWRITE , repositoryName , workspaceName ) ; } } if ( checkAcl && hasPermission ) { Path path = pathSupplier != null ? pathSupplier . getAbsolutePath ( ) : null ; if ( path != null ) { assert path . isAbsolute ( ) : "The path (if provided) must be absolute" ; hasPermission = acm . hasPermission ( path , actions ) ; } } return hasPermission ; } catch ( ItemNotFoundException err ) { return false ; } }
Determine if the current user does not have permission for all of the named actions in the named workspace in the given
context, otherwise returns silently.

@param workspaceName the name of the workspace in which the path exists
@param pathSupplier the supplier for the path on which the actions are occurring; may be null if the permission is on the
whole workspace
@param actions the list of {@link ModeShapePermissions actions} to check
@return true if the subject has privilege to perform all of the named actions on the content at the supplied path in the
given workspace within the repository, or false otherwise