01: /*
02: * Copyright 2005 Joe Walker
03: *
04: * Licensed under the Apache License, Version 2.0 (the "License");
05: * you may not use this file except in compliance with the License.
06: * You may obtain a copy of the License at
07: *
08: * http://www.apache.org/licenses/LICENSE-2.0
09: *
10: * Unless required by applicable law or agreed to in writing, software
11: * distributed under the License is distributed on an "AS IS" BASIS,
12: * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13: * See the License for the specific language governing permissions and
14: * limitations under the License.
15: */
16: package org.directwebremoting.extend;
17:
18: import java.lang.reflect.Method;
19:
20: /**
21: * Control who should be accessing which methods on which classes.
22: * @author Joe Walker [joe at getahead dot ltd dot uk]
23: */
24: public interface AccessControl {
25: /**
26: * Check the method for accessibility at runtime, and return an error
27: * message if anything is wrong. If nothing is wrong, return null.
28: * <p>See notes on <code>getReasonToNotDisplay()</code>. This method should
29: * duplicate the tests made by that method.
30: * <p>This is not a great because it mixes 2 bits of information in the same
31: * variable (is it wrong, and what is wrong) but without multi-value returns
32: * in Java this seems like the most simple implementation.
33: * @param creator Where does the method come from?
34: * @param className The Javascript name of the class
35: * @param method What is the method to execute?
36: * @throws SecurityException If the given method is disallowed
37: * @see AccessControl#assertIsDisplayable(Creator, String, Method)
38: */
39: void assertExecutionIsPossible(Creator creator, String className,
40: Method method) throws SecurityException;
41:
42: /**
43: * Check the method for accessibility at 'compile-time' (i.e. when the application
44: * is downloaded), and return an error message if anything is wrong. If
45: * nothing is wrong, return null.
46: * <p>This method is similar to <code>getReasonToNotExecute()</code> except
47: * that there may be checks (like security checks) that we wish to make only
48: * at runtime in case the situation changes between 'compile-time' and
49: * runtime.
50: * <p>This is not a great because it mixes 2 bits of information in the same
51: * variable (is it wrong, and what is wrong) but without multi-value returns
52: * in Java this seems like the most simple implementation.
53: * @param creator Where does the method come from?
54: * @param className The Javascript name of the class
55: * @param method What is the method to execute?
56: * @throws SecurityException If the given method is disallowed
57: * @see AccessControl#assertExecutionIsPossible(Creator, String, Method)
58: */
59: void assertIsDisplayable(Creator creator, String className,
60: Method method) throws SecurityException;
61:
62: /**
63: * J2EE role based security allows us to restrict methods to only being used
64: * by people in certain roles.
65: * @param scriptName The name of the creator to Javascript
66: * @param methodName The name of the method (without brackets)
67: * @param role The new role name to add to the list for the given scriptName and methodName
68: */
69: void addRoleRestriction(String scriptName, String methodName,
70: String role);
71:
72: /**
73: * Add an include rule.
74: * Each creator can have either a list of inclusions or a list of exclusions
75: * but not both. If a creator has a list of inclusions then the default
76: * policy is to deny any method that is not specifically included. If the
77: * creator has a list of exclusions then the default policy is to allow
78: * any method not listed.
79: * If there are no included or excluded rules then the default policy is to
80: * allow all methods
81: * @param scriptName The name of the creator to Javascript
82: * @param methodName The name of the method (without brackets)
83: */
84: void addIncludeRule(String scriptName, String methodName);
85:
86: /**
87: * Add an exclude rule.
88: * @param scriptName The name of the creator to Javascript
89: * @param methodName The name of the method (without brackets)
90: * @see AccessControl#addIncludeRule(String, String)
91: */
92: void addExcludeRule(String scriptName, String methodName);
93: }
|