auth/auth-cass/src/main/java/org/onap/aaf/auth/dao/hl/Function.java

   1 /**
   2  * ============LICENSE_START====================================================
   3  * org.onap.aaf
   4  * ===========================================================================
   5  * Copyright (c) 2018 AT&T Intellectual Property. All rights reserved.
   6  * ===========================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  * ============LICENSE_END====================================================
  19  *
  20  */
  21
  22 package org.onap.aaf.auth.dao.hl;
  23
  24 import static org.onap.aaf.auth.layer.Result.OK;
  25
  26 import java.io.IOException;
  27 import java.util.ArrayList;
  28 import java.util.Date;
  29 import java.util.GregorianCalendar;
  30 import java.util.HashSet;
  31 import java.util.List;
  32 import java.util.Set;
  33 import java.util.UUID;
  34
  35 import org.onap.aaf.auth.common.Define;
  36 import org.onap.aaf.auth.dao.DAOException;
  37 import org.onap.aaf.auth.dao.cass.ApprovalDAO;
  38 import org.onap.aaf.auth.dao.cass.CredDAO;
  39 import org.onap.aaf.auth.dao.cass.DelegateDAO;
  40 import org.onap.aaf.auth.dao.cass.FutureDAO;
  41 import org.onap.aaf.auth.dao.cass.Namespace;
  42 import org.onap.aaf.auth.dao.cass.NsDAO;
  43 import org.onap.aaf.auth.dao.cass.NsDAO.Data;
  44 import org.onap.aaf.auth.dao.cass.NsSplit;
  45 import org.onap.aaf.auth.dao.cass.NsType;
  46 import org.onap.aaf.auth.dao.cass.PermDAO;
  47 import org.onap.aaf.auth.dao.cass.RoleDAO;
  48 import org.onap.aaf.auth.dao.cass.Status;
  49 import org.onap.aaf.auth.dao.cass.UserRoleDAO;
  50 import org.onap.aaf.auth.dao.hl.Question.Access;
  51 import org.onap.aaf.auth.env.AuthzTrans;
  52 import org.onap.aaf.auth.env.AuthzTrans.REQD_TYPE;
  53 import org.onap.aaf.auth.layer.Result;
  54 import org.onap.aaf.auth.org.Executor;
  55 import org.onap.aaf.auth.org.Organization;
  56 import org.onap.aaf.auth.org.Organization.Expiration;
  57 import org.onap.aaf.auth.org.Organization.Identity;
  58 import org.onap.aaf.auth.org.Organization.Policy;
  59 import org.onap.aaf.auth.org.OrganizationException;
  60
  61 public class Function {
  62
  63         private static final String CANNOT_BE_THE_OWNER_OF_A_NAMESPACE = "%s(%s) cannot be the owner of the namespace '%s'. Owners %s.";
  64
  65         public enum FUTURE_OP {
  66                 C("Create"),U("Update"),D("Delete"),G("Grant"),UG("UnGrant"),A("Approval");
  67
  68                 private String desc;
  69
  70                 private FUTURE_OP(String desc) {
  71                         this.desc = desc;
  72                 }
  73
  74                 public String desc() {
  75                         return desc;
  76                 }
  77
  78                 /**
  79                  *  Same as valueOf(), but passes back null instead of throwing Exception
  80                  * @param value
  81                  * @return
  82                  */
  83                 public static FUTURE_OP toFO(String value) {
  84                         if(value!=null) {
  85                                 for(FUTURE_OP fo : values()) {
  86                                         if(fo.name().equals(value)){
  87                                                 return fo;
  88                                         }
  89                                 }
  90                         }
  91                         return null;
  92                 }
  93         }
  94
  95         public enum OP_STATUS {
  96                 E("Executed"),D("Denied"),P("Pending"),L("Lapsed");
  97
  98                 private String desc;
  99                 public final static Result<OP_STATUS> RE = Result.ok(OP_STATUS.E);
 100                 public final static Result<OP_STATUS> RD = Result.ok(OP_STATUS.D);
 101                 public final static Result<OP_STATUS> RP = Result.ok(OP_STATUS.P);
 102                 public final static Result<OP_STATUS> RL = Result.ok(OP_STATUS.L);
 103
 104                 private OP_STATUS(String desc) {
 105                         this.desc = desc;
 106                 }
 107
 108                 public String desc() {
 109                         return desc;
 110                 }
 111
 112         }
 113
 114         public static final String FOP_CRED = "cred";
 115         public static final String FOP_DELEGATE = "delegate";
 116         public static final String FOP_NS = "ns";
 117         public static final String FOP_PERM = "perm";
 118         public static final String FOP_ROLE = "role";
 119         public static final String FOP_USER_ROLE = "user_role";
 120         private static final List<Identity> NO_ADDL_APPROVE = new ArrayList<>();
 121         private static final String ROOT_NS = Define.ROOT_NS();
 122         // First Action should ALWAYS be "write", see "CreateRole"
 123         public final Question q;
 124
 125         public Function(AuthzTrans trans, Question question) {
 126                 q = question;
 127         }
 128
 129         private class ErrBuilder {
 130                 private StringBuilder sb;
 131                 private List<String> ao;
 132
 133                 public void log(Result<?> result) {
 134                         if (result.notOK()) {
 135                                 if (sb == null) {
 136                                         sb = new StringBuilder();
 137                                         ao = new ArrayList<>();
 138                                 }
 139                                 sb.append(result.details);
 140                                 sb.append('\n');
 141                                 for (String s : result.variables) {
 142                                         ao.add(s);
 143                                 }
 144                         }
 145                 }
 146
 147                 public String[] vars() {
 148                         String[] rv = new String[ao.size()];
 149                         ao.toArray(rv);
 150                         return rv;
 151                 }
 152
 153                 public boolean hasErr() {
 154                         return sb != null;
 155                 }
 156
 157                 @Override
 158                 public String toString() {
 159                         return sb == null ? "" : String.format(sb.toString(), ao);
 160                 }
 161         }
 162
 163         /**
 164          * createNS
 165          *
 166          * Create Namespace
 167          *
 168          * @param trans
 169          * @param org
 170          * @param ns
 171          * @param user
 172          * @return
 173          * @throws DAOException
 174          *
 175          *             To create an NS, you need to: 1) validate permission to
 176          *             modify parent NS 2) Does NS exist already? 3) Create NS with
 177          *             a) "user" as owner. NOTE: Per 10-15 request for AAF 1.0 4)
 178          *             Loop through Roles with Parent NS, and map any that start
 179          *             with this NS into this one 5) Loop through Perms with Parent
 180          *             NS, and map any that start with this NS into this one
 181          */
 182         public Result<Void> createNS(AuthzTrans trans, Namespace namespace, boolean fromApproval) {
 183                 Result<?> rq;
 184 //              if (namespace.name.endsWith(Question.DOT_ADMIN)
 185 //                              || namespace.name.endsWith(Question.DOT_OWNER)) {
 186 //                      return Result.err(Status.ERR_BadData,
 187 //                                      "'admin' and 'owner' are reserved names in AAF");
 188 //              }
 189
 190                 try {
 191                         for (String u : namespace.owner) {
 192                                 Organization org = trans.org();
 193                                 Identity orgUser = org.getIdentity(trans, u);
 194                                 String reason;
 195                                 if (orgUser == null) {
 196                                         return Result.err(Status.ERR_Policy,"%s is not a valid user at %s",u,org.getName());
 197                                 } else if((reason=orgUser.mayOwn())!=null) {
 198                                         if (org.isTestEnv()) {
 199                                                 String reason2;
 200                                                 if((reason2=org.validate(trans, Policy.AS_RESPONSIBLE,new CassExecutor(trans, this), u))!=null) { // can masquerade as responsible
 201                                                         trans.debug().log(reason2);
 202                                                         return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name,reason);
 203                                                 }
 204                                                 // a null means ok
 205                                         } else {
 206                                                 if(orgUser.isFound()) {
 207                                                         return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,orgUser.fullName(),orgUser.id(),namespace.name, reason);
 208                                                 } else {
 209                                                         return Result.err(Status.ERR_Policy,u + " is an invalid Identity");
 210                                                 }
 211                                         }
 212                                 }
 213                         }
 214                 } catch (Exception e) {
 215                         trans.error().log(e,
 216                                         "Could not contact Organization for User Validation");
 217                 }
 218
 219                 String user = trans.user();
 220                 // 1) May Change Parent?
 221                 int idx = namespace.name.lastIndexOf('.');
 222                 String parent;
 223                 if (idx < 0) {
 224                         if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "create")) {
 225                                 return Result.err(Result.ERR_Security,
 226                                                 "%s may not create Root Namespaces", user);
 227                         }
 228                         parent = null;
 229                         fromApproval = true;
 230                 } else {
 231                         parent = namespace.name.substring(0, idx); // get Parent String
 232                 }
 233
 234                 Result<NsDAO.Data> rparent = q.deriveNs(trans, parent);
 235                 if (rparent.notOK()) {
 236                         return Result.err(rparent);
 237                 }
 238                 if (!fromApproval) {
 239                         rparent = q.mayUser(trans, user, rparent.value, Access.write);
 240                         if (rparent.notOK()) {
 241                                 return Result.err(rparent);
 242                         }
 243                 }
 244                 parent = namespace.parent = rparent.value.name; // Correct Namespace from real data
 245
 246                 // 2) Does requested NS exist
 247                 if (q.nsDAO.read(trans, namespace.name).isOKhasData()) {
 248                         return Result.err(Status.ERR_ConflictAlreadyExists,
 249                                         "Target Namespace already exists");
 250                 }
 251
 252                 // Someone must be responsible.
 253                 if (namespace.owner == null || namespace.owner.isEmpty()) {
 254                         return Result
 255                                         .err(Status.ERR_Policy,
 256                                                         "Namespaces must be assigned at least one responsible party");
 257                 }
 258
 259                 // 3) Create NS
 260                 Date now = new Date();
 261
 262                 Result<Void> r;
 263                 // 3a) Admin
 264
 265                 try {
 266                         // Originally, added the enterer as Admin, but that's not necessary,
 267                         // or helpful for Operations folks..
 268                         // Admins can be empty, because they can be changed by lower level
 269                         // NSs
 270                         // if(ns.admin(false).isEmpty()) {
 271                         // ns.admin(true).add(user);
 272                         // }
 273                         if (namespace.admin != null) {
 274                                 for (String u : namespace.admin) {
 275                                         if ((r = checkValidID(trans, now, u)).notOK()) {
 276                                                 return r;
 277                                         }
 278                                 }
 279                         }
 280
 281                         // 3b) Responsible
 282                         Organization org = trans.org();
 283                         for (String u : namespace.owner) {
 284                                 Identity orgUser = org.getIdentity(trans, u);
 285                                 if (orgUser == null) {
 286                                         return Result
 287                                                         .err(Status.ERR_BadData,
 288                                                                         "NS must be created with an %s approved Responsible Party",
 289                                                                         org.getName());
 290                                 }
 291                         }
 292                 } catch (Exception e) {
 293                         return Result.err(Status.ERR_UserNotFound, e.getMessage());
 294                 }
 295
 296                 // VALIDATIONS done... Add NS
 297                 if ((rq = q.nsDAO.create(trans, namespace.data())).notOK()) {
 298                     return Result.err(rq);
 299                 }
 300
 301                 // Since Namespace is now created, we need to grab all subsequent errors
 302                 ErrBuilder eb = new ErrBuilder();
 303
 304                 // Add UserRole(s)
 305                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
 306                 urdd.expires = trans.org().expiration(null, Expiration.UserInRole).getTime();
 307                 urdd.role(namespace.name, Question.ADMIN);
 308                 for (String admin : namespace.admin) {
 309                         urdd.user = admin;
 310                         eb.log(q.userRoleDAO.create(trans, urdd));
 311                 }
 312                 urdd.role(namespace.name,Question.OWNER);
 313                 for (String owner : namespace.owner) {
 314                         urdd.user = owner;
 315                         eb.log(q.userRoleDAO.create(trans, urdd));
 316                 }
 317
 318                 addNSAdminRolesPerms(trans, eb, namespace.name);
 319
 320                 addNSOwnerRolesPerms(trans, eb, namespace.name);
 321
 322                 if (parent != null) {
 323                         // Build up with any errors
 324
 325                         String targetNs = rparent.value.name; // Get the Parent Namespace,
 326                                                                                                         // not target
 327                         String targetName = namespace.name.substring(targetNs.length() + 1); // Remove the Parent Namespace from the
 328                                                                         // Target + a dot, and you'll get the name
 329                         int targetNameDot = targetName.length() + 1;
 330
 331                         // 4) Change any roles with children matching this NS, and
 332                         Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readChildren(trans, targetNs, targetName);
 333                         if (rrdc.isOKhasData()) {
 334                                 for (RoleDAO.Data rdd : rrdc.value) {
 335                                         // Remove old Role from Perms, save them off
 336                                         List<PermDAO.Data> lpdd = new ArrayList<>();
 337                                         for(String p : rdd.perms(false)) {
 338                                                 Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);
 339                                                 if(rpdd.isOKhasData()) {
 340                                                         PermDAO.Data pdd = rpdd.value;
 341                                                         lpdd.add(pdd);
 342                                                         q.permDAO.delRole(trans, pdd, rdd);
 343                                                 } else{
 344                                                         trans.error().log(rpdd.errorString());
 345                                                 }
 346                                         }
 347
 348                                         // Save off Old keys
 349                                         String delP1 = rdd.ns;
 350                                         String delP2 = rdd.name;
 351
 352                                         // Write in new key
 353                                         rdd.ns = namespace.name;
 354                                         rdd.name = (delP2.length() > targetNameDot) ? delP2
 355                                                         .substring(targetNameDot) : "";
 356
 357                                         // Need to use non-cached, because switching namespaces, not
 358                                         // "create" per se
 359                                         if ((rq = q.roleDAO.create(trans, rdd)).isOK()) {
 360                                                 // Put Role back into Perm, with correct info
 361                                                 for(PermDAO.Data pdd : lpdd) {
 362                                                         q.permDAO.addRole(trans, pdd, rdd);
 363                                                 }
 364                                                 // Change data for User Roles
 365                                                 Result<List<UserRoleDAO.Data>> rurd = q.userRoleDAO.readByRole(trans, rdd.fullName());
 366                                                 if(rurd.isOKhasData()) {
 367                                                         for(UserRoleDAO.Data urd : rurd.value) {
 368                                                                 urd.ns = rdd.ns;
 369                                                                 urd.rname = rdd.name;
 370                                                                 q.userRoleDAO.update(trans, urd);
 371                                                         }
 372                                                 }
 373                                                 // Now delete old one
 374                                                 rdd.ns = delP1;
 375                                                 rdd.name = delP2;
 376                                                 if ((rq = q.roleDAO.delete(trans, rdd, false)).notOK()) {
 377                                                         eb.log(rq);
 378                                                 }
 379                                         } else {
 380                                                 eb.log(rq);
 381                                         }
 382                                 }
 383                         }
 384
 385                         // 4) Change any Permissions with children matching this NS, and
 386                         Result<List<PermDAO.Data>> rpdc = q.permDAO.readChildren(trans,targetNs, targetName);
 387                         if (rpdc.isOKhasData()) {
 388                                 for (PermDAO.Data pdd : rpdc.value) {
 389                                         // Remove old Perm from Roles, save them off
 390                                         List<RoleDAO.Data> lrdd = new ArrayList<>();
 391
 392                                         for(String rl : pdd.roles(false)) {
 393                                                 Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);
 394                                                 if(rrdd.isOKhasData()) {
 395                                                         RoleDAO.Data rdd = rrdd.value;
 396                                                         lrdd.add(rdd);
 397                                                         q.roleDAO.delPerm(trans, rdd, pdd);
 398                                                 } else{
 399                                                         trans.error().log(rrdd.errorString());
 400                                                 }
 401                                         }
 402
 403                                         // Save off Old keys
 404                                         String delP1 = pdd.ns;
 405                                         String delP2 = pdd.type;
 406                                         pdd.ns = namespace.name;
 407                                         pdd.type = (delP2.length() > targetNameDot) ? delP2
 408                                                         .substring(targetNameDot) : "";
 409                                         if ((rq = q.permDAO.create(trans, pdd)).isOK()) {
 410                                                 // Put Role back into Perm, with correct info
 411                                                 for(RoleDAO.Data rdd : lrdd) {
 412                                                         q.roleDAO.addPerm(trans, rdd, pdd);
 413                                                 }
 414
 415                                                 pdd.ns = delP1;
 416                                                 pdd.type = delP2;
 417                                                 if ((rq = q.permDAO.delete(trans, pdd, false)).notOK()) {
 418                                                         eb.log(rq);
 419                                                         // } else {
 420                                                         // Need to invalidate directly, because we're
 421                                                         // switching places in NS, not normal cache behavior
 422                                                         // q.permDAO.invalidate(trans,pdd);
 423                                                 }
 424                                         } else {
 425                                                 eb.log(rq);
 426                                         }
 427                                 }
 428                         }
 429                         if (eb.hasErr()) {
 430                                 return Result.err(Status.ERR_ActionNotCompleted,eb.sb.toString(), eb.vars());
 431                         }
 432                 }
 433                 return Result.ok();
 434         }
 435
 436         private void addNSAdminRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {
 437                 // Admin Role/Perm
 438                 RoleDAO.Data rd = new RoleDAO.Data();
 439                 rd.ns = ns;
 440                 rd.name = "admin";
 441                 rd.description = "AAF Namespace Administrators";
 442
 443                 PermDAO.Data pd = new PermDAO.Data();
 444                 pd.ns = ns;
 445                 pd.type = "access";
 446                 pd.instance = Question.ASTERIX;
 447                 pd.action = Question.ASTERIX;
 448                 pd.description = "AAF Namespace Write Access";
 449
 450                 rd.perms = new HashSet<>();
 451                 rd.perms.add(pd.encode());
 452                 eb.log(q.roleDAO.create(trans, rd));
 453
 454                 pd.roles = new HashSet<>();
 455                 pd.roles.add(rd.encode());
 456                 eb.log(q.permDAO.create(trans, pd));
 457         }
 458
 459         private void addNSOwnerRolesPerms(AuthzTrans trans, ErrBuilder eb, String ns) {
 460                 RoleDAO.Data rd = new RoleDAO.Data();
 461                 rd.ns = ns;
 462                 rd.name = "owner";
 463                 rd.description = "AAF Namespace Owners";
 464
 465                 PermDAO.Data pd = new PermDAO.Data();
 466                 pd.ns = ns;
 467                 pd.type = "access";
 468                 pd.instance = Question.ASTERIX;
 469                 pd.action = Question.READ;
 470                 pd.description = "AAF Namespace Read Access";
 471
 472                 rd.perms = new HashSet<>();
 473                 rd.perms.add(pd.encode());
 474                 eb.log(q.roleDAO.create(trans, rd));
 475
 476                 pd.roles = new HashSet<>();
 477                 pd.roles.add(rd.encode());
 478                 eb.log(q.permDAO.create(trans, pd));
 479         }
 480
 481         /**
 482          * deleteNS
 483          *
 484          * Delete Namespace
 485          *
 486          * @param trans
 487          * @param org
 488          * @param ns
 489          * @param force
 490          * @param user
 491          * @return
 492          * @throws DAOException
 493          *
 494          *
 495          *             To delete an NS, you need to: 1) validate permission to
 496          *             modify this NS 2) Find all Roles with this NS, and 2a) if
 497          *             Force, delete them, else modify to Parent NS 3) Find all
 498          *             Perms with this NS, and modify to Parent NS 3a) if Force,
 499          *             delete them, else modify to Parent NS 4) Find all IDs
 500          *             associated to this NS, and deny if exists. 5) Remove NS
 501          */
 502         public Result<Void> deleteNS(AuthzTrans trans, String ns) {
 503                 boolean force = trans.requested(REQD_TYPE.force);
 504                 boolean move = trans.requested(REQD_TYPE.move);
 505                 // 1) Validate
 506                 Result<List<NsDAO.Data>> nsl;
 507                 if ((nsl = q.nsDAO.read(trans, ns)).notOKorIsEmpty()) {
 508                         return Result.err(Status.ERR_NsNotFound, "%s does not exist", ns);
 509                 }
 510                 NsDAO.Data nsd = nsl.value.get(0);
 511                 NsType nt;
 512                 if (move && !q.canMove(nt = NsType.fromType(nsd.type))) {
 513                         return Result.err(Status.ERR_Denied, "Namespace Force=move not permitted for Type %s",nt.name());
 514                 }
 515
 516                 Result<NsDAO.Data> dnr = q.mayUser(trans, trans.user(), nsd, Access.write);
 517                 if (dnr.status != Status.OK) {
 518                         return Result.err(dnr);
 519                 }
 520
 521                 // 2) Find Parent
 522                 String user = trans.user();
 523                 int idx = ns.lastIndexOf('.');
 524                 NsDAO.Data parent;
 525                 if (idx < 0) {
 526                         if (!q.isGranted(trans, user, ROOT_NS,Question.NS, ".", "delete")) {
 527                                 return Result.err(Result.ERR_Security,
 528                                                 "%s may not delete Root Namespaces", user);
 529                         }
 530                         parent = null;
 531                 } else {
 532                         Result<NsDAO.Data> rlparent = q.deriveNs(trans, ns.substring(0, idx));
 533                         if (rlparent.notOKorIsEmpty()) {
 534                                 return Result.err(rlparent);
 535                         }
 536                         parent = rlparent.value;
 537                 }
 538
 539                 // Build up with any errors
 540                 // If sb != null below is an indication of error
 541                 StringBuilder sb = null;
 542                 ErrBuilder er = new ErrBuilder();
 543
 544                 // 2a) Deny if any IDs on Namespace
 545                 Result<List<CredDAO.Data>> creds = q.credDAO.readNS(trans, ns);
 546                 if (creds.isOKhasData()) {
 547                         if (force || move) {
 548                                 for (CredDAO.Data cd : creds.value) {
 549                                         er.log(q.credDAO.delete(trans, cd, false));
 550                                         // Since we're deleting all the creds, we should delete all
 551                                         // the user Roles for that Cred
 552                                         Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO
 553                                                         .readByUser(trans, cd.id);
 554                                         if (rlurd.isOK()) {
 555                                                 for (UserRoleDAO.Data data : rlurd.value) {
 556                                                     q.userRoleDAO.delete(trans, data, false);
 557                                                 }
 558                                         }
 559
 560                                 }
 561                         } else {
 562                                 // first possible StringBuilder Create.
 563                                 sb = new StringBuilder();
 564                                 sb.append('[');
 565                                 sb.append(ns);
 566                                 sb.append("] contains users");
 567                         }
 568                 }
 569
 570                 // 2b) Find (or delete if forced flag is set) dependencies
 571                 // First, find if NS Perms are the only ones
 572                 Result<List<PermDAO.Data>> rpdc = q.permDAO.readNS(trans, ns);
 573                 if (rpdc.isOKhasData()) {
 574                         // Since there are now NS perms, we have to count NON-NS perms.
 575                         // FYI, if we delete them now, and the NS is not deleted, it is in
 576                         // an inconsistent state.
 577                         boolean nonaccess = false;
 578                         for (PermDAO.Data pdd : rpdc.value) {
 579                                 if (!"access".equals(pdd.type)) {
 580                                         nonaccess = true;
 581                                         break;
 582                                 }
 583                         }
 584                         if (nonaccess && !force && !move) {
 585                                 if (sb == null) {
 586                                         sb = new StringBuilder();
 587                                         sb.append('[');
 588                                         sb.append(ns);
 589                                         sb.append("] contains ");
 590                                 } else {
 591                                         sb.append(", ");
 592                                 }
 593                                 sb.append("permissions");
 594                         }
 595                 }
 596
 597                 Result<List<RoleDAO.Data>> rrdc = q.roleDAO.readNS(trans, ns);
 598                 if (rrdc.isOKhasData()) {
 599                         // Since there are now NS roles, we have to count NON-NS roles.
 600                         // FYI, if we delete th)em now, and the NS is not deleted, it is in
 601                         // an inconsistent state.
 602                         int count = rrdc.value.size();
 603                         for (RoleDAO.Data rdd : rrdc.value) {
 604                                 if ("admin".equals(rdd.name) || "owner".equals(rdd.name)) {
 605                                         --count;
 606                                 }
 607                         }
 608                         if (count > 0 && !force && !move) {
 609                                 if (sb == null) {
 610                                         sb = new StringBuilder();
 611                                         sb.append('[');
 612                                         sb.append(ns);
 613                                         sb.append("] contains ");
 614                                 } else {
 615                                         sb.append(", ");
 616                                 }
 617                                 sb.append("roles");
 618                         }
 619                 }
 620
 621                 // 2c) Deny if dependencies exist that would be moved to root level
 622                 // parent is root level parent here. Need to find closest parent ns that
 623                 // exists
 624                 if (sb != null) {
 625                         if (!force && !move) {
 626                                 sb.append(".\n  Delete dependencies and try again.  Note: using \"force=true\" will delete all. \"force=move\" will delete Creds, but move Roles and Perms to parent.");
 627                                 return Result.err(Status.ERR_DependencyExists, sb.toString());
 628                         }
 629
 630                         if (move && (parent == null || parent.type == NsType.COMPANY.type)) {
 631                                 return Result
 632                                                 .err(Status.ERR_DependencyExists,
 633                                                                 "Cannot move users, roles or permissions to [%s].\nDelete dependencies and try again",
 634                                                                 parent.name);
 635                         }
 636                 } else if (move && parent != null) {
 637                         sb = new StringBuilder();
 638                         // 3) Change any roles with children matching this NS, and
 639                         moveRoles(trans, parent, sb, rrdc);
 640                         // 4) Change any Perms with children matching this NS, and
 641                         movePerms(trans, parent, sb, rpdc);
 642                 }
 643
 644                 if (sb != null && sb.length() > 0) {
 645                         return Result.err(Status.ERR_DependencyExists, sb.toString());
 646                 }
 647
 648                 if (er.hasErr()) {
 649                         if (trans.debug().isLoggable()) {
 650                                 trans.debug().log(er.toString());
 651                         }
 652                         return Result.err(Status.ERR_DependencyExists,
 653                                         "Namespace members cannot be deleted for %s", ns);
 654                 }
 655
 656                 // 5) OK... good to go for NS Deletion...
 657                 if (!rpdc.isEmpty()) {
 658                         for (PermDAO.Data perm : rpdc.value) {
 659                                 deletePerm(trans, perm, true, true);
 660                         }
 661                 }
 662                 if (!rrdc.isEmpty()) {
 663                         for (RoleDAO.Data role : rrdc.value) {
 664                                 deleteRole(trans, role, true, true);
 665                         }
 666                 }
 667
 668                 return q.nsDAO.delete(trans, nsd, false);
 669         }
 670
 671         public Result<List<String>> getOwners(AuthzTrans trans, String ns,
 672                         boolean includeExpired) {
 673                 return getUsersByRole(trans, ns + Question.DOT_OWNER, includeExpired);
 674         }
 675
 676         private Result<Void> mayAddOwner(AuthzTrans trans, String ns, String id) {
 677                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
 678                 if (rq.notOK()) {
 679                         return Result.err(rq);
 680                 }
 681
 682                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
 683                 if (rq.notOK()) {
 684                         return Result.err(rq);
 685                 }
 686
 687                 Identity user;
 688                 Organization org = trans.org();
 689                 try {
 690                         if ((user = org.getIdentity(trans, id)) == null) {
 691                                 return Result.err(Status.ERR_Policy,
 692                                                 "%s reports that this is not a valid credential",
 693                                                 org.getName());
 694                         }
 695                         String reason;
 696                         if ((reason=user.mayOwn())==null) {
 697                                 return Result.ok();
 698                         } else {
 699                                 if (org.isTestEnv()) {
 700                                         String reason2;
 701                                         if((reason2 = org.validate(trans, Policy.AS_RESPONSIBLE, new CassExecutor(trans, this), id))==null) {
 702                                                 return Result.ok();
 703                                         } else {
 704                                                 trans.debug().log(reason2);
 705                                         }
 706                                 }
 707                                 return Result.err(Status.ERR_Policy,CANNOT_BE_THE_OWNER_OF_A_NAMESPACE,user.fullName(),user.id(),ns, reason);
 708                         }
 709                 } catch (Exception e) {
 710                         return Result.err(e);
 711                 }
 712         }
 713
 714         private Result<Void> mayAddAdmin(AuthzTrans trans, String ns,   String id) {
 715                 // Does NS Exist?
 716                 Result<Void> r = checkValidID(trans, new Date(), id);
 717                 if (r.notOK()) {
 718                         return r;
 719                 }
 720                 // Is id able to be an Admin
 721                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
 722                 if (rq.notOK()) {
 723                         return Result.err(rq);
 724                 }
 725
 726                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
 727                 if (rq.notOK()) {
 728                         Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO.readUserInRole(trans, trans.user(),ns+".owner");
 729                         if(!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) {
 730                                 return Result.err(rq);
 731                         }
 732                 }
 733                 return r;
 734         }
 735
 736         private Result<Void> checkValidID(AuthzTrans trans, Date now, String user) {
 737                 Organization org = trans.org();
 738                 if (org.supportsRealm(user)) {
 739                         try {
 740                                 if (org.getIdentity(trans, user) == null) {
 741                                         return Result.err(Status.ERR_Denied,
 742                                                         "%s reports that %s is a faulty ID", org.getName(),
 743                                                         user);
 744                                 }
 745                                 return Result.ok();
 746                         } catch (Exception e) {
 747                                 return Result.err(Result.ERR_Security,
 748                                                 "%s is not a valid %s Credential", user, org.getName());
 749                         }
 750                 //TODO find out how to make sure good ALTERNATE OAUTH DOMAIN USER
 751 //              } else if(user.endsWith(ALTERNATE OAUTH DOMAIN)) {
 752 //                      return Result.ok();
 753                 } else {
 754                         Result<List<CredDAO.Data>> cdr = q.credDAO.readID(trans, user);
 755                         if (cdr.notOKorIsEmpty()) {
 756                                 return Result.err(Status.ERR_Security,
 757                                                 "%s is not a valid AAF Credential", user);
 758                         }
 759
 760                         for (CredDAO.Data cd : cdr.value) {
 761                                 if (cd.expires.after(now)) {
 762                                         return Result.ok();
 763                                 }
 764                         }
 765                 }
 766                 return Result.err(Result.ERR_Security, "%s has expired", user);
 767         }
 768
 769         public Result<Void> delOwner(AuthzTrans trans, String ns, String id) {
 770                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
 771                 if (rq.notOK()) {
 772                         return Result.err(rq);
 773                 }
 774
 775                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
 776                 if (rq.notOK()) {
 777                         return Result.err(rq);
 778                 }
 779
 780                 return delUserRole(trans, id, ns,Question.OWNER);
 781         }
 782
 783         public Result<List<String>> getAdmins(AuthzTrans trans, String ns, boolean includeExpired) {
 784                 return getUsersByRole(trans, ns + Question.DOT_ADMIN, includeExpired);
 785         }
 786
 787         public Result<Void> delAdmin(AuthzTrans trans, String ns, String id) {
 788                 Result<NsDAO.Data> rq = q.deriveNs(trans, ns);
 789                 if (rq.notOK()) {
 790                         return Result.err(rq);
 791                 }
 792
 793                 rq = q.mayUser(trans, trans.user(), rq.value, Access.write);
 794                 if (rq.notOK()) {
 795                         // Even though not a "writer", Owners still determine who gets to be an Admin
 796                         Result<List<UserRoleDAO.Data>> ruinr = q.userRoleDAO.readUserInRole(trans, trans.user(),ns+".owner");
 797                         if(!(ruinr.isOKhasData() && ruinr.value.get(0).expires.after(new Date()))) {
 798                                 return Result.err(rq);
 799                         }
 800                 }
 801
 802                 return delUserRole(trans, id, ns, Question.ADMIN);
 803         }
 804
 805         /**
 806          * Helper function that moves permissions from a namespace being deleted to
 807          * its parent namespace
 808          *
 809          * @param trans
 810          * @param parent
 811          * @param sb
 812          * @param rpdc
 813          *            - list of permissions in namespace being deleted
 814          */
 815         private void movePerms(AuthzTrans trans, NsDAO.Data parent,
 816                         StringBuilder sb, Result<List<PermDAO.Data>> rpdc) {
 817
 818                 Result<Void> rv;
 819                 Result<PermDAO.Data> pd;
 820
 821                 if (rpdc.isOKhasData()) {
 822                         for (PermDAO.Data pdd : rpdc.value) {
 823                                 String delP2 = pdd.type;
 824                                 if ("access".equals(delP2)) {
 825                                     continue;
 826                                 }
 827                                 // Remove old Perm from Roles, save them off
 828                                 List<RoleDAO.Data> lrdd = new ArrayList<>();
 829
 830                                 for(String rl : pdd.roles(false)) {
 831                                         Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans,q,rl);
 832                                         if(rrdd.isOKhasData()) {
 833                                                 RoleDAO.Data rdd = rrdd.value;
 834                                                 lrdd.add(rdd);
 835                                                 q.roleDAO.delPerm(trans, rdd, pdd);
 836                                         } else{
 837                                                 trans.error().log(rrdd.errorString());
 838                                         }
 839                                 }
 840
 841                                 // Save off Old keys
 842                                 String delP1 = pdd.ns;
 843                                 NsSplit nss = new NsSplit(parent, pdd.fullType());
 844                                 pdd.ns = nss.ns;
 845                                 pdd.type = nss.name;
 846                                 // Use direct Create/Delete, because switching namespaces
 847                                 if ((pd = q.permDAO.create(trans, pdd)).isOK()) {
 848                                         // Put Role back into Perm, with correct info
 849                                         for(RoleDAO.Data rdd : lrdd) {
 850                                                 q.roleDAO.addPerm(trans, rdd, pdd);
 851                                         }
 852
 853                                         pdd.ns = delP1;
 854                                         pdd.type = delP2;
 855                                         if ((rv = q.permDAO.delete(trans, pdd, false)).notOK()) {
 856                                                 sb.append(rv.details);
 857                                                 sb.append('\n');
 858                                                 // } else {
 859                                                 // Need to invalidate directly, because we're switching
 860                                                 // places in NS, not normal cache behavior
 861                                                 // q.permDAO.invalidate(trans,pdd);
 862                                         }
 863                                 } else {
 864                                         sb.append(pd.details);
 865                                         sb.append('\n');
 866                                 }
 867                         }
 868                 }
 869         }
 870
 871         /**
 872          * Helper function that moves roles from a namespace being deleted to its
 873          * parent namespace
 874          *
 875          * @param trans
 876          * @param parent
 877          * @param sb
 878          * @param rrdc
 879          *            - list of roles in namespace being deleted
 880          */
 881         private void moveRoles(AuthzTrans trans, NsDAO.Data parent,
 882                         StringBuilder sb, Result<List<RoleDAO.Data>> rrdc) {
 883
 884                 Result<Void> rv;
 885                 Result<RoleDAO.Data> rd;
 886
 887                 if (rrdc.isOKhasData()) {
 888                         for (RoleDAO.Data rdd : rrdc.value) {
 889                                 String delP2 = rdd.name;
 890                                 if ("admin".equals(delP2) || "owner".equals(delP2)) {
 891                                     continue;
 892                                 }
 893                                 // Remove old Role from Perms, save them off
 894                                 List<PermDAO.Data> lpdd = new ArrayList<>();
 895                                 for(String p : rdd.perms(false)) {
 896                                         Result<PermDAO.Data> rpdd = PermDAO.Data.decode(trans,q,p);
 897                                         if(rpdd.isOKhasData()) {
 898                                                 PermDAO.Data pdd = rpdd.value;
 899                                                 lpdd.add(pdd);
 900                                                 q.permDAO.delRole(trans, pdd, rdd);
 901                                         } else{
 902                                                 trans.error().log(rpdd.errorString());
 903                                         }
 904                                 }
 905
 906                                 // Save off Old keys
 907                                 String delP1 = rdd.ns;
 908
 909                                 NsSplit nss = new NsSplit(parent, rdd.fullName());
 910                                 rdd.ns = nss.ns;
 911                                 rdd.name = nss.name;
 912                                 // Use direct Create/Delete, because switching namespaces
 913                                 if ((rd = q.roleDAO.create(trans, rdd)).isOK()) {
 914                                         // Put Role back into Perm, with correct info
 915                                         for(PermDAO.Data pdd : lpdd) {
 916                                                 q.permDAO.addRole(trans, pdd, rdd);
 917                                         }
 918
 919                                         rdd.ns = delP1;
 920                                         rdd.name = delP2;
 921                                         if ((rv = q.roleDAO.delete(trans, rdd, true)).notOK()) {
 922                                                 sb.append(rv.details);
 923                                                 sb.append('\n');
 924                                                 // } else {
 925                                                 // Need to invalidate directly, because we're switching
 926                                                 // places in NS, not normal cache behavior
 927                                                 // q.roleDAO.invalidate(trans,rdd);
 928                                         }
 929                                 } else {
 930                                         sb.append(rd.details);
 931                                         sb.append('\n');
 932                                 }
 933                         }
 934                 }
 935         }
 936
 937         /**
 938          * Create Permission (and any missing Permission between this and Parent) if
 939          * we have permission
 940          *
 941          * Pass in the desired Management Permission for this Permission
 942          *
 943          * If Force is set, then Roles listed will be created, if allowed,
 944          * pre-granted.
 945          */
 946         public Result<Void> createPerm(AuthzTrans trans, PermDAO.Data perm, boolean fromApproval) {
 947                 String user = trans.user();
 948                 // Next, see if User is allowed to Manage Parent Permission
 949
 950                 Result<NsDAO.Data> rnsd;
 951                 if (!fromApproval) {
 952                         rnsd = q.mayUser(trans, user, perm, Access.write);
 953                         if (rnsd.notOK()) {
 954                                 return Result.err(rnsd);
 955                         }
 956                 } else {
 957                         rnsd = q.deriveNs(trans, perm.ns);
 958                 }
 959
 960                 // Does Child exist?
 961                 if (!trans.requested(REQD_TYPE.force)) {
 962                         if (q.permDAO.read(trans, perm).isOKhasData()) {
 963                                 return Result.err(Status.ERR_ConflictAlreadyExists,
 964                                                 "Permission [%s.%s|%s|%s] already exists.", perm.ns,
 965                                                 perm.type, perm.instance, perm.action);
 966                         }
 967                 }
 968
 969                 // Attempt to add perms to roles, creating as possible
 970                 Set<String> roles;
 971                 String pstring = perm.encode();
 972
 973                 // For each Role
 974                 for (String role : roles = perm.roles(true)) {
 975                         Result<RoleDAO.Data> rdd = RoleDAO.Data.decode(trans,q,role);
 976                         if(rdd.isOKhasData()) {
 977                                 RoleDAO.Data rd = rdd.value;
 978                                 if (!fromApproval) {
 979                                         // May User write to the Role in question.
 980                                         Result<NsDAO.Data> rns = q.mayUser(trans, user, rd,
 981                                                         Access.write);
 982                                         if (rns.notOK()) {
 983                                                 // Remove the role from Add, because
 984                                                 roles.remove(role); // Don't allow adding
 985                                                 trans.warn()
 986                                                                 .log("User [%s] does not have permission to relate Permissions to Role [%s]",
 987                                                                                 user, role);
 988                                         }
 989                                 }
 990
 991                                 Result<List<RoleDAO.Data>> rlrd;
 992                                 if ((rlrd = q.roleDAO.read(trans, rd)).notOKorIsEmpty()) {
 993                                         rd.perms(true).add(pstring);
 994                                         if (q.roleDAO.create(trans, rd).notOK()) {
 995                                                 roles.remove(role); // Role doesn't exist, and can't be
 996                                                                                         // created
 997                                         }
 998                                 } else {
 999                                         rd = rlrd.value.get(0);
1000                                         if (!rd.perms.contains(pstring)) {
1001                                                 q.roleDAO.addPerm(trans, rd, perm);
1002                                         }
1003                                 }
1004                         }
1005                 }
1006
1007                 Result<PermDAO.Data> pdr = q.permDAO.create(trans, perm);
1008                 if (pdr.isOK()) {
1009                         return Result.ok();
1010                 } else {
1011                         return Result.err(pdr);
1012                 }
1013         }
1014
1015         public Result<Void> deletePerm(final AuthzTrans trans, final PermDAO.Data perm, boolean force, boolean fromApproval) {
1016                 String user = trans.user();
1017
1018                 // Next, see if User is allowed to Manage Permission
1019                 Result<NsDAO.Data> rnsd;
1020                 if (!fromApproval) {
1021                         rnsd = q.mayUser(trans, user, perm, Access.write);
1022                         if (rnsd.notOK()) {
1023                                 return Result.err(rnsd);
1024                         }
1025                 }
1026                 // Does Perm exist?
1027                 Result<List<PermDAO.Data>> pdr = q.permDAO.read(trans, perm);
1028                 if (pdr.notOKorIsEmpty()) {
1029                         return Result.err(Status.ERR_PermissionNotFound,"Permission [%s.%s|%s|%s] does not exist.",
1030                                         perm.ns,perm.type, perm.instance, perm.action);
1031                 }
1032                 // Get perm, but with rest of data.
1033                 PermDAO.Data fullperm = pdr.value.get(0);
1034
1035                 // Attached to any Roles?
1036                 if (fullperm.roles != null) {
1037                         if (force) {
1038                                 for (String role : fullperm.roles) {
1039                                         Result<Void> rv = null;
1040                                         Result<RoleDAO.Data> rrdd = RoleDAO.Data.decode(trans, q, role);
1041                                         if(rrdd.isOKhasData()) {
1042                                                 trans.debug().log("Removing", role, "from", fullperm, "on Perm Delete");
1043                                                 if ((rv = q.roleDAO.delPerm(trans, rrdd.value, fullperm)).notOK()) {
1044                                                         if (rv.notOK()) {
1045                                                                 trans.error().log("Error removing Role during delFromPermRole: ",
1046                                                                                                 trans.getUserPrincipal(),
1047                                                                                                 rv.errorString());
1048                                                         }
1049                                                 }
1050                                         } else {
1051                                                 return Result.err(rrdd);
1052                                         }
1053                                 }
1054                         } else if (!fullperm.roles.isEmpty()) {
1055                                 return Result
1056                                                 .err(Status.ERR_DependencyExists,
1057                                                                 "Permission [%s.%s|%s|%s] cannot be deleted as it is attached to 1 or more roles.",
1058                                                                 fullperm.ns, fullperm.type, fullperm.instance, fullperm.action);
1059                         }
1060                 }
1061
1062                 return q.permDAO.delete(trans, fullperm, false);
1063         }
1064
1065         public Result<Void> deleteRole(final AuthzTrans trans, final RoleDAO.Data role, boolean force, boolean fromApproval) {
1066                 String user = trans.user();
1067
1068                 // Next, see if User is allowed to Manage Role
1069                 Result<NsDAO.Data> rnsd;
1070                 if (!fromApproval) {
1071                         rnsd = q.mayUser(trans, user, role, Access.write);
1072                         if (rnsd.notOK()) {
1073                                 return Result.err(rnsd);
1074                         }
1075                 }
1076
1077                 // Are there any Users Attached to Role?
1078                 Result<List<UserRoleDAO.Data>> urdr = q.userRoleDAO.readByRole(trans,role.fullName());
1079                 if (force) {
1080                         if (urdr.isOKhasData()) {
1081                                 for (UserRoleDAO.Data urd : urdr.value) {
1082                                         q.userRoleDAO.delete(trans, urd, false);
1083                                 }
1084                         }
1085                 } else if (urdr.isOKhasData()) {
1086                         return Result.err(Status.ERR_DependencyExists,
1087                                                         "Role [%s.%s] cannot be deleted as it is used by 1 or more Users.",
1088                                                         role.ns, role.name);
1089                 }
1090
1091                 // Does Role exist?
1092                 Result<List<RoleDAO.Data>> rdr = q.roleDAO.read(trans, role);
1093                 if (rdr.notOKorIsEmpty()) {
1094                         return Result.err(Status.ERR_RoleNotFound,
1095                                         "Role [%s.%s] does not exist", role.ns, role.name);
1096                 }
1097                 RoleDAO.Data fullrole = rdr.value.get(0); // full key search
1098
1099                 // Remove Self from Permissions... always, force or not.  Force only applies to Dependencies (Users)
1100                 if (fullrole.perms != null) {
1101                         for (String perm : fullrole.perms(false)) {
1102                                 Result<PermDAO.Data> rpd = PermDAO.Data.decode(trans,q,perm);
1103                                 if (rpd.isOK()) {
1104                                         trans.debug().log("Removing", perm, "from", fullrole,"on Role Delete");
1105
1106                                         Result<?> r = q.permDAO.delRole(trans, rpd.value, fullrole);
1107                                         if (r.notOK()) {
1108                                                 trans.error().log("ERR_FDR1 unable to remove",fullrole,"from",perm,':',r.status,'-',r.details);
1109                                         }
1110                                 } else {
1111                                         trans.error().log("ERR_FDR2 Could not remove",perm,"from",fullrole);
1112                                 }
1113                         }
1114                 }
1115                 return q.roleDAO.delete(trans, fullrole, false);
1116         }
1117
1118         /**
1119          * Only owner of Permission may add to Role
1120          *
1121          * If force set, however, Role will be created before Grant, if User is
1122          * allowed to create.
1123          *
1124          * @param trans
1125          * @param role
1126          * @param pd
1127          * @return
1128          */
1129         public Result<Void> addPermToRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {
1130                 String user = trans.user();
1131
1132                 if (!fromApproval) {
1133                         Result<NsDAO.Data> rRoleCo = q.deriveFirstNsForType(trans, role.ns, NsType.COMPANY);
1134                         if(rRoleCo.notOK()) {
1135                                 return Result.err(rRoleCo);
1136                         }
1137                         Result<NsDAO.Data> rPermCo = q.deriveFirstNsForType(trans, pd.ns, NsType.COMPANY);
1138                         if(rPermCo.notOK()) {
1139                                 return Result.err(rPermCo);
1140                         }
1141
1142                         // Not from same company
1143                         if(!rRoleCo.value.name.equals(rPermCo.value.name)) {
1144                                 Result<Data> r;
1145                                 // Only grant if User ALSO has Write ability in Other Company
1146                                 if((r = q.mayUser(trans, user, role, Access.write)).notOK()) {
1147                                         return Result.err(r);
1148                                 }
1149                         }
1150
1151
1152                         // Must be Perm Admin, or Granted Special Permission
1153                         Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);
1154                         if (ucp.notOK()) {
1155                                 // Don't allow CLI potential Grantees to change their own AAF
1156                                 // Perms,
1157                                 if ((ROOT_NS.equals(pd.ns) && Question.NS.equals(pd.type))
1158                                                 || !q.isGranted(trans, trans.user(),ROOT_NS,Question.PERM, rPermCo.value.name, "grant")) {
1159                                 // Not otherwise granted
1160                                 // TODO Needed?
1161                                         return Result.err(ucp);
1162                                 }
1163                                 // Final Check... Don't allow Grantees to add to Roles they are
1164                                 // part of
1165                                 Result<List<UserRoleDAO.Data>> rlurd = q.userRoleDAO
1166                                                 .readByUser(trans, trans.user());
1167                                 if (rlurd.isOK()) {
1168                                         for (UserRoleDAO.Data ur : rlurd.value) {
1169                                                 if (role.ns.equals(ur.ns) && role.name.equals(ur.rname)) {
1170                                                         return Result.err(ucp);
1171                                                 }
1172                                         }
1173                                 }
1174                         }
1175                 }
1176
1177                 Result<List<PermDAO.Data>> rlpd = q.permDAO.read(trans, pd);
1178                 if (rlpd.notOKorIsEmpty()) {
1179                         return Result.err(Status.ERR_PermissionNotFound,
1180                                         "Permission must exist to add to Role");
1181                 }
1182
1183                 Result<List<RoleDAO.Data>> rlrd = q.roleDAO.read(trans, role); // Already
1184                                                                                                                                                 // Checked
1185                                                                                                                                                 // for
1186                                                                                                                                                 // can
1187                                                                                                                                                 // change
1188                                                                                                                                                 // Role
1189                 Result<Void> rv;
1190
1191                 if (rlrd.notOKorIsEmpty()) {
1192                         if (trans.requested(REQD_TYPE.force)) {
1193                                 Result<NsDAO.Data> ucr = q.mayUser(trans, user, role,
1194                                                 Access.write);
1195                                 if (ucr.notOK()) {
1196                                     return Result
1197                                                 .err(Status.ERR_Denied,
1198                                                                 "Role [%s.%s] does not exist. User [%s] cannot create.",
1199                                                                 role.ns, role.name, user);
1200                                 }
1201
1202                                 role.perms(true).add(pd.encode());
1203                                 Result<RoleDAO.Data> rdd = q.roleDAO.create(trans, role);
1204                                 if (rdd.isOK()) {
1205                                         rv = Result.ok();
1206                                 } else {
1207                                         rv = Result.err(rdd);
1208                                 }
1209                         } else {
1210                             return Result.err(Status.ERR_RoleNotFound,
1211                                         "Role [%s.%s] does not exist.", role.ns, role.name);
1212                         }
1213                 } else {
1214                         role = rlrd.value.get(0);
1215                         if (role.perms(false).contains(pd.encode())) {
1216                                 return Result.err(Status.ERR_ConflictAlreadyExists,
1217                                                                 "Permission [%s.%s] is already a member of role [%s,%s]",
1218                                                                 pd.ns, pd.type, role.ns, role.name);
1219                         }
1220                         role.perms(true).add(pd.encode()); // this is added for Caching
1221                                                                                                 // access purposes... doesn't
1222                                                                                                 // affect addPerm
1223                         rv = q.roleDAO.addPerm(trans, role, pd);
1224                 }
1225                 if (rv.status == Status.OK) {
1226                         return q.permDAO.addRole(trans, pd, role);
1227                         // exploring how to add information message to successful http
1228                         // request
1229                 }
1230                 return rv;
1231         }
1232
1233         /**
1234          * Either Owner of Role or Permission may delete from Role
1235          *
1236          * @param trans
1237          * @param role
1238          * @param pd
1239          * @return
1240          */
1241         public Result<Void> delPermFromRole(AuthzTrans trans, RoleDAO.Data role,PermDAO.Data pd, boolean fromApproval) {
1242                 String user = trans.user();
1243                 if (!fromApproval) {
1244                         Result<NsDAO.Data> ucr = q.mayUser(trans, user, role, Access.write);
1245                         Result<NsDAO.Data> ucp = q.mayUser(trans, user, pd, Access.write);
1246
1247                         // If Can't change either Role or Perm, then deny
1248                         if (ucr.notOK() && ucp.notOK()) {
1249                                 return Result.err(Status.ERR_Denied,
1250                                                 "User [" + trans.user()
1251                                                                 + "] does not have permission to delete ["
1252                                                                 + pd.encode() + "] from Role ["
1253                                                                 + role.fullName() + ']');
1254                         }
1255                 }
1256
1257                 Result<List<RoleDAO.Data>> rlr = q.roleDAO.read(trans, role);
1258                 if (rlr.notOKorIsEmpty()) {
1259                         // If Bad Data, clean out
1260                         Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd);
1261                         if (rlp.isOKhasData()) {
1262                                 for (PermDAO.Data pv : rlp.value) {
1263                                         q.permDAO.delRole(trans, pv, role);
1264                                 }
1265                         }
1266                         return Result.err(rlr);
1267                 }
1268                 String perm1 = pd.encode();
1269                 boolean notFound;
1270                 if (trans.requested(REQD_TYPE.force)) {
1271                         notFound = false;
1272                 } else { // only check if force not set.
1273                         notFound = true;
1274                         for (RoleDAO.Data r : rlr.value) {
1275                                 if (r.perms != null) {
1276                                         for (String perm : r.perms) {
1277                                                 if (perm1.equals(perm)) {
1278                                                         notFound = false;
1279                                                         break;
1280                                                 }
1281                                         }
1282                                         if(!notFound) {
1283                                                 break;
1284                                         }
1285                                 }
1286                         }
1287                 }
1288                 if (notFound) { // Need to check both, in case of corruption
1289                         return Result.err(Status.ERR_PermissionNotFound,
1290                                         "Permission [%s.%s|%s|%s] not associated with any Role",
1291                                         pd.ns,pd.type,pd.instance,pd.action);
1292                 }
1293
1294                 // Read Perm for full data
1295                 Result<List<PermDAO.Data>> rlp = q.permDAO.read(trans, pd);
1296                 Result<Void> rv = null;
1297                 if (rlp.isOKhasData()) {
1298                         for (PermDAO.Data pv : rlp.value) {
1299                                 if ((rv = q.permDAO.delRole(trans, pv, role)).isOK()) {
1300                                         if ((rv = q.roleDAO.delPerm(trans, role, pv)).notOK()) {
1301                                                 trans.error().log(
1302                                                                 "Error removing Perm during delFromPermRole:",
1303                                                                 trans.getUserPrincipal(), rv.errorString());
1304                                         }
1305                                 } else {
1306                                         trans.error().log(
1307                                                         "Error removing Role during delFromPermRole:",
1308                                                         trans.getUserPrincipal(), rv.errorString());
1309                                 }
1310                         }
1311                 } else {
1312                         rv = q.roleDAO.delPerm(trans, role, pd);
1313                         if (rv.notOK()) {
1314                                 trans.error().log("Error removing Role during delFromPermRole",
1315                                                 rv.errorString());
1316                         }
1317                 }
1318                 return rv == null ? Result.ok() : rv;
1319         }
1320
1321         public Result<Void> delPermFromRole(AuthzTrans trans, String role,PermDAO.Data pd) {
1322                 Result<NsSplit> nss = q.deriveNsSplit(trans, role);
1323                 if (nss.notOK()) {
1324                         return Result.err(nss);
1325                 }
1326                 RoleDAO.Data rd = new RoleDAO.Data();
1327                 rd.ns = nss.value.ns;
1328                 rd.name = nss.value.name;
1329                 return delPermFromRole(trans, rd, pd, false);
1330         }
1331
1332         /**
1333          * Add a User to Role
1334          *
1335          * 1) Role must exist 2) User must be a known Credential (i.e. mechID ok if
1336          * Credential) or known Organizational User
1337          *
1338          * @param trans
1339          * @param org
1340          * @param urData
1341          * @return
1342          * @throws DAOException
1343          */
1344         public Result<Void> addUserRole(AuthzTrans trans,UserRoleDAO.Data urData) {
1345                 Result<Void> rv;
1346                 if(Question.ADMIN.equals(urData.rname)) {
1347                         rv = mayAddAdmin(trans, urData.ns, urData.user);
1348                 } else if(Question.OWNER.equals(urData.rname)) {
1349                         rv = mayAddOwner(trans, urData.ns, urData.user);
1350                 } else {
1351                         rv = checkValidID(trans, new Date(), urData.user);
1352                 }
1353                 if(rv.notOK()) {
1354                         return rv;
1355                 }
1356
1357                 // Check if record exists
1358                 if (q.userRoleDAO.read(trans, urData).isOKhasData()) {
1359                         return Result.err(Status.ERR_ConflictAlreadyExists,
1360                                         "User Role exists");
1361                 }
1362                 if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {
1363                         return Result.err(Status.ERR_RoleNotFound,
1364                                         "Role [%s.%s] does not exist", urData.ns, urData.rname);
1365                 }
1366
1367                 urData.expires = trans.org().expiration(null, Expiration.UserInRole, urData.user).getTime();
1368
1369
1370                 Result<UserRoleDAO.Data> udr = q.userRoleDAO.create(trans, urData);
1371                 switch (udr.status) {
1372                 case OK:
1373                         return Result.ok();
1374                 default:
1375                         return Result.err(udr);
1376                 }
1377         }
1378
1379         public Result<Void> addUserRole(AuthzTrans trans, String user, String ns, String rname) {
1380                 try {
1381                         if(trans.org().getIdentity(trans, user)==null) {
1382                                 return Result.err(Result.ERR_BadData,user+" is an Invalid Identity for " + trans.org().getName());
1383                         }
1384                 } catch (OrganizationException e) {
1385                         return Result.err(e);
1386                 }
1387                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
1388                 urdd.ns = ns;
1389                 urdd.role(ns, rname);
1390                 urdd.user = user;
1391                 return addUserRole(trans,urdd);
1392         }
1393
1394         /**
1395          * Extend User Role.
1396          *
1397          * extend the Expiration data, according to Organization rules.
1398          *
1399          * @param trans
1400          * @param org
1401          * @param urData
1402          * @return
1403          */
1404         public Result<Void> extendUserRole(AuthzTrans trans, UserRoleDAO.Data urData, boolean checkForExist) {
1405                 // Check if record still exists
1406                 if (checkForExist && q.userRoleDAO.read(trans, urData).notOKorIsEmpty()) {
1407                         return Result.err(Status.ERR_UserRoleNotFound,
1408                                         "User Role does not exist");
1409                 }
1410
1411                 if (q.roleDAO.read(trans, urData.ns, urData.rname).notOKorIsEmpty()) {
1412                         return Result.err(Status.ERR_RoleNotFound,
1413                                         "Role [%s.%s] does not exist", urData.ns,urData.rname);
1414                 }
1415                 // Special case for "Admin" roles. Issue brought forward with Prod
1416                 // problem 9/26
1417                 Date now = new Date();
1418                 GregorianCalendar gc = new GregorianCalendar();
1419                 gc.setTime(now.after(urData.expires)?now:urData.expires);
1420                 urData.expires = trans.org().expiration(gc, Expiration.UserInRole).getTime(); // get
1421                                                                                                                                                                 // Full
1422                                                                                                                                                                 // time
1423                                                                                                                                                                 // starting
1424                                                                                                                                                                 // today
1425                 return q.userRoleDAO.update(trans, urData);
1426         }
1427
1428         // ////////////////////////////////////////////////////
1429         // Special User Role Functions
1430         // These exist, because User Roles have Expiration dates, which must be
1431         // accounted for
1432         // Also, as of July, 2015, Namespace Owners and Admins are now regular User
1433         // Roles
1434         // ////////////////////////////////////////////////////
1435         public Result<List<String>> getUsersByRole(AuthzTrans trans, String role, boolean includeExpired) {
1436                 Result<List<UserRoleDAO.Data>> rurdd = q.userRoleDAO.readByRole(trans,role);
1437                 if (rurdd.notOK()) {
1438                         return Result.err(rurdd);
1439                 }
1440                 Date now = new Date();
1441                 List<UserRoleDAO.Data> list = rurdd.value;
1442                 List<String> rv = new ArrayList<>(list.size()); // presize
1443                 for (UserRoleDAO.Data urdd : rurdd.value) {
1444                         if (includeExpired || urdd.expires.after(now)) {
1445                                 rv.add(urdd.user);
1446                         }
1447                 }
1448                 return Result.ok(rv);
1449         }
1450
1451         public Result<Void> delUserRole(AuthzTrans trans, String user, String ns, String rname) {
1452                 UserRoleDAO.Data urdd = new UserRoleDAO.Data();
1453                 urdd.user = user;
1454                 urdd.role(ns,rname);
1455                 Result<List<UserRoleDAO.Data>> r = q.userRoleDAO.read(trans, urdd);
1456                 if (r.status == 404 || r.isEmpty()) {
1457                         return Result.err(Status.ERR_UserRoleNotFound,
1458                                         "UserRole [%s] [%s.%s]", user, ns, rname);
1459                 }
1460                 if (r.notOK()) {
1461                         return Result.err(r);
1462                 }
1463
1464                 return q.userRoleDAO.delete(trans, urdd, false);
1465         }
1466
1467         public Result<String> createFuture(AuthzTrans trans, FutureDAO.Data data, String id, String user,
1468                         NsDAO.Data nsd, FUTURE_OP op) {
1469                 StringBuilder sb = new StringBuilder();
1470                 try {
1471                         Organization org = trans.org();
1472                         // For Reapproval, only check Owners.. Do Supervisors, etc, separately
1473                         List<Identity> approvers = op.equals(FUTURE_OP.A)?NO_ADDL_APPROVE:org.getApprovers(trans, user);
1474                         List<Identity> owners = new ArrayList<>();
1475                         if (nsd != null) {
1476                                 Result<List<UserRoleDAO.Data>> rrbr = q.userRoleDAO
1477                                                 .readByRole(trans, nsd.name + Question.DOT_OWNER);
1478                                 if (rrbr.isOKhasData()) {
1479                                         for(UserRoleDAO.Data urd : rrbr.value) {
1480                                                 Identity owner = org.getIdentity(trans, urd.user);
1481                                                 if(owner==null) {
1482                                                         return Result.err(Result.ERR_NotFound,urd.user + " is not a Valid Owner of " + nsd.name);
1483                                                 } else {
1484                                                         owners.add(owner);
1485                                                 }
1486                                         }
1487                                 }
1488                         }
1489
1490                         if(owners.isEmpty()) {
1491                                 return Result.err(Result.ERR_NotFound,"No Owners found for " + nsd.name);
1492                         }
1493
1494                         // Create Future Object
1495
1496                         Result<FutureDAO.Data> fr = q.futureDAO.create(trans, data, id);
1497                         if (fr.isOK()) {
1498                                 sb.append("Created Future: ");
1499                                 sb.append(data.id);
1500                                 // User Future ID as ticket for Approvals
1501                                 final UUID ticket = fr.value.id;
1502                                 sb.append(", Approvals: ");
1503                                 Boolean first[] = new Boolean[]{true};
1504                                 if(op!=FUTURE_OP.A) {
1505                                         for (Identity u : approvers) {
1506                                                 Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,org.getApproverType());
1507                                                 if(r.notOK()) {
1508                                                         return Result.err(r);
1509                                                 }
1510                                         }
1511                                 }
1512                                 for (Identity u : owners) {
1513                                         Result<ApprovalDAO.Data> r = addIdentity(trans,sb,first,user,data.memo,op,u,ticket,"owner");
1514                                         if(r.notOK()) {
1515                                                 return Result.err(r);
1516                                         }
1517                                 }
1518                         }
1519                 } catch (Exception e) {
1520                         return Result.err(e);
1521                 }
1522
1523                 return Result.ok(sb.toString());
1524         }
1525
1526         /*
1527          * This interface is to allow performFutureOps with either Realtime Data, or Batched lookups (See Expiring)
1528          */
1529         public interface Lookup<T> {
1530                 T get(AuthzTrans trans, Object ... keys);
1531         }
1532
1533         public Lookup<UserRoleDAO.Data> urDBLookup = new Lookup<UserRoleDAO.Data>() {
1534                 @Override
1535                 public UserRoleDAO.Data get(AuthzTrans trans, Object ... keys) {
1536                         Result<List<UserRoleDAO.Data>> r = q.userRoleDAO.read(trans, keys);
1537                         if(r.isOKhasData()) {
1538                                 return r.value.get(0);
1539                         } else {
1540                                 return null;
1541                         }
1542                 }
1543         };
1544
1545         /**
1546          * Note: if "allApprovals for Ticket is null, it will be looked up.
1547          *       if "fdd" is null, it will be looked up, but
1548          *
1549          * They can be passed for performance reasons.
1550          *
1551          * @param trans
1552          * @param cd
1553          * @param allApprovalsForTicket
1554          * @return
1555          */
1556         public Result<OP_STATUS> performFutureOp(final AuthzTrans trans, FUTURE_OP fop, FutureDAO.Data curr, Lookup<List<ApprovalDAO.Data>> la, Lookup<UserRoleDAO.Data> lur) {
1557                 // Pre-Evaluate if ReApproval is already done.
1558                 UserRoleDAO.Data urdd = null;
1559                 if(fop.equals(FUTURE_OP.A) && curr.target.equals(FOP_USER_ROLE) && curr.construct!=null) {
1560                         try {
1561                                 // Get Expected UserRole from Future
1562                                 urdd = new UserRoleDAO.Data();
1563                                 urdd.reconstitute(curr.construct);
1564                                 // Get Current UserRole from lookup
1565                                 UserRoleDAO.Data lurdd = lur.get(trans, urdd.user,urdd.role);
1566                                 if(lurdd==null) {
1567                                         q.futureDAO.delete(trans, curr, false);
1568                                         return OP_STATUS.RL;
1569                                 } else {
1570                                         if(curr.expires.compareTo(lurdd.expires)<0) {
1571                                                 q.futureDAO.delete(trans, curr, false);
1572                                                 return OP_STATUS.RL;
1573                                         }
1574                                 }
1575                         } catch (IOException e) {
1576                                 return Result.err(Result.ERR_BadData,"Cannot reconstitute %1",curr.memo);
1577                         }
1578                 }
1579
1580                 boolean aDenial = false;
1581                 int cntSuper=0, appSuper=0,cntOwner=0, appOwner=0;
1582                 for(ApprovalDAO.Data add : la.get(trans)) {
1583                         switch(add.status) {
1584                                 case "approved":
1585                                         if("owner".equals(add.type)) {
1586                                                 ++cntOwner;
1587                                                 ++appOwner;
1588                                         } else if("supervisor".equals(add.type)) {
1589                                                 ++cntSuper;
1590                                                 ++appSuper;
1591                                         }
1592                                         break;
1593                                 case "pending":
1594                                         if("owner".equals(add.type)) {
1595                                                 ++cntOwner;
1596                                         } else if("supervisor".equals(add.type)) {
1597                                                 ++cntSuper;
1598                                         }
1599                                         break;
1600                                 case "denied":
1601                                         aDenial=true;
1602                                         break;
1603                         }
1604                 }
1605
1606                 Result<OP_STATUS> ros=null;
1607                 if(aDenial) {
1608                         // Note: Denial will be Audit-logged.
1609 //                      for (ApprovalDAO.Data ad : allApprovalsForTicket.value) {
1610 //                          q.approvalDAO.delete(trans, ad, false);
1611 //                      }
1612                         ros = OP_STATUS.RD;
1613                         if(q.futureDAO.delete(trans, curr, false).notOK()) {
1614                                 trans.info().printf("Future %s could not be deleted", curr.id.toString());
1615                         }  else {
1616                                 if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {
1617                                         // A Denial means we must remove UserRole
1618                                         if(fop.equals(FUTURE_OP.U) || fop.equals(FUTURE_OP.A)) {
1619                                                 UserRoleDAO.Data data = new UserRoleDAO.Data();
1620                                                 try {
1621                                                         data.reconstitute(curr.construct);
1622                                                 } catch (IOException e) {
1623                                                         trans.error().log("Cannot reconstitue",curr.memo);
1624                                                 }
1625                                                 ros = set(OP_STATUS.RD,delUserRole(trans, data.user, data.ns, data.rname));
1626                                         }
1627                                 }
1628                         }
1629                 }
1630
1631                 // Decision: If not Denied, and at least owner, if exists, and at least one Super, if exists
1632                 boolean goDecision = (cntOwner>0?appOwner>0:true) && (cntSuper>0?appSuper>0:true);
1633
1634                 if(goDecision) {
1635                         // should check if any other pendings before performing
1636                         // actions
1637                         try {
1638                                 if (FOP_ROLE.equalsIgnoreCase(curr.target)) {
1639                                         RoleDAO.Data data = new RoleDAO.Data();
1640                                         data.reconstitute(curr.construct);
1641                                         switch(fop) {
1642                                                 case C:
1643                                                         ros = set(OP_STATUS.RE,q.roleDAO.dao().create(trans, data));
1644                                                         break;
1645                                                 case D:
1646                                                         ros = set(OP_STATUS.RE,deleteRole(trans, data, true, true));
1647                                                         break;
1648                                                 default:
1649                                         }
1650                                 } else if (FOP_PERM.equalsIgnoreCase(curr.target)) {
1651                                         PermDAO.Data pdd = new PermDAO.Data();
1652                                         pdd.reconstitute(curr.construct);
1653                                         Set<String> roles;
1654                                         Result<RoleDAO.Data> rrdd;
1655                                         switch(fop) {
1656                                                 case C:
1657                                                         ros = set(OP_STATUS.RE,createPerm(trans, pdd, true));
1658                                                         break;
1659                                                 case D:
1660                                                         ros = set(OP_STATUS.RE,deletePerm(trans, pdd, true, true));
1661                                                         break;
1662                                                 case G:
1663                                                         roles = pdd.roles(true);
1664                                                         for (String roleStr : roles) {
1665                                                                 rrdd = RoleDAO.Data.decode(trans, q, roleStr);
1666                                                                 if (rrdd.isOKhasData()) {
1667                                                                         ros = set(OP_STATUS.RE,addPermToRole(trans, rrdd.value, pdd, true));
1668                                                                 } else {
1669                                                                         trans.error().log(rrdd.errorString());
1670                                                                 }
1671                                                         }
1672                                                         break;
1673                                                 case UG:
1674                                                         roles = pdd.roles(true);
1675                                                         for (String roleStr : roles) {
1676                                                                 rrdd = RoleDAO.Data.decode(trans, q, roleStr);
1677                                                                 if (rrdd.isOKhasData()) {
1678                                                                         ros = set(OP_STATUS.RE,delPermFromRole(trans, rrdd.value, pdd,  true));
1679                                                                 } else {
1680                                                                         trans.error().log(rrdd.errorString());
1681                                                                 }
1682                                                         }
1683                                                         break;
1684                                                 default:
1685                                         }
1686                                 } else if (FOP_USER_ROLE.equalsIgnoreCase(curr.target)) {
1687                                         if(urdd==null) {
1688                                                 urdd = new UserRoleDAO.Data();
1689                                                 urdd.reconstitute(curr.construct);
1690                                         }
1691                                         // if I am the last to approve, create user role
1692                                         switch(fop) {
1693                                                 case C:
1694                                                         ros = set(OP_STATUS.RE,addUserRole(trans, urdd));
1695                                                         break;
1696                                                 case U:
1697                                                 case A:
1698                                                         ros = set(OP_STATUS.RE,extendUserRole(trans,urdd,true));
1699                                                         break;
1700                                                 default:
1701                                         }
1702                                 } else if (FOP_NS.equalsIgnoreCase(curr.target)) {
1703                                         Namespace namespace = new Namespace();
1704                                         namespace.reconstitute(curr.construct);
1705                                         switch(fop) {
1706                                                 case C:
1707                                                         ros = set(OP_STATUS.RE,createNS(trans, namespace, true));
1708                                                         break;
1709                                                 default:
1710                                         }
1711                                 } else if (FOP_DELEGATE.equalsIgnoreCase(curr.target)) {
1712                                         DelegateDAO.Data data = new DelegateDAO.Data();
1713                                         data.reconstitute(curr.construct);
1714                                         switch(fop) {
1715                                                 case C:
1716                                                         ros = set(OP_STATUS.RE,q.delegateDAO.create(trans, data));
1717                                                         break;
1718                                                 case U:
1719                                                         ros = set(OP_STATUS.RE,q.delegateDAO.update(trans, data));
1720                                                         break;
1721                                                 default:
1722                                         }
1723                                 } else if (FOP_CRED.equalsIgnoreCase(curr.target)) {
1724                                         CredDAO.Data data = new CredDAO.Data();
1725                                         data.reconstitute(curr.construct);
1726                                         switch(fop) {
1727                                                 case C:
1728                                                         ros = set(OP_STATUS.RE,q.credDAO.dao().create(trans, data));
1729                                                         break;
1730                                                 default:
1731                                         }
1732                                 }
1733                         } catch (Throwable e) {
1734                                 trans.error().log("Exception: ", e.getMessage(),
1735                                         " \n occurred while performing", curr.memo,
1736                                         " from Ticket ", curr.id.toString());
1737                         }
1738                         q.futureDAO.delete(trans, curr, false);
1739                 } // end for goDecision
1740                 if(ros==null) {
1741                         //return Result.err(Status.ACC_Future, "Full Approvals not obtained: No action taken");
1742                         ros = OP_STATUS.RP;
1743                 }
1744
1745                 return ros;
1746         }
1747
1748         // Convenience method for setting OPSTatus Results
1749         private Result<OP_STATUS> set(Result<OP_STATUS> rs, Result<?> orig) {
1750                 if(orig.isOK()) {
1751                         return rs;
1752                 } else {
1753                         return Result.err(orig);
1754                 }
1755         }
1756
1757         private Result<ApprovalDAO.Data>  addIdentity(AuthzTrans trans, StringBuilder sb,
1758                                                 Boolean[] first, String user, String memo, FUTURE_OP op, Identity u, UUID ticket, String type) throws OrganizationException {
1759                 ApprovalDAO.Data ad = new ApprovalDAO.Data();
1760                 // Note ad.id is set by ApprovalDAO Create
1761                 ad.ticket = ticket;
1762                 ad.user = user;
1763                 ad.approver = u.fullID();
1764                 ad.status = ApprovalDAO.PENDING;
1765                 ad.memo = memo;
1766                 ad.type = type;
1767                 ad.operation = op.name();
1768                 // Note ad.updated is created in System
1769             Result<ApprovalDAO.Data> r = q.approvalDAO.create(trans,ad);
1770             if(r.isOK()) {
1771                         if(first[0]) {
1772                                 first[0] = false;
1773                         } else {
1774                                 sb.append(", ");
1775                         }
1776                         sb.append(r.value.user);
1777                         sb.append(':');
1778                         sb.append(r.value.ticket);
1779                         return r;
1780             } else {
1781                 return Result.err(Status.ERR_ActionNotCompleted,
1782                                         "Approval for %s, %s could not be created: %s",
1783                                         ad.user, ad.approver,
1784                                         r.details, sb.toString());
1785             }
1786         }
1787
1788         public Executor newExecutor(AuthzTrans trans) {
1789                 return new CassExecutor(trans, this);
1790         }
1791
1792 }