Prevent POSTing to a pairtree resource

Resolves: https://jira.duraspace.org/browse/FCREPO-1505
fcrepo · Jul 10, 2015 · 15373cb · 15373cb
1 parent 2a4e650
commit 15373cb
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 0 deletions.
diff --git a/fcrepo-http-api/src/main/java/org/fcrepo/http/api/FedoraLdp.java b/fcrepo-http-api/src/main/java/org/fcrepo/http/api/FedoraLdp.java
@@ -28,6 +28,7 @@
 import static javax.ws.rs.core.Response.ok;
 import static javax.ws.rs.core.Response.Status.CONFLICT;
 import static javax.ws.rs.core.Response.Status.UNSUPPORTED_MEDIA_TYPE;
+import static javax.ws.rs.core.Response.Status.FORBIDDEN;
 import static org.apache.commons.lang.StringUtils.isBlank;
 import static org.apache.jena.riot.WebContent.contentTypeSPARQLUpdate;
 import static org.fcrepo.http.commons.domain.RDFMediaType.JSON_LD;
@@ -39,6 +40,7 @@
 import static org.fcrepo.http.commons.domain.RDFMediaType.TURTLE_X;
 import static org.fcrepo.kernel.FedoraJcrTypes.FEDORA_BINARY;
 import static org.fcrepo.kernel.FedoraJcrTypes.FEDORA_CONTAINER;
+import static org.fcrepo.kernel.FedoraJcrTypes.FEDORA_PAIRTREE;
 import static org.fcrepo.kernel.RdfLexicon.LDP_NAMESPACE;
 import static org.fcrepo.kernel.impl.services.TransactionServiceImpl.getCurrentTransactionId;
 import static org.slf4j.LoggerFactory.getLogger;
@@ -415,6 +417,8 @@ public Response createObject(@QueryParam("checksum") final String checksum,
 
         if (!(resource() instanceof Container)) {
             throw new ClientErrorException("Object cannot have child nodes", CONFLICT);
+        } else if (resource().hasType(FEDORA_PAIRTREE)) {
+            throw new ClientErrorException("Objects cannot be created under pairtree nodes", FORBIDDEN);
         }
 
         final MediaType contentType = getSimpleContentType(requestContentType);

diff --git a/fcrepo-http-api/src/test/java/org/fcrepo/integration/http/api/FedoraLdpIT.java b/fcrepo-http-api/src/test/java/org/fcrepo/integration/http/api/FedoraLdpIT.java
@@ -37,6 +37,7 @@
 import static javax.ws.rs.core.Response.Status.NO_CONTENT;
 import static javax.ws.rs.core.Response.Status.OK;
 import static javax.ws.rs.core.Response.Status.TEMPORARY_REDIRECT;
+import static javax.ws.rs.core.Response.Status.FORBIDDEN;
 import static nu.validator.htmlparser.common.DoctypeExpectation.NO_DOCTYPE_ERRORS;
 import static nu.validator.htmlparser.common.XmlViolationPolicy.ALLOW;
 import static org.apache.http.impl.client.cache.CacheConfig.DEFAULT;
@@ -51,6 +52,7 @@
 import static org.fcrepo.kernel.FedoraJcrTypes.FCR_METADATA;
 import static org.fcrepo.kernel.FedoraJcrTypes.FEDORA_CONTAINER;
 import static org.fcrepo.kernel.FedoraJcrTypes.ROOT;
+import static org.fcrepo.kernel.FedoraJcrTypes.FEDORA_PAIRTREE;
 import static org.fcrepo.kernel.RdfLexicon.BASIC_CONTAINER;
 import static org.fcrepo.kernel.RdfLexicon.CONSTRAINED_BY;
 import static org.fcrepo.kernel.RdfLexicon.CONTAINS;
@@ -1041,6 +1043,29 @@ public void testIngestOnSubtree() throws Exception {
 
     }
 
+    /**
+     * Ensure that the objects cannot be pairtree child resources
+     *
+     */
+    @Test
+    public void testIngestOnPairtree() throws Exception {
+        final HttpResponse response = createObject("");
+
+        //  Following the approach undertaken for FedoraExportIT#shouldRoundTripOnePairtree
+        final String objName = response.getFirstHeader("Location").getValue();
+        final String pairtreeName = objName.substring(serverAddress.length(), objName.lastIndexOf('/'));
+
+        final GraphStore graphStore = getGraphStore(getObjMethod(pairtreeName));
+        assertTrue("Resource \"" + objName + " " + pairtreeName + "\" must be pairtree.", graphStore.contains(ANY,
+                createResource(serverAddress + pairtreeName).asNode(),
+                createURI(REPOSITORY_NAMESPACE + "mixinTypes"),
+                createLiteral(FEDORA_PAIRTREE)));
+
+        // Attempting to POST to the child of the pairtree node...
+        final int status = getStatus(postObjMethod(pairtreeName));
+        assertEquals("Created an Object under a pairtree node!", FORBIDDEN.getStatusCode(), status);
+    }
+
     @Test
     public void testIngestWithRDFLang() throws Exception {
         final HttpPost method = postObjMethod("");