private boolean isAuthorizedForMembershipResource ( final HttpServletRequest request , final Subject currentUser ) throws IOException { if ( resourceExists ( request ) && request . getMethod ( ) . equalsIgnoreCase ( "POST" ) ) { // Check resource if it exists and we are POSTing to it. if ( isResourceIndirectOrDirect ( resource ( request ) ) ) { final URI membershipResource = getHasMemberFromResource ( request ) ; addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } } else if ( request . getMethod ( ) . equalsIgnoreCase ( "PUT" ) ) { // PUT to a URI check that the immediate container is not direct or indirect. if ( containerExists ( request ) && isResourceIndirectOrDirect ( getContainer ( request ) ) ) { final URI membershipResource = getHasMemberFromResource ( request , getContainer ( request ) ) ; addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } } else if ( isSparqlUpdate ( request ) && isResourceIndirectOrDirect ( resource ( request ) ) ) { // PATCH to a direct/indirect might change the ldp:membershipResource final URI membershipResource = getHasMemberFromPatch ( request ) ; if ( membershipResource != null ) { log . debug ( "Found membership resource: {}" , membershipResource ) ; // add the membership URI to the list URIs to retrieve ACLs for addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } } else if ( request . getMethod ( ) . equalsIgnoreCase ( "DELETE" ) ) { if ( isResourceIndirectOrDirect ( resource ( request ) ) ) { // If we delete a direct/indirect container we have to have access to the ldp:membershipResource final URI membershipResource = getHasMemberFromResource ( request ) ; addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } else if ( isResourceIndirectOrDirect ( getContainer ( request ) ) ) { // or if we delete a child of a direct/indirect container we have to have access to the // ldp:membershipResource final FedoraResource container = getContainer ( request ) ; final URI membershipResource = getHasMemberFromResource ( request , container ) ; addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } } if ( isPayloadIndirectOrDirect ( request ) ) { // Check if we are creating a direct/indirect container. final URI membershipResource = getHasMemberFromRequest ( request ) ; if ( membershipResource != null ) { log . debug ( "Found membership resource: {}" , membershipResource ) ; // add the membership URI to the list URIs to retrieve ACLs for addURIToAuthorize ( request , membershipResource ) ; if ( ! currentUser . isPermitted ( new WebACPermission ( WEBAC_MODE_WRITE , membershipResource ) ) ) { return false ; } } } // Not indirect/directs or we are authorized. return true ; }
Check if we are authorized to access the target of membershipRelation if required . Really this is a test for failure . The default is true because we might not be looking at an indirect or direct container .