1 /* Copyright 2004, 2005, 2006 Acegi Technology Pty Limited
2 *
3 * Licensed under the Apache License, Version 2.0 (the "License");
4 * you may not use this file except in compliance with the License.
5 * You may obtain a copy of the License at
6 *
7 * http://www.apache.org/licenses/LICENSE-2.0
8 *
9 * Unless required by applicable law or agreed to in writing, software
10 * distributed under the License is distributed on an "AS IS" BASIS,
11 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 * See the License for the specific language governing permissions and
13 * limitations under the License.
14 */
15
16 package org.acegisecurity.vote;
17
18 import org.acegisecurity.Authentication;
19 import org.acegisecurity.ConfigAttribute;
20 import org.acegisecurity.ConfigAttributeDefinition;
21
22
23 /**
24 * Indicates a class is responsible for voting on authorization decisions.
25 *
26 * <p>
27 * The coordination of voting (ie polling <code>AccessDecisionVoter</code>s,
28 * tallying their responses, and making the final authorization decision) is
29 * performed by an {@link org.acegisecurity.AccessDecisionManager}.
30 * </p>
31 *
32 * @author Ben Alex
33 * @version $Id: AccessDecisionVoter.java 1784 2007-02-24 21:00:24Z luke_t $
34 */
35 public interface AccessDecisionVoter {
36 //~ Static fields/initializers =====================================================================================
37
38 int ACCESS_GRANTED = 1;
39 int ACCESS_ABSTAIN = 0;
40 int ACCESS_DENIED = -1;
41
42 //~ Methods ========================================================================================================
43
44 /**
45 * Indicates whether this <code>AccessDecisionVoter</code> is able to vote on the passed
46 * <code>ConfigAttribute</code>.<p>This allows the <code>AbstractSecurityInterceptor</code> to check every
47 * configuration attribute can be consumed by the configured <code>AccessDecisionManager</code> and/or
48 * <code>RunAsManager</code> and/or <code>AfterInvocationManager</code>.</p>
49 *
50 * @param attribute a configuration attribute that has been configured against the
51 * <code>AbstractSecurityInterceptor</code>
52 *
53 * @return true if this <code>AccessDecisionVoter</code> can support the passed configuration attribute
54 */
55 boolean supports(ConfigAttribute attribute);
56
57 /**
58 * Indicates whether the <code>AccessDecisionVoter</code> implementation is able to provide access control
59 * votes for the indicated secured object type.
60 *
61 * @param clazz the class that is being queried
62 *
63 * @return true if the implementation can process the indicated class
64 */
65 boolean supports(Class clazz);
66
67 /**
68 * Indicates whether or not access is granted.
69 * <p>The decision must be affirmative (<code>ACCESS_GRANTED</code>), negative (<code>ACCESS_DENIED</code>)
70 * or the <code>AccessDecisionVoter</code> can abstain (<code>ACCESS_ABSTAIN</code>) from voting.
71 * Under no circumstances should implementing classes return any other value. If a weighting of results is desired,
72 * this should be handled in a custom {@link org.acegisecurity.AccessDecisionManager} instead.
73 * </p>
74 * <p>Unless an <code>AccessDecisionVoter</code> is specifically intended to vote on an access control
75 * decision due to a passed method invocation or configuration attribute parameter, it must return
76 * <code>ACCESS_ABSTAIN</code>. This prevents the coordinating <code>AccessDecisionManager</code> from counting
77 * votes from those <code>AccessDecisionVoter</code>s without a legitimate interest in the access control
78 * decision.
79 * </p>
80 * <p>Whilst the method invocation is passed as a parameter to maximise flexibility in making access
81 * control decisions, implementing classes must never modify the behaviour of the method invocation (such as
82 * calling <Code>MethodInvocation.proceed()</code>).</p>
83 *
84 * @param authentication the caller invoking the method
85 * @param object the secured object
86 * @param config the configuration attributes associated with the method being invoked
87 *
88 * @return either {@link #ACCESS_GRANTED}, {@link #ACCESS_ABSTAIN} or {@link #ACCESS_DENIED}
89 */
90 int vote(Authentication authentication, Object object, ConfigAttributeDefinition config);
91 }