001/*
002 * (C) Copyright 2006-2007 Nuxeo SA (http://nuxeo.com/) and others.
003 *
004 * Licensed under the Apache License, Version 2.0 (the "License");
005 * you may not use this file except in compliance with the License.
006 * You may obtain a copy of the License at
007 *
008 *     http://www.apache.org/licenses/LICENSE-2.0
009 *
010 * Unless required by applicable law or agreed to in writing, software
011 * distributed under the License is distributed on an "AS IS" BASIS,
012 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
013 * See the License for the specific language governing permissions and
014 * limitations under the License.
015 *
016 * Contributors:
017 *     Nuxeo - initial API and implementation
018 *
019 * $Id: JOOoConvertPluginImpl.java 18651 2007-05-13 20:28:53Z sfermigier $
020 */
021
022package org.nuxeo.ecm.platform.usermanager;
023
024import java.io.Serializable;
025import java.util.List;
026import java.util.Map;
027import java.util.Set;
028
029import org.nuxeo.ecm.core.api.DocumentModel;
030import org.nuxeo.ecm.core.api.DocumentModelList;
031import org.nuxeo.ecm.core.api.NuxeoPrincipal;
032import org.nuxeo.ecm.core.api.security.ACP;
033import org.nuxeo.ecm.core.query.sql.model.QueryBuilder;
034import org.nuxeo.ecm.directory.DirectoryException;
035import org.nuxeo.ecm.platform.usermanager.exceptions.GroupAlreadyExistsException;
036import org.nuxeo.ecm.platform.usermanager.exceptions.UserAlreadyExistsException;
037
038/**
039 * @author Benjamin Jalon <[email protected]>
040 */
041public interface MultiTenantUserManager extends Serializable {
042
043    /**
044     * Retrieves the principal with the given username or null if it does not exist into the given context document. The
045     * context document must be contained into the tenant
046     * <p>
047     * Can build principals for anonymous and virtual users as well as for users defined in the users directory.
048     *
049     * @since 5.5
050     */
051    NuxeoPrincipal getPrincipal(String username, DocumentModel context);
052
053    /**
054     * Search matching groups through their defined search fields into the given context document. The context document
055     * must be contained into the tenant.
056     *
057     * @since 5.5
058     */
059    DocumentModelList searchGroups(String pattern, DocumentModel context);
060
061    /**
062     * Returns groups matching the given query, within the given context.
063     *
064     * @param queryBuilder the query to use, including limit, offset, ordering and countTotal
065     * @param context the context for the tenant, or {@code null}
066     * @since 10.3
067     */
068    DocumentModelList searchGroups(QueryBuilder queryBuilder, DocumentModel context);
069
070    /**
071     * Returns the list of all user ids into the given context document. The context document must be contained into the
072     * tenant.
073     *
074     * @since 5.5
075     */
076    List<String> getUserIds(DocumentModel context);
077
078    /**
079     * Creates user from given model into the given context document. The context document must be contained into the
080     * tenant.
081     *
082     * @since 5.5
083     * @throws UserAlreadyExistsException
084     */
085    DocumentModel createUser(DocumentModel userModel, DocumentModel context) throws
086            UserAlreadyExistsException;
087
088    /**
089     * Updates user represented by given model into the given context document. The context document must be contained
090     * into the tenant.
091     *
092     * @param userModel
093     * @since 5.5
094     */
095    void updateUser(DocumentModel userModel, DocumentModel context);
096
097    /**
098     * Deletes user represented by given model into the given context document. The context document must be contained
099     * into the tenant.
100     *
101     * @since 5.5
102     */
103    void deleteUser(DocumentModel userModel, DocumentModel context);
104
105    /**
106     * Deletes user with given id into the given context document. The context document must be contained into the
107     * tenant.
108     *
109     * @since 5.5
110     */
111    void deleteUser(String userId, DocumentModel context);
112
113    /**
114     * Returns the document model representing user with given id or null if it does not exist into the given context
115     * document. The context document must be contained into the tenant.
116     *
117     * @since 5.5
118     */
119    DocumentModel getUserModel(String userName, DocumentModel context);
120
121    /**
122     * Returns users matching given pattern with the given context. if the Document Context have a directory local
123     * configuration, the service try to open the directory with directory suffix set into the local configuration
124     * <p>
125     * Pattern is used to fill a filter and fulltext map according to users search fields configuration. Search is
126     * performed on each of these fields (OR).
127     *
128     * @since 5.5
129     */
130    DocumentModelList searchUsers(String pattern, DocumentModel context);
131
132    /**
133     * Returns users matching the given query, within the given context.
134     *
135     * @param queryBuilder the query to use, including limit, offset, ordering and countTotal
136     * @param context the context for the tenant, or {@code null}
137     * @since 10.3
138     */
139    DocumentModelList searchUsers(QueryBuilder queryBuilder, DocumentModel context);
140
141    /**
142     * Returns users matching given criteria and with the given context. if the Document Context have a directory local
143     * configuration, the service try to open the user directory with directory suffix set into the local configuration
144     *
145     * @param filter filter with field names as keys
146     * @param fulltext field names used for fulltext match
147     * @param context
148     * @since 5.5
149     */
150    DocumentModelList searchUsers(Map<String, Serializable> filter, Set<String> fulltext, DocumentModel context);
151
152    /**
153     * Returns the list of all groups ids with the given context. if the Document Context have a directory local
154     * configuration, the service try to open the user directory with directory suffix set into the local configuration
155     *
156     * @since 5.5
157     */
158    List<String> getGroupIds(DocumentModel context);
159
160    /**
161     * Returns groups matching given criteria with the given context. if the Document Context have a directory local
162     * configuration, the service try to open the user directory with directory suffix set into the local configuration
163     *
164     * @param filter filter with field names as keys
165     * @param fulltext field names used for fulltext match
166     * @param context
167     * @since 5.5
168     */
169    DocumentModelList searchGroups(Map<String, Serializable> filter, Set<String> fulltext, DocumentModel context);
170
171    /**
172     * Creates a group from given model with the given context. If the Document Context have a directory local
173     * configuration, the service will append at the end of the groupname the directory suffix set into the local
174     * configuration of the context document.
175     *
176     * @return the created group model
177     * @since 5.5
178     * @throws GroupAlreadyExistsException
179     */
180    DocumentModel createGroup(DocumentModel groupModel, DocumentModel context) throws
181            GroupAlreadyExistsException;
182
183    /**
184     * Updates group represented by given model with the given context. If the Document Context have a directory local
185     * configuration, the service will append at the end of the groupname the directory suffix set into the local
186     * configuration of the context document.
187     *
188     * @since 5.5
189     */
190    void updateGroup(DocumentModel groupModel, DocumentModel context);
191
192    /**
193     * Deletes group represented by given model with the given context. If the Document Context have a directory local
194     * configuration, the service will append at the end of the groupname the directory suffix set into the local
195     * configuration of the context document.
196     *
197     * @param groupModel
198     * @since 5.5
199     */
200    void deleteGroup(DocumentModel groupModel, DocumentModel context);
201
202    /**
203     * Deletes group with given id with the given context. If the Document Context have a directory local configuration,
204     * the service will append at the end of the groupname the directory suffix set into the local configuration of the
205     * context document.
206     *
207     * @param groupId
208     * @since 5.5
209     */
210    void deleteGroup(String groupId, DocumentModel context);
211
212    /**
213     * Return the group document model with this id concatenated with the directory local config (if not null) or null
214     * if group does not exist.
215     *
216     * @param groupName the group identifier
217     * @since 5.5
218     */
219    DocumentModel getGroupModel(String groupName, DocumentModel context);
220
221    /**
222     * Returns the list of groups that belong to this group with the given context. If the Document Context have a
223     * directory local configuration, the service will append at the end of the groupname the directory suffix set into
224     * the local configuration of the context document.
225     *
226     * @param parentId the name of the parent group.
227     * @return
228     * @since 5.5
229     */
230    List<String> getGroupsInGroup(String parentId, DocumentModel context);
231
232    /**
233     * Returns the list of groups that are not members of other groups with the given context.
234     *
235     * @return
236     * @since 5.5
237     */
238    List<String> getTopLevelGroups(DocumentModel context);
239
240    /**
241     * Returns the list of users that belong to this group into the given context
242     *
243     * @param groupId ID of the group
244     * @return
245     * @since 5.5
246     */
247    List<String> getUsersInGroup(String groupId, DocumentModel context);
248
249    /**
250     * Get users from a group and its subgroups into the given context
251     *
252     * @param groupId ID of the group
253     * @return
254     * @since 5.5
255     */
256    List<String> getUsersInGroupAndSubGroups(String groupId, DocumentModel context);
257
258    /**
259     * Returns true is users referential is read only (ie : LDAP) -> can not add users -> can not delete users.
260     *
261     * @since 5.5
262     */
263    Boolean areGroupsReadOnly();
264
265    /**
266     * Returns true is groups referential is read only (ie : LDAP) -> can not add groups -> can not delete groups.
267     */
268    Boolean areUsersReadOnly();
269
270    /**
271     * For an ACP, get the list of user that has a permission into the given context. This method should be use with
272     * care as it can cause performance issues while getting the list of users.
273     *
274     * @since 5.5
275     * @param perm the permission
276     * @param acp The access control policy of the document
277     * @return the list of user ids
278     */
279    String[] getUsersForPermission(String perm, ACP acp, DocumentModel context);
280
281}