ModeShape/modeshape — pull request #818 by rhauch (2013-05-16 12:28:20+00:00)
Title: MODE-1924 Changed AuthorizationProvider framework to always use absolute paths, and added AdvancedAuthorizationProvider

Most of the time ModeShape was passing absolute paths to the AuthorizationProvider. However, in some places ModeShape passed relative paths, and this makes it very difficult for implementations to properly check permissions. This behavior was changed so that ModeShape always passes absolute paths.

A new AdvancedAuthorizationProvider interface was added, where this new interface now provides access to the Session through a new context mechanism (which can be used in the future to add more parameters without breaking API compatibility). The Session now simply does one extra instanceof check when attempting to determine the permissions.

The new interface allows implementations to access authorization information stored as regular repository content. While this makes it possible to create quite rich and complicated authorization providers, it does open up the possibility for an infinite loop, since any calls within a provider to get repository content will result in authorization checks for that content. Therefore, such implementations need to likely handle the permissions for the authorization-related content in a special way. (This was documented in the JavaDoc for the AdvancedAuthorizationProvider interface.)