authz-cass/src/main/java/com/att/dao/aaf/hl/Function.java

   1 /*******************************************************************************\r
   2  * ============LICENSE_START====================================================\r
   3  * * org.onap.aai\r
   4  * * ===========================================================================\r
   5  * * Copyright © 2017 AT&T Intellectual Property. All rights reserved.\r
   6  * * Copyright © 2017 Amdocs\r
   7  * * ===========================================================================\r
   8  * * Licensed under the Apache License, Version 2.0 (the "License");\r
   9  * * you may not use this file except in compliance with the License.\r
  10  * * You may obtain a copy of the License at\r
  11  * * \r
  12  *  *      http://www.apache.org/licenses/LICENSE-2.0\r
  13  * * \r
  14  *  * Unless required by applicable law or agreed to in writing, software\r
  15  * * distributed under the License is distributed on an "AS IS" BASIS,\r
  16  * * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\r
  17  * * See the License for the specific language governing permissions and\r
  18  * * limitations under the License.\r
  19  * * ============LICENSE_END====================================================\r
  20  * *\r
  21  * * ECOMP is a trademark and service mark of AT&T Intellectual Property.\r
  22  * *\r
  23  ******************************************************************************/\r
  24 package com.att.dao.aaf.hl;\r
  25 \r
  26 import static com.att.authz.layer.Result.OK;\r
  27 \r
  28 import java.io.IOException;\r
  29 import java.util.ArrayList;\r
  30 import java.util.Date;\r
  31 import java.util.HashSet;\r
  32 import java.util.List;\r
  33 import java.util.Set;\r
  34 import java.util.UUID;\r
  35 \r
  36 import com.att.authz.common.Define;\r
  37 import com.att.authz.env.AuthzTrans;\r
  38 import com.att.authz.layer.Result;\r
  39 import com.att.authz.org.Executor;\r
  40 import com.att.authz.org.Organization;\r
  41 import com.att.authz.org.Organization.Expiration;\r
  42 import com.att.authz.org.Organization.Policy;\r
  43 import com.att.authz.org.Organization.Identity;\r
  44 import com.att.dao.DAOException;\r
  45 import com.att.dao.aaf.cass.ApprovalDAO;\r
  46 import com.att.dao.aaf.cass.CredDAO;\r
  47 import com.att.dao.aaf.cass.DelegateDAO;\r
  48 import com.att.dao.aaf.cass.FutureDAO;\r
  49 import com.att.dao.aaf.cass.Namespace;\r
  50 import com.att.dao.aaf.cass.NsDAO;\r
  51 import com.att.dao.aaf.cass.NsDAO.Data;\r
  52 import com.att.dao.aaf.cass.NsSplit;\r
  53 import com.att.dao.aaf.cass.NsType;\r
  54 import com.att.dao.aaf.cass.PermDAO;\r
  55 import com.att.dao.aaf.cass.RoleDAO;\r
  56 import com.att.dao.aaf.cass.Status;\r
  57 import com.att.dao.aaf.cass.UserRoleDAO;\r
  58 import com.att.dao.aaf.hl.Question.Access;\r
  59 \r
  60 public class Function {\r
  61 \r
  62         public static final String FOP_CRED = "cred";\r
  63         public static final String FOP_DELEGATE = "delegate";\r
  64         public static final String FOP_NS = "ns";\r
  65         public static final String FOP_PERM = "perm";\r
  66         public static final String FOP_ROLE = "role";\r
  67         public static final String FOP_USER_ROLE = "user_role";\r
  68         // First Action should ALWAYS be "write", see "CreateRole"\r
  69         public final Question q;\r
  70 \r
  71         public Function(AuthzTrans trans, Question question) {\r
  72                 q = question;\r
  73         }\r
  74 \r
  75         private class ErrBuilder {\r
  76                 private StringBuilder sb;\r
  77                 private List<String> ao;\r
  78 \r
  79                 public void log(Result<?> result) {\r
  80                         if (result.notOK()) {\r
  81                                 if (sb == null) {\r
  82                                         sb = new StringBuilder();\r
  83                                         ao = new ArrayList<String>();\r
  84                                 }\r
  85                                 sb.append(result.details);\r
  86                                 sb.append('\n');\r
  87                                 for (String s : result.variables) {\r
  88                                         ao.add(s);\r
  89                                 }\r
  90                         }\r
  91                 }\r
  92 \r
  93                 public String[] vars() {\r
  94                         String[] rv = new String[ao.size()];\r
  95                         ao.toArray(rv);\r
  96                         return rv;\r
  97                 }\r
  98 \r
  99                 public boolean hasErr() {\r
 100                         return sb != null;\r
 101                 }\r
 102 \r
 103                 @Override\r
 104                 public String toString() {\r
 105                         return sb == null ? "" : String.format(sb.toString(), ao);\r
 106                 }\r
 107         }\r
 108 \r
 109         /**\r
 110          * createNS\r
 111          * \r
 112          * Create Namespace\r
 113          * \r
 114          * @param trans\r
 115          * @param org\r
 116          * @param ns\r
 117          * @param user\r
 118          * @return\r
 119          * @throws DAOException\r
 120          * \r
 121          *             To create an NS, you need to: 1) validate permission to\r
 122          *             modify parent NS 2) Does NS exist already? 3) Create NS with\r
 123          *             a) "user" as owner. NOTE: Per 10-15 request for AAF 1.0 4)\r
 124          *             Loop through Roles with Parent NS, and map any that start\r
 125          *             with this NS into this one 5) Loop through Perms with Parent\r
 126          *             NS, and map any that start with this NS into this one\r
 127          */\r
 128         public Result<Void> createNS(AuthzTrans trans, Namespace namespace, boolean fromApproval) {\r
 129                 Result<?> rq;\r
 130 \r
 131                 if (namespace.name.endsWith(Question.DOT_ADMIN)\r
 132                                 || namespace.name.endsWith(Question.DOT_OWNER)) {\r
 133                         return Result.err(Status.ERR_BadData,\r
 134                                         "'admin' and 'owner' are reserved names in AAF");\r
 135                 }\r
 136 \r
 137                 try {\r
 138                         for (String u : namespace.owner) {\r
 139                                 Organization org = trans.org();\r
 140                                 Identity orgUser = org.getIdentity(trans, u);\r
 141                                 if (orgUser == null || !orgUser.isResponsible()) {\r
 142                                         // check if user has explicit permission\r
 143                                         String reason;\r
 144                                         if (org.isTestEnv() && (reason=org.validate(trans, Policy.AS_EMPLOYEE,\r
 145                                                         new CassExecutor(trans, this), u))!=null) {\r
 146                                             return Result.err(Status.ERR_Policy,reason);\r
 147                                         }\r
 148                                 }\r
 149                         }\r
 150                 } catch (Exception e) {\r
 151                         trans.error().log(e,\r
 152                                         "Could not contact Organization for User Validation");\r
 153                 }\r
 154 \r
 155                 String user = trans.user();\r
 156                 // 1) May Change Parent?\r
 157                 int idx = namespace.name.lastIndexOf('.');\r
 158                 String parent;\r
 159                 if (idx < 0) {\r
 160                         if (!q.isGranted(trans, user, Define.ROOT_NS,Question.NS, ".", "create")) {\r
 161                                 return Result.err(Result.ERR_Security,\r
 162                                                 "%s may not create Root Namespaces", user);\r
 163                         }\r
 164                         parent = null;\r
 165                         fromApproval = true;\r
 166                 } else {\r
 167                         parent = namespace.name.substring(0, idx);\r
 168                 }\r
 169 \r
 170                 if (!fromApproval) {\r
 171                         Result<NsDAO.Data> rparent = q.deriveNs(trans, parent);\r
 172                         if (rparent.notOK()) {\r
 173                                 return Result.err(rparent);\r
 174                         }\r
 175                         rparent = q.mayUser(trans, user, rparent.value, Access.write);\r
 176                         if (rparent.notOK()) {\r
 177                                 return Result.err(rparent);\r
 178                         }\r
 179                 }\r
 180 \r
 181                 // 2) Does requested NS exist\r
 182                 if (q.nsDAO.read(trans, namespace.name).isOKhasData()) {\r
 183                         return Result.err(Status.ERR_ConflictAlreadyExists,\r
 184                                         "Target Namespace already exists");\r
 185                 }\r
 186 \r
 187                 // Someone must be responsible.\r
 188                 if (namespace.owner == null || namespace.owner.isEmpty()) {\r
 189                         return Result\r
 190                                         .err(Status.ERR_Policy,\r
 191                                                         "Namespaces must be assigned at least one responsible party");\r
 192                 }\r
 193 \r
 194                 // 3) Create NS\r
 195                 Date now = new Date();\r
 196 \r
 197                 Result<Void> r;\r
 198                 // 3a) Admin\r
 199 \r
 200                 try {\r
 201                         // Originally, added the enterer as Admin, but that's not necessary,\r
 202                         // or helpful for Operations folks..\r
 203                         // Admins can be empty, because they can be changed by lower level\r
 204                         // NSs\r
 205                         // if(ns.admin(false).isEmpty()) {\r
 206                         // ns.admin(true).add(user);\r
 207                         // }\r
 208                         if (namespace.admin != null) {\r
 209                                 for (String u : namespace.admin) {\r
 210                                         if ((r = checkValidID(trans, now, u)).notOK()) {\r
 211                                                 return r;\r
 212                                         }\r
 213                                 }\r
 214                         }\r
 215 \r
 216                         // 3b) Responsible\r
 217                         Organization org = trans.org();\r
 218                         for (String u : namespace.owner) {\r
 219                                 Identity orgUser = org.getIdentity(trans, u);\r
 220                                 if (orgUser == null) {\r
 221                                         return Result\r
 222                                                         .err(Status.ERR_BadData,\r
 223                                                                         "NS must be created with an %s approved Responsible Party",\r
 224                                                                         org.getName());\r
 225                                 }\r
 226                         }\r
 227                 } catch (Exception e) {\r
 228                         return Result.err(Status.ERR_UserNotFound, e.getMessage());\r
 229                 }\r
 230 \r
 231                 // VALIDATIONS done... Add NS\r
 232                 if ((rq = q.nsDAO.create(trans, namespace.data())).notOK()) {\r
 233                     return Result.err(rq);\r
 234                 }\r
 235 \r
 236                 // Since Namespace is now created, we need to grab all subsequent errors\r
 237                 ErrBuilder eb = new ErrBuilder();\r
 238 \r
 239                 // Add UserRole(s)\r
 240                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();\r
 241                 urdd.expires = trans.org().expiration(null, Expiration.UserInRole).getTime();\r
 242                 urdd.role(namespace.name, Question.ADMIN);\r
 243                 for (String admin : namespace.admin) {\r
 244                         urdd.user = admin;\r
 245                         eb.log(q.userRoleDAO.create(trans, urdd));\r
 246                 }\r
 247                 urdd.role(namespace.name,Question.OWNER);\r
 248                 for (String owner : namespace.owner) {\r
 249                         urdd.user = owner;\r
 250                         eb.log(q.userRoleDAO.create(trans, urdd));\r
 251                 }\r
 252 \r
 253                 addNSAdminRolesPerms(trans, eb, namespace.name);\r
 254 \r
 255                 addNSOwnerRolesPerms(trans, eb, namespace.name);\r
 256 \r
 257                 if (parent != null) {\r
 258                         // Build up with any errors\r
 259 \r
 260                         Result<NsDAO.Data> parentNS = q.deriveNs(trans, parent);\r
 261                         String targetNs = parentNS.value.name; // Get the Parent Namespace,\r
 262                                                                                                         // not target\r
 263                         String targetName = namespace.name.substring(parentNS.value.name.length() + 1); // Remove the Parent Namespace from the\r
 264                                                                         // Target + a dot, and you'll get the name\r
 265                         int targetNameDot = targetName.length() + 1;\r
 266 \r
 267                         // 4) Change any roles with children matching this NS, and\r
 268                         Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readChildren(trans, targetNs, targetName);\r
 269                         if (rrdc.isOKhasData()) {\r
 270                                 for (RoleDAO.Data rdd : rrdc.value) {\r
 271                                         // Remove old Role from Perms, save them off\r
 272                                         List<PermDAO.Data> lpdd = new ArrayList<PermDAO.Data>();\r
 273                                         for(String p : rdd.perms(false)) {\r
 274                                                 Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);\r
 275                                                 if(rpdd.isOKhasData()) {\r
 276                                                         PermDAO.Data pdd = rpdd.value;\r
 277                                                         lpdd.add(pdd);\r
 278                                                         q.permDAO.delRole(trans, pdd, rdd);\r
 279                                                 } else{\r
 280                                                         trans.error().log(rpdd.errorString());\r
 281                                                 }\r
 282                                         }\r
 283                                         \r
 284                                         // Save off Old keys\r
 285                                         String delP1 = rdd.ns;\r
 286                                         String delP2 = rdd.name;\r
 287 \r
 288                                         // Write in new key\r
 289                                         rdd.ns = namespace.name;\r
 290                                         rdd.name = (delP2.length() > targetNameDot) ? delP2\r
 291                                                         .substring(targetNameDot) : "";\r
 292                                                         \r
 293                                         // Need to use non-cached, because switching namespaces, not\r
 294                                         // "create" per se\r
 295                                         if ((rq = q.roleDAO.create(trans, rdd)).isOK()) {\r
 296                                                 // Put Role back into Perm, with correct info\r
 297                                                 for(PermDAO.Data pdd : lpdd) {\r
 298                                                         q.permDAO.addRole(trans, pdd, rdd);\r
 299                                                 }\r
 300                                                 // Change data for User Roles \r
 301                                                 Result<List<UserRoleDAO.Data>> rurd = q.userRoleDAO.readByRole(trans, rdd.fullName());\r
 302                                                 if(rurd.isOKhasData()) {\r
 303                                                         for(UserRoleDAO.Data urd : rurd.value) {\r
 304                                                                 urd.ns = rdd.ns;\r
 305                                                                 urd.rname = rdd.name;\r
 306                                                                 q.userRoleDAO.update(trans, urd);\r
 307                                                         }\r
 308                                                 }\r
 309                                                 // Now delete old one\r
 310                                                 rdd.ns = delP1;\r
 311                                                 rdd.name = delP2;\r
 312                                                 if ((rq = q.roleDAO.delete(trans, rdd, false)).notOK()) {\r
 313                                                         eb.log(rq);\r
 314                                                 }\r
 315                                         } else {\r
 316                                                 eb.log(rq);\r
 317                                         }\r
 318                                 }\r
 319                         }\r
 320 \r
 321                         // 4) Change any Permissions with children matching this NS, and\r
 322                         Result<List<PermDAO.Data>> rpdc = q.permDAO.readChildren(trans,targetNs, targetName);\r
 323                         if (rpdc.isOKhasData()) {\r
 324                                 for (PermDAO.Data pdd : rpdc.value) {\r
 325                                         // Remove old Perm from Roles, save them off\r
 326                                         List<RoleDAO.Data> lrdd = new ArrayList<RoleDAO.Data>();\r
 327                                         \r
 328                                         for(String rl : pdd.roles(false)) {\r
 329                                                 Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);\r
 330                                                 if(rrdd.isOKhasData()) {\r
 331                                                         RoleDAO.Data rdd = rrdd.value;\r
 332                                                         lrdd.add(rdd);\r
 333                                                         q.roleDAO.delPerm(trans, rdd, pdd);\r
 334                                                 } else{\r
 335                                                         trans.error().log(rrdd.errorString());\r
 336                                                 }\r
 337                                         }\r
 338                                         \r
 339                                         // Save off Old keys\r
 340                                         String delP1 = pdd.ns;\r
 341                                         String delP2 = pdd.type;\r
 342                                         pdd.ns = namespace.name;\r
 343                                         pdd.type = (delP2.length() > targetNameDot) ? delP2\r
 344                                                         .substring(targetNameDot) : "";\r
 345                                         if ((rq = q.permDAO.create(trans, pdd)).isOK()) {\r
 346                                                 // Put Role back into Perm, with correct info\r
 347                                                 for(RoleDAO.Data rdd : lrdd) {\r
 348                                                         q.roleDAO.addPerm(trans, rdd, pdd);\r
 349                                                 }\r
 350 \r
 351                                                 pdd.ns = delP1;\r
 352                                                 pdd.type = delP2;\r
 353                                                 if ((rq = q.permDAO.delete(trans, pdd, false)).notOK()) {\r
 354                                                         eb.log(rq);\r
 355                                                         // } else {\r
 356                                                         // Need to invalidate directly, because we're\r
 357                                                         // switching places in NS, not normal cache behavior\r
 358                                                         // q.permDAO.invalidate(trans,pdd);\r
 359                                                 }\r
 360                                         } else {\r
 361                                                 eb.log(rq);\r
 362                                         }\r
 363                                 }\r
 364                         }\r
 365                         if (eb.hasErr()) {\r
 366                                 return Result.err(Status.ERR_ActionNotCompleted,eb.sb.toString(), eb.vars());\r
 367                         }\r
 368                 }\r
 369                 return Result.ok();\r
 370         }\r
 371 \r
 372         private void addNSAdminRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {\r
 373                 // Admin Role/Perm\r
 374                 RoleDAO.Data rd = new RoleDAO.Data();\r
 375                 rd.ns = ns;\r
 376                 rd.name = "admin";\r
 377                 rd.description = "AAF Namespace Administrators";\r
 378 \r
 379                 PermDAO.Data pd = new PermDAO.Data();\r
 380                 pd.ns = ns;\r
 381                 pd.type = "access";\r
 382                 pd.instance = Question.ASTERIX;\r
 383                 pd.action = Question.ASTERIX;\r
 384                 pd.description = "AAF Namespace Write Access";\r
 385 \r
 386                 rd.perms = new HashSet<String>();\r
 387                 rd.perms.add(pd.encode());\r
 388                 eb.log(q.roleDAO.create(trans, rd));\r
 389 \r
 390                 pd.roles = new HashSet<String>();\r
 391                 pd.roles.add(rd.encode());\r
 392                 eb.log(q.permDAO.create(trans, pd));\r
 393         }\r
 394 \r
 395         private void addNSOwnerRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {\r
 396                 RoleDAO.Data rd = new RoleDAO.Data();\r
 397                 rd.ns = ns;\r
 398                 rd.name = "owner";\r
 399                 rd.description = "AAF Namespace Owners";\r
 400 \r
 401                 PermDAO.Data pd = new PermDAO.Data();\r
 402                 pd.ns = ns;\r
 403                 pd.type = "access";\r
 404                 pd.instance = Question.ASTERIX;\r
 405                 pd.action = Question.READ;\r
 406                 pd.description = "AAF Namespace Read Access";\r
 407 \r
 408                 rd.perms = new HashSet<String>();\r
 409                 rd.perms.add(pd.encode());\r
 410                 eb.log(q.roleDAO.create(trans, rd));\r
 411 \r
 412                 pd.roles = new HashSet<String>();\r
 413                 pd.roles.add(rd.encode());\r
 414                 eb.log(q.permDAO.create(trans, pd));\r
 415         }\r
 416 \r
 417         /**\r
 418          * deleteNS\r
 419          * \r
 420          * Delete Namespace\r
 421          * \r
 422          * @param trans\r
 423          * @param org\r
 424          * @param ns\r
 425          * @param force\r
 426          * @param user\r
 427          * @return\r
 428          * @throws DAOException\r
 429          * \r
 430          * \r
 431          *             To delete an NS, you need to: 1) validate permission to\r
 432          *             modify this NS 2) Find all Roles with this NS, and 2a) if\r
 433          *             Force, delete them, else modify to Parent NS 3) Find all\r
 434          *             Perms with this NS, and modify to Parent NS 3a) if Force,\r
 435          *             delete them, else modify to Parent NS 4) Find all IDs\r
 436          *             associated to this NS, and deny if exists. 5) Remove NS\r
 437          */\r
 438         public Result<Void> deleteNS(AuthzTrans trans, String ns) {\r
 439                 boolean force = trans.forceRequested();\r
 440                 boolean move = trans.moveRequested();\r
 441                 // 1) Validate\r
 442                 Result<List<NsDAO.Data>> nsl;\r
 443                 if ((nsl = q.nsDAO.read(trans, ns)).notOKorIsEmpty()) {\r
 444                         return Result.err(Status.ERR_NsNotFound, "%s does not exist", ns);\r
 445                 }\r
 446                 NsDAO.Data nsd = nsl.value.get(0);\r
 447                 NsType nt;\r
 448                 if (move && !q.canMove(nt = NsType.fromType(nsd.type))) {\r
 449                         return Result.err(Status.ERR_Denied, "Namespace Force=move not permitted for Type %s",nt.name());\r
 450                 }\r
 451 \r
 452                 Result<NsDAO.Data> dnr = q.mayUser(trans, trans.user(), nsd, Access.write);\r
 453                 if (dnr.status != Status.OK) {\r
 454                         return Result.err(dnr);\r
 455                 }\r
 456 \r
 457                 // 2) Find Parent\r
 458                 String user = trans.user();\r
 459                 int idx = ns.lastIndexOf('.');\r
 460                 NsDAO.Data parent;\r
 461                 if (idx < 0) {\r
 462                         if (!q.isGranted(trans, user, Define.ROOT_NS,Question.NS, ".", "delete")) {\r
 463                                 return Result.err(Result.ERR_Security,\r
 464                                                 "%s may not delete Root Namespaces", user);\r
 465                         }\r
 466                         parent = null;\r
 467                 } else {\r
 468                         Result<NsDAO.Data> rlparent = q.deriveNs(trans, ns.substring(0, idx));\r
 469                         if (rlparent.notOKorIsEmpty()) {\r
 470                                 return Result.err(rlparent);\r
 471                         }\r
 472                         parent = rlparent.value;\r
 473                 }\r
 474 \r
 475                 // Build up with any errors\r
 476                 // If sb != null below is an indication of error\r
 477                 StringBuilder sb = null;\r
 478                 ErrBuilder er = new ErrBuilder();\r
 479 \r
 480                 // 2a) Deny if any IDs on Namespace\r
 481                 Result<List<CredDAO.Data>> creds = q.credDAO.readNS(trans, ns);\r
 482                 if (creds.isOKhasData()) {\r
 483                         if (force || move) {\r
 484                                 for (CredDAO.Data cd : creds.value) {\r
 485                                         er.log(q.credDAO.delete(trans, cd, false));\r
 486                                         // Since we're deleting all the creds, we should delete all\r
 487                                         // the user Roles for that Cred\r
 488                                         Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO\r
 489                                                         .readByUser(trans, cd.id);\r
 490                                         if (rlurd.isOK()) {\r
 491                                                 for (UserRoleDAO.Data data : rlurd.value) {\r
 492                                                     q.userRoleDAO.delete(trans, data, false);\r
 493                                                 }\r
 494                                         }\r
 495 \r
 496                                 }\r
 497                         } else {\r
 498                                 // first possible StringBuilder Create.\r
 499                                 sb = new StringBuilder();\r
 500                                 sb.append('[');\r
 501                                 sb.append(ns);\r
 502                                 sb.append("] contains users");\r
 503                         }\r
 504                 }\r
 505 \r
 506                 // 2b) Find (or delete if forced flag is set) dependencies\r
 507                 // First, find if NS Perms are the only ones\r
 508                 Result<List<PermDAO.Data>> rpdc = q.permDAO.readNS(trans, ns);\r
 509                 if (rpdc.isOKhasData()) {\r
 510                         // Since there are now NS perms, we have to count NON-NS perms.\r
 511                         // FYI, if we delete them now, and the NS is not deleted, it is in\r
 512                         // an inconsistent state.\r
 513                         boolean nonaccess = false;\r
 514                         for (PermDAO.Data pdd : rpdc.value) {\r
 515                                 if (!"access".equals(pdd.type)) {\r
 516                                         nonaccess = true;\r
 517                                         break;\r
 518                                 }\r
 519                         }\r
 520                         if (nonaccess && !force && !move) {\r
 521                                 if (sb == null) {\r
 522                                         sb = new StringBuilder();\r
 523                                         sb.append('[');\r
 524                                         sb.append(ns);\r
 525                                         sb.append("] contains ");\r
 526                                 } else {\r
 527                                         sb.append(", ");\r
 528                                 }\r
 529                                 sb.append("permissions");\r
 530                         }\r
 531                 }\r
 532 \r
 533                 Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readNS(trans, ns);\r
 534                 if (rrdc.isOKhasData()) {\r
 535                         // Since there are now NS roles, we have to count NON-NS roles.\r
 536                         // FYI, if we delete th)em now, and the NS is not deleted, it is in\r
 537                         // an inconsistent state.\r
 538                         int count = rrdc.value.size();\r
 539                         for (RoleDAO.Data rdd : rrdc.value) {\r
 540                                 if ("admin".equals(rdd.name) || "owner".equals(rdd.name)) {\r
 541                                         --count;\r
 542                                 }\r
 543                         }\r
 544                         if (count > 0 && !force && !move) {\r
 545                                 if (sb == null) {\r
 546                                         sb = new StringBuilder();\r
 547                                         sb.append('[');\r
 548                                         sb.append(ns);\r
 549                                         sb.append("] contains ");\r
 550                                 } else {\r
 551                                         sb.append(", ");\r
 552                                 }\r
 553                                 sb.append("roles");\r
 554                         }\r
 555                 }\r
 556 \r
 557                 // 2c) Deny if dependencies exist that would be moved to root level\r
 558                 // parent is root level parent here. Need to find closest parent ns that\r
 559                 // exists\r
 560                 if (sb != null) {\r
 561                         if (!force && !move) {\r
 562                                 sb.append(".\n  Delete dependencies and try again.  Note: using \"force=true\" will delete all. \"force=move\" will delete Creds, but move Roles and Perms to parent.");\r
 563                                 return Result.err(Status.ERR_DependencyExists, sb.toString());\r
 564                         }\r
 565 \r
 566                         if (move && (parent == null || parent.type == NsType.COMPANY.type)) {\r
 567                                 return Result\r
 568                                                 .err(Status.ERR_DependencyExists,\r
 569                                                                 "Cannot move users, roles or permissions to [%s].\nDelete dependencies and try again",\r
 570                                                                 parent.name);\r
 571                         }\r
 572                 } else if (move && parent != null) {\r
 573                         sb = new StringBuilder();\r
 574                         // 3) Change any roles with children matching this NS, and\r
 575                         moveRoles(trans, parent, sb, rrdc);\r
 576                         // 4) Change any Perms with children matching this NS, and\r
 577                         movePerms(trans, parent, sb, rpdc);\r
 578                 }\r
 579 \r
 580                 if (sb != null && sb.length() > 0) {\r
 581                         return Result.err(Status.ERR_DependencyExists, sb.toString());\r
 582                 }\r
 583 \r
 584                 if (er.hasErr()) {\r
 585                         if (trans.debug().isLoggable()) {\r
 586                                 trans.debug().log(er.toString());\r
 587                         }\r
 588                         return Result.err(Status.ERR_DependencyExists,\r
 589                                         "Namespace members cannot be deleted for %s", ns);\r
 590                 }\r
 591 \r
 592                 // 5) OK... good to go for NS Deletion...\r
 593                 if (!rpdc.isEmpty()) {\r
 594                         for (PermDAO.Data perm : rpdc.value) {\r
 595                                 deletePerm(trans, perm, true, true);\r
 596                         }\r
 597                 }\r
 598                 if (!rrdc.isEmpty()) {\r
 599                         for (RoleDAO.Data role : rrdc.value) {\r
 600                                 deleteRole(trans, role, true, true);\r
 601                         }\r
 602                 }\r
 603 \r
 604                 return q.nsDAO.delete(trans, nsd, false);\r
 605         }\r
 606 \r
 607         public Result<List<String>> getOwners(AuthzTrans trans, String ns,\r
 608                         boolean includeExpired) {\r
 609                 return getUsersByRole(trans, ns + Question.DOT_OWNER, includeExpired);\r
 610         }\r
 611 \r
 612         private Result<Void> mayAddOwner(AuthzTrans trans, String ns, String id) {\r
 613                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);\r
 614                 if (rq.notOK()) {\r
 615                         return Result.err(rq);\r
 616                 }\r
 617 \r
 618                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);\r
 619                 if (rq.notOK()) {\r
 620                         return Result.err(rq);\r
 621                 }\r
 622 \r
 623                 Identity user;\r
 624                 Organization org = trans.org();\r
 625                 try {\r
 626                         if ((user = org.getIdentity(trans, id)) == null) {\r
 627                                 return Result.err(Status.ERR_Policy,\r
 628                                                 "%s reports that this is not a valid credential",\r
 629                                                 org.getName());\r
 630                         }\r
 631                         if (user.isResponsible()) {\r
 632                                 return Result.ok();\r
 633                         } else {\r
 634                                 String reason="This is not a Test Environment";\r
 635                                 if (org.isTestEnv() && (reason = org.validate(trans, Policy.AS_EMPLOYEE, \r
 636                                                 new CassExecutor(trans, this), id))==null) {\r
 637                                         return Result.ok();\r
 638                                 }\r
 639                                 return Result.err(Status.ERR_Policy,reason);\r
 640                         }\r
 641                 } catch (Exception e) {\r
 642                         return Result.err(e);\r
 643                 }\r
 644         }\r
 645 \r
 646         private Result<Void> mayAddAdmin(AuthzTrans trans, String ns,   String id) {\r
 647                 // Does NS Exist?\r
 648                 Result<Void> r = checkValidID(trans, new Date(), id);\r
 649                 if (r.notOK()) {\r
 650                         return r;\r
 651                 }\r
 652                 // Is id able to be an Admin\r
 653                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);\r
 654                 if (rq.notOK()) {\r
 655                         return Result.err(rq);\r
 656                 }\r
 657         \r
 658                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);\r
 659                 if (rq.notOK()) {\r
 660                         return Result.err(rq);\r
 661                 }\r
 662                 return r;\r
 663         }\r
 664 \r
 665         private Result<Void> checkValidID(AuthzTrans trans, Date now, String user) {\r
 666                 Organization org = trans.org();\r
 667                 if (user.endsWith(org.getRealm())) {\r
 668                         try {\r
 669                                 if (org.getIdentity(trans, user) == null) {\r
 670                                         return Result.err(Status.ERR_Denied,\r
 671                                                         "%s reports that %s is a faulty ID", org.getName(),\r
 672                                                         user);\r
 673                                 }\r
 674                                 return Result.ok();\r
 675                         } catch (Exception e) {\r
 676                                 return Result.err(Result.ERR_Security,\r
 677                                                 "%s is not a valid %s Credential", user, org.getName());\r
 678                         }\r
 679                 } else {\r
 680                         Result<List<CredDAO.Data>> cdr = q.credDAO.readID(trans, user);\r
 681                         if (cdr.notOKorIsEmpty()) {\r
 682                                 return Result.err(Status.ERR_Security,\r
 683                                                 "%s is not a valid AAF Credential", user);\r
 684                         }\r
 685         \r
 686                         for (CredDAO.Data cd : cdr.value) {\r
 687                                 if (cd.expires.after(now)) {\r
 688                                         return Result.ok();\r
 689                                 }\r
 690                         }\r
 691                 }\r
 692                 return Result.err(Result.ERR_Security, "%s has expired", user);\r
 693         }\r
 694 \r
 695         public Result<Void> delOwner(AuthzTrans trans, String ns, String id) {\r
 696                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);\r
 697                 if (rq.notOK()) {\r
 698                         return Result.err(rq);\r
 699                 }\r
 700 \r
 701                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);\r
 702                 if (rq.notOK()) {\r
 703                         return Result.err(rq);\r
 704                 }\r
 705 \r
 706                 return delUserRole(trans, id, ns,Question.OWNER);\r
 707         }\r
 708 \r
 709         public Result<List<String>> getAdmins(AuthzTrans trans, String ns, boolean includeExpired) {\r
 710                 return getUsersByRole(trans, ns + Question.DOT_ADMIN, includeExpired);\r
 711         }\r
 712 \r
 713         public Result<Void> delAdmin(AuthzTrans trans, String ns, String id) {\r
 714                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);\r
 715                 if (rq.notOK()) {\r
 716                         return Result.err(rq);\r
 717                 }\r
 718 \r
 719                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);\r
 720                 if (rq.notOK()) {\r
 721                         return Result.err(rq);\r
 722                 }\r
 723 \r
 724                 return delUserRole(trans, id, ns, Question.ADMIN);\r
 725         }\r
 726 \r
 727         /**\r
 728          * Helper function that moves permissions from a namespace being deleted to\r
 729          * its parent namespace\r
 730          * \r
 731          * @param trans\r
 732          * @param parent\r
 733          * @param sb\r
 734          * @param rpdc\r
 735          *            - list of permissions in namespace being deleted\r
 736          */\r
 737         private void movePerms(AuthzTrans trans, NsDAO.Data parent,\r
 738                         StringBuilder sb, Result<List<PermDAO.Data>> rpdc) {\r
 739 \r
 740                 Result<Void> rv;\r
 741                 Result<PermDAO.Data> pd;\r
 742 \r
 743                 if (rpdc.isOKhasData()) {\r
 744                         for (PermDAO.Data pdd : rpdc.value) {\r
 745                                 String delP2 = pdd.type;\r
 746                                 if ("access".equals(delP2)) {\r
 747                                     continue;\r
 748                                 }\r
 749                                 // Remove old Perm from Roles, save them off\r
 750                                 List<RoleDAO.Data> lrdd = new ArrayList<RoleDAO.Data>();\r
 751                                 \r
 752                                 for(String rl : pdd.roles(false)) {\r
 753                                         Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);\r
 754                                         if(rrdd.isOKhasData()) {\r
 755                                                 RoleDAO.Data rdd = rrdd.value;\r
 756                                                 lrdd.add(rdd);\r
 757                                                 q.roleDAO.delPerm(trans, rdd, pdd);\r
 758                                         } else{\r
 759                                                 trans.error().log(rrdd.errorString());\r
 760                                         }\r
 761                                 }\r
 762                                 \r
 763                                 // Save off Old keys\r
 764                                 String delP1 = pdd.ns;\r
 765                                 NsSplit nss = new NsSplit(parent, pdd.fullType());\r
 766                                 pdd.ns = nss.ns;\r
 767                                 pdd.type = nss.name;\r
 768                                 // Use direct Create/Delete, because switching namespaces\r
 769                                 if ((pd = q.permDAO.create(trans, pdd)).isOK()) {\r
 770                                         // Put Role back into Perm, with correct info\r
 771                                         for(RoleDAO.Data rdd : lrdd) {\r
 772                                                 q.roleDAO.addPerm(trans, rdd, pdd);\r
 773                                         }\r
 774 \r
 775                                         pdd.ns = delP1;\r
 776                                         pdd.type = delP2;\r
 777                                         if ((rv = q.permDAO.delete(trans, pdd, false)).notOK()) {\r
 778                                                 sb.append(rv.details);\r
 779                                                 sb.append('\n');\r
 780                                                 // } else {\r
 781                                                 // Need to invalidate directly, because we're switching\r
 782                                                 // places in NS, not normal cache behavior\r
 783                                                 // q.permDAO.invalidate(trans,pdd);\r
 784                                         }\r
 785                                 } else {\r
 786                                         sb.append(pd.details);\r
 787                                         sb.append('\n');\r
 788                                 }\r
 789                         }\r
 790                 }\r
 791         }\r
 792 \r
 793         /**\r
 794          * Helper function that moves roles from a namespace being deleted to its\r
 795          * parent namespace\r
 796          * \r
 797          * @param trans\r
 798          * @param parent\r
 799          * @param sb\r
 800          * @param rrdc\r
 801          *            - list of roles in namespace being deleted\r
 802          */\r
 803         private void moveRoles(AuthzTrans trans, NsDAO.Data parent,\r
 804                         StringBuilder sb, Result<List<RoleDAO.Data>> rrdc) {\r
 805 \r
 806                 Result<Void> rv;\r
 807                 Result<RoleDAO.Data> rd;\r
 808 \r
 809                 if (rrdc.isOKhasData()) {\r
 810                         for (RoleDAO.Data rdd : rrdc.value) {\r
 811                                 String delP2 = rdd.name;\r
 812                                 if ("admin".equals(delP2) || "owner".equals(delP2)) {\r
 813                                     continue;\r
 814                                 }\r
 815                                 // Remove old Role from Perms, save them off\r
 816                                 List<PermDAO.Data> lpdd = new ArrayList<PermDAO.Data>();\r
 817                                 for(String p : rdd.perms(false)) {\r
 818                                         Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);\r
 819                                         if(rpdd.isOKhasData()) {\r
 820                                                 PermDAO.Data pdd = rpdd.value;\r
 821                                                 lpdd.add(pdd);\r
 822                                                 q.permDAO.delRole(trans, pdd, rdd);\r
 823                                         } else{\r
 824                                                 trans.error().log(rpdd.errorString());\r
 825                                         }\r
 826                                 }\r
 827                                 \r
 828                                 // Save off Old keys\r
 829                                 String delP1 = rdd.ns;\r
 830 \r
 831                                 NsSplit nss = new NsSplit(parent, rdd.fullName());\r
 832                                 rdd.ns = nss.ns;\r
 833                                 rdd.name = nss.name;\r
 834                                 // Use direct Create/Delete, because switching namespaces\r
 835                                 if ((rd = q.roleDAO.create(trans, rdd)).isOK()) {\r
 836                                         // Put Role back into Perm, with correct info\r
 837                                         for(PermDAO.Data pdd : lpdd) {\r
 838                                                 q.permDAO.addRole(trans, pdd, rdd);\r
 839                                         }\r
 840 \r
 841                                         rdd.ns = delP1;\r
 842                                         rdd.name = delP2;\r
 843                                         if ((rv = q.roleDAO.delete(trans, rdd, true)).notOK()) {\r
 844                                                 sb.append(rv.details);\r
 845                                                 sb.append('\n');\r
 846                                                 // } else {\r
 847                                                 // Need to invalidate directly, because we're switching\r
 848                                                 // places in NS, not normal cache behavior\r
 849                                                 // q.roleDAO.invalidate(trans,rdd);\r
 850                                         }\r
 851                                 } else {\r
 852                                         sb.append(rd.details);\r
 853                                         sb.append('\n');\r
 854                                 }\r
 855                         }\r
 856                 }\r
 857         }\r
 858 \r
 859         /**\r
 860          * Create Permission (and any missing Permission between this and Parent) if\r
 861          * we have permission\r
 862          * \r
 863          * Pass in the desired Management Permission for this Permission\r
 864          * \r
 865          * If Force is set, then Roles listed will be created, if allowed,\r
 866          * pre-granted.\r
 867          */\r
 868         public Result<Void> createPerm(AuthzTrans trans, PermDAO.Data perm, boolean fromApproval) {\r
 869                 String user = trans.user();\r
 870                 // Next, see if User is allowed to Manage Parent Permission\r
 871 \r
 872                 Result<NsDAO.Data> rnsd;\r
 873                 if (!fromApproval) {\r
 874                         rnsd = q.mayUser(trans, user, perm, Access.write);\r
 875                         if (rnsd.notOK()) {\r
 876                                 return Result.err(rnsd);\r
 877                         }\r
 878                 } else {\r
 879                         rnsd = q.deriveNs(trans, perm.ns);\r
 880                 }\r
 881 \r
 882                 // Does Child exist?\r
 883                 if (!trans.forceRequested()) {\r
 884                         if (q.permDAO.read(trans, perm).isOKhasData()) {\r
 885                                 return Result.err(Status.ERR_ConflictAlreadyExists,\r
 886                                                 "Permission [%s.%s|%s|%s] already exists.", perm.ns,\r
 887                                                 perm.type, perm.instance, perm.action);\r
 888                         }\r
 889                 }\r
 890 \r
 891                 // Attempt to add perms to roles, creating as possible\r
 892                 Set<String> roles;\r
 893                 String pstring = perm.encode();\r
 894 \r
 895                 // For each Role\r
 896                 for (String role : roles = perm.roles(true)) {\r
 897                         Result<RoleDAO.Data> rdd = RoleDAO.Data.decode(trans,q,role);\r
 898                         if(rdd.isOKhasData()) {\r
 899                                 RoleDAO.Data rd = rdd.value;\r
 900                                 if (!fromApproval) {\r
 901                                         // May User write to the Role in question.\r
 902                                         Result<NsDAO.Data> rns = q.mayUser(trans, user, rd,\r
 903                                                         Access.write);\r
 904                                         if (rns.notOK()) {\r
 905                                                 // Remove the role from Add, because\r
 906                                                 roles.remove(role); // Don't allow adding\r
 907                                                 trans.warn()\r
 908                                                                 .log("User [%s] does not have permission to relate Permissions to Role [%s]",\r
 909                                                                                 user, role);\r
 910                                         }\r
 911                                 }\r
 912 \r
 913                                 Result<List<RoleDAO.Data>> rlrd;\r
 914                                 if ((rlrd = q.roleDAO.read(trans, rd)).notOKorIsEmpty()) {\r
 915                                         rd.perms(true).add(pstring);\r
 916                                         if (q.roleDAO.create(trans, rd).notOK()) {\r
 917                                                 roles.remove(role); // Role doesn't exist, and can't be\r
 918                                                                                         // created\r
 919                                         }\r
 920                                 } else {\r
 921                                         rd = rlrd.value.get(0);\r
 922                                         if (!rd.perms.contains(pstring)) {\r
 923                                                 q.roleDAO.addPerm(trans, rd, perm);\r
 924                                         }\r
 925                                 }\r
 926                         }\r
 927                 }\r
 928 \r
 929                 Result<PermDAO.Data> pdr = q.permDAO.create(trans, perm);\r
 930                 if (pdr.isOK()) {\r
 931                         return Result.ok();\r
 932                 } else { \r
 933                         return Result.err(pdr);\r
 934                 }\r
 935         }\r
 936 \r
 937         public Result<Void> deletePerm(final AuthzTrans trans, final PermDAO.Data perm, boolean force, boolean fromApproval) {\r
 938                 String user = trans.user();\r
 939 \r
 940                 // Next, see if User is allowed to Manage Permission\r
 941                 Result<NsDAO.Data> rnsd;\r
 942                 if (!fromApproval) {\r
 943                         rnsd = q.mayUser(trans, user, perm, Access.write);\r
 944                         if (rnsd.notOK()) {\r
 945                                 return Result.err(rnsd);\r
 946                         }\r
 947                 }\r
 948                 // Does Perm exist?\r
 949                 Result<List<PermDAO.Data>> pdr = q.permDAO.read(trans, perm);\r
 950                 if (pdr.notOKorIsEmpty()) {\r
 951                         return Result.err(Status.ERR_PermissionNotFound,"Permission [%s.%s|%s|%s] does not exist.",\r
 952                                         perm.ns,perm.type, perm.instance, perm.action);\r
 953                 }\r
 954                 // Get perm, but with rest of data.\r
 955                 PermDAO.Data fullperm = pdr.value.get(0);\r
 956 \r
 957                 // Attached to any Roles?\r
 958                 if (fullperm.roles != null) {\r
 959                         if (force) {\r
 960                                 for (String role : fullperm.roles) {\r
 961                                         Result<Void> rv = null;\r
 962                                         Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, q, role);\r
 963                                         if(rrdd.isOKhasData()) {\r
 964                                                 trans.debug().log("Removing", role, "from", fullperm, "on Perm Delete");\r
 965                                                 if ((rv = q.roleDAO.delPerm(trans, rrdd.value, fullperm)).notOK()) {\r
 966                                                         if (rv.notOK()) {\r
 967                                                                 trans.error().log("Error removing Role during delFromPermRole: ",\r
 968                                                                                                 trans.getUserPrincipal(),\r
 969                                                                                                 rv.errorString());\r
 970                                                         }\r
 971                                                 }\r
 972                                         } else {\r
 973                                                 return Result.err(rrdd);\r
 974                                         }\r
 975                                 }\r
 976                         } else if (!fullperm.roles.isEmpty()) {\r
 977                                 return Result\r
 978                                                 .err(Status.ERR_DependencyExists,\r
 979                                                                 "Permission [%s.%s|%s|%s] cannot be deleted as it is attached to 1 or more roles.",\r
 980                                                                 fullperm.ns, fullperm.type, fullperm.instance, fullperm.action);\r
 981                         }\r
 982                 }\r
 983 \r
 984                 return q.permDAO.delete(trans, fullperm, false);\r
 985         }\r
 986 \r
 987         public Result<Void> deleteRole(final AuthzTrans trans, final RoleDAO.Data role, boolean force, boolean fromApproval) {\r
 988                 String user = trans.user();\r
 989 \r
 990                 // Next, see if User is allowed to Manage Role\r
 991                 Result<NsDAO.Data> rnsd;\r
 992                 if (!fromApproval) {\r
 993                         rnsd = q.mayUser(trans, user, role, Access.write);\r
 994                         if (rnsd.notOK()) {\r
 995                                 return Result.err(rnsd);\r
 996                         }\r
 997                 }\r
 998 \r
 999                 // Are there any Users Attached to Role?\r
1000                 Result<List<UserRoleDAO.Data>> urdr = q.userRoleDAO.readByRole(trans,role.fullName());\r
1001                 if (force) {\r
1002                         if (urdr.isOKhasData()) {\r
1003                                 for (UserRoleDAO.Data urd : urdr.value) {\r
1004                                         q.userRoleDAO.delete(trans, urd, false);\r
1005                                 }\r
1006                         }\r
1007                 } else if (urdr.isOKhasData()) {\r
1008                         return Result.err(Status.ERR_DependencyExists,\r
1009                                                         "Role [%s.%s] cannot be deleted as it is used by 1 or more Users.",\r
1010                                                         role.ns, role.name);\r
1011                 }\r
1012 \r
1013                 // Does Role exist?\r
1014                 Result<List<RoleDAO.Data>> rdr = q.roleDAO.read(trans, role);\r
1015                 if (rdr.notOKorIsEmpty()) {\r
1016                         return Result.err(Status.ERR_RoleNotFound,\r
1017                                         "Role [%s.%s] does not exist", role.ns, role.name);\r
1018                 }\r
1019                 RoleDAO.Data fullrole = rdr.value.get(0); // full key search\r
1020 \r
1021                 // Remove Self from Permissions... always, force or not.  Force only applies to Dependencies (Users)\r
1022                 if (fullrole.perms != null) {\r
1023                         for (String perm : fullrole.perms(false)) {\r
1024                                 Result<PermDAO.Data> rpd = PermDAO.Data.decode(trans,q,perm);\r
1025                                 if (rpd.isOK()) {\r
1026                                         trans.debug().log("Removing", perm, "from", fullrole,"on Role Delete");\r
1027 \r
1028                                         Result<?> r = q.permDAO.delRole(trans, rpd.value, fullrole);\r
1029                                         if (r.notOK()) {\r
1030                                                 trans.error().log("ERR_FDR1 unable to remove",fullrole,"from",perm,':',r.status,'-',r.details);\r
1031                                         }\r
1032                                 } else {\r
1033                                         trans.error().log("ERR_FDR2 Could not remove",perm,"from",fullrole);\r
1034                                 }\r
1035                         }\r
1036                 }\r
1037                 return q.roleDAO.delete(trans, fullrole, false);\r
1038         }\r
1039 \r
1040         /**\r
1041          * Only owner of Permission may add to Role\r
1042          * \r
1043          * If force set, however, Role will be created before Grant, if User is\r
1044          * allowed to create.\r
1045          * \r
1046          * @param trans\r
1047          * @param role\r
1048          * @param pd\r
1049          * @return\r
1050          */\r
1051         public Result<Void> addPermToRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {\r
1052                 String user = trans.user();\r
1053                 \r
1054                 if (!fromApproval) {\r
1055                         Result<NsDAO.Data> rRoleCo = q.deriveFirstNsForType(trans, role.ns, NsType.COMPANY);\r
1056                         if(rRoleCo.notOK()) {\r
1057                                 return Result.err(rRoleCo);\r
1058                         }\r
1059                         Result<NsDAO.Data> rPermCo = q.deriveFirstNsForType(trans, pd.ns, NsType.COMPANY);\r
1060                         if(rPermCo.notOK()) {\r
1061                                 return Result.err(rPermCo);\r
1062                         }\r
1063 \r
1064                         // Not from same company\r
1065                         if(!rRoleCo.value.name.equals(rPermCo.value.name)) {\r
1066                                 Result<Data> r;\r
1067                                 // Only grant if User ALSO has Write ability in Other Company\r
1068                                 if((r = q.mayUser(trans, user, role, Access.write)).notOK()) {\r
1069                                         return Result.err(r);\r
1070                                 }\r
1071                         }\r
1072                         \r
1073 \r
1074                         // Must be Perm Admin, or Granted Special Permission\r
1075                         Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);\r
1076                         if (ucp.notOK()) {\r
1077                                 // Don't allow CLI potential Grantees to change their own AAF\r
1078                                 // Perms,\r
1079                                 if ((Define.ROOT_NS.equals(pd.ns) && Question.NS.equals(pd.type)) \r
1080                                                 || !q.isGranted(trans, trans.user(),Define.ROOT_NS,Question.PERM, rPermCo.value.name, "grant")) {\r
1081                                 // Not otherwise granted\r
1082                                 // TODO Needed?\r
1083                                         return Result.err(ucp);\r
1084                                 }\r
1085                                 // Final Check... Don't allow Grantees to add to Roles they are\r
1086                                 // part of\r
1087                                 Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO\r
1088                                                 .readByUser(trans, trans.user());\r
1089                                 if (rlurd.isOK()) {\r
1090                                         for (UserRoleDAO.Data ur : rlurd.value) {\r
1091                                                 if (role.ns.equals(ur.ns) && role.name.equals(ur.rname)) {\r
1092                                                         return Result.err(ucp);\r
1093                                                 }\r
1094                                         }\r
1095                                 }\r
1096                         }\r
1097                 }\r
1098 \r
1099                 Result<List<PermDAO.Data>> rlpd = q.permDAO.read(trans, pd);\r
1100                 if (rlpd.notOKorIsEmpty()) {\r
1101                         return Result.err(Status.ERR_PermissionNotFound,\r
1102                                         "Permission must exist to add to Role");\r
1103                 }\r
1104 \r
1105                 Result<List<RoleDAO.Data>> rlrd = q.roleDAO.read(trans, role); // Already\r
1106                                                                                                                                                 // Checked\r
1107                                                                                                                                                 // for\r
1108                                                                                                                                                 // can\r
1109                                                                                                                                                 // change\r
1110                                                                                                                                                 // Role\r
1111                 Result<Void> rv;\r
1112 \r
1113                 if (rlrd.notOKorIsEmpty()) {\r
1114                         if (trans.forceRequested()) {\r
1115                                 Result<NsDAO.Data> ucr = q.mayUser(trans, user, role,\r
1116                                                 Access.write);\r
1117                                 if (ucr.notOK()) {\r
1118                                     return Result\r
1119                                                 .err(Status.ERR_Denied,\r
1120                                                                 "Role [%s.%s] does not exist. User [%s] cannot create.",\r
1121                                                                 role.ns, role.name, user);\r
1122                                 }\r
1123 \r
1124                                 role.perms(true).add(pd.encode());\r
1125                                 Result<RoleDAO.Data> rdd = q.roleDAO.create(trans, role);\r
1126                                 if (rdd.isOK()) {\r
1127                                         rv = Result.ok();\r
1128                                 } else {\r
1129                                         rv = Result.err(rdd);\r
1130                                 }\r
1131                         } else {\r
1132                             return Result.err(Status.ERR_RoleNotFound,\r
1133                                         "Role [%s.%s] does not exist.", role.ns, role.name);\r
1134                         }\r
1135                 } else {\r
1136                         role = rlrd.value.get(0);\r
1137                         if (role.perms(false).contains(pd.encode())) {\r
1138                                 return Result.err(Status.ERR_ConflictAlreadyExists,\r
1139                                                                 "Permission [%s.%s] is already a member of role [%s,%s]",\r
1140                                                                 pd.ns, pd.type, role.ns, role.name);\r
1141                         }\r
1142                         role.perms(true).add(pd.encode()); // this is added for Caching\r
1143                                                                                                 // access purposes... doesn't\r
1144                                                                                                 // affect addPerm\r
1145                         rv = q.roleDAO.addPerm(trans, role, pd);\r
1146                 }\r
1147                 if (rv.status == Status.OK) {\r
1148                         return q.permDAO.addRole(trans, pd, role);\r
1149                         // exploring how to add information message to successful http\r
1150                         // request\r
1151                 }\r
1152                 return rv;\r
1153         }\r
1154 \r
1155         /**\r
1156          * Either Owner of Role or Permission may delete from Role\r
1157          * \r
1158          * @param trans\r
1159          * @param role\r
1160          * @param pd\r
1161          * @return\r
1162          */\r
1163         public Result<Void> delPermFromRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {\r
1164                 String user = trans.user();\r
1165                 if (!fromApproval) {\r
1166                         Result<NsDAO.Data> ucr = q.mayUser(trans, user, role, Access.write);\r
1167                         Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);\r
1168 \r
1169                         // If Can't change either Role or Perm, then deny\r
1170                         if (ucr.notOK() && ucp.notOK()) {\r
1171                                 return Result.err(Status.ERR_Denied,\r
1172                                                 "User [" + trans.user()\r
1173                                                                 + "] does not have permission to delete ["\r
1174                                                                 + pd.encode() + "] from Role ["\r
1175                                                                 + role.fullName() + ']');\r
1176                         }\r
1177                 }\r
1178 \r
1179                 Result<List<RoleDAO.Data>> rlr = q.roleDAO.read(trans, role);\r
1180                 if (rlr.notOKorIsEmpty()) {\r
1181                         // If Bad Data, clean out\r
1182                         Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd);\r
1183                         if (rlp.isOKhasData()) {\r
1184                                 for (PermDAO.Data pv : rlp.value) {\r
1185                                         q.permDAO.delRole(trans, pv, role);\r
1186                                 }\r
1187                         }\r
1188                         return Result.err(rlr);\r
1189                 }\r
1190                 String perm1 = pd.encode();\r
1191                 boolean notFound;\r
1192                 if (trans.forceRequested()) {\r
1193                         notFound = false;\r
1194                 } else { // only check if force not set.\r
1195                         notFound = true;\r
1196                         for (RoleDAO.Data r : rlr.value) {\r
1197                                 if (r.perms != null) {\r
1198                                         for (String perm : r.perms) {\r
1199                                                 if (perm1.equals(perm)) {\r
1200                                                         notFound = false;\r
1201                                                         break;\r
1202                                                 }\r
1203                                         }\r
1204                                         if(!notFound) {\r
1205                                                 break;\r
1206                                         }\r
1207                                 }\r
1208                         }\r
1209                 }\r
1210                 if (notFound) { // Need to check both, in case of corruption\r
1211                         return Result.err(Status.ERR_PermissionNotFound,\r
1212                                         "Permission [%s.%s|%s|%s] not associated with any Role",\r
1213                                         pd.ns,pd.type,pd.instance,pd.action);\r
1214                 }\r
1215 \r
1216                 // Read Perm for full data\r
1217                 Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd);\r
1218                 Result<Void> rv = null;\r
1219                 if (rlp.isOKhasData()) {\r
1220                         for (PermDAO.Data pv : rlp.value) {\r
1221                                 if ((rv = q.permDAO.delRole(trans, pv, role)).isOK()) {\r
1222                                         if ((rv = q.roleDAO.delPerm(trans, role, pv)).notOK()) {\r
1223                                                 trans.error().log(\r
1224                                                                 "Error removing Perm during delFromPermRole:",\r
1225                                                                 trans.getUserPrincipal(), rv.errorString());\r
1226                                         }\r
1227                                 } else {\r
1228                                         trans.error().log(\r
1229                                                         "Error removing Role during delFromPermRole:",\r
1230                                                         trans.getUserPrincipal(), rv.errorString());\r
1231                                 }\r
1232                         }\r
1233                 } else {\r
1234                         rv = q.roleDAO.delPerm(trans, role, pd);\r
1235                         if (rv.notOK()) {\r
1236                                 trans.error().log("Error removing Role during delFromPermRole",\r
1237                                                 rv.errorString());\r
1238                         }\r
1239                 }\r
1240                 return rv == null ? Result.ok() : rv;\r
1241         }\r
1242 \r
1243         public Result<Void> delPermFromRole(AuthzTrans trans, String role,PermDAO.Data pd) {\r
1244                 Result<NsSplit> nss = q.deriveNsSplit(trans, role);\r
1245                 if (nss.notOK()) {\r
1246                         return Result.err(nss);\r
1247                 }\r
1248                 RoleDAO.Data rd = new RoleDAO.Data();\r
1249                 rd.ns = nss.value.ns;\r
1250                 rd.name = nss.value.name;\r
1251                 return delPermFromRole(trans, rd, pd, false);\r
1252         }\r
1253 \r
1254         /**\r
1255          * Add a User to Role\r
1256          * \r
1257          * 1) Role must exist 2) User must be a known Credential (i.e. mechID ok if\r
1258          * Credential) or known Organizational User\r
1259          * \r
1260          * @param trans\r
1261          * @param org\r
1262          * @param urData\r
1263          * @return\r
1264          * @throws DAOException\r
1265          */\r
1266         public Result<Void> addUserRole(AuthzTrans trans,UserRoleDAO.Data urData) {\r
1267                 Result<Void> rv;\r
1268                 if(Question.ADMIN.equals(urData.rname)) {\r
1269                         rv = mayAddAdmin(trans, urData.ns, urData.user);\r
1270                 } else if(Question.OWNER.equals(urData.rname)) {\r
1271                         rv = mayAddOwner(trans, urData.ns, urData.user);\r
1272                 } else {\r
1273                         rv = checkValidID(trans, new Date(), urData.user);\r
1274                 }\r
1275                 if(rv.notOK()) {\r
1276                         return rv; \r
1277                 }\r
1278                 \r
1279                 // Check if record exists\r
1280                 if (q.userRoleDAO.read(trans, urData).isOKhasData()) {\r
1281                         return Result.err(Status.ERR_ConflictAlreadyExists,\r
1282                                         "User Role exists");\r
1283                 }\r
1284                 if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {\r
1285                         return Result.err(Status.ERR_RoleNotFound,\r
1286                                         "Role [%s.%s] does not exist", urData.ns, urData.rname);\r
1287                 }\r
1288 \r
1289                 urData.expires = trans.org().expiration(null, Expiration.UserInRole, urData.user).getTime();\r
1290                 \r
1291                 \r
1292                 Result<UserRoleDAO.Data> udr = q.userRoleDAO.create(trans, urData);\r
1293                 switch (udr.status) {\r
1294                 case OK:\r
1295                         return Result.ok();\r
1296                 default:\r
1297                         return Result.err(udr);\r
1298                 }\r
1299         }\r
1300 \r
1301         public Result<Void> addUserRole(AuthzTrans trans, String user, String ns, String rname) {\r
1302                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();\r
1303                 urdd.ns = ns;\r
1304                 urdd.role(ns, rname);\r
1305                 urdd.user = user;\r
1306                 return addUserRole(trans,urdd);\r
1307         }\r
1308 \r
1309         /**\r
1310          * Extend User Role.\r
1311          * \r
1312          * extend the Expiration data, according to Organization rules.\r
1313          * \r
1314          * @param trans\r
1315          * @param org\r
1316          * @param urData\r
1317          * @return\r
1318          */\r
1319         public Result<Void> extendUserRole(AuthzTrans trans, UserRoleDAO.Data urData, boolean checkForExist) {\r
1320                 // Check if record still exists\r
1321                 if (checkForExist && q.userRoleDAO.read(trans, urData).notOKorIsEmpty()) {\r
1322                         return Result.err(Status.ERR_UserRoleNotFound,\r
1323                                         "User Role does not exist");\r
1324                 }\r
1325                 if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {\r
1326                         return Result.err(Status.ERR_RoleNotFound,\r
1327                                         "Role [%s.%s] does not exist", urData.ns,urData.rname);\r
1328                 }\r
1329                 // Special case for "Admin" roles. Issue brought forward with Prod\r
1330                 // problem 9/26\r
1331 \r
1332                 urData.expires = trans.org().expiration(null, Expiration.UserInRole).getTime(); // get\r
1333                                                                                                                                                                 // Full\r
1334                                                                                                                                                                 // time\r
1335                                                                                                                                                                 // starting\r
1336                                                                                                                                                                 // today\r
1337                 return q.userRoleDAO.update(trans, urData);\r
1338         }\r
1339 \r
1340         // ////////////////////////////////////////////////////\r
1341         // Special User Role Functions\r
1342         // These exist, because User Roles have Expiration dates, which must be\r
1343         // accounted for\r
1344         // Also, as of July, 2015, Namespace Owners and Admins are now regular User\r
1345         // Roles\r
1346         // ////////////////////////////////////////////////////\r
1347         public Result<List<String>> getUsersByRole(AuthzTrans trans, String role, boolean includeExpired) {\r
1348                 Result<List<UserRoleDAO.Data>> rurdd = q.userRoleDAO.readByRole(trans,role);\r
1349                 if (rurdd.notOK()) {\r
1350                         return Result.err(rurdd);\r
1351                 }\r
1352                 Date now = new Date();\r
1353                 List<UserRoleDAO.Data> list = rurdd.value;\r
1354                 List<String> rv = new ArrayList<String>(list.size()); // presize\r
1355                 for (UserRoleDAO.Data urdd : rurdd.value) {\r
1356                         if (includeExpired || urdd.expires.after(now)) {\r
1357                                 rv.add(urdd.user);\r
1358                         }\r
1359                 }\r
1360                 return Result.ok(rv);\r
1361         }\r
1362 \r
1363         public Result<Void> delUserRole(AuthzTrans trans, String user, String ns, String rname) {\r
1364                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();\r
1365                 urdd.user = user;\r
1366                 urdd.role(ns,rname);\r
1367                 Result<List<UserRoleDAO.Data>> r = q.userRoleDAO.read(trans, urdd);\r
1368                 if (r.status == 404 || r.isEmpty()) {\r
1369                         return Result.err(Status.ERR_UserRoleNotFound,\r
1370                                         "UserRole [%s] [%s.%s]", user, ns, rname);\r
1371                 }\r
1372                 if (r.notOK()) {\r
1373                         return Result.err(r);\r
1374                 }\r
1375 \r
1376                 return q.userRoleDAO.delete(trans, urdd, false);\r
1377         }\r
1378 \r
1379         public Result<List<Identity>> createFuture(AuthzTrans trans, FutureDAO.Data data, String id, String user,\r
1380                         NsDAO.Data nsd, String op) {\r
1381                 // Create Future Object\r
1382                 List<Identity> approvers=null;\r
1383                 Result<FutureDAO.Data> fr = q.futureDAO.create(trans, data, id);\r
1384                 if (fr.isOK()) {\r
1385                         // User Future ID as ticket for Approvals\r
1386                         final UUID ticket = fr.value.id;\r
1387                         ApprovalDAO.Data ad;\r
1388                         try {\r
1389                                 Organization org = trans.org();\r
1390                                 approvers = org.getApprovers(trans, user);\r
1391                                 for (Identity u : approvers) {\r
1392                                         ad = new ApprovalDAO.Data();\r
1393                                         // Note ad.id is set by ApprovalDAO Create\r
1394                                         ad.ticket = ticket;\r
1395                                         ad.user = user;\r
1396                                         ad.approver = u.id();\r
1397                                         ad.status = ApprovalDAO.PENDING;\r
1398                                         ad.memo = data.memo;\r
1399                                         ad.type = org.getApproverType();\r
1400                                         ad.operation = op;\r
1401                                         // Note ad.updated is created in System\r
1402                                         Result<ApprovalDAO.Data> ar = q.approvalDAO.create(trans,ad);\r
1403                                         if (ar.notOK()) {\r
1404                                                 return Result.err(Status.ERR_ActionNotCompleted,\r
1405                                                                 "Approval for %s, %s could not be created: %s",\r
1406                                                                 ad.user, ad.approver, ar.details);\r
1407                                         }\r
1408                                 }\r
1409                                 if (nsd != null) {\r
1410                                         Result<List<UserRoleDAO.Data>> rrbr = q.userRoleDAO\r
1411                                                         .readByRole(trans, nsd.name + Question.DOT_OWNER);\r
1412                                         if (rrbr.isOK()) {\r
1413                                                 for (UserRoleDAO.Data urd : rrbr.value) {\r
1414                                                         ad = new ApprovalDAO.Data();\r
1415                                                         // Note ad.id is set by ApprovalDAO Create\r
1416                                                         ad.ticket = ticket;\r
1417                                                         ad.user = user;\r
1418                                                         ad.approver = urd.user;\r
1419                                                         ad.status = ApprovalDAO.PENDING;\r
1420                                                         ad.memo = data.memo;\r
1421                                                         ad.type = "owner";\r
1422                                                         ad.operation = op;\r
1423                                                         // Note ad.updated is created in System\r
1424                                                         Result<ApprovalDAO.Data> ar = q.approvalDAO.create(trans, ad);\r
1425                                                         if (ar.notOK()) {\r
1426                                                                 return Result.err(Status.ERR_ActionNotCompleted,\r
1427                                                                                                 "Approval for %s, %s could not be created: %s",\r
1428                                                                                                 ad.user, ad.approver,\r
1429                                                                                                 ar.details);\r
1430                                                         }\r
1431                                                 }\r
1432                                         }\r
1433                                 }\r
1434                         } catch (Exception e) {\r
1435                                 return Result.err(e);\r
1436                         }\r
1437                 }\r
1438                 \r
1439                 return Result.ok(approvers);\r
1440         }\r
1441 \r
1442         public Result<Void> performFutureOp(AuthzTrans trans, ApprovalDAO.Data cd) {\r
1443                 Result<List<FutureDAO.Data>> fd = q.futureDAO.read(trans, cd.ticket);\r
1444                 Result<List<ApprovalDAO.Data>> allApprovalsForTicket = q.approvalDAO\r
1445                                 .readByTicket(trans, cd.ticket);\r
1446                 Result<Void> rv = Result.ok();\r
1447                 for (FutureDAO.Data curr : fd.value) {\r
1448                         if ("approved".equalsIgnoreCase(cd.status)) {\r
1449                                 if (allApprovalsForTicket.value.size() <= 1) {\r
1450                                         // should check if any other pendings before performing\r
1451                                         // actions\r
1452                                         try {\r
1453                                                 if (FOP_ROLE.equalsIgnoreCase(curr.target)) {\r
1454                                                         RoleDAO.Data data = new RoleDAO.Data();\r
1455                                                         data.reconstitute(curr.construct);\r
1456                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1457                                                                 Result<RoleDAO.Data> rd;\r
1458                                                                 if ((rd = q.roleDAO.dao().create(trans, data)).notOK()) {\r
1459                                                                         rv = Result.err(rd);\r
1460                                                                 }\r
1461                                                         } else if ("D".equalsIgnoreCase(cd.operation)) {\r
1462                                                                 rv = deleteRole(trans, data, true, true);\r
1463                                                         }\r
1464         \r
1465                                                 } else if (FOP_PERM.equalsIgnoreCase(curr.target)) {\r
1466                                                         PermDAO.Data pdd = new PermDAO.Data();\r
1467                                                         pdd.reconstitute(curr.construct);\r
1468                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1469                                                                 rv = createPerm(trans, pdd, true);\r
1470                                                         } else if ("D".equalsIgnoreCase(cd.operation)) {\r
1471                                                                 rv = deletePerm(trans, pdd, true, true);\r
1472                                                         } else if ("G".equalsIgnoreCase(cd.operation)) {\r
1473                                                                 Set<String> roles = pdd.roles(true);\r
1474                                                                 Result<RoleDAO.Data> rrdd = null;\r
1475                                                                 for (String roleStr : roles) {\r
1476                                                                         rrdd = RoleDAO.Data.decode(trans, q, roleStr);\r
1477                                                                         if (rrdd.isOKhasData()) {\r
1478                                                                                 rv = addPermToRole(trans, rrdd.value, pdd, true);\r
1479                                                                         } else {\r
1480                                                                                 trans.error().log(rrdd.errorString());\r
1481                                                                         }\r
1482                                                                 }\r
1483                                                         } else if ("UG".equalsIgnoreCase(cd.operation)) {\r
1484                                                                 Set<String> roles = pdd.roles(true);\r
1485                                                                 Result<RoleDAO.Data> rrdd;\r
1486                                                                 for (String roleStr : roles) {\r
1487                                                                         rrdd = RoleDAO.Data.decode(trans, q, roleStr);\r
1488                                                                         if (rrdd.isOKhasData()) {\r
1489                                                                                 rv = delPermFromRole(trans, rrdd.value, pdd,    true);\r
1490                                                                         } else {\r
1491                                                                                 trans.error().log(rrdd.errorString());\r
1492                                                                         }\r
1493                                                                 }\r
1494                                                         }\r
1495         \r
1496                                                 } else if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {\r
1497                                                         UserRoleDAO.Data data = new UserRoleDAO.Data();\r
1498                                                         data.reconstitute(curr.construct);\r
1499                                                         // if I am the last to approve, create user role\r
1500                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1501                                                                 rv = addUserRole(trans, data);\r
1502                                                         } else if ("U".equals(cd.operation)) {\r
1503                                                                 rv = extendUserRole(trans, data, true);\r
1504                                                         }\r
1505         \r
1506                                                 } else if (FOP_NS.equalsIgnoreCase(curr.target)) {\r
1507                                                         Namespace namespace = new Namespace();\r
1508                                                         namespace.reconstitute(curr.construct);\r
1509         \r
1510                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1511                                                                 rv = createNS(trans, namespace, true);\r
1512                                                         }\r
1513         \r
1514                                                 } else if (FOP_DELEGATE.equalsIgnoreCase(curr.target)) {\r
1515                                                         DelegateDAO.Data data = new DelegateDAO.Data();\r
1516                                                         data.reconstitute(curr.construct);\r
1517                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1518                                                                 Result<DelegateDAO.Data> dd;\r
1519                                                                 if ((dd = q.delegateDAO.create(trans, data)).notOK()) {\r
1520                                                                         rv = Result.err(dd);\r
1521                                                                 }\r
1522                                                         } else if ("U".equalsIgnoreCase(cd.operation)) {\r
1523                                                                 rv = q.delegateDAO.update(trans, data);\r
1524                                                         }\r
1525                                                 } else if (FOP_CRED.equalsIgnoreCase(curr.target)) {\r
1526                                                         CredDAO.Data data = new CredDAO.Data();\r
1527                                                         data.reconstitute(curr.construct);\r
1528                                                         if ("C".equalsIgnoreCase(cd.operation)) {\r
1529                                                                 Result<CredDAO.Data> rd;\r
1530                                                                 if ((rd = q.credDAO.dao().create(trans, data)).notOK()) {\r
1531                                                                         rv = Result.err(rd);\r
1532                                                                 }\r
1533                                                         }\r
1534                                                 }\r
1535                                         } catch (IOException e) {\r
1536                                                 trans.error().log("IOException: ", e.getMessage(),\r
1537                                                                 " \n occurred while performing", cd.memo,\r
1538                                                                 " from approval ", cd.id.toString());\r
1539                                         }\r
1540                                 }\r
1541                         } else if ("denied".equalsIgnoreCase(cd.status)) {\r
1542                                 for (ApprovalDAO.Data ad : allApprovalsForTicket.value) {\r
1543                                     q.approvalDAO.delete(trans, ad, false);\r
1544                                 }\r
1545                                 q.futureDAO.delete(trans, curr, false);\r
1546                                 if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {\r
1547                                         // if I am the last to approve, create user role\r
1548                                         if ("U".equals(cd.operation)) {\r
1549                                                 UserRoleDAO.Data data = new UserRoleDAO.Data();\r
1550                                                 try {\r
1551                                                         data.reconstitute(curr.construct);\r
1552                                                 } catch (IOException e) {\r
1553                                                         trans.error().log("Cannot reconstitue",curr.memo);\r
1554                                                 }\r
1555                                                 rv = delUserRole(trans, data.user, data.ns, data.rname);\r
1556                                         }\r
1557                                 }\r
1558 \r
1559                         }\r
1560         \r
1561                         // if I am the last to approve, delete the future object\r
1562                         if (rv.isOK() && allApprovalsForTicket.value.size() <= 1) {\r
1563                                 q.futureDAO.delete(trans, curr, false);\r
1564                         }\r
1565         \r
1566                 } // end for each\r
1567                 return rv;\r
1568         \r
1569         }\r
1570 \r
1571         public Executor newExecutor(AuthzTrans trans) {\r
1572                 return new CassExecutor(trans, this);\r
1573         }\r
1574 \r
1575 }\r