in src/main/java/org/apache/sling/feature/cpconverter/handlers/RepPrincipalPolicyEntryHandler.java [74:106]
public void startElement(String uri, String localName, String qName, Attributes attributes)
throws SAXException {
if (onRepAclNode) {
String primaryType = attributes.getValue(JCR_PRIMARYTYPE);
if (REP_PRINCIPAL_ENTRY.equals(primaryType)) {
if (principalName == null) {
throw new IllegalStateException("isolated principal-based access control entry. no principal found.");
}
List<String> privileges = extractValues(attributes.getValue(REP_PRIVILEGES));
RepoPath effectivePath = new RepoPath(extractEffectivePath(attributes.getValue(REP_EFFECTIVE_PATH)));
AccessControlEntry ace = new AccessControlEntry(true, privileges, effectivePath, true);
// NOTE: nt-definition doesn't allow for jr2-type restrictions defined right below the entry.
// instead always requires rep:restrictions child node
processCurrentAce = aclManager.addAccessControlEntry(principalName, ace);
if (processCurrentAce) {
aces.add(ace);
} else {
hasRejectedNodes = true;
}
} else if (REP_RESTRICTIONS.equals(primaryType) && !aces.isEmpty() && processCurrentAce) {
AccessControlEntry ace = aces.peek();
aces.add(ace);
addRestrictions(ace, attributes);
}
} else {
super.startElement(uri, localName, qName, attributes);
}
if (!onRepAclNode || !processCurrentAce) {
handler.startElement(uri, localName, qName, attributes);
}
}