/*  Copyright (c) 2000, 2001, Oracle Corporation. All Rights Reserved. */

package oracle.portal.provider.v2.security;

import oracle.portal.provider.v2.*;
import oracle.portal.provider.v2.personalize.PortletReference;

/**
 * A PortletSecurityManager is the access controller for a portlet.  If the Portlet
 * restricts its capabilities in any manner it implements a PortletSecurityManager.
 * The manager is responsible for authorizing (but not authenticating) the user.
 * There are two authorization levels.  The first level checks whether the user
 * is authorized to use this Portlet.  The second level checks whether the user
 * is authorized to use a particular instance of this Portlet.
 */
public abstract class PortletSecurityManager
{

    /**
     *  Verifies whether the user is authorized to use this Portlet. That is
     *  does this user have the necessary privileges to create, get, copy, and
     *  destroy instances of this Portlet.
     *
     *  @param pi the provider instance from which the portlet is being
     *  accessed.
     *  @param pd the definition of the portlet which we want to authorize
     *  access to.
     *  @param user the current user we are being asked to authorize.
     *  @return true is this user is authorized to access this portlet.
     */
    public abstract boolean hasAccess(ProviderInstance pi, 
                                      PortletDefinition p,
                                      ProviderUser user);

    /**
     *  Verifies whether the user is authorized to use this particular portlet
     *  instance.  Generally, this check will only be made of the default instance
     *  as it is assumed you cannot be denied access to the default while having
     *  access to the customized instance, and in turn must always have access
     *  to your customized version if you have access to the default. However,
     *  if asked to authorize a particular instance the PortletNotFoundException
     *  should be thrown if that instance doesn't exist (even if the default does).
     *
     *  @param ref portlet reference
     *  @param  user the current user we are being asked to authorize.
     *  @return true is this user is authorized to access this portlet instance.
     */
    public abstract boolean hasAccess(PortletReference ref, ProviderUser user)
        throws PortletNotFoundException;

}
