CCM NG/ccm-cms: Queries used by ContentItemRepository now include permissions.

git-svn-id: https://svn.libreccm.org/ccm/ccm_ng@4732 8810af33-2d31-482b-a856-94f89814c4df

Former-commit-id: 98d4858ff8

ccm-cms/src/main/java/org/librecms/contentsection/ContentItem.java

@@ -88,6 +88,26 @@ import static org.librecms.CmsConstants.*;
                   + "      OR true = :isSystemUser OR true = :isAdmin"
                   + "    )")
     ,
+    @NamedQuery(
+        name = "ContentItem.findByUuid",
+        query
+            = "SELECT DISTINCT i "
+                  + "FROM ContentItem i "
+                  + "JOIN i.permissions p "
+                  + "WHERE i.uuid = :uuid "
+                  + "AND ("
+                  + "      ("
+                  + "        p.grantee IN :roles "
+                  + "        AND p.grantedPrivilege = "
+                  + "          (CASE WHEN i.version = 'DRAFT' "
+                  + "           THEN '" + ItemPrivileges.PREVIEW + "' "
+                  + "           ELSE '" + ItemPrivileges.VIEW_PUBLISHED + "' "
+                  + "           END"
+                  + "          )"
+                  + "      ) "
+                  + "      OR true = :isSystemUser OR true = :isAdmin"
+                  + "    )")
+    ,
     @NamedQuery(
         name = "ContentItem.findByType",
         query
@@ -108,6 +128,48 @@ import static org.librecms.CmsConstants.*;
                   + "      OR true = :isSystemUser OR true = :isAdmin"
                   + "    )")
     ,
+    @NamedQuery(
+        name = "ContentItem.findByIdAndType",
+        query
+            = "SELECT DISTINCT i "
+                  + "FROM ContentItem i "
+                  + "JOIN i.permissions p "
+                  + "WHERE i.objectId = :objectId "
+                  + "AND TYPE(i) = :type "
+                  + "AND ("
+                  + "      ("
+                  + "        p.grantee IN :roles "
+                  + "        AND p.grantedPrivilege = "
+                  + "          (CASE WHEN i.version = 'DRAFT' "
+                  + "           THEN '" + ItemPrivileges.PREVIEW + "' "
+                  + "           ELSE '" + ItemPrivileges.VIEW_PUBLISHED + "' "
+                  + "           END"
+                  + "          )"
+                  + "      ) "
+                  + "      OR true = :isSystemUser OR true = :isAdmin"
+                  + "    )")
+    ,
+    @NamedQuery(
+        name = "ContentItem.findByUuidAndType",
+        query
+            = "SELECT DISTINCT i "
+                  + "FROM ContentItem i "
+                  + "JOIN i.permissions p "
+                  + "WHERE i.uuid = :uuid "
+                  + "AND TYPE(i) = :type "
+                  + "AND ("
+                  + "      ("
+                  + "        p.grantee IN :roles "
+                  + "        AND p.grantedPrivilege = "
+                  + "          (CASE WHEN i.version = 'DRAFT' "
+                  + "           THEN '" + ItemPrivileges.PREVIEW + "' "
+                  + "           ELSE '" + ItemPrivileges.VIEW_PUBLISHED + "' "
+                  + "           END"
+                  + "          )"
+                  + "      ) "
+                  + "      OR true = :isSystemUser OR true = :isAdmin"
+                  + "    )")
+    ,
     @NamedQuery(
         name = "ContentItem.findByFolder",
         query
@@ -133,7 +195,7 @@ import static org.librecms.CmsConstants.*;
     @NamedQuery(
         name = "ContentItem.countItemsInFolder",
         query
-            = "SELECT DISTINCT COUNT(i) "
+            = "SELECT COUNT(DISTINCT i) "
                   + "FROM ContentItem i "
                   + "JOIN i.categories c "
                   + "JOIN i.permissions p "
@@ -177,7 +239,7 @@ import static org.librecms.CmsConstants.*;
     ,
     @NamedQuery(
         name = "ContentItem.countByNameInFolder",
-        query = "SELECT DISTINCT COUNT(i)"
+        query = "SELECT COUNT(DISTINCT i)"
                     + " FROM ContentItem i "
                     + "JOIN i.categories c "
                     + "JOIN i.permissions p "
@@ -205,15 +267,28 @@ import static org.librecms.CmsConstants.*;
                     + "JOIN i.permissions p "
                     + "WHERE c.category = :folder "
                     + "AND c.type = '" + CATEGORIZATION_TYPE_FOLDER + "' "
-                    + "AND LOWER(i.displayName) LIKE CONCAT(LOWER(:name), '%')")
+                    + "AND LOWER(i.displayName) LIKE CONCAT(LOWER(:name), '%') "
+                    + "AND ("
+                    + "      ("
+                    + "        p.grantee IN :roles "
+                    + "        AND p.grantedPrivilege = "
+                    + "          (CASE WHEN i.version = 'DRAFT' "
+                    + "           THEN '" + ItemPrivileges.PREVIEW + "' "
+                    + "           ELSE '" + ItemPrivileges.VIEW_PUBLISHED + "' "
+                    + "           END"
+                    + "          )"
+                    + "       )"
+                    + "       OR true = :isSystemUser OR true = :isAdmin"
+                    + "     ) "
+                    + "ORDER BY i.displayName")
     ,
     @NamedQuery(
         name = "ContentItem.countFilterByFolderAndName",
-        query = "SELECT COUNT(i) FROM ContentItem i "
+        query = "SELECT COUNT(DISTINCT i) FROM ContentItem i "
                     + "JOIN i.categories c "
+                    + "JOIN i.permissions p "
                     + "WHERE c.category = :folder "
-                    + "AND c.type = '" + CATEGORIZATION_TYPE_FOLDER
+                    + "AND c.type = '" + CATEGORIZATION_TYPE_FOLDER + "' "
-                    + "' "
                     + "AND LOWER(i.displayName) LIKE CONCAT(LOWER(:name), '%') "
                     + "AND ("
                     + "      ("

ccm-cms/src/main/java/org/librecms/contentsection/ContentItemRepository.java

@@ -74,7 +74,7 @@ public class ContentItemRepository
 
     @Inject
     private Shiro shiro;
-    
+
     @Inject
     private PermissionChecker permissionChecker;
 
@@ -111,10 +111,16 @@ public class ContentItemRepository
      *         nothing if there is such content item.
      */
     public Optional<ContentItem> findById(final long itemId) {
-        final Optional<CcmObject> result = ccmObjectRepo.findObjectById(itemId);
+
-        if (result.isPresent() && result.get() instanceof ContentItem) {
+        final TypedQuery<ContentItem> query = getEntityManager()
-            return Optional.of((ContentItem) result.get());
+            .createNamedQuery("ContentItem.findById",
-        } else {
+                              ContentItem.class);
+        query.setParameter("objectId", itemId);
+        setAuthorizationParameters(query);
+
+        try {
+            return Optional.of(query.getSingleResult());
+        } catch (NoResultException ex) {
             return Optional.empty();
         }
     }
@@ -133,10 +139,21 @@ public class ContentItemRepository
     @SuppressWarnings("unchecked")
     public <T extends ContentItem> Optional<T> findById(final long itemId,
                                                         final Class<T> type) {
-        final Optional<CcmObject> result = ccmObjectRepo.findById(itemId);
+
-        if (result.get().getClass().isAssignableFrom(type)) {
+        final TypedQuery<ContentItem> query = getEntityManager()
-            return Optional.of((T) result.get());
+            .createNamedQuery("ContentItem.findByIdAndType", ContentItem.class);
-        } else {
+        query.setParameter("objectId", itemId);
+        query.setParameter("type", type);
+        setAuthorizationParameters(query);
+
+        try {
+            final ContentItem result = query.getSingleResult();
+            if (result.getClass().isAssignableFrom(type)) {
+                return Optional.of((T) query.getSingleResult());
+            } else {
+                return Optional.empty();
+            }
+        } catch (NoResultException ex) {
             return Optional.empty();
         }
     }
@@ -150,10 +167,16 @@ public class ContentItemRepository
      *         nothing if there is such content item.
      */
     public Optional<ContentItem> findByUuid(final String uuid) {
-        final Optional<CcmObject> result = ccmObjectRepo.findObjectByUuid(uuid);
+
-        if (result.isPresent() && result.get() instanceof ContentItem) {
+        final TypedQuery<ContentItem> query = getEntityManager()
-            return Optional.of((ContentItem) result.get());
+            .createNamedQuery("ContentItem.findByUuid",
-        } else {
+                              ContentItem.class);
+        query.setParameter("objectId", uuid);
+        setAuthorizationParameters(query);
+
+        try {
+            return Optional.of(query.getSingleResult());
+        } catch (NoResultException ex) {
             return Optional.empty();
         }
     }
@@ -173,12 +196,22 @@ public class ContentItemRepository
     @SuppressWarnings("unchecked")
     public <T extends ContentItem> Optional<T> findByUuid(final String uuid,
                                                           final Class<T> type) {
-        final Optional<CcmObject> result = ccmObjectRepo.findObjectByUuid(uuid);
 
-        if (result.isPresent()
+        final TypedQuery<ContentItem> query = getEntityManager()
-                && result.get().getClass().isAssignableFrom(type)) {
+            .createNamedQuery("ContentItem.findByUuidAndType",
-            return Optional.of((T) result.get());
+                              ContentItem.class);
-        } else {
+        query.setParameter("uuid", uuid);
+        query.setParameter("type", type);
+        setAuthorizationParameters(query);
+
+        try {
+            final ContentItem result = query.getSingleResult();
+            if (result.getClass().isAssignableFrom(type)) {
+                return Optional.of((T) query.getSingleResult());
+            } else {
+                return Optional.empty();
+            }
+        } catch (NoResultException ex) {
             return Optional.empty();
         }
     }
@@ -193,9 +226,11 @@ public class ContentItemRepository
      */
     @SuppressWarnings("unchecked")
     public <T extends ContentItem> List<T> findByType(final Class<T> type) {
+
         final TypedQuery<ContentItem> query = getEntityManager()
             .createNamedQuery("ContentItem.findByType", ContentItem.class);
         query.setParameter("type", type);
+        setAuthorizationParameters(query);
 
         return (List<T>) query.getResultList();
     }
@@ -208,10 +243,12 @@ public class ContentItemRepository
      * @return A list of all items in the provided folder.
      */
     public List<ContentItem> findByFolder(final Category folder) {
+
         final TypedQuery<ContentItem> query = getEntityManager()
             .createNamedQuery("ContentItem.findByFolder",
                               ContentItem.class);
         query.setParameter("folder", folder);
+        setAuthorizationParameters(query);
 
         return query.getResultList();
     }
@@ -224,9 +261,11 @@ public class ContentItemRepository
      * @return The number of content items in the category/folder.
      */
     public long countItemsInFolder(final Category folder) {
+
         final TypedQuery<Long> query = getEntityManager()
             .createNamedQuery("ContentItem.countItemsInFolder", Long.class);
         query.setParameter("folder", folder);
+        setAuthorizationParameters(query);
 
         return query.getSingleResult();
     }
@@ -235,31 +274,13 @@ public class ContentItemRepository
     public Optional<ContentItem> findByNameInFolder(final Category folder,
                                                     final String name) {
 
-        final Optional<User> user = shiro.getUser();
-        final List<Role> roles;
-        if (user.isPresent()) {
-            roles = user
-                .get()
-                .getRoleMemberships()
-                .stream()
-                .map(membership -> membership.getRole())
-                .collect(Collectors.toList());
-        } else {
-            roles = Collections.emptyList();
-        }
-
-        final boolean isSystemUser = shiro.isSystemUser();
-        final boolean isAdmin = permissionChecker.isPermitted("*");
-        
         final TypedQuery<ContentItem> query = getEntityManager()
             .createNamedQuery("ContentItem.findByNameInFolder",
                               ContentItem.class);
         query.setParameter("folder", folder);
         query.setParameter("name", name);
-        query.setParameter("roles", roles);
+        setAuthorizationParameters(query);
-        query.setParameter("isSystemUser", isSystemUser);
+
-        query.setParameter("isAdmin", isAdmin);
-        
         try {
             return Optional.of(query.getSingleResult());
         } catch (NoResultException ex) {
@@ -276,10 +297,12 @@ public class ContentItemRepository
      * @return
      */
     public long countByNameInFolder(final Category folder, final String name) {
+
         final TypedQuery<Long> query = getEntityManager().createNamedQuery(
             "ContentItem.countByNameInFolder", Long.class);
         query.setParameter("folder", folder);
         query.setParameter("name", name);
+        setAuthorizationParameters(query);
 
         return query.getSingleResult();
     }
@@ -296,11 +319,13 @@ public class ContentItemRepository
      */
     public List<ContentItem> filterByFolderAndName(final Category folder,
                                                    final String name) {
+
         final TypedQuery<ContentItem> query = getEntityManager()
             .createNamedQuery("ContentItem.filterByFolderAndName",
                               ContentItem.class);
         query.setParameter("folder", folder);
         query.setParameter("name", name);
+        setAuthorizationParameters(query);
 
         return query.getResultList();
     }
@@ -322,15 +347,18 @@ public class ContentItemRepository
                               Long.class);
         query.setParameter("folder", folder);
         query.setParameter("name", name);
+        setAuthorizationParameters(query);
 
         return query.getSingleResult();
     }
 
     public Optional<ContentItem> findItemWithWorkflow(final Workflow workflow) {
+
         final TypedQuery<ContentItem> query = getEntityManager()
             .createNamedQuery("ContentItem.findItemWithWorkflow",
                               ContentItem.class);
         query.setParameter("workflow", workflow);
+        setAuthorizationParameters(query);
 
         try {
             return Optional.of(query.getSingleResult());
@@ -351,6 +379,7 @@ public class ContentItemRepository
      *         item.
      */
     public Optional<ContentItem> findByPath(final String path) {
+
         //The last token is the name of the item itself. Remove this part an get 
         //the folder containing the item using the FolderRepository.
         final String normalizedPath = PathUtil.normalizePath(path);
@@ -381,6 +410,7 @@ public class ContentItemRepository
      */
     public Optional<ContentItem> findByPath(final ContentSection section,
                                             final String path) {
+
         //The last token is the name of the item itself. Remove this part an get 
         //the folder containing the item using the FolderRepository.
         final String normalizedPath = PathUtil.normalizePath(path);
@@ -449,4 +479,35 @@ public class ContentItemRepository
         }
     }
 
+    /**
+     * A helper method for setting the parameters for the common query
+     * parameters used to determine if a user has access to an item.
+     *
+     * @param query The query on which the parameters are set. No type type
+     *              boundary here to allow usage with all results type used in
+     *              this class ({@link ContentItem} and sub classes ,Long)
+     */
+    private void setAuthorizationParameters(final TypedQuery<?> query) {
+
+        final Optional<User> user = shiro.getUser();
+        final List<Role> roles;
+        if (user.isPresent()) {
+            roles = user
+                .get()
+                .getRoleMemberships()
+                .stream()
+                .map(membership -> membership.getRole())
+                .collect(Collectors.toList());
+        } else {
+            roles = Collections.emptyList();
+        }
+
+        final boolean isSystemUser = shiro.isSystemUser();
+        final boolean isAdmin = permissionChecker.isPermitted("*");
+
+        query.setParameter("roles", roles);
+        query.setParameter("isSystemUser", isSystemUser);
+        query.setParameter("isAdmin", isAdmin);
+    }
+
 }

ccm-cms/src/test/java/org/librecms/contentsection/ContentItemRepositoryTest.java

@@ -21,7 +21,9 @@ package org.librecms.contentsection;
 import java.util.List;
 import java.util.Locale;
 import java.util.Optional;
+
 import javax.inject.Inject;
+
 import org.jboss.arquillian.container.test.api.Deployment;
 import org.jboss.arquillian.junit.Arquillian;
 import org.jboss.arquillian.junit.InSequence;
@@ -50,8 +52,14 @@ import org.librecms.contenttypes.News;
 
 import static org.hamcrest.CoreMatchers.*;
 import static org.junit.Assert.*;
+
 import static org.libreccm.testutils.DependenciesHelpers.*;
 
+import org.apache.shiro.subject.Subject;
+import org.libreccm.security.Shiro;
+
+import java.util.concurrent.Callable;
+
 /**
  *
  * @author <a href="mailto:jens.pelzetter@googlemail.com">Jens Pelzetter</a>
@@ -71,6 +79,9 @@ public class ContentItemRepositoryTest {
     @Inject
     private CategoryRepository categoryRepo;
 
+    @Inject
+    private Shiro shiro;
+
     public ContentItemRepositoryTest() {
     }
 
@@ -92,6 +103,7 @@ public class ContentItemRepositoryTest {
 
     @Deployment
     public static WebArchive createDeployment() {
+
         return ShrinkWrap
             .create(WebArchive.class,
                     "LibreCCM-org.librecms.contentsection.ContentItemRepositoryTest.war")
@@ -154,6 +166,7 @@ public class ContentItemRepositoryTest {
     @Test
     @InSequence(10)
     public void isRepositoryInjected() {
+
         assertThat(itemRepo, is(not(nullValue())));
         assertThat(categoryRepo, is(not(nullValue())));
     }
@@ -163,19 +176,26 @@ public class ContentItemRepositoryTest {
     @UsingDataSet("datasets/org/librecms/contentsection/"
                       + "ContentItemRepositoryTest/data.xml")
     public void findByIdAndType() {
-        final Optional<Article> article1 = itemRepo.findById(
-            -10100L, Article.class);
-        final Optional<Article> article2 = itemRepo.findById(
-            -10200L, Article.class);
-        final Optional<Article> article3 = itemRepo.findById(
-            -10300L, Article.class);
-        final Optional<News> news1 = itemRepo.findById(
-            -10400L, News.class);
 
-        final Optional<Article> newsAsArticle = itemRepo.findById(
+        final Optional<Article> article1 = shiro
-            -10400, Article.class);
+            .getSystemUser()
-        final Optional<News> articleAsNews = itemRepo.findById(
+            .execute(() -> itemRepo.findById(-10100L, Article.class));
-            -10200L, News.class);
+        final Optional<Article> article2 = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10200L, Article.class));
+        final Optional<Article> article3 = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10300L, Article.class));
+        final Optional<News> news1 = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10400L, News.class));
+
+        final Optional<Article> newsAsArticle = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10400, Article.class));
+        final Optional<News> articleAsNews = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10200L, News.class));
 
         assertThat(article1.isPresent(), is(true));
         assertThat(article1.get().getDisplayName(), is(equalTo("article1")));
@@ -195,19 +215,46 @@ public class ContentItemRepositoryTest {
     @UsingDataSet("datasets/org/librecms/contentsection/"
                       + "ContentItemRepositoryTest/data.xml")
     public void findByUuidAndType() {
-        final Optional<Article> article1 = itemRepo.findByUuid(
-            "aed4b402-1180-46c6-b42d-7245f4dca248", Article.class);
-        final Optional<Article> article2 = itemRepo.findByUuid(
-            "acae860f-2ffa-450d-b486-054292f0dae6", Article.class);
-        final Optional<Article> article3 = itemRepo.findByUuid(
-            "f4b38abb-234b-4354-bc92-e36c068a1ebd", Article.class);
-        final Optional<News> news1 = itemRepo.findByUuid(
-            "d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72", News.class);
 
-        final Optional<Article> newsAsArticle = itemRepo.findByUuid(
+        final Subject systemUser = shiro.getSystemUser();
-            "d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72", Article.class);
+
-        final Optional<News> articleAsNews = itemRepo.findByUuid(
+        final Optional<Article> article1 = systemUser
-            "acae860f-2ffa-450d-b486-054292f0dae6", News.class);
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("aed4b402-1180-46c6-b42d-7245f4dca248",
+                                Article.class);
+            });
+        final Optional<Article> article2 = systemUser
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("acae860f-2ffa-450d-b486-054292f0dae6",
+                                Article.class);
+            });
+        final Optional<Article> article3 = systemUser
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("f4b38abb-234b-4354-bc92-e36c068a1ebd",
+                                Article.class);
+            });
+        final Optional<News> news1 = systemUser
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72",
+                                News.class);
+            });
+
+        final Optional<Article> newsAsArticle = systemUser
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("d9ea527d-c6e3-4bdd-962d-c0a1a80c6c72",
+                                Article.class);
+            });
+        final Optional<News> articleAsNews = systemUser
+            .execute(() -> {
+                return itemRepo
+                    .findByUuid("acae860f-2ffa-450d-b486-054292f0dae6",
+                                News.class);
+            });
 
         assertThat(article1.isPresent(), is(true));
         assertThat(article1.get().getDisplayName(), is(equalTo("article1")));
@@ -227,11 +274,16 @@ public class ContentItemRepositoryTest {
     @UsingDataSet("datasets/org/librecms/contentsection/"
                       + "ContentItemRepositoryTest/data.xml")
     public void findByType() {
-        final List<Article> articles = itemRepo.findByType(Article.class);
+
+        final List<Article> articles = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findByType(Article.class));
         assertThat(articles, is(not(nullValue())));
         assertThat(articles.size(), is(3));
 
-        final List<News> news = itemRepo.findByType(News.class);
+        final List<News> news = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findByType(News.class));
         assertThat(news, is(not(nullValue())));
         assertThat(news.size(), is(1));
     }
@@ -245,7 +297,9 @@ public class ContentItemRepositoryTest {
 
         assertThat(folder.getObjects().size(), is(4));
 
-        final List<ContentItem> items = itemRepo.findByFolder(folder);
+        final List<ContentItem> items = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findByFolder(folder));
 
         assertThat(items, is(not(nullValue())));
         assertThat(items.size(), is(4));
@@ -256,9 +310,14 @@ public class ContentItemRepositoryTest {
     @UsingDataSet("datasets/org/librecms/contentsection/"
                       + "ContentItemRepositoryTest/data.xml")
     public void countItemsInFolder() {
+
         final Category folder = categoryRepo.findById(-2100L).get();
 
-        assertThat(itemRepo.countItemsInFolder(folder), is(4L));
+        assertThat(
+            shiro.getSystemUser().execute(() -> {
+                return itemRepo.countItemsInFolder(folder);
+            }),
+            is(4L));
     }
 
     @Test
@@ -266,14 +325,35 @@ public class ContentItemRepositoryTest {
     @UsingDataSet("datasets/org/librecms/contentsection/"
                       + "ContentItemRepositoryTest/data.xml")
     public void countByNameInFolder() {
+
         final Category folder = categoryRepo.findById(-2100L).get();
 
-        assertThat(itemRepo.countByNameInFolder(folder, "article1"), is(1L));
+        final Subject systemUser = shiro.getSystemUser();
-        assertThat(itemRepo.countByNameInFolder(folder, "article2"), is(1L));
+
-        assertThat(itemRepo.countByNameInFolder(folder, "article3"), is(1L));
+        assertThat(
-        assertThat(itemRepo.countByNameInFolder(folder, "article4"), is(0L));
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
-        assertThat(itemRepo.countByNameInFolder(folder, "article"), is(0L));
+                                                                  "article1")),
-        assertThat(itemRepo.countByNameInFolder(folder, "news1"), is(1L));
+            is(1L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
+                                                                  "article2")),
+            is(1L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
+                                                                  "article3")),
+            is(1L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
+                                                                  "article4")),
+            is(0L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
+                                                                  "article")),
+            is(0L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countByNameInFolder(folder,
+                                                                  "news1")),
+            is(1L));
     }
 
     @Test
@@ -283,10 +363,12 @@ public class ContentItemRepositoryTest {
     public void filterByFolderAndName() {
         final Category folder = categoryRepo.findById(-2100L).get();
 
-        final List<ContentItem> articles = itemRepo.filterByFolderAndName(
+        final List<ContentItem> articles = shiro
-            folder, "article");
+            .getSystemUser()
-        final List<ContentItem> news = itemRepo.filterByFolderAndName(folder,
+            .execute(() -> itemRepo.filterByFolderAndName(folder, "article"));
-                                                                      "news");
+        final List<ContentItem> news = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.filterByFolderAndName(folder, "news"));
 
         assertThat(articles.size(), is(3));
         assertThat(news.size(), is(1));
@@ -305,24 +387,42 @@ public class ContentItemRepositoryTest {
     public void countFilterByFolderAndName() {
         final Category folder = categoryRepo.findById(-2100L).get();
 
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "article"),
+        final Subject systemUser = shiro.getSystemUser();
-                   is(3L));
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "art"),
-                   is(3L));
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "article1"),
-                   is(1L));
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "article2"),
-                   is(1L));
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "article3"),
-                   is(1L));
 
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "news"),
+        assertThat(
-                   is(1L));
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "article")),
+            is(3L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "art")),
+            is(3L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "article1")),
+            is(1L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "article2")),
+            is(1L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "article3")),
+            is(1L));
 
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "article10"),
+        assertThat(
-                   is(0L));
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
-        assertThat(itemRepo.countFilterByFolderAndName(folder, "foo"),
+                                                                         "news")),
-                   is(0L));
+            is(1L));
+
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "article10")),
+            is(0L));
+        assertThat(
+            systemUser.execute(() -> itemRepo.countFilterByFolderAndName(folder,
+                                                                         "foo")),
+            is(0L));
     }
 
     @Test
@@ -336,7 +436,10 @@ public class ContentItemRepositoryTest {
                                           "item_uuid",
                                           "timestamp"})
     public void saveChangedItem() {
-        final Optional<ContentItem> item = itemRepo.findById(-10100L);
+
+        final Optional<ContentItem> item = shiro
+            .getSystemUser()
+            .execute(() -> itemRepo.findById(-10100L));
 
         assertThat(item.isPresent(), is(true));
 

ccm-cms/src/test/resources/datasets/org/librecms/contentsection/ContentItemRepositoryTest/after-save.xml

@@ -364,61 +364,301 @@
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41101" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41102" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41103" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41104" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4120" 
                           granted_privilege="create_new_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41201" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41202" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41203" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41204" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4130" 
                           granted_privilege="edit_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41301" 
+                          granted_privilege="edit_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41302" 
+                          granted_privilege="edit_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41303" 
+                          granted_privilege="edit_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41304" 
+                          granted_privilege="edit_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4140" 
                           granted_privilege="view_published_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41401" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41402" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41403" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41404" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4150" 
                           granted_privilege="preview_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-4151" 
+                          granted_privilege="preview_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41502" 
+                          granted_privilege="preview_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41503" 
+                          granted_privilege="preview_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41504" 
+                          granted_privilege="preview_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4210" 
                           granted_privilege="categorize_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42101" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42102" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42103" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42104" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4220" 
                           granted_privilege="create_new_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42201" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42202" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42203" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-422014" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4230" 
                           granted_privilege="edit_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42301" 
+                          granted_privilege="edit_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42302" 
+                          granted_privilege="edit_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42303" 
+                          granted_privilege="edit_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42304" 
+                          granted_privilege="edit_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4240" 
                           granted_privilege="approve_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42401" 
+                          granted_privilege="approve_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42402" 
+                          granted_privilege="approve_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42403" 
+                          granted_privilege="approve_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42404" 
+                          granted_privilege="approve_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4250" 
                           granted_privilege="delete_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42501" 
+                          granted_privilege="delete_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42502" 
+                          granted_privilege="delete_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42503" 
+                          granted_privilege="delete_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42504" 
+                          granted_privilege="delete_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4260" 
                           granted_privilege="view_published_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42601" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42602" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42603" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42604" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4270" 
                           granted_privilege="preview_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42701" 
+                          granted_privilege="preview_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42702" 
+                          granted_privilege="preview_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42703" 
+                          granted_privilege="preview_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42704" 
+                          granted_privilege="preview_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4310" 
                           granted_privilege="administer_roles" 
                           object_id="-1100" 
@@ -529,6 +769,5 @@
                           object_id="-2100" 
                           grantee_id="-3600" 
                           creation_date="2016-07-15"/>
-
     
 </dataset>

ccm-cms/src/test/resources/datasets/org/librecms/contentsection/ContentItemRepositoryTest/data.xml

@@ -278,7 +278,7 @@
     <ccm_core.categorizations categorization_id="-30200" 
                               category_id="-2100" 
                               object_id="-10200" 
-                              category_order="1" 
+                              category_order="1"
                               object_order="2" 
                               category_index="false" 
                               type="folder" />
@@ -328,61 +328,301 @@
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41101" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41102" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41103" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41104" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4120" 
                           granted_privilege="create_new_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41201" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41202" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41203" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41204" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4130" 
                           granted_privilege="edit_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41301" 
+                          granted_privilege="edit_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41302" 
+                          granted_privilege="edit_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41303" 
+                          granted_privilege="edit_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41304" 
+                          granted_privilege="edit_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4140" 
                           granted_privilege="view_published_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41401" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41402" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41403" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41404" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4150" 
                           granted_privilege="preview_items" 
                           object_id="-2100" 
                           grantee_id="-3200" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-4151" 
+                          granted_privilege="preview_items" 
+                          object_id="-10100" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41502" 
+                          granted_privilege="preview_items" 
+                          object_id="-10200" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41503" 
+                          granted_privilege="preview_items" 
+                          object_id="-10300" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-41504" 
+                          granted_privilege="preview_items" 
+                          object_id="-10400" 
+                          grantee_id="-3200" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4210" 
                           granted_privilege="categorize_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42101" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42102" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42103" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42104" 
+                          granted_privilege="categorize_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4220" 
                           granted_privilege="create_new_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42201" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42202" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42203" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-422014" 
+                          granted_privilege="create_new_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4230" 
                           granted_privilege="edit_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42301" 
+                          granted_privilege="edit_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42302" 
+                          granted_privilege="edit_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42303" 
+                          granted_privilege="edit_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42304" 
+                          granted_privilege="edit_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4240" 
                           granted_privilege="approve_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42401" 
+                          granted_privilege="approve_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42402" 
+                          granted_privilege="approve_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42403" 
+                          granted_privilege="approve_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42404" 
+                          granted_privilege="approve_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4250" 
                           granted_privilege="delete_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42501" 
+                          granted_privilege="delete_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42502" 
+                          granted_privilege="delete_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42503" 
+                          granted_privilege="delete_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42504" 
+                          granted_privilege="delete_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4260" 
                           granted_privilege="view_published_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42601" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42602" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42603" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42604" 
+                          granted_privilege="view_published_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4270" 
                           granted_privilege="preview_items" 
                           object_id="-2100" 
                           grantee_id="-3300" 
                           creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42701" 
+                          granted_privilege="preview_items" 
+                          object_id="-10100" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42702" 
+                          granted_privilege="preview_items" 
+                          object_id="-10200" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42703" 
+                          granted_privilege="preview_items" 
+                          object_id="-10300" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
+    <ccm_core.permissions permission_id="-42704" 
+                          granted_privilege="preview_items" 
+                          object_id="-10400" 
+                          grantee_id="-3300" 
+                          creation_date="2016-07-15"/>
     <ccm_core.permissions permission_id="-4310" 
                           granted_privilege="administer_roles" 
                           object_id="-1100" 
@@ -494,5 +734,4 @@
                           grantee_id="-3600" 
                           creation_date="2016-07-15"/>
 
-    
 </dataset>