merge branch 'trunk' into OAK-11448

Author: reschke

oak-auth-external/src/main/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/principal/ExternalGroupPrincipalProvider.java

@@ -38,6 +38,8 @@
 import javax.jcr.RepositoryException;
 import javax.jcr.Value;
 import javax.jcr.query.Query;
+
+import org.apache.commons.collections4.IterableUtils;
 import org.apache.jackrabbit.api.security.principal.GroupPrincipal;
 import org.apache.jackrabbit.api.security.principal.ItemBasedPrincipal;
 import org.apache.jackrabbit.api.security.principal.PrincipalManager;
@@ -608,7 +610,7 @@ private boolean isContainedInExternalPrincipalNames(@NotNull Principal member) t
                 Tree tree = root.getTree(((ItemBasedPrincipal) member).getPath());
                 if (UserUtil.isType(tree, AuthorizableType.USER)) {
                     PropertyState ps = tree.getProperty(REP_EXTERNAL_PRINCIPAL_NAMES);
-                    return (ps != null && Iterables.contains(ps.getValue(Type.STRINGS), name));
+                    return (ps != null && IterableUtils.contains(ps.getValue(Type.STRINGS), name));
                 }
             } else {
                 Authorizable a = userManager.getAuthorizable(member);

oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/basic/DefaultSyncContextTest.java

@@ -16,6 +16,7 @@
  */
 package org.apache.jackrabbit.oak.spi.security.authentication.external.basic;
 
+import org.apache.commons.collections4.IterableUtils;
 import org.apache.jackrabbit.guava.common.collect.Iterables;
 import org.apache.jackrabbit.api.security.user.Authorizable;
 import org.apache.jackrabbit.api.security.user.Group;
@@ -904,7 +905,7 @@ public void testSyncMembershipDepthInfinite() throws Exception {
             for (ExternalIdentityRef inheritedGrRef : extGr.getDeclaredGroups()) {
                 Group g = userManager.getAuthorizable(inheritedGrRef.getId(), Group.class);
                 assertNotNull(g);
-                if (Iterables.contains(externalUser.getDeclaredGroups(), inheritedGrRef)) {
+                if (IterableUtils.contains(externalUser.getDeclaredGroups(), inheritedGrRef)) {
                     assertTrue(g.isDeclaredMember(a));
                 } else {
                     assertFalse(g.isDeclaredMember(a));

oak-auth-external/src/test/java/org/apache/jackrabbit/oak/spi/security/authentication/external/impl/DynamicSyncContextTest.java

@@ -164,7 +164,7 @@ void assertSyncedMembership(@NotNull UserManager userManager,
             List<String> ids = getIds(a.memberOf());
             assertTrue("Expected "+ids+ " to contain "+gr.getID(), ids.contains(gr.getID()));
 
-            if (Iterables.contains(declaredGroupRefs, ref)) {
+            if (IterableUtils.contains(declaredGroupRefs, ref)) {
                 assertTrue(gr.isDeclaredMember(a));
                 assertTrue(Iterators.contains(a.declaredMemberOf(), gr));
             }
@@ -203,7 +203,7 @@ static boolean hasStoredMembershipInformation(@NotNull Tree groupTree, @NotNull
 
     private static boolean containsMemberRef(@NotNull Tree tree, @NotNull String ref) {
         Iterable<String> memberRefs = TreeUtil.getStrings(tree, REP_MEMBERS);
-        return memberRefs != null && Iterables.contains(memberRefs, ref);
+        return memberRefs != null && IterableUtils.contains(memberRefs, ref);
     }
 
     @Test(expected = IllegalArgumentException.class)

oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/CugAccessControlManager.java

@@ -367,7 +367,7 @@ private Set<String> collectEffectiveCandidates(@NotNull Root r, @NotNull Iterabl
             String path = eval.remove();
             Tree t = immutableRoot.getTree(path);
             if (PathUtils.denotesRoot(path)) {
-                Iterables.addAll(eval, nestedCugPaths(t));
+                nestedCugPaths(t).forEach(eval::add);
             }
             if (CugUtil.isSupportedPath(path, supportedPaths)) {
                 Tree cug = CugUtil.getCug(t);
@@ -376,7 +376,7 @@ private Set<String> collectEffectiveCandidates(@NotNull Root r, @NotNull Iterabl
                     if (!Collections.disjoint(SetUtils.toSet(principalNames), SetUtils.toSet(pNames.getValue(Type.STRINGS)))) {
                         candidates.add(path);
                     }
-                    Iterables.addAll(eval, nestedCugPaths(cug));
+                    nestedCugPaths(cug).forEach(eval::add);
                 }
             }
         }

oak-authorization-cug/src/main/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/NestedCugHook.java

@@ -325,7 +325,7 @@ private boolean processDiff(@NotNull Diff diff, @NotNull Set<String> reconnect)
                 // parent CUG got removed -> no removal/reconnect required if current path is listed.
                 NodeState cugNode = diff.beforeState.getChildNode(REP_CUG_POLICY);
                 PropertyState ps = cugNode.getProperty(HIDDEN_NESTED_CUGS);
-                if (ps != null && Iterables.contains(ps.getValue(Type.STRINGS), path)) {
+                if (ps != null && IterableUtils.contains(ps.getValue(Type.STRINGS), path)) {
                     log.debug("Nested cug property containing {} has also been removed; no reconnect required.", path);
                     return true;
                 }

oak-authorization-cug/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/cug/impl/CugPolicyImplTest.java

@@ -266,14 +266,14 @@ public void testAddExcludedPrincipal() throws Exception {
 
         Principal excluded = getExcludedPrincipal();
         assertTrue(cug.addPrincipals(EveryonePrincipal.getInstance(), excluded));
-        assertFalse(Iterables.contains(cug.getPrincipalNames(), excluded.getName()));
+        assertFalse(IterableUtils.contains(cug.getPrincipalNames(), excluded.getName()));
     }
 
     @Test
     public void testExcludedPrincipalAddedBefore() {
         Principal excluded = getExcludedPrincipal();
         CugPolicyImpl cug = createCugPolicy(ImportBehavior.ABORT, Collections.singleton(excluded));
-        assertTrue(Iterables.contains(cug.getPrincipalNames(), excluded.getName()));
+        assertTrue(IterableUtils.contains(cug.getPrincipalNames(), excluded.getName()));
     }
 
     @Test

oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/PolicyValidatorTest.java

@@ -16,6 +16,7 @@
  */
 package org.apache.jackrabbit.oak.spi.security.authorization.principalbased.impl;
 
+import org.apache.commons.collections4.IterableUtils;
 import org.apache.jackrabbit.guava.common.collect.Iterables;
 import org.apache.jackrabbit.JcrConstants;
 import org.apache.jackrabbit.api.security.authorization.PrivilegeManager;
@@ -265,7 +266,7 @@ public void tetPolicyChildAddedWrongType() {
     @Test
     public void tetPolicyChildAddedMissingMixinOnParent() {
         NodeState rootState = getTreeProvider().asNodeState(root.getTree(PathUtils.ROOT_PATH));
-        assertFalse(Iterables.contains(rootState.getNames(JcrConstants.JCR_MIXINTYPES), MIX_REP_PRINCIPAL_BASED_MIXIN));
+        assertFalse(IterableUtils.contains(rootState.getNames(JcrConstants.JCR_MIXINTYPES), MIX_REP_PRINCIPAL_BASED_MIXIN));
 
         NodeState child = mockNodeState(NT_REP_PRINCIPAL_POLICY);
         try {

oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/ReadablePathsAccessControlTest.java

@@ -73,7 +73,7 @@ public void before() throws Exception {
         readablePaths = Iterators.cycle(Iterables.transform(paths, f -> getNamePathMapper().getJcrPath(f)));
         Set<String> childPaths = new HashSet<>();
         for (String path : paths) {
-            Iterables.addAll(childPaths, Iterables.transform(root.getTree(path).getChildren(), tree -> getNamePathMapper().getJcrPath(tree.getPath())));
+            Iterables.transform(root.getTree(path).getChildren(), tree -> getNamePathMapper().getJcrPath(tree.getPath())).forEach(childPaths::add);
         }
         readableChildPaths = Iterators.cycle(childPaths);
     }

oak-authorization-principalbased/src/test/java/org/apache/jackrabbit/oak/spi/security/authorization/principalbased/impl/ReadablePathsPermissionTest.java

@@ -64,7 +64,7 @@ public void before() throws Exception {
         readablePaths = Iterators.cycle(paths);
         Set<String> childPaths = new HashSet<>();
         for (String path : paths) {
-            Iterables.addAll(childPaths, Iterables.transform(root.getTree(path).getChildren(), Tree::getPath));
+            Iterables.transform(root.getTree(path).getChildren(), Tree::getPath).forEach(childPaths::add);
         }
         readableChildPaths = Iterators.cycle(childPaths);
 

oak-core-spi/src/main/java/org/apache/jackrabbit/oak/namepath/NameMapper.java

@@ -63,16 +63,35 @@ public interface NameMapper {
     Map<String, String> getSessionLocalMappings();
 
     /**
-     * Returns the JCR name for the given Oak name. The given name is
+     * Returns the JCR name in qualified form for the given Oak name. The given name is
      * expected to have come from a valid Oak repository that contains
      * only valid names with proper namespace mappings. If that's not
      * the case, either a programming error or a repository corruption
      * has occurred and an appropriate unchecked exception gets thrown.
      *
      * @param oakName Oak name
-     * @return JCR name
+     * @return JCR name in qualified form
+     * 
+     * @see <a href="https://s.apache.org/jcr-2.0-spec/3_Repository_Model.html#3.2.5.2%20Qualified%20Form">JCR 2.0, 3.2.5.2 Qualifed Form</a>
      */
     @NotNull
     String getJcrName(@NotNull String oakName);
 
+    /**
+     * Returns the JCR name in expanded form for the given Oak name. The given name is
+     * expected to have come from a valid Oak repository that contains
+     * only valid names with proper namespace mappings. If that's not
+     * the case, either a programming error or a repository corruption
+     * has occurred and an appropriate unchecked exception gets thrown.
+     *
+     * @param oakName Oak name
+     * @return JCR name in expanded form
+     * @since Oak 1.76.0
+     * @throws IllegalStateException in case the namespace URI for the given Oak name cannot be resolved
+     * 
+     * @see <a href="https://s.apache.org/jcr-2.0-spec/3_Repository_Model.html#3.2.5.1%20Expanded%20Form">JCR 2.0, 3.2.5.1 Expanded Form</a>
+     */
+    @NotNull
+    String getExpandedJcrName(@NotNull String oakName);
+
 }