/*

 * Copyright (c) 2002, 2017, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

package javax.management;

import java.io.IOException;

import java.io.ObjectInputStream;

import java.security.Permission;

/**

 * <p>Permission controlling access to MBeanServer operations.  If a

 * security manager has been set using {@link

 * System#setSecurityManager}, most operations on the MBean Server

 * require that the caller's permissions imply an MBeanPermission

 * appropriate for the operation.  This is described in detail in the

 * documentation for the {@link MBeanServer} interface.</p>

 *

 * <p>As with other {@link Permission} objects, an MBeanPermission can

 * represent either a permission that you <em>have</em> or a

 * permission that you <em>need</em>.  When a sensitive operation is

 * being checked for permission, an MBeanPermission is constructed

 * representing the permission you need.  The operation is only

 * allowed if the permissions you have {@linkplain #implies imply} the

 * permission you need.</p>

 *

 * <p>An MBeanPermission contains four items of information:</p>

 *

 * <ul>

 *

 * <li><p>The <em>action</em>.  For a permission you need,

 * this is one of the actions in the list <a

 * href="#action-list">below</a>.  For a permission you have, this is

 * a comma-separated list of those actions, or <code>*</code>,

 * representing all actions.</p>

 *

 * <p>The action is returned by {@link #getActions()}.</p>

 *

 * <li><p>The <em>class name</em>.</p>

 *

 * <p>For a permission you need, this is the class name of an MBean

 * you are accessing, as returned by {@link

 * MBeanServer#getMBeanInfo(ObjectName)

 * MBeanServer.getMBeanInfo(name)}.{@link MBeanInfo#getClassName()

 * getClassName()}.  Certain operations do not reference a class name,

 * in which case the class name is null.</p>

 *

 * <p>For a permission you have, this is either empty or a <em>class

 * name pattern</em>.  A class name pattern is a string following the

 * Java conventions for dot-separated class names.  It may end with

 * "<code>.*</code>" meaning that the permission grants access to any

 * class that begins with the string preceding "<code>.*</code>".  For

 * instance, "<code>javax.management.*</code>" grants access to

 * <code>javax.management.MBeanServerDelegate</code> and

 * <code>javax.management.timer.Timer</code>, among other classes.</p>

 *

 * <p>A class name pattern can also be empty or the single character

 * "<code>*</code>", both of which grant access to any class.</p>

 *

 * <li><p>The <em>member</em>.</p>

 *

 * <p>For a permission you need, this is the name of the attribute or

 * operation you are accessing.  For operations that do not reference

 * an attribute or operation, the member is null.</p>

 *

 * <p>For a permission you have, this is either the name of an attribute

 * or operation you can access, or it is empty or the single character

 * "<code>*</code>", both of which grant access to any member.</p>

 *

 * <li id="MBeanName"><p>The <em>object name</em>.</p>

 *

 * <p>For a permission you need, this is the {@link ObjectName} of the

 * MBean you are accessing.  For operations that do not reference a

 * single MBean, it is null.  It is never an object name pattern.</p>

 *

 * <p>For a permission you have, this is the {@link ObjectName} of the

 * MBean or MBeans you can access.  It may be an object name pattern

 * to grant access to all MBeans whose names match the pattern.  It

 * may also be empty, which grants access to all MBeans whatever their

 * name.</p>

 *

 * </ul>

 *

 * <p>If you have an MBeanPermission, it allows operations only if all

 * four of the items match.</p>

 *

 * <p>The class name, member, and object name can be written together

 * as a single string, which is the <em>name</em> of this permission.

 * The name of the permission is the string returned by {@link

 * Permission#getName() getName()}.  The format of the string is:</p>

 *

 * <blockquote>

 * <code>className#member[objectName]</code>

 * </blockquote>

 *

 * <p>The object name is written using the usual syntax for {@link

 * ObjectName}.  It may contain any legal characters, including

 * <code>]</code>.  It is terminated by a <code>]</code> character

 * that is the last character in the string.</p>

 *

 * <p>One or more of the <code>className</code>, <code>member</code>,

 * or <code>objectName</code> may be omitted.  If the

 * <code>member</code> is omitted, the <code>#</code> may be too (but

 * does not have to be).  If the <code>objectName</code> is omitted,

 * the <code>[]</code> may be too (but does not have to be).  It is

 * not legal to omit all three items, that is to have a <em>name</em>

 * that is the empty string.</p>

 *

 * <p>One or more of the <code>className</code>, <code>member</code>,

 * or <code>objectName</code> may be the character "<code>-</code>",

 * which is equivalent to a null value.  A null value is implied by

 * any value (including another null value) but does not imply any

 * other value.</p>

 *

 * <p><a id="action-list">The possible actions are these:</a></p>

 *

 * <ul>

 * <li>addNotificationListener</li>

 * <li>getAttribute</li>

 * <li>getClassLoader</li>

 * <li>getClassLoaderFor</li>

 * <li>getClassLoaderRepository</li>

 * <li>getDomains</li>

 * <li>getMBeanInfo</li>

 * <li>getObjectInstance</li>

 * <li>instantiate</li>

 * <li>invoke</li>

 * <li>isInstanceOf</li>

 * <li>queryMBeans</li>

 * <li>queryNames</li>

 * <li>registerMBean</li>

 * <li>removeNotificationListener</li>

 * <li>setAttribute</li>

 * <li>unregisterMBean</li>

 * </ul>

 *

 * <p>In a comma-separated list of actions, spaces are allowed before

 * and after each action.

 *

 * @since 1.5

 */

public class MBeanPermission extends Permission {

    private static final long serialVersionUID = -2416928705275160661L;

    /**

     * Actions list.

     */

    private static final int AddNotificationListener    = 0x00001;

    private static final int GetAttribute               = 0x00002;

    private static final int GetClassLoader             = 0x00004;

    private static final int GetClassLoaderFor          = 0x00008;

    private static final int GetClassLoaderRepository   = 0x00010;

    private static final int GetDomains                 = 0x00020;

    private static final int GetMBeanInfo               = 0x00040;

    private static final int GetObjectInstance          = 0x00080;

    private static final int Instantiate                = 0x00100;

    private static final int Invoke                     = 0x00200;

    private static final int IsInstanceOf               = 0x00400;

    private static final int QueryMBeans                = 0x00800;

    private static final int QueryNames                 = 0x01000;

    private static final int RegisterMBean              = 0x02000;

    private static final int RemoveNotificationListener = 0x04000;

    private static final int SetAttribute               = 0x08000;

    private static final int UnregisterMBean            = 0x10000;

    /**

     * No actions.

     */

    private static final int NONE = 0x00000;

    /**

     * All actions.

     */

    private static final int ALL =

        AddNotificationListener    |

        GetAttribute               |

        GetClassLoader             |

        GetClassLoaderFor          |

        GetClassLoaderRepository   |

        GetDomains                 |

        GetMBeanInfo               |

        GetObjectInstance          |

        Instantiate                |

        Invoke                     |

        IsInstanceOf               |

        QueryMBeans                |

        QueryNames                 |

        RegisterMBean              |

        RemoveNotificationListener |

        SetAttribute               |

        UnregisterMBean;

    /**

     * The actions string.

     */

    private String actions;

    /**

     * The actions mask.

     */

    private transient int mask;

    /**

     * The classname prefix that must match.  If null, is implied by any

     * classNamePrefix but does not imply any non-null classNamePrefix.

     */

    private transient String classNamePrefix;

    /**

     * True if classNamePrefix must match exactly.  Otherwise, the

     * className being matched must start with classNamePrefix.

     */

    private transient boolean classNameExactMatch;

    /**

     * The member that must match.  If null, is implied by any member

     * but does not imply any non-null member.

     */

    private transient String member;

    /**

     * The objectName that must match.  If null, is implied by any

     * objectName but does not imply any non-null objectName.

     */

    private transient ObjectName objectName;

    /**

     * Parse <code>actions</code> parameter.

     */

    private void parseActions() {

        int mask;

        if (actions == null)

            throw new IllegalArgumentException("MBeanPermission: " +

                                               "actions can't be null");

            throw new IllegalArgumentException("MBeanPermission: " +

                                               "actions can't be empty");

        mask = getMask(actions);

        if ((mask & ALL) != mask)

            throw new IllegalArgumentException("Invalid actions mask");

        if (mask == NONE)

            throw new IllegalArgumentException("Invalid actions mask");

        this.mask = mask;

    }

    /**

     * Parse <code>name</code> parameter.

     */

    private void parseName() {

        String name = getName();

        if (name == null)

            throw new IllegalArgumentException("MBeanPermission name " +

                                               "cannot be null");

            throw new IllegalArgumentException("MBeanPermission name " +

                                               "cannot be empty");

        /* The name looks like "class#member[objectname]".  We subtract

           elements from the right as we parse, so after parsing the

           objectname we have "class#member" and after parsing the

           member we have "class".  Each element is optional.  */

        // Parse ObjectName

        int openingBracket = name.indexOf('[');

        if (openingBracket == -1) {

            // If "[on]" missing then ObjectName("*:*")

            //

            objectName = ObjectName.WILDCARD;

        } else {

            if (!name.endsWith("]")) {

                throw new IllegalArgumentException("MBeanPermission: " +

                                                   "The ObjectName in the " +

                                                   "target name must be " +

                                                   "included in square " +

                                                   "brackets");

            } else {

                // Create ObjectName

                //

                try {

                    // If "[]" then ObjectName("*:*")

                    //

                    String on = name.substring(openingBracket + 1,

                                               name.length() - 1);

                        objectName = ObjectName.WILDCARD;

                    else if (on.equals("-"))

                        objectName = null;

                    else

                        objectName = new ObjectName(on);

                } catch (MalformedObjectNameException e) {

                    throw new IllegalArgumentException("MBeanPermission: " +

                                                       "The target name does " +

                                                       "not specify a valid " +

                                                       "ObjectName", e);

                }

            }

            name = name.substring(0, openingBracket);

        }

        // Parse member

        int poundSign = name.indexOf('#');

        if (poundSign == -1)

            setMember("*");

        else {

            String memberName = name.substring(poundSign + 1);

            setMember(memberName);

            name = name.substring(0, poundSign);

        }

        // Parse className

        setClassName(name);

    }

    /**

     * Assign fields based on className, member, and objectName

     * parameters.

     */

    private void initName(String className, String member,

                          ObjectName objectName) {

        setClassName(className);

        setMember(member);

        this.objectName = objectName;

    }

    private void setClassName(String className) {

        if (className == null || className.equals("-")) {

            classNamePrefix = null;

            classNameExactMatch = false;

            classNamePrefix = "";

            classNameExactMatch = false;

        } else if (className.endsWith(".*")) {

            // Note that we include the "." in the required prefix

            classNamePrefix = className.substring(0, className.length() - 1);

            classNameExactMatch = false;

        } else {

            classNamePrefix = className;

            classNameExactMatch = true;

        }

    }

    private void setMember(String member) {

        if (member == null || member.equals("-"))

            this.member = null;

            this.member = "*";

        else

            this.member = member;

    }

    /**

     * <p>Create a new MBeanPermission object with the specified target name

     * and actions.</p>

     *

     * <p>The target name is of the form

     * "<code>className#member[objectName]</code>" where each part is

     * optional.  It must not be empty or null.</p>

     *

     * <p>The actions parameter contains a comma-separated list of the

     * desired actions granted on the target name.  It must not be

     * empty or null.</p>

     *

     * @param name the triplet "className#member[objectName]".

     * @param actions the action string.

     *

     * @exception IllegalArgumentException if the <code>name</code> or

     * <code>actions</code> is invalid.

     */

    public MBeanPermission(String name, String actions) {

        super(name);

        parseName();

        this.actions = actions;

        parseActions();

    }

    /**

     * <p>Create a new MBeanPermission object with the specified target name

     * (class name, member, object name) and actions.</p>

     *

     * <p>The class name, member and object name parameters define a

     * target name of the form

     * "<code>className#member[objectName]</code>" where each part is

     * optional.  This will be the result of {@link #getName()} on the

     * resultant MBeanPermission.</p>

     *

     * <p>The actions parameter contains a comma-separated list of the

     * desired actions granted on the target name.  It must not be

     * empty or null.</p>

     *

     * @param className the class name to which this permission applies.

     * May be null or <code>"-"</code>, which represents a class name

     * that is implied by any class name but does not imply any other

     * class name.

     * @param member the member to which this permission applies.  May

     * be null or <code>"-"</code>, which represents a member that is

     * implied by any member but does not imply any other member.

     * @param objectName the object name to which this permission

     * applies.  May be null, which represents an object name that is

     * implied by any object name but does not imply any other object

     * name.

     * @param actions the action string.

     */

    public MBeanPermission(String className,

                           String member,

                           ObjectName objectName,

                           String actions) {

        super(makeName(className, member, objectName));

        initName(className, member, objectName);

        this.actions = actions;

        parseActions();

    }

    private static String makeName(String className, String member,

                                   ObjectName objectName) {

        final StringBuilder name = new StringBuilder();

        if (className == null)

            className = "-";

        name.append(className);

        if (member == null)

            member = "-";

        name.append('#').append(member);

        if (objectName == null)

            name.append("[-]");

        else

            name.append('[').append(objectName.getCanonicalName()).append(']');

        /* In the interests of legibility for Permission.toString(), we

           transform the empty string into "*".  */

        if (name.length() == 0)

            return "*";

        else

            return name.toString();

    }

    /**

     * Returns the "canonical string representation" of the actions. That is,

     * this method always returns present actions in alphabetical order.

     *

     * @return the canonical string representation of the actions.

     */

    public String getActions() {

        if (actions == null)

            actions = getActions(this.mask);

        return actions;

    }

    /**

     * Returns the "canonical string representation"

     * of the actions from the mask.

     */

    private static String getActions(int mask) {

        final StringBuilder sb = new StringBuilder();

        boolean comma = false;

        if ((mask & AddNotificationListener) == AddNotificationListener) {

            comma = true;

            sb.append("addNotificationListener");

        }

        if ((mask & GetAttribute) == GetAttribute) {

            if (comma) sb.append(',');

            else comma = true;

            sb.append("getAttribute");

        }

        if ((mask & GetClassLoader) == GetClassLoader) {

            if (comma) sb.append(',');

            else comma = true;

            sb.append("getClassLoader");

        }

        if ((mask & GetClassLoaderFor) == GetClassLoaderFor) {

            if (comma) sb.append(',');

            else comma = true;

            sb.append("getClassLoaderFor");

        }

        if ((mask & GetClassLoaderRepository) == GetClassLoaderRepository) {

            if (comma) sb.append(',');

            else comma = true;

            sb.append("getClassLoaderRepository");

        }