<commit_before>/*
 *   Copyright 2004 The Apache Software Foundation
 *
 *   Licensed under the Apache License, Version 2.0 (the "License");
 *   you may not use this file except in compliance with the License.
 *   You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 *   Unless required by applicable law or agreed to in writing, software
 *   distributed under the License is distributed on an "AS IS" BASIS,
 *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *   See the License for the specific language governing permissions and
 *   limitations under the License.
 *
 */
package org.apache.ldap.server.authz;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;

import javax.naming.Name;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.SearchControls;

import org.apache.ldap.common.aci.ACIItem;
import org.apache.ldap.common.aci.ACITuple;
import org.apache.ldap.common.aci.AuthenticationLevel;
import org.apache.ldap.common.aci.MicroOperation;
import org.apache.ldap.common.aci.ProtectedItem;
import org.apache.ldap.common.aci.UserClass;
import org.apache.ldap.common.aci.ProtectedItem.MaxValueCountItem;
import org.apache.ldap.common.aci.ProtectedItem.RestrictedByItem;
import org.apache.ldap.common.exception.LdapNoPermissionException;
import org.apache.ldap.common.filter.ExprNode;
import org.apache.ldap.common.filter.FilterParserImpl;
import org.apache.ldap.common.name.LdapName;
import org.apache.ldap.common.subtree.SubtreeSpecification;
import org.apache.ldap.server.event.Evaluator;
import org.apache.ldap.server.event.ExpressionEvaluator;
import org.apache.ldap.server.interceptor.NextInterceptor;
import org.apache.ldap.server.schema.AttributeTypeRegistry;
import org.apache.ldap.server.schema.OidRegistry;
import org.apache.ldap.server.subtree.RefinementEvaluator;
import org.apache.ldap.server.subtree.RefinementLeafEvaluator;
import org.apache.ldap.server.subtree.SubtreeEvaluator;

public class ACDFEngine
{
    private static final LdapName ROOTDSE_NAME = new LdapName();

    private final Evaluator entryEvaluator;
    private final SubtreeEvaluator subtreeEvaluator;
    private final RefinementEvaluator refinementEvaluator;
    private final ExprNode childrenFilter;
    private final SearchControls childrenSearchControls;
    
    public ACDFEngine( OidRegistry oidRegistry, AttributeTypeRegistry attrTypeRegistry ) throws NamingException
    {
        entryEvaluator = new ExpressionEvaluator( oidRegistry, attrTypeRegistry );
        subtreeEvaluator = new SubtreeEvaluator( oidRegistry );
        refinementEvaluator = new RefinementEvaluator(
                new RefinementLeafEvaluator( oidRegistry ) );

        try
        {
            childrenFilter = new FilterParserImpl().parse( "(objectClass=*)" );
        }
        catch( Exception e )
        {
            throw ( NamingException ) new NamingException(
                    "Failed to initialize a children filter." ).initCause( e );
        }
        
        childrenSearchControls = new SearchControls();
        childrenSearchControls.setSearchScope( SearchControls.ONELEVEL_SCOPE );
    }
    
    /**
     * Checks the user with the specified name can access the specified resource
     * (entry, attribute type, or attribute value) and throws {@link LdapNoPermissionException}
     * if the user doesn't have any permission to perform the specified grants.
     * 
     * @param next the next interceptor to the current interceptor
     * @param userGroupName the DN of the group of the user who is trying to access the resource
     * @param username the DN of the user who is trying to access the resource
     * @param entryName the DN of the entry the user is trying to access 
     * @param attrId the attribute type of the attribute the user is trying to access.
     *               <tt>null</tt> if the user is not accessing a specific attribute type.
     * @param attrValue the attribute value of the attribute the user is trying to access.
     *                  <tt>null</tt> if the user is not accessing a specific attribute value.<commit_msg>Used PresenceNode instead of FilterParser.<commit_after>/*
 *   Copyright 2004 The Apache Software Foundation
 *
 *   Licensed under the Apache License, Version 2.0 (the "License");
 *   you may not use this file except in compliance with the License.
 *   You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 *   Unless required by applicable law or agreed to in writing, software
 *   distributed under the License is distributed on an "AS IS" BASIS,
 *   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *   See the License for the specific language governing permissions and
 *   limitations under the License.
 *
 */
package org.apache.ldap.server.authz;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;

import javax.naming.Name;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.SearchControls;

import org.apache.ldap.common.aci.ACIItem;
import org.apache.ldap.common.aci.ACITuple;
import org.apache.ldap.common.aci.AuthenticationLevel;
import org.apache.ldap.common.aci.MicroOperation;
import org.apache.ldap.common.aci.ProtectedItem;
import org.apache.ldap.common.aci.UserClass;
import org.apache.ldap.common.aci.ProtectedItem.MaxValueCountItem;
import org.apache.ldap.common.aci.ProtectedItem.RestrictedByItem;
import org.apache.ldap.common.exception.LdapNoPermissionException;
import org.apache.ldap.common.filter.ExprNode;
import org.apache.ldap.common.filter.PresenceNode;
import org.apache.ldap.common.name.LdapName;
import org.apache.ldap.common.subtree.SubtreeSpecification;
import org.apache.ldap.server.event.Evaluator;
import org.apache.ldap.server.event.ExpressionEvaluator;
import org.apache.ldap.server.interceptor.NextInterceptor;
import org.apache.ldap.server.schema.AttributeTypeRegistry;
import org.apache.ldap.server.schema.OidRegistry;
import org.apache.ldap.server.subtree.RefinementEvaluator;
import org.apache.ldap.server.subtree.RefinementLeafEvaluator;
import org.apache.ldap.server.subtree.SubtreeEvaluator;

public class ACDFEngine
{
    private static final LdapName ROOTDSE_NAME = new LdapName();

    private final Evaluator entryEvaluator;
    private final SubtreeEvaluator subtreeEvaluator;
    private final RefinementEvaluator refinementEvaluator;
    private final ExprNode childrenFilter;
    private final SearchControls childrenSearchControls;
    
    public ACDFEngine( OidRegistry oidRegistry, AttributeTypeRegistry attrTypeRegistry ) throws NamingException
    {
        entryEvaluator = new ExpressionEvaluator( oidRegistry, attrTypeRegistry );
        subtreeEvaluator = new SubtreeEvaluator( oidRegistry );
        refinementEvaluator = new RefinementEvaluator(
                new RefinementLeafEvaluator( oidRegistry ) );

        
        childrenFilter = new PresenceNode( "objectClass" );
        childrenSearchControls = new SearchControls();
        childrenSearchControls.setSearchScope( SearchControls.ONELEVEL_SCOPE );
    }
    
    /**
     * Checks the user with the specified name can access the specified resource
     * (entry, attribute type, or attribute value) and throws {@link LdapNoPermissionException}
     * if the user doesn't have any permission to perform the specified grants.
     * 
     * @param next the next interceptor to the current interceptor
     * @param userGroupName the DN of the group of the user who is trying to access the resource
     * @param username the DN of the user who is trying to access the resource
     * @param entryName the DN of the entry the user is trying to access 
     * @param attrId the attribute type of the attribute the user is trying to access.
     *               <tt>null</tt> if the user is not accessing a specific attribute type.
     * @param attrValue the attribute value of the attribute the user is trying to access.
     *                  <tt>null</tt> if the user is not accessing a specific attribute value.
{'fraction_non_alphanumeric': 0.07392075694855116, 'fraction_numerical': 0.0018923713778829095, 'mean_word_length': 3.8681635002878525, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3108322', 'n_tokens_mistral': 2348, 'n_tokens_neox': 2317, 'n_words': 715}