Xinwen Deng / aem-src

/*
 * Decompiled with CFR 0_118.
 * 
 * Could not load the following classes:
 *  javax.jcr.Item
 *  javax.jcr.Node
 *  javax.jcr.NodeIterator
 *  javax.jcr.RepositoryException
 *  javax.jcr.Session
 *  javax.jcr.Workspace
 *  javax.jcr.observation.Event
 *  javax.jcr.observation.EventIterator
 *  javax.jcr.observation.EventListener
 *  javax.jcr.observation.ObservationManager
 *  javax.jcr.query.Query
 *  javax.jcr.query.QueryManager
 *  javax.jcr.query.QueryResult
 *  javax.jcr.security.AccessControlEntry
 *  javax.jcr.security.AccessControlList
 *  javax.jcr.security.AccessControlManager
 *  javax.jcr.security.AccessControlPolicy
 *  javax.jcr.security.AccessControlPolicyIterator
 *  javax.jcr.security.Privilege
 *  javax.servlet.http.HttpServletRequest
 *  org.apache.felix.scr.annotations.Activate
 *  org.apache.felix.scr.annotations.Component
 *  org.apache.felix.scr.annotations.ConfigurationPolicy
 *  org.apache.felix.scr.annotations.Deactivate
 *  org.apache.felix.scr.annotations.Modified
 *  org.apache.felix.scr.annotations.Properties
 *  org.apache.felix.scr.annotations.Property
 *  org.apache.felix.scr.annotations.Reference
 *  org.apache.jackrabbit.api.JackrabbitSession
 *  org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry
 *  org.apache.jackrabbit.api.security.JackrabbitAccessControlList
 *  org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy
 *  org.apache.jackrabbit.api.security.principal.PrincipalManager
 *  org.apache.jackrabbit.oak.spi.security.principal.SystemUserPrincipal
 *  org.apache.sling.api.SlingException
 *  org.apache.sling.api.resource.LoginException
 *  org.apache.sling.api.resource.Resource
 *  org.apache.sling.api.resource.ResourceResolver
 *  org.apache.sling.api.resource.ResourceResolverFactory
 *  org.apache.sling.api.resource.ResourceUtil
 *  org.osgi.framework.BundleContext
 *  org.osgi.framework.ServiceRegistration
 *  org.osgi.service.event.Event
 *  org.osgi.service.event.EventHandler
 *  org.slf4j.Logger
 *  org.slf4j.LoggerFactory
 */
package com.day.cq.auth.impl.cug;

import com.day.cq.auth.impl.CugSupport;
import com.day.cq.auth.impl.cug.CugRoot;
import com.day.cq.auth.impl.cug.CugSupportWebConsolePlugin;
import java.security.Principal;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.Comparator;
import java.util.Dictionary;
import java.util.HashSet;
import java.util.Hashtable;
import java.util.Map;
import java.util.Set;
import java.util.TreeMap;
import javax.jcr.Item;
import javax.jcr.Node;
import javax.jcr.NodeIterator;
import javax.jcr.RepositoryException;
import javax.jcr.Session;
import javax.jcr.Workspace;
import javax.jcr.observation.Event;
import javax.jcr.observation.EventIterator;
import javax.jcr.observation.EventListener;
import javax.jcr.observation.ObservationManager;
import javax.jcr.query.Query;
import javax.jcr.query.QueryManager;
import javax.jcr.query.QueryResult;
import javax.jcr.security.AccessControlEntry;
import javax.jcr.security.AccessControlList;
import javax.jcr.security.AccessControlManager;
import javax.jcr.security.AccessControlPolicy;
import javax.jcr.security.AccessControlPolicyIterator;
import javax.jcr.security.Privilege;
import javax.servlet.http.HttpServletRequest;
import org.apache.felix.scr.annotations.Activate;
import org.apache.felix.scr.annotations.Component;
import org.apache.felix.scr.annotations.ConfigurationPolicy;
import org.apache.felix.scr.annotations.Deactivate;
import org.apache.felix.scr.annotations.Modified;
import org.apache.felix.scr.annotations.Properties;
import org.apache.felix.scr.annotations.Property;
import org.apache.felix.scr.annotations.Reference;
import org.apache.jackrabbit.api.JackrabbitSession;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlEntry;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlList;
import org.apache.jackrabbit.api.security.JackrabbitAccessControlPolicy;
import org.apache.jackrabbit.api.security.principal.PrincipalManager;
import org.apache.jackrabbit.oak.spi.security.principal.SystemUserPrincipal;
import org.apache.sling.api.SlingException;
import org.apache.sling.api.resource.LoginException;
import org.apache.sling.api.resource.Resource;
import org.apache.sling.api.resource.ResourceResolver;
import org.apache.sling.api.resource.ResourceResolverFactory;
import org.apache.sling.api.resource.ResourceUtil;
import org.apache.sling.commons.osgi.OsgiUtil;
import org.osgi.framework.BundleContext;
import org.osgi.framework.ServiceRegistration;
import org.osgi.service.event.EventHandler;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/*
 * This class specifies class file version 49.0 but uses Java 6 signatures.  Assumed Java 6.
 */
@Component(label="%auth.cug.name", description="%auth.cug.description", metatype=1, policy=ConfigurationPolicy.REQUIRE)
@Properties(value={@Property(name="service.description", value={"Day CQ Closed User Group (CUG) Support"}), @Property(name="event.topics", value={"org/apache/sling/api/resource/ResourceResolverMapping/CHANGED"}, propertyPrivate=1)})
public class CugSupportImpl
implements CugSupport,
EventListener,
EventHandler {
    private static final String CUG_ENABLED = "cug.enabled";
    private static final boolean CUG_ENABLED_DEFAULT = false;
    private static final String CUG_EXEMPTED = "cug.exempted.principals";
    private static final String CUG_EXEMPTED_DEFAULT = "administrators";
    @Reference
    private ResourceResolverFactory resourceResolverFactory;
    @Property(name="cug.exempted.principals", value={"administrators"}, cardinality=200)
    private String[] cugExemptedPrincipals;
    @Property(name="cug.enabled", boolValue={0})
    private boolean cugEnabled;
    private static final String CUG_PRINCIPALS_REGEX = "cug.principals.regex";
    private static final String CUG_PRINCIPALS_REPLACEMENT = "cug.principals.replacement";
    @Property(name="cug.principals.regex", value={""})
    private String cugPrincipalsRegex;
    @Property(name="cug.principals.replacement", value={""})
    private String cugPrincipalsReplacement;
    private final Logger log = LoggerFactory.getLogger(CugSupportImpl.class);
    private ResourceResolver serviceResolver;
    private Map<String, Object> properties;
    private ServiceRegistration registration;
    private final Object registrationSync = new Object();
    private final Map<String, CugRoot> cugRoots = new TreeMap(Collections.reverseOrder());
    private CugSupportWebConsolePlugin webConsolePlugin;

    @Activate
    private void activate(BundleContext bundleContext, Map<String, Object> properties) {
        this.properties = properties;
        this.cugRoots.clear();
        try {
            this.serviceResolver = this.resourceResolverFactory.getServiceResourceResolver(null);
            this.configure(bundleContext, properties);
            this.registerObservation();
        }
        catch (LoginException le) {
            this.log.error("activate: Cannot get a privileged ResourceResolver; CUG support disabled", (Throwable)le);
        }
        try {
            this.webConsolePlugin = new CugSupportWebConsolePlugin(bundleContext, this);
        }
        catch (Throwable t) {
            this.log.warn("activate: Failed registering the CUG Web Console Plugin", t);
        }
    }

    /*
     * WARNING - Removed try catching itself - possible behaviour change.
     */
    @Modified
    private void configure(BundleContext bundleContext, Map<String, Object> properties) {
        Object object = this.registrationSync;
        synchronized (object) {
            if (this.registration != null) {
                this.registration.unregister();
                this.registration = null;
            }
        }
        if (properties != null) {
            this.properties = properties;
        }
        this.cugExemptedPrincipals = OsgiUtil.toStringArray(properties.get("cug.exempted.principals"));
        if (this.cugExemptedPrincipals == null) {
            this.cugExemptedPrincipals = new String[]{"administrators"};
        }
        this.cugEnabled = OsgiUtil.toBoolean(properties.get("cug.enabled"), false);
        if (this.cugEnabled) {
            this.findInitialSet();
            object = this.registrationSync;
            synchronized (object) {
                this.registration = bundleContext.registerService(new String[]{"com.day.cq.auth.impl.CugSupport", EventHandler.class.getName()}, (Object)this, this.getProperties());
            }
        }
        this.cugPrincipalsRegex = OsgiUtil.toString(properties.get("cug.principals.regex"), "");
        this.cugPrincipalsReplacement = OsgiUtil.toString(properties.get("cug.principals.replacement"), "");
    }

    private void registerObservation() {
        Session serviceSession = this.getServiceSession();
        if (serviceSession != null) {
            try {
                serviceSession.getWorkspace().getObservationManager().addEventListener((EventListener)this, 63, "/", true, null, null, true);
                this.log.info("registered observation listener");
            }
            catch (RepositoryException e) {
                this.log.error("error while registering observation: ", (Throwable)e);
            }
        }
    }

    private void unregisterObservation() {
        Session serviceSession = this.getServiceSession();
        if (serviceSession != null) {
            try {
                serviceSession.getWorkspace().getObservationManager().removeEventListener((EventListener)this);
                this.log.info("unregistered ovservation.");
            }
            catch (RepositoryException e) {
                this.log.error("error unregistering observation: ", (Throwable)e);
            }
        }
    }

    private Session getServiceSession() {
        return (Session)this.serviceResolver.adaptTo(Session.class);
    }

    /*
     * WARNING - Removed try catching itself - possible behaviour change.
     */
    @Deactivate
    private void deactivate() {
        if (this.webConsolePlugin != null) {
            this.webConsolePlugin.dispose();
            this.webConsolePlugin = null;
        }
        Object object = this.registrationSync;
        synchronized (object) {
            if (this.registration != null) {
                this.registration.unregister();
                this.registration = null;
            }
        }
        this.unregisterObservation();
        if (this.serviceResolver != null) {
            this.serviceResolver.close();
            this.serviceResolver = null;
        }
        this.cugRoots.clear();
    }

    public void onEvent(EventIterator events) {
        HashSet<String> cugRootCandidates = new HashSet<String>();
        while (events.hasNext()) {
            Event event = events.nextEvent();
            try {
                String parent;
                String path = event.getPath();
                if (this.cugRoots.containsKey(path)) {
                    cugRootCandidates.add(path);
                    continue;
                }
                String name = ResourceUtil.getName((String)path);
                if (name.startsWith("cq:cug")) {
                    parent = ResourceUtil.getParent((String)path);
                    parent = ResourceUtil.getParent((String)parent);
                    cugRootCandidates.add(parent);
                    continue;
                }
                if (!"jcr:content".equals(name) || !this.cugRoots.containsKey(parent = ResourceUtil.getParent((String)path))) continue;
                cugRootCandidates.add(parent);
            }
            catch (RepositoryException e) {
                this.log.error("error accessing event: ", (Throwable)e);
            }
        }
        if (this.manage(cugRootCandidates)) {
            this.updateRegistration();
        }
    }

    public void handleEvent(org.osgi.service.event.Event event) {
        this.updateRegistration();
    }

    @Override
    public String getLoginPage(HttpServletRequest request) {
        CugRoot cugRoot = this.getCugRoot(request);
        if (cugRoot != null) {
            String loginPage = cugRoot.getLoginPath();
            this.log.debug("Found login page {} of cug root {}", (Object)loginPage, (Object)cugRoot.getRoot());
            if (loginPage != null) {
                if (ResourceUtil.isNonExistingResource((Resource)this.serviceResolver.resolve(loginPage))) {
                    this.log.info("getLoginPage: Configured login page {} does not exist, using default", (Object)loginPage);
                }
                return loginPage;
            }
            this.log.debug("getLoginPage: CUG Root {} defines no login page, using default", (Object)cugRoot);
        }
        return null;
    }

    @Override
    public String getRealm(HttpServletRequest request) {
        CugRoot cugRoot = this.getCugRoot(request);
        return cugRoot != null ? cugRoot.getRealm() : null;
    }

    private CugRoot getCugRoot(HttpServletRequest request) {
        if (this.cugEnabled) {
            Resource mappedResource;
            String handlerPath = null;
            if (request.getParameter("resource") != null) {
                handlerPath = request.getParameter("resource");
            }
            if (handlerPath == null) {
                handlerPath = request.getPathInfo();
            }
            if (handlerPath == null) {
                handlerPath = "/";
            }
            if (!ResourceUtil.isNonExistingResource((Resource)(mappedResource = this.serviceResolver.resolve(request, handlerPath)))) {
                handlerPath = mappedResource.getPath();
            }
            if (!handlerPath.endsWith("/")) {
                handlerPath = handlerPath + "/";
            }
            this.log.debug("Trying to find cug root for {}", (Object)handlerPath);
            for (Map.Entry<String, CugRoot> rootMapEntry : this.cugRoots.entrySet()) {
                if (!handlerPath.startsWith(rootMapEntry.getKey() + (rootMapEntry.getKey().endsWith("/") ? "" : "/"))) continue;
                return rootMapEntry.getValue();
            }
        }
        return null;
    }

    boolean isEnabled() {
        return this.cugEnabled;
    }

    String[] getExemptedPrincipals() {
        return this.cugExemptedPrincipals;
    }

    CugRoot[] getCugRoots() {
        return this.cugRoots.values().toArray(new CugRoot[this.cugRoots.values().size()]);
    }

    private Dictionary<String, Object> getProperties() {
        Hashtable<String, Object> newProps = new Hashtable<String, Object>();
        for (String key : this.properties.keySet()) {
            newProps.put(key, this.properties.get(key));
        }
        HashSet<String> authReqs = new HashSet<String>();
        for (CugRoot cugRoot : this.cugRoots.values()) {
            authReqs.add(cugRoot.getRegistrationPath());
            authReqs.add(cugRoot.getRoot());
            if (cugRoot.getLoginPath() == null) continue;
            authReqs.add("-" + this.toRawPath(cugRoot.getLoginPath()));
        }
        newProps.put("sling.auth.requirements", authReqs.toArray(new String[authReqs.size()]));
        return newProps;
    }

    private String toRawPath(String path) {
        Resource loginPageResource;
        if (this.serviceResolver != null && !ResourceUtil.isNonExistingResource((Resource)(loginPageResource = this.serviceResolver.resolve(path)))) {
            return this.serviceResolver.map(loginPageResource.getPath());
        }
        return path;
    }

    /*
     * WARNING - Removed try catching itself - possible behaviour change.
     */
    private void updateRegistration() {
        Object object = this.registrationSync;
        synchronized (object) {
            try {
                if (this.registration != null) {
                    this.registration.setProperties(this.getProperties());
                }
            }
            catch (NullPointerException npe) {
            }
            catch (IllegalStateException ise) {
            }
            catch (Throwable t) {
                // empty catch block
            }
        }
    }

    private void findInitialSet() {
        String queryString = "select * from nt:base where cq:cugEnabled='true'";
        try {
            Session serviceSession = this.getServiceSession();
            QueryManager qm = serviceSession.getWorkspace().getQueryManager();
            Query q = qm.createQuery(queryString, "sql");
            NodeIterator nodes = q.execute().getNodes();
            while (nodes.hasNext()) {
                Node node = nodes.nextNode();
                if ("jcr:content".equals(node.getName())) {
                    node = node.getParent();
                }
                this.enable(node.getPath(), node);
            }
        }
        catch (RepositoryException re) {
            this.log.error("findInitialSet: Failed finding initial set of CUG roots", (Throwable)re);
        }
    }

    private boolean manage(Set<String> cugRoots) {
        Session serviceSession = this.getServiceSession();
        boolean modified = false;
        for (String cugRoot : cugRoots) {
            try {
                if (serviceSession.itemExists(cugRoot)) {
                    Node node = (Node)serviceSession.getItem(cugRoot);
                    if (CugRoot.isEnabled(node)) {
                        modified |= this.enable(cugRoot, node);
                        continue;
                    }
                    modified |= this.disable(cugRoot);
                    continue;
                }
                modified |= this.disable(cugRoot);
            }
            catch (RepositoryException re) {
                this.log.error("onEvent: Cannot handle potential CUG Root " + cugRoot, (Throwable)re);
            }
        }
        return modified;
    }

    private boolean enable(String cugRoot, Node cugRootNode) throws RepositoryException {
        if (!cugRootNode.getPath().startsWith("/content") || cugRootNode.getPath().startsWith("/content/usergenerated")) {
            this.log.debug("only in /content are honored (with the scxlusion of /content/user-generated");
            return false;
        }
        String fullPath = this.serviceResolver.map(cugRoot);
        CugRoot cr = new CugRoot(fullPath, cugRootNode);
        this.cugRoots.put(cugRoot, cr);
        boolean synchronizedAcl = this.syncACLs(cr, true);
        return synchronizedAcl;
    }

    private boolean disable(String cugRoot) {
        CugRoot cr = this.cugRoots.remove(cugRoot);
        if (cr != null) {
            this.syncACLs(cr, false);
            return true;
        }
        return false;
    }

    private boolean syncACLs(CugRoot cugRoot, boolean applyCugPrincipals) {
        boolean synchronizedACL;
        block12 : {
            synchronizedACL = true;
            Session serviceSession = this.getServiceSession();
            if (serviceSession instanceof JackrabbitSession) {
                try {
                    if (applyCugPrincipals) {
                        synchronizedACL = this.installCUG(cugRoot);
                        break block12;
                    }
                    this.clearCUG(cugRoot);
                }
                catch (Exception ex) {
                    this.log.warn("syncACLs: Cannot apply ACL to " + cugRoot.getRoot(), (Throwable)ex);
                    throw new SlingException(ex.getMessage(), (Throwable)ex);
                }
                finally {
                    try {
                        if (serviceSession.hasPendingChanges()) {
                            serviceSession.refresh(false);
                        }
                    }
                    catch (RepositoryException e) {
                        this.log.error("Failed to revert pending changes.", (Throwable)e);
                        throw new SlingException(e.getMessage(), (Throwable)e);
                    }
                }
            }
            this.log.warn("syncACLs: Cannot apply ACLs to {}: This is only supported with Jackrabbit based Repositories", (Object)cugRoot.getRoot());
            synchronizedACL = false;
        }
        return synchronizedACL;
    }

    private boolean installCUG(CugRoot cugRoot) throws RepositoryException {
        this.log.debug("installCUG: Limitting read access on {}", (Object)cugRoot.getRoot());
        boolean installedCUG = false;
        HashSet<String> principalNames = new HashSet<String>();
        if (cugRoot.getPrincipals() != null) {
            for (String principalName : cugRoot.getPrincipals()) {
                if (principalName == null || principalName.length() <= 0) continue;
                if (this.cugPrincipalsRegex != null && this.cugPrincipalsRegex.length() > 0) {
                    String newPrincipalName = principalName.replaceAll(this.cugPrincipalsRegex, this.cugPrincipalsReplacement);
                    this.log.info("installCUG: replacing principal name " + principalName + " with " + newPrincipalName);
                    principalNames.add(newPrincipalName);
                    continue;
                }
                principalNames.add(principalName);
            }
        }
        Session serviceSession = this.getServiceSession();
        AccessControlManager acMgr = serviceSession.getAccessControlManager();
        PrincipalManager principalManager = ((JackrabbitSession)serviceSession).getPrincipalManager();
        if (serviceSession.itemExists(cugRoot.getRoot())) {
            JackrabbitAccessControlList acl = this.getAcl(cugRoot.getRoot(), acMgr);
            if (acl == null) {
                this.log.warn("installCUG: Cannot install CUG: No editable AccessControlList at " + cugRoot.getRoot());
            } else if (this.needInstall(principalManager, principalNames, acMgr, (AccessControlList)acl)) {
                AccessControlPolicy[] pols;
                if (!acl.isEmpty()) {
                    this.log.debug("installCUG: Removing existing ACEs at " + cugRoot.getRoot());
                    for (AccessControlEntry ace : acl.getAccessControlEntries()) {
                        if (ace.getPrincipal() instanceof SystemUserPrincipal) continue;
                        acl.removeAccessControlEntry(ace);
                    }
                }
                acl.addEntry(principalManager.getEveryone(), new Privilege[]{acMgr.privilegeFromName("{http://www.jcp.org/jcr/1.0}all")}, false);
                for (AccessControlPolicy pol : pols = acMgr.getEffectivePolicies(cugRoot.getRoot())) {
                    if (!(pol instanceof JackrabbitAccessControlList)) continue;
                    JackrabbitAccessControlList effAcl = (JackrabbitAccessControlList)pol;
                    if (cugRoot.getRoot().equals(effAcl.getPath())) continue;
                    AccessControlEntry[] aces = effAcl.getAccessControlEntries();
                    for (String principal : this.cugExemptedPrincipals) {
                        for (AccessControlEntry ace : aces) {
                            if (!principal.equals(ace.getPrincipal().getName())) continue;
                            if (principalManager.hasPrincipal(principal)) {
                                boolean isAllow = ace instanceof JackrabbitAccessControlEntry ? ((JackrabbitAccessControlEntry)ace).isAllow() : true;
                                acl.addEntry(ace.getPrincipal(), ace.getPrivileges(), isAllow);
                                continue;
                            }
                            this.log.warn("installCUG: Cannot install ACE for cugExempted principal '" + principal + "': Unknown to the PrincipalManager.");
                        }
                    }
                }
                if (cugRoot.getPrincipals() != null) {
                    for (AccessControlPolicy principalName22 : cugRoot.getPrincipals()) {
                        Principal princ;
                        void principalName22;
                        if (principalName22 == null || "".equals((Object)principalName22)) continue;
                        if (this.cugPrincipalsRegex != null && this.cugPrincipalsRegex.length() > 0) {
                            String newPrincipalName = principalName22.replaceAll(this.cugPrincipalsRegex, this.cugPrincipalsReplacement);
                            this.log.info("installCUG: replacing principal name " + (String)principalName22 + " with " + newPrincipalName);
                            String principalName22 = newPrincipalName;
                        }
                        if ((princ = principalManager.getPrincipal((String)principalName22)) != null) {
                            acl.addAccessControlEntry(princ, new Privilege[]{acMgr.privilegeFromName("{http://www.jcp.org/jcr/1.0}read")});
                            continue;
                        }
                        this.log.warn("installCUG: Cannot install ACE for admitted principal '" + (String)principalName22 + "': Unknown to the PrincipalManager.");
                    }
                }
                acMgr.setPolicy(cugRoot.getRoot(), (AccessControlPolicy)acl);
                serviceSession.save();
                installedCUG = true;
            } else {
                this.log.debug("installCUG: AccessControlList already correct at " + cugRoot.getRoot());
            }
        } else {
            this.log.warn("installCUG: Cannot install CUG: Target node " + cugRoot.getRoot() + " does not exist.");
        }
        return installedCUG;
    }

    private boolean needInstall(PrincipalManager principalManager, HashSet<String> principalNames, AccessControlManager acMgr, AccessControlList acl) throws RepositoryException {
        this.log.debug("needInstall: Checking current ACL");
        AccessControlEntry[] aces = acl.getAccessControlEntries();
        if (aces == null || aces.length == 0) {
            this.log.debug("needInstall: Yes: no ACL currently installed");
            return true;
        }
        AccessControlEntry zeroAce = aces[0];
        if (!principalManager.getEveryone().equals(zeroAce.getPrincipal()) || zeroAce.getPrivileges().length != 1 || !acMgr.privilegeFromName("{http://www.jcp.org/jcr/1.0}all").equals((Object)zeroAce.getPrivileges()[0]) || !(zeroAce instanceof JackrabbitAccessControlEntry) || ((JackrabbitAccessControlEntry)zeroAce).isAllow()) {
            this.log.debug("needInstall: Yes: first ACE is expected to be DENY JCR_ALL to everyone");
            return true;
        }
        HashSet<String> exempted = new HashSet<String>(Arrays.asList(this.cugExemptedPrincipals));
        HashSet<String> principals = new HashSet<String>(principalNames);
        for (int i = 1; i < aces.length; ++i) {
            AccessControlEntry ace = aces[i];
            if (exempted.remove(ace.getPrincipal().getName())) continue;
            if (!exempted.isEmpty()) {
                this.log.debug("needInstall: Yes: ACE missing for preempted principals {}", exempted);
                return true;
            }
            if (ace.getPrivileges().length != 1 || !acMgr.privilegeFromName("{http://www.jcp.org/jcr/1.0}read").equals((Object)ace.getPrivileges()[0])) {
                this.log.debug("needInstall: Yes: expect ALLOW READ to {}", (Object)ace.getPrincipal().getName());
                return true;
            }
            if (principals.remove(ace.getPrincipal().getName())) continue;
            this.log.debug("needInstall: Yes: ACE owner {} not member of Closed User Group", (Object)ace.getPrincipal().getName());
            return true;
        }
        if (!principals.isEmpty()) {
            this.log.debug("needInstall: Yes: missing ACEs for {}", principals);
            return true;
        }
        this.log.debug("needInstall: No: ACL seems to be up to date");
        return false;
    }

    private void clearCUG(CugRoot cugRoot) throws RepositoryException {
        this.log.debug("syncACLs: Removing all access control from {}", (Object)cugRoot.getRoot());
        Session serviceSession = this.getServiceSession();
        AccessControlManager aMgr = serviceSession.getAccessControlManager();
        String cugPath = cugRoot.getRoot();
        for (AccessControlPolicy pol : aMgr.getPolicies(cugPath)) {
            if (!(pol instanceof AccessControlList)) continue;
            for (AccessControlEntry ace : ((AccessControlList)pol).getAccessControlEntries()) {
                if (ace.getPrincipal() instanceof SystemUserPrincipal) continue;
                ((AccessControlList)pol).removeAccessControlEntry(ace);
            }
            if (((AccessControlList)pol).getAccessControlEntries().length == 0) {
                aMgr.removePolicy(cugPath, pol);
                continue;
            }
            aMgr.setPolicy(cugPath, pol);
        }
        if (serviceSession.hasPendingChanges()) {
            serviceSession.save();
        }
    }

    private JackrabbitAccessControlList getAcl(String path, AccessControlManager acManager) throws RepositoryException {
        AccessControlPolicyIterator app = acManager.getApplicablePolicies(path);
        while (app.hasNext()) {
            AccessControlPolicy pol = app.nextAccessControlPolicy();
            if (!(pol instanceof JackrabbitAccessControlPolicy)) continue;
            this.log.debug("No Policy present create a new ACL Policy");
            return (JackrabbitAccessControlList)pol;
        }
        for (AccessControlPolicy pol : acManager.getPolicies(path)) {
            if (!(pol instanceof JackrabbitAccessControlPolicy)) continue;
            this.log.debug("Found existing ACL Policy");
            return (JackrabbitAccessControlList)pol;
        }
        return null;
    }

    protected void bindResourceResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        this.resourceResolverFactory = resourceResolverFactory;
    }

    protected void unbindResourceResolverFactory(ResourceResolverFactory resourceResolverFactory) {
        if (this.resourceResolverFactory == resourceResolverFactory) {
            this.resourceResolverFactory = null;
        }
    }
}