<commit_before>package ca.firstvoices.securitypolicies.groups;

import java.security.Principal;
import java.util.Arrays;
import java.util.List;

import org.nuxeo.ecm.core.api.security.ACP;
import org.nuxeo.ecm.core.api.security.Access;
import org.nuxeo.ecm.core.api.security.SecurityConstants;
import org.nuxeo.ecm.core.model.Document;
import org.nuxeo.ecm.core.query.sql.model.SQLQuery.Transformer;
import org.nuxeo.ecm.core.security.AbstractSecurityPolicy;

import ca.firstvoices.utils.CustomSecurityConstants;

/**
 * Language administrators policies
 */
public class LanguageAdministrators extends AbstractSecurityPolicy {

    @Override
    public Access checkPermission(Document doc, ACP mergedAcp,
            Principal principal, String permission,
            String[] resolvedPermissions, String[] additionalPrincipals) throws SecurityException {

        List<String> additionalPrincipalsList = Arrays.asList(additionalPrincipals);

        // Skip administrators, system user and groups that aren't language administrators
        if (additionalPrincipalsList.contains("administrators") || principal.equals(SecurityConstants.SYSTEM_USERNAME) || !additionalPrincipalsList.contains(CustomSecurityConstants.LANGUAGE_ADMINS_GROUP)) {
            return Access.UNKNOWN;
        }

        // Skip permissions that are READ, this policy will not limit them
        if ("BROWSE".equals(permission)) {
        	return Access.UNKNOWN;
        }

        String docType = doc.getType().getName();
        String parentType = doc.getParent().getType().getName();

        // Publishing permissions
        if ( doc.isProxy() ) {

        	// TODO: Restrict language administrators from publishing to someone else's FVDialect
        	/*if ( "FVDialect".equals(docType) ) {
                if ( !Access.GRANT.equals(mergedAcp.getAccess(additionalPrincipals, new String[]{SecurityConstants.EVERYTHING})) ) {
                    return Access.DENY;
                }
        	}*/
        	// TODO: Restrict this to THEIR language
        	// Allow publication to language
        	if ("FVLanguage".equals(docType)) {
        		return Access.GRANT;
        	}

        	// Allow WriteSecurity on dialect so permissions can be assigned when publishing
        	if ("FVDialect".equals(docType) && SecurityConstants.WRITE_SECURITY.equals(permission)) {
        		return Access.GRANT;
        	}
        }<commit_msg>Bug when LA publishes tree from scratch<commit_after>package ca.firstvoices.securitypolicies.groups;

import java.security.Principal;
import java.util.Arrays;
import java.util.List;

import org.nuxeo.ecm.core.api.security.ACP;
import org.nuxeo.ecm.core.api.security.Access;
import org.nuxeo.ecm.core.api.security.SecurityConstants;
import org.nuxeo.ecm.core.model.Document;
import org.nuxeo.ecm.core.query.sql.model.SQLQuery.Transformer;
import org.nuxeo.ecm.core.security.AbstractSecurityPolicy;

import ca.firstvoices.utils.CustomSecurityConstants;

/**
 * Language administrators policies
 */
public class LanguageAdministrators extends AbstractSecurityPolicy {

    @Override
    public Access checkPermission(Document doc, ACP mergedAcp,
            Principal principal, String permission,
            String[] resolvedPermissions, String[] additionalPrincipals) throws SecurityException {

        List<String> additionalPrincipalsList = Arrays.asList(additionalPrincipals);

        // Skip administrators, system user and groups that aren't language administrators
        if (additionalPrincipalsList.contains("administrators") || principal.equals(SecurityConstants.SYSTEM_USERNAME) || !additionalPrincipalsList.contains(CustomSecurityConstants.LANGUAGE_ADMINS_GROUP)) {
            return Access.UNKNOWN;
        }

        // Skip permissions that are READ, this policy will not limit them
        if ("BROWSE".equals(permission)) {
        	return Access.UNKNOWN;
        }

        String docType = doc.getType().getName();
        String parentType = doc.getParent().getType().getName();

        // Publishing permissions

        // Allow ADD_CHILDREN on section root (for when hierarchy needs to be created from scratch)
        if ( "/FV/sections/Data".equals(doc.getPath()) && SecurityConstants.ADD_CHILDREN.equals(permission) ) {
        	return Access.GRANT;
        }

        // Proxy documents
        if ( doc.isProxy() ) {

        	// TODO: Restrict language administrators from publishing to someone else's FVDialect
        	/*if ( "FVDialect".equals(docType) ) {
                if ( !Access.GRANT.equals(mergedAcp.getAccess(additionalPrincipals, new String[]{SecurityConstants.EVERYTHING})) ) {
                    return Access.DENY;
                }
        	}*/

        	// Allow WriteSecurity on dialect so permissions can be assigned when publishing
        	if ("FVDialect".equals(docType) && SecurityConstants.WRITE_SECURITY.equals(permission)) {
        		return Access.GRANT;
        	}

        	// TODO: Restrict this to THEIR language
        	// Allow ADD_CHILDREN on Families, Languages and section root (for when hierarchy needs to be created from scratch)
        	if ("FVLanguage".equals(docType) || "FVLanguageFamily".equals(docType) && SecurityConstants.ADD_CHILDREN.equals(permission)) {
        		return Access.GRANT;
        	}
        }
{'fraction_non_alphanumeric': 0.0956242927197284, 'fraction_numerical': 0.0, 'mean_word_length': 3.082371054657429, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2898076', 'n_tokens_mistral': 1486, 'n_tokens_neox': 1413, 'n_words': 320}