File D:\maven-qcr-plugin-testsunitaires\qcr4java\h2-1.3.170-sources\target\site\qc\lecode\engine\User.java.html

1 /*
2 * Copyright 2004-2011 H2 Group. Multiple-Licensed under the H2 License,
3 * Version 1.0, and under the Eclipse Public License, Version 1.0
4 * (http://h2database.com/html/license.html).
5 * Initial Developer: H2 Group
6 */
7 package org.h2.engine;
8
9 import java.util.ArrayList;
10 import java.util.Arrays;
11 import org.h2.constant.ErrorCode;
12 import org.h2.message.DbException;
13 import org.h2.message.Trace;
14 import org.h2.schema.Schema;
15 import org.h2.security.SHA256;
16 import org.h2.table.MetaTable;
17 import org.h2.table.RangeTable;
18 import org.h2.table.Table;
19 import org.h2.table.TableView;
20 import org.h2.util.MathUtils;
21 import org.h2.util.New;
22 import org.h2.util.StringUtils;
23 import org.h2.util.Utils;
24
25 /**
26 * Represents a user object.
27 */
28 public class User extends RightOwner {
29
30 private final boolean systemUser;
31 private byte[] salt;
32 private byte[] passwordHash;
33 private boolean admin;
34
35 public User(Database database, int id, String userName, boolean systemUser) {
36 super(database, id, userName, Trace.USER);
37 this.systemUser = systemUser;
38 }
39
40 public void setAdmin(boolean admin) {
41 this.admin = admin;
42 }
43
44 public boolean isAdmin() {
45 return admin;
46 }
47
48 /**
49 * Set the salt and hash of the password for this user.
50 *
51 * @param salt the salt
52 * @param hash the password hash
53 */
54 public void setSaltAndHash(byte[] salt, byte[] hash) {
55 this.salt = salt;
56 this.passwordHash = hash;
57 }
58
59 /**
60 * Set the user name password hash. A random salt is generated as well.
61 * The parameter is filled with zeros after use.
62 *
63 * @param userPasswordHash the user name password hash
64 */
65 public void setUserPasswordHash(byte[] userPasswordHash) {
66 if (userPasswordHash != null) {
67 if (userPasswordHash.length == 0) {
68 salt = passwordHash = userPasswordHash;
69 } else {
70 salt = new byte[Constants.SALT_LEN];
71 MathUtils.randomBytes(salt);
72 passwordHash = SHA256.getHashWithSalt(userPasswordHash, salt);
73 }
74 }
75 }
76
77 public String getCreateSQLForCopy(Table table, String quotedName) {
78 throw DbException.throwInternalError();
79 }
80
81 public String getCreateSQL() {
82 return getCreateSQL(true);
83 }
84
85 public String getDropSQL() {
86 return null;
87 }
88
89 /**
90 * Checks that this user has the given rights for this database object.
91 *
92 * @param table the database object
93 * @param rightMask the rights required
94 * @throws DbException if this user does not have the required rights
95 */
96 public void checkRight(Table table, int rightMask) {
97 if (!hasRight(table, rightMask)) {
98 throw DbException.get(ErrorCode.NOT_ENOUGH_RIGHTS_FOR_1, table.getSQL());
99 }
100 }
101
102 /**
103 * See if this user has the given rights for this database object.
104 *
105 * @param table the database object
106 * @param rightMask the rights required
107 * @return true if the user has the rights
108 */
109 public boolean hasRight(Table table, int rightMask) {
110 if (rightMask != Right.SELECT && !systemUser) {
111 table.checkWritingAllowed();
112 }
113 if (admin) {
114 return true;
115 }
116 Role publicRole = database.getPublicRole();
117 if (publicRole.isRightGrantedRecursive(table, rightMask)) {
118 return true;
119 }
120 if (table instanceof MetaTable || table instanceof RangeTable) {
121 // everybody has access to the metadata information
122 return true;
123 }
124 String tableType = table.getTableType();
125 if (Table.VIEW.equals(tableType)) {
126 TableView v = (TableView) table;
127 if (v.getOwner() == this) {
128 // the owner of a view has access:
129 // SELECT * FROM (SELECT * FROM ...)
130 return true;
131 }
132 } else if (tableType == null) {
133 // function table
134 return true;
135 }
136 if (table.isTemporary() && !table.isGlobalTemporary()) {
137 // the owner has all rights on local temporary tables
138 return true;
139 }
140 if (isRightGrantedRecursive(table, rightMask)) {
141 return true;
142 }
143 return false;
144 }
145
146 /**
147 * Get the CREATE SQL statement for this object.
148 *
149 * @param password true if the password (actually the salt and hash) should
150 * be returned
151 * @return the SQL statement
152 */
153 public String getCreateSQL(boolean password) {
154 StringBuilder buff = new StringBuilder("CREATE USER IF NOT EXISTS ");
155 buff.append(getSQL());
156 if (comment != null) {
157 buff.append(" COMMENT ").append(StringUtils.quoteStringSQL(comment));
158 }
159 if (password) {
160 buff.append(" SALT '").
161 append(StringUtils.convertBytesToHex(salt)).
162 append("' HASH '").
163 append(StringUtils.convertBytesToHex(passwordHash)).
164 append('\'');
165 } else {
166 buff.append(" PASSWORD ''");
167 }
168 if (admin) {
169 buff.append(" ADMIN");
170 }
171 return buff.toString();
172 }
173
174 /**
175 * Check the password of this user.
176 *
177 * @param userPasswordHash the password data (the user password hash)
178 * @return true if the user password hash is correct
179 */
180 boolean validateUserPasswordHash(byte[] userPasswordHash) {
181 if (userPasswordHash.length == 0 && passwordHash.length == 0) {
182 return true;
183 }
184 if (userPasswordHash.length == 0) {
185 userPasswordHash = SHA256.getKeyPasswordHash(getName(), new char[0]);
186 }
187 byte[] hash = SHA256.getHashWithSalt(userPasswordHash, salt);
188 return Utils.compareSecure(hash, passwordHash);
189 }
190
191 /**
192 * Check if this user has admin rights. An exception is thrown if he does
193 * not have them.
194 *
195 * @throws DbException if this user is not an admin
196 */
197 public void checkAdmin() {
198 if (!admin) {
199 throw DbException.get(ErrorCode.ADMIN_RIGHTS_REQUIRED);
200 }
201 }
202
203 public int getType() {
204 return DbObject.USER;
205 }
206
207 public ArrayList<DbObject> getChildren() {
208 ArrayList<DbObject> children = New.arrayList();
209 for (Right right : database.getAllRights()) {
210 if (right.getGrantee() == this) {
211 children.add(right);
212 }
213 }
214 for (Schema schema : database.getAllSchemas()) {
215 if (schema.getOwner() == this) {
216 children.add(schema);
217 }
218 }
219 return children;
220 }
221
222 public void removeChildrenAndResources(Session session) {
223 for (Right right : database.getAllRights()) {
224 if (right.getGrantee() == this) {
225 database.removeDatabaseObject(session, right);
226 }
227 }
228 database.removeMeta(session, getId());
229 salt = null;
230 Arrays.fill(passwordHash, (byte) 0);
231 passwordHash = null;
232 invalidate();
233 }
234
235 public void checkRename() {
236 // ok
237 }
238
239 /**
240 * Check that this user does not own any schema. An exception is thrown if he
241 * owns one or more schemas.
242 *
243 * @throws DbException if this user owns a schema
244 */
245 public void checkOwnsNoSchemas() {
246 for (Schema s : database.getAllSchemas()) {
247 if (this == s.getOwner()) {
248 throw DbException.get(ErrorCode.CANNOT_DROP_2, getName(), s.getName());
249 }
250 }
251 }
252
253 }
254