Class AclLinterHelperServiceImpl

java.lang.Object

ubic.gemma.core.security.authorization.acl.AclLinterHelperServiceImpl

All Implemented Interfaces:

AclLinterHelperService

@Service
public class AclLinterHelperServiceImpl
extends Object
implements AclLinterHelperService

Constructor Summary

Constructors

Constructor	Description
AclLinterHelperServiceImpl()

Method Summary

Modifier and Type	Method	Description
Collection<AclLinterService.LintResult>	linkParentsInNewTransaction(Class<? extends SecuredChild<?>> clazz, List<Long> identifiers)	Link each of identifiers to the parent ACL identity its entity resolves to, in a new transaction that commits independently of the caller's.
void	setParentAcl(Class<? extends Securable> clazz, Long identifier, AclObjectIdentity parentAoi)	This MUST go through MutableAclService.updateAcl(MutableAcl) rather than AclObjectIdentity.setParentObject(AclObjectIdentity).

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

AclLinterHelperServiceImpl

public AclLinterHelperServiceImpl()

Method Details

linkParentsInNewTransaction

@Transactional(propagation=REQUIRES_NEW)
public Collection<AclLinterService.LintResult> linkParentsInNewTransaction(Class<? extends SecuredChild<?>> clazz,
 List<Long> identifiers)

Description copied from interface: AclLinterHelperService

Link each of identifiers to the parent ACL identity its entity resolves to, in a new transaction that commits independently of the caller's.

Identifiers whose entity cannot be found, or whose parent cannot be resolved, are reported as unfixed rather than failing the batch — a BioMaterial shared by more than one experiment has no single parent to pick, and there is no point losing the rest of the batch over it.

Specified by:

linkParentsInNewTransaction in interface AclLinterHelperService

setParentAcl

@Transactional
public void setParentAcl(Class<? extends Securable> clazz,
 Long identifier,
 AclObjectIdentity parentAoi)

This MUST go through MutableAclService.updateAcl(MutableAcl) rather than AclObjectIdentity.setParentObject(AclObjectIdentity). AclObjectIdentity is annotated @Immutable, so Hibernate silently discards the dirty state and the fix never reaches the database — no exception, no UPDATE. On 2026-08-06 a production repair run reported 548 successful parent assignments while writing none of them. Routing through JdbcMutableAclService makes the write land and evicts the ACL cache.

entries_inheriting has to be turned on with the parent, not just the parent set. Spring only walks to the parent when it is on, so a link written without it grants nothing and the run still reports a fix. It is off on exactly the rows this repairs: BaseAclAdvice sets it from inheritFromParent, which is false when no parent was discoverable at insert time — the same branch that gives the child its own ACEs. Those ACEs stay, and correctly so: Spring checks an ACL's own entries before the parent's. AclEventListener.handleChild sets both for the same reason.

Specified by:

setParentAcl in interface AclLinterHelperService