Package org.exoplatform.caldav.client

Class BlueMindAclClient

java.lang.Object
org.exoplatform.caldav.client.BlueMindAclClient
@Component public class BlueMindAclClient extends Object
Reads the access control list of a BlueMind calendar through BlueMind's own REST API — the one place its sharing state can be read (EXO-90253).

BlueMind's DAV server answers a CS:share with 200 whatever it did and publishes no sharee list over DAV (CS:invite is a stub: plugins/net.bluemind.dav.server/.../proto/props/calendarserver/Invite.java), so the only proof that a grant was applied is the container's access list, GET /api/containers/_manage/{containerUid}/_acl (parent/core/net.bluemind.core.container.api/.../IContainerManagement.java), which the container's owner may read (ContainerPermissionResolver.java: the owner holds every verb).

The conversation, and what keeps it safe:

  • Same server, never another. The REST root is the scheme, host and port of the endpoint minted from the server registry for the DAV calls, with the /api root BlueMind serves its REST API under (RestServiceApiDescriptionParser.java prefixes every path with /api; bluemind-vhosts.conf proxies location /api/). Nothing a caller passes can name a host; redirects are never followed.
  • The owner's own credentials, from storage. The login and password are the ones the configured credentials provider produces for the owner's DAV requests, taken from its Basic header; a provider producing anything else is not a login this API accepts, and sharing is not offered.
  • A session for one read. POST /api/auth/login?login=… with the password as a JSON string, Content-Type: application/json — what BlueMind's own client proxy sends (ClientProxyGenerator.java, ByMimeTypeCodec.encode); BlueMind picks the body codec by the exact Content-Type value (DefaultBodyParameterCodecs.java), so a text/plain carrying a charset parameter would be read as JSON, refused with a 500 and logged by BlueMind with the password in it — answers a LoginResponse whose authKey travels in the X-BM-ApiKey header (parent/core/net.bluemind.core.rest/.../base/RestRootHandler.java reads it, BasicClientProxy.java sends it); the key is used for the read and POST /api/auth/logout is always sent after it. The key and the password are never logged, never stored, and never part of an exception message. A grant or a revoke, which reads the list before and after its change, holds one such BlueMindAclClient.Session for both reads (open(org.exoplatform.caldav.client.CalDavEndpoint)) rather than authenticating once per read: half the logins per action, and half the replays of the password against a server whose account lock-out policy eXo does not know.

  • Field Details

    • API_KEY_HEADER

      public static final String API_KEY_HEADER
      The header BlueMind's REST API reads a session key from.
      See Also:

  • Constructor Details

    • BlueMindAclClient

      @Autowired public BlueMindAclClient(CaldavCredentialsResolver caldavCredentialsResolver)
      The client Spring builds: no redirects, bounded timeouts.
      Parameters:
      caldavCredentialsResolver - the seam producing the owner's credentials

  • Method Details

    • readAcl

      public List<BlueMindAclClient.BlueMindAce> readAcl(CalDavEndpoint endpoint, String containerUid)
      A container's access list, read as its owner in one short REST session.
      Parameters:
      endpoint - the owner's DAV endpoint, minted from the registry
      containerUid - the container uid, the last segment of the calendar collection's path
      Returns:
      the entries, in the order BlueMind lists them
      Throws:
      UnsupportedOperationException - when the configured credentials are not a login and password
      CalDavAuthenticationException - when BlueMind refuses the login
      CalDavForbiddenException - when the account may not read the list
      CalDavUnreachableException - when the server cannot be reached
      CalDavException - when the answer is anything else

    • open

      public BlueMindAclClient.Session open(CalDavEndpoint endpoint)
      Opens a REST session as the owner, for as many reads as one service call needs; BlueMindAclClient.Session.close() logs it out. The exceptions are those of readAcl(CalDavEndpoint, String) for the login half.
      Parameters:
      endpoint - the owner's DAV endpoint, minted from the registry
      Returns:
      the session, to close

    • acceptsCredentials

      public boolean acceptsCredentials(CalDavEndpoint endpoint)
      Whether the owner's configured credentials are a login and password this API can take, without calling the server: what decides whether sharing on BlueMind is offered at all, so that a registration whose provider produces a token never shows an action every click of which would be refused.
      Parameters:
      endpoint - the owner's endpoint, minted from the registry
      Returns:
      true when the provider produces a Basic login and password