ModeShape/modeshape — pull request #849 by okulikov (2013-06-05 14:49:23+00:00)
Title: MODE-1920: Initial access management implementation

This implementation contains following changes:
-AccessManager provides implementation for access list policy only where policy is associated with each node. Access list data is stored as special child node. Node types are defined in the file access-manager.cnd. Nodes defined protected;
-AccessManager also implements AdvancedAuthorization interface and SecurityContext interface what allows to plug it with minimal changes
- Security context interface was extended with additional methods which allow to get/set subordinated security context. The purpose was from one hand plug access manager with minimal changes at the core level and from other hand to make security functions more flexible. For instance modeshape can provide role based servlet context with JCR defined access manager as subordinated for finer grained access control.
- session.checkPermissions was modified to be able recursively check chain of primary/subordinated security contexts and to skip all checks when call is initiated by security context itself. it is required to prevent cyclic calls of hasPermission(..) when call is initiated by access manager itself.
- Access list nodes are defined as protected. I was always trying to prevent changes at the methods signature to allow internal manipulation with protected properties or add new methods. Instead it uses session context to distinguish calls and allow validate protected fields if call was initiated by access manager.
-Unit tests for functional tests of the access list