/**
* Set authorizable id.
*
* @param request The sling request.
* @param node The node where the authorizableId property is set
* @throws RepositoryException if there is an error when saving to repository
*/
private void setAuthorizableId(final SlingHttpServletRequest request, final Node node)
throws RepositoryException {
final String userIdentifier = request.getParameter(CollabUser.PROP_NAME);
final Profile sessionProfile = getSessionProfile(request);
String sessionUserId = null;
if (sessionProfile != null) {
sessionUserId = sessionProfile.getAuthorizable().getID();
}
if (StringUtils.isNotBlank(sessionUserId)) {
final boolean anonymous = "anonymous".equals(sessionUserId);
final boolean authorMode = isAuthorMode();
if (!anonymous && authorMode) {
final boolean userExists = userExists(userIdentifier, node.getSession());
final boolean hasPermissions =
hasPermissions(userIdentifier, getRequestSession(request), node.getSession());
// use node.getSession() because that's an admin session
if (userExists && hasPermissions) {
JcrUtil.setProperty(node, "authorizableId", userIdentifier);
if (!userIdentifier.equals(sessionUserId)) {
log.warn(
"host {} posted a comment with different userIdentifier ({}) than sessionUserId ({})",
new String[] {request.getRemoteAddr(), userIdentifier, sessionUserId});
}
} else {
log.warn(
"host {} posted a comment with an unknown userIdentifier ({})",
request.getRemoteAddr(),
userIdentifier);
}
} else if (!anonymous && !authorMode) {
final String userId = sessionUserId;
if (userIdentifier != null && !sessionUserId.equals(userIdentifier)) {
final StringBuilder exception = new StringBuilder("host ");
exception.append(request.getRemoteAddr());
exception.append("posted a comment with suspect userIdentifier (");
exception.append(userIdentifier);
exception.append("), sessionUserId (");
exception.append(sessionUserId);
exception.append(")");
final String exceptionMessage = exception.toString();
if (log.isWarnEnabled()) {
log.warn(exceptionMessage);
}
throw new CommentException(exceptionMessage);
}
JcrUtil.setProperty(node, "authorizableId", userId);
}
}
}
