org.wicketstuff.security.models

Class SecureCompoundPropertyModel<T>

java.lang.Object

org.apache.wicket.model.ChainingModel<T>

org.apache.wicket.model.CompoundPropertyModel<T>

org.wicketstuff.security.models.SecureCompoundPropertyModel<T>

All Implemented Interfaces:

Serializable, org.apache.wicket.model.IChainingModel<T>, org.apache.wicket.model.IComponentInheritedModel<T>, org.apache.wicket.model.IDetachable, org.apache.wicket.model.IModel<T>, org.apache.wicket.util.io.IClusterable, ISecureModel<T>

Direct Known Subclasses:

SwarmCompoundPropertyModel

public class SecureCompoundPropertyModel<T>
extends org.apache.wicket.model.CompoundPropertyModel<T>
implements ISecureModel<T>

A secure CompoundPropertyModel. Please note that this model does not enforce a security on get or setObject as this is left to Wicket. Please provide an override on the inner class SecureCompoundPropertyModel.AttachedSecureCompoundPropertyModel if you wish to do so

 
 public void setObject(Object obj)
 {
        if(isAuthorized(getOwner(),getActionFactory().getAction(Enable.class))
                super.setObject(obj);
        else
                throw new UnauthorizedActionException(getOwner(),getActionFactory().getAction(Enable.class));
 }
 
 

and override wrapOnInheritance(Component) to return your class. Also note that Wicket by default only checks the setter and not the getter as that is generally equivalent to the render check on the component. Note when setting this model on a page the model is shared with every component on this page including the page itself, failing to grant enough rights to the page will result in an AccessDeniedPage. Failing the 2nd will result in Wicket complaining about missing components. Therefore it is best to set this model on a Panel or Form. Notes for usage: When you have a model that enables the use of a form, note that you need to enable the parent model if you want your form components enabled (like the textfield). The code below shows (copied out the SecureCompoundPropertyModelTest) what you need to set in order to get a form to work.

 
       authorized.put("model:" + SecureModelPage.class.getName(), application.getActionFactory().getAction("render enable"));
       authorized.put("model:label", application.getActionFactory().getAction("render"));
       authorized.put("model:input", application.getActionFactory().getAction("render enable"));
 
 

Author:

marrink

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
protected class	SecureCompoundPropertyModel.AttachedSecureCompoundPropertyModel<Y> Component aware variation of the SecureCompoundPropertyModel that components that inherit the model get.

Constructor Summary

Constructors

Constructor and Description
SecureCompoundPropertyModel(T object) Construct.

Method Summary

Methods

Modifier and Type	Method and Description
protected ActionFactory	getActionFactory() Shortcut to the ActionFactory.
protected WaspAuthorizationStrategy	getStrategy() Shortcut to the IAuthorizationStrategy.
boolean	isAuthenticated(org.apache.wicket.Component component) Checks if the user is authenticated for this model.
boolean	isAuthorized(org.apache.wicket.Component component, WaspAction action) Checks if the component is authorized for this model.
String	toString()
<C> org.apache.wicket.model.IWrapModel<C>	wrapOnInheritance(org.apache.wicket.Component component)

Methods inherited from class org.apache.wicket.model.CompoundPropertyModel

bind, of, propertyExpression

Methods inherited from class org.apache.wicket.model.ChainingModel

detach, getChainedModel, getObject, getTarget, setChainedModel, setObject, setTarget

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.apache.wicket.model.IModel

getObject, setObject

Methods inherited from interface org.apache.wicket.model.IDetachable

detach

Constructor Detail

SecureCompoundPropertyModel

public SecureCompoundPropertyModel(T object)

Construct.

Parameters:

object -

Method Detail

getStrategy

protected final WaspAuthorizationStrategy getStrategy()

Shortcut to the IAuthorizationStrategy.

Returns:

the strategy

getActionFactory

protected final ActionFactory getActionFactory()

Shortcut to the ActionFactory.

Returns:

the factory

wrapOnInheritance

public <C> org.apache.wicket.model.IWrapModel<C> wrapOnInheritance(org.apache.wicket.Component component)

Specified by:

wrapOnInheritance in interface org.apache.wicket.model.IComponentInheritedModel<T>

Overrides:

wrapOnInheritance in class org.apache.wicket.model.CompoundPropertyModel<T>

See Also:

CompoundPropertyModel.wrapOnInheritance(org.apache.wicket.Component)

isAuthenticated

public boolean isAuthenticated(org.apache.wicket.Component component)

Description copied from interface: ISecureModel

Checks if the user is authenticated for this model.

Specified by:

isAuthenticated in interface ISecureModel<T>

Parameters:

component - the (owning) component of the model, some models might allow null.

Returns:

true if the user is authenticated for this model, false otherwise.

See Also:

ISecureModel.isAuthenticated(org.apache.wicket.Component)

isAuthorized

public boolean isAuthorized(org.apache.wicket.Component component,
                   WaspAction action)

Description copied from interface: ISecureModel

Checks if the component is authorized for this model.

Specified by:

isAuthorized in interface ISecureModel<T>

Parameters:

component - the (owning) component of the model, some models might allow null.

Returns:

true if the component is allowed to access this model, false otherwise

See Also:

ISecureModel.isAuthorized(org.apache.wicket.Component, org.wicketstuff.security.actions.WaspAction)

toString

public String toString()

Overrides:

toString in class org.apache.wicket.model.ChainingModel<T>

See Also:

ChainingModel.toString()