private void validateAccessPermissions ( ItemState changedItem ) throws RepositoryException , AccessDeniedException { if ( changedItem . isAddedAutoCreatedNodes ( ) ) { validateAddNodePermission ( changedItem ) ; } else if ( changedItem . isDeleted ( ) ) { validateRemoveAccessPermission ( changedItem ) ; } else if ( changedItem . isMixinChanged ( ) ) { validateMixinChangedPermission ( changedItem ) ; } else { NodeData parent = ( NodeData ) getItemData ( changedItem . getData ( ) . getParentIdentifier ( ) ) ; if ( parent != null ) { if ( changedItem . getData ( ) . isNode ( ) ) { // add node if ( changedItem . isAdded ( ) ) { if ( ! accessManager . hasPermission ( parent . getACL ( ) , new String [ ] { PermissionType . ADD_NODE } , session . getUserState ( ) . getIdentity ( ) ) ) { throw new AccessDeniedException ( "Access denied: ADD_NODE " + changedItem . getData ( ) . getQPath ( ) . getAsString ( ) + " for: " + session . getUserID ( ) + " item owner " + parent . getACL ( ) . getOwner ( ) ) ; } } } else if ( changedItem . isAdded ( ) || changedItem . isUpdated ( ) ) { // add or update property if ( ! accessManager . hasPermission ( parent . getACL ( ) , new String [ ] { PermissionType . SET_PROPERTY } , session . getUserState ( ) . getIdentity ( ) ) ) { throw new AccessDeniedException ( "Access denied: SET_PROPERTY " + changedItem . getData ( ) . getQPath ( ) . getAsString ( ) + " for: " + session . getUserID ( ) + " item owner " + parent . getACL ( ) . getOwner ( ) ) ; } } } // else - parent not found, deleted in this session or from another } }
Validate ItemState for access permeations