adjustedvalidityperiod.java

一个完整的XACML工程,学习XACML技术的好例子!

/*
* Copyright (c) 2000-2005, University of Salford
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without 
* modification, are permitted provided that the following conditions are met:
*
* Redistributions of source code must retain the above copyright notice, this 
* list of conditions and the following disclaimer.
* 
* Redistributions in binary form must reproduce the above copyright notice, 
* this list of conditions and the following disclaimer in the documentation 
* and/or other materials provided with the distribution. 
*
* Neither the name of the University of Salford nor the names of its 
* contributors may be used to endorse or promote products derived from this 
* software without specific prior written permission. 
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE 
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 
* POSSIBILITY OF SUCH DAMAGE.
*/

package issrg.pba.rbac;

/**
 * This class represents a validity period with run-time rules. It
 * builds the margins updated according to the rules and the given 
 * ValidityPeriod.
 *
 * <p>If the given validity period has NotAfter time between MinSpan and 
 * MaxSpan, and
 * NotBefore time later than Age, then the unchanged validity period is 
 * returned. Otherwise
 * an Invalid Period is returned (null length).
 *
 * <p>If no validity period is provided, it returns "now" for both notBefore 
 * and notAfter times.
 *
 * @author A.Otenko
 */

public class AdjustedValidityPeriod extends RelativeValidityPeriod {

  protected RelativeDate maxSpan;
  protected RelativeDate minSpan;
  protected RelativeDate age;

  private java.util.GregorianCalendar gc=new java.util.GregorianCalendar();

  // this variable contains a reference to an invalid validity
  // period: intersecting withit will always result in a null period
  private final static RelativeValidityPeriod INVALID_PERIOD=null;//new RelativeValidityPeriod(0,0,0,0,0,0,-1,0,0,0,0,0);

  protected AdjustedValidityPeriod() {
    super(0,0,0,0,0,0,
          0,0,0,0,0,0);
  }

  /**
   * This constructor builds a AdjustedValidityPeriod given the Age, Min life 
   * span, and Max life span. Note that if Min life span is longer than Max 
   * life span, any ValidityPeriod will be invalid. Any or all of these 
   * parameters can be null, 
   * meaning that the ValidityPeriods will not be constrained in that respect.
   *
   * @param age - the maximum age of the ValidityPeriod; a RelativeDate showing
   *   the earliest point in the past when the ValidityPeriod can start; if it
   *   starts earlier, it is fully invalid
   * @param minSpan - the minimum life span required of the ValidityPeriod; a
   *   RelativeDate showing the earliest point in the future when the 
   *   ValidityPeriod can end; if it ends earlier, it is fully invalid
   * @param maxSpan - the maximum life span required of the ValidityPeriod; a
   *   RelativeDate showing the latest point in the future when the 
   *   ValidityPeriod can end; if it ends later, it is fully invalid
   */
  public AdjustedValidityPeriod(RelativeDate age, RelativeDate minSpan, RelativeDate maxSpan){
    super(0,0,0,0,0,0,
          0,0,0,0,0,0);

    this.maxSpan=maxSpan;
    this.minSpan=minSpan;
    this.age=age;
  }

  /**
   * This method returns the given ValidityPeriod adjusted according to the
   * constraints provided at construction time. See description of the 
   * logic of the constraints in the constructor.
   *
   * @param vp - the ValidityPeriod to be constrained
   */
  public ValidityPeriod adjust(ValidityPeriod vp){
    if (vp==null) return this;        // if there is nothing on input, return this, which will work as "now"

    synchronized(gc){
      if (age!=null){ // vp is invalid, if it contains age - been valid for too long
        if (vp.getNotBefore()==null){
          return INVALID_PERIOD;
        }

        gc.setTime(getNotBefore());   // this will get now

        gc.add(gc.YEAR, -age.years);
        gc.add(gc.MONTH, -age.months);
        gc.add(gc.DATE, -age.days);
        gc.add(gc.HOUR, -age.hours);
        gc.add(gc.MINUTE, -age.minutes);
        gc.add(gc.SECOND, -age.seconds);
          // now gc is set to the maximum acceptable age. the older must be discarded

        if (gc.getTime().after(vp.getNotBefore())){ // the margin of age is after the notBefore of the given VP
          return INVALID_PERIOD;
        }
      }

      if (minSpan!=null){ // vp is invalid, if it does not contain minSpan - valid for too little time
        if (vp.getNotAfter()!=null){ // if vp.getNotAfter()==null, then vp is infinitely valid => it contains minSpan

          gc.setTime(getNotAfter());   // this will get now

          gc.add(gc.YEAR, minSpan.years);
          gc.add(gc.MONTH, minSpan.months);
          gc.add(gc.DATE, minSpan.days);
          gc.add(gc.HOUR, minSpan.hours);
          gc.add(gc.MINUTE, minSpan.minutes);
          gc.add(gc.SECOND, minSpan.seconds);
          // now gc is set to the minimum acceptable lifespan. the shorter must be discarded

          if (gc.getTime().after(vp.getNotAfter())){ // the margin of lifespan is after the notAfter of the given VP
            return INVALID_PERIOD;
          }
        }
      }

      if (maxSpan!=null){ // vp is invalid, if it contains maxSpan - valid for too long
        if (vp.getNotAfter()==null){
          return INVALID_PERIOD;
        }

        gc.setTime(getNotAfter());   // this will get now

        gc.add(gc.YEAR, maxSpan.years);
        gc.add(gc.MONTH, maxSpan.months);
        gc.add(gc.DATE, maxSpan.days);
        gc.add(gc.HOUR, maxSpan.hours);
        gc.add(gc.MINUTE, maxSpan.minutes);
        gc.add(gc.SECOND, maxSpan.seconds);
          // now gc is set to the maximum acceptable lifespan. the longer must be discarded

        if (gc.getTime().before(vp.getNotAfter())){ // the margin of lifespan is before the notAfter of the given VP
          return INVALID_PERIOD;
        }
      }

      return vp;
    }
  }

  /**
   * This method redefines how intersection rule works. Effectively, it applies
   * the adjust method to compute intersections, if the given Credentials is a
   * ValidityPeriod.
   *
   * @param c - a Credentials to intersect with; makes sense only if it is a 
   *   ValidityPeriod, but supports intersections with other Credentials
   */
  public issrg.pba.Credentials intersection(issrg.pba.Credentials c){
    if (!(c instanceof ValidityPeriod)){
      return super.intersection(c);
    }

    if (c instanceof AdjustedValidityPeriod){
      return new AdjustedPeriodCollection(this, (ValidityPeriod)c);
    }

    return adjust((ValidityPeriod)c);
  }

  public String toString(){
    return "{rule age="+age+", max="+maxSpan+", min="+minSpan+"}";
  }
}