PermissionResolver.filterSetByAction - denying or allowing?

[edek234]

Hi,

my question is: should this method leave in the Set target for which the resolver allows or denies access?

Seam 2.1.0.SP1, docs 15.6.8.1.1. Writing your own PermissionResolver

This method should remove any objects from the specified set, that would otherwise return false if passed to the hasPermission() method with the same action parameter value.

I understand the above: leave the targets for which access is allowed, remove denied.

In PermissionMapper.filterByPermission:

     if (homogenous)
      { 
         Set<Object> denied = new HashSet<Object>(collection);   
         ResolverChain chain = getResolverChain(targetClass, action);
         for (PermissionResolver resolver : chain.getResolvers())
         {
            resolver.filterSetByAction(denied, action);
         }
         for (Object target : denied)
         {
            collection.remove(target);
         }     
      }

If I understand: PermissionReolvers leave the denied targets in the Set. That would actually make sense, because if any PermissionResover allows, removes the Object from the Set, and permission is allowed, following the logic of PermissionResolver.hasPermission.

Do I miss anything, or is the documentation wrong?

Greetings,
Stefan

[edek234]

JBSEAM-3754

[shane.bryzak]

The denied targets are ultimately removed from the passed-in collection, which is how the documentation describes it.  I've closed the JIRA issue.

[edek234]

I never said they are not removed.

But please relate to the first post, I quote the documentation which is saying that PermissionResolver should remove denied targets, while it should remove allowed targets from passed Set, and that's what builtin PermissionResolvers do.

On Identity API the behaviour is opposite (Identity.filterByPermission).

[shane.bryzak]

Oops you're right, I parsed your post incorrectly thinking that the documentation you were referring to was for PermissionMapper.  I've fixed the docs in SVN for PermissionResolver.