/*  Copyright (c) 2000 by Oracle Corporation. All Rights Reserved. */

package oracle.portal.provider.v2.security;

import oracle.portal.provider.v2.ProviderUser;
import oracle.portal.provider.v2.ProviderInstance;
import oracle.portal.provider.v2.PortletDefinition;
import oracle.portal.provider.v2.PortletNotFoundException;
import oracle.portal.provider.v2.personalize.PortletReference;

/**
 * DenyAllSecurityManager is a simple security manager that always denys access
 * regardless of the user or portlet instance. This can be used to test security
 * features or make a portlet temporarily inaccessible to all users.
 */
public class DenyAllSecurityManager extends PortletSecurityManager
{
    /**
     *  Verifies whether the user is authorized to use this Portlet. That is
     *  does this user have the necessary privileges to create, get, copy, and
     *  destroy instances of this Portlet.
     *
     *  This implementation always returns false and effectively denys access
     *  to all users. This security manager can be used to temporarily hide a
     *  portlet 
     *
     *  @param pi the provider instance from which the portlet is being
     *  accessed.
     *  @param pd the definition of the portlet which we want to authorize
     *  access to.
     *  @param user the current user we are being asked to authorize.
     *  @return false (denys access to all users for all portlets)
     */
    public boolean hasAccess(ProviderInstance pi, 
                             PortletDefinition p,
                             ProviderUser user)
    {
        return false;
    }

    /**
     *  Verifies whether the user is authorized to use this particular portlet
     *  instance.  Generally, this check will only be made of the default instance
     *  as it is assumed you cannot be denied access to the default while having
     *  access to the customized instance, and in turn must always have access
     *  to your customized version if you have access to the default. However,
     *  if asked to authorize a particular instance the PortletNotFoundException
     *  should be thrown if that instance doesn't exist (even if the default does).
     *
     *  This implementation always returns false and effectively denys access
     *  to all users. This security manager can be used to temporarily hide a
     *  portlet 
     *
     *  @param ref portlet reference
     *  @param  user the current user we are being asked to authorize.
     *  @return always (denys access to all users for all portlet instances)
     */
    public boolean hasAccess(PortletReference ref, ProviderUser user)
        throws PortletNotFoundException
    {
        return false;
    }

}

