#13: ACL system

docs-web/src/main/java/com/sismics/docs/rest/resource/AclResource.java

@@ -0,0 +1,174 @@
+package com.sismics.docs.rest.resource;
+
+import java.text.MessageFormat;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.ws.rs.DELETE;
+import javax.ws.rs.FormParam;
+import javax.ws.rs.GET;
+import javax.ws.rs.PUT;
+import javax.ws.rs.Path;
+import javax.ws.rs.PathParam;
+import javax.ws.rs.Produces;
+import javax.ws.rs.QueryParam;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+
+import org.codehaus.jettison.json.JSONException;
+import org.codehaus.jettison.json.JSONObject;
+
+import com.sismics.docs.core.constant.AclTargetType;
+import com.sismics.docs.core.constant.PermType;
+import com.sismics.docs.core.dao.jpa.AclDao;
+import com.sismics.docs.core.dao.jpa.DocumentDao;
+import com.sismics.docs.core.dao.jpa.UserDao;
+import com.sismics.docs.core.dao.jpa.criteria.UserCriteria;
+import com.sismics.docs.core.dao.jpa.dto.UserDto;
+import com.sismics.docs.core.model.jpa.Acl;
+import com.sismics.docs.core.model.jpa.Document;
+import com.sismics.docs.core.model.jpa.User;
+import com.sismics.docs.core.util.jpa.PaginatedList;
+import com.sismics.docs.core.util.jpa.PaginatedLists;
+import com.sismics.docs.core.util.jpa.SortCriteria;
+import com.sismics.rest.exception.ClientException;
+import com.sismics.rest.exception.ForbiddenClientException;
+import com.sismics.rest.util.ValidationUtil;
+
+/**
+ * ACL REST resources.
+ * 
+ * @author bgamard
+ */
+@Path("/acl")
+public class AclResource extends BaseResource {
+    /**
+     * Add an ACL.
+     * 
+     * @return Response
+     * @throws JSONException
+     */
+    @PUT
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response add(@FormParam("source") String sourceId,
+            @FormParam("perm") String permStr,
+            @FormParam("username") String username) throws JSONException {
+        if (!authenticate()) {
+            throw new ForbiddenClientException();
+        }
+        
+        // Validate input
+        sourceId = ValidationUtil.validateLength(sourceId, "source", 36, 36, false);
+        PermType perm = PermType.valueOf(ValidationUtil.validateLength(permStr, "perm", 1, 30, false));
+        username = ValidationUtil.validateLength(username, "username", 1, 50, false);
+        
+        // Validate the target user
+        UserDao userDao = new UserDao();
+        User user = userDao.getActiveByUsername(username);
+        if (user == null) {
+            throw new ClientException("UserNotFound", MessageFormat.format("User not found: {0}", username));
+        }
+        
+        // Check permission on the source by the principal
+        AclDao aclDao = new AclDao();
+        if (!aclDao.checkPermission(sourceId, PermType.WRITE, principal.getId())) {
+            throw new ForbiddenClientException();
+        }
+        
+        // Create the ACL
+        Acl acl = new Acl();
+        acl.setSourceId(sourceId);
+        acl.setPerm(perm);
+        acl.setTargetId(user.getId());
+        
+        // Avoid duplicates
+        if (!aclDao.checkPermission(acl.getSourceId(), acl.getPerm(), acl.getTargetId())) {
+            aclDao.create(acl);
+            
+            // Returns the ACL
+            JSONObject response = new JSONObject();
+            response.put("perm", acl.getPerm().name());
+            response.put("id", acl.getTargetId());
+            response.put("name", user.getUsername());
+            response.put("type", AclTargetType.USER.name());
+            return Response.ok().entity(response).build();
+        }
+        
+        return Response.ok().entity(new JSONObject()).build();
+    }
+    
+    /**
+     * Deletes an ACL.
+     * 
+     * @param id ACL ID
+     * @return Response
+     * @throws JSONException
+     */
+    @DELETE
+    @Path("{sourceId: [a-z0-9\\-]+}/{perm: READ|WRITE}/{targetId: [a-z0-9\\-]+}")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response delete(
+            @PathParam("sourceId") String sourceId,
+            @PathParam("perm") String permStr,
+            @PathParam("targetId") String targetId) throws JSONException {
+        if (!authenticate()) {
+            throw new ForbiddenClientException();
+        }
+        
+        // Validate input
+        sourceId = ValidationUtil.validateLength(sourceId, "source", 36, 36, false);
+        PermType perm = PermType.valueOf(ValidationUtil.validateLength(permStr, "perm", 1, 30, false));
+        targetId = ValidationUtil.validateLength(targetId, "target", 36, 36, false);
+
+        // Check permission on the source by the principal
+        AclDao aclDao = new AclDao();
+        if (!aclDao.checkPermission(sourceId, PermType.WRITE, principal.getId())) {
+            throw new ForbiddenClientException();
+        }
+        
+        // Cannot delete R/W on a source document if the target is the creator
+        DocumentDao documentDao = new DocumentDao();
+        Document document = documentDao.getById(sourceId);
+        if (document != null && document.getUserId().equals(targetId)) {
+            throw new ClientException("AclError", "Cannot delete base ACL on a document");
+        }
+        
+        // Delete the ACL
+        aclDao.delete(sourceId, perm, targetId);
+        
+        // Always return ok
+        JSONObject response = new JSONObject();
+        response.put("status", "ok");
+        return Response.ok().entity(response).build();
+    }
+    
+    @GET
+    @Path("target/search")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response targetList(@QueryParam("search") String search) throws JSONException {
+        if (!authenticate()) {
+            throw new ForbiddenClientException();
+        }
+        
+        // Validate input
+        search = ValidationUtil.validateLength(search, "search", 1, 50, false);
+        
+        // Search users
+        UserDao userDao = new UserDao();
+        JSONObject response = new JSONObject();
+        List<JSONObject> users = new ArrayList<>();
+        
+        PaginatedList<UserDto> paginatedList = PaginatedLists.create();
+        SortCriteria sortCriteria = new SortCriteria(1, true);
+
+        userDao.findByCriteria(paginatedList, new UserCriteria().setSearch(search), sortCriteria);
+        for (UserDto userDto : paginatedList.getResultList()) {
+            JSONObject user = new JSONObject();
+            user.put("username", userDto.getUsername());
+            users.add(user);
+        }
+        
+        response.put("users", users);
+        return Response.ok().entity(response).build();
+    }
+}

docs-web/src/main/java/com/sismics/docs/rest/resource/AppResource.java

@@ -6,6 +6,8 @@ import java.util.List;
 import java.util.Map;
 import java.util.ResourceBundle;
 
+import javax.persistence.EntityManager;
+import javax.persistence.Query;
 import javax.ws.rs.GET;
 import javax.ws.rs.POST;
 import javax.ws.rs.Path;
@@ -20,11 +22,14 @@ import org.apache.log4j.Logger;
 import org.codehaus.jettison.json.JSONException;
 import org.codehaus.jettison.json.JSONObject;
 
+import com.sismics.docs.core.constant.PermType;
+import com.sismics.docs.core.dao.jpa.AclDao;
 import com.sismics.docs.core.dao.jpa.DocumentDao;
 import com.sismics.docs.core.dao.jpa.FileDao;
 import com.sismics.docs.core.dao.jpa.criteria.DocumentCriteria;
 import com.sismics.docs.core.dao.jpa.dto.DocumentDto;
 import com.sismics.docs.core.model.context.AppContext;
+import com.sismics.docs.core.model.jpa.Acl;
 import com.sismics.docs.core.model.jpa.File;
 import com.sismics.docs.core.util.ConfigUtil;
 import com.sismics.docs.core.util.DirectoryUtil;
@@ -34,6 +39,7 @@ import com.sismics.docs.core.util.jpa.SortCriteria;
 import com.sismics.docs.rest.constant.BaseFunction;
 import com.sismics.rest.exception.ForbiddenClientException;
 import com.sismics.rest.exception.ServerException;
+import com.sismics.util.context.ThreadLocalContext;
 import com.sismics.util.log4j.LogCriteria;
 import com.sismics.util.log4j.LogEntry;
 import com.sismics.util.log4j.MemoryAppender;
@@ -206,4 +212,58 @@ public class AppResource extends BaseResource {
         response.put("status", "ok");
         return Response.ok().entity(response).build();
     }
+    
+    /**
+     * Rebuild ACLs.
+     * Set Read + Write on documents' creator.
+     * Loose all sharing.
+     * 
+     * @return Response
+     * @throws JSONException
+     */
+    @POST
+    @Path("batch/rebuild_acls")
+    @Produces(MediaType.APPLICATION_JSON)
+    public Response batchRebuildAcls() throws JSONException {
+        if (!authenticate()) {
+            throw new ForbiddenClientException();
+        }
+        checkBaseFunction(BaseFunction.ADMIN);
+        
+        AclDao aclDao = new AclDao();
+        EntityManager em = ThreadLocalContext.get().getEntityManager();
+        em.createNativeQuery("truncate table T_ACL").executeUpdate();
+        em.createNativeQuery("truncate table T_SHARE").executeUpdate();
+        
+        Query q = em.createNativeQuery("select DOC_ID_C, DOC_IDUSER_C from T_DOCUMENT");
+        @SuppressWarnings("unchecked")
+        List<Object[]> l = q.getResultList();
+        for (Object[] o : l) {
+            String documentId = (String) o[0];
+            String userId = (String) o[1];
+            
+            // Create read ACL
+            Acl acl = new Acl();
+            acl.setPerm(PermType.READ);
+            acl.setSourceId(documentId);
+            acl.setTargetId(userId);
+            System.out.println(acl);
+            aclDao.create(acl);
+            
+            // Create write ACL
+            acl = new Acl();
+            acl.setPerm(PermType.WRITE);
+            acl.setSourceId(documentId);
+            acl.setTargetId(userId);
+            System.out.println(acl);
+            aclDao.create(acl);
+        }
+        
+        int mod = em.createNativeQuery("update T_FILE set FIL_IDUSER_C = (select DOC_IDUSER_C from T_DOCUMENT where DOC_ID_C = FIL_IDDOC_C) where FIL_IDDOC_C is not null").executeUpdate();
+        
+        JSONObject response = new JSONObject();
+        response.put("status", "ok");
+        response.put("file_id_user_updated", mod);
+        return Response.ok().entity(response).build();
+    }
 }

docs-web/src/main/java/com/sismics/docs/rest/resource/DocumentResource.java

@@ -33,11 +33,13 @@ import org.joda.time.format.DateTimeParser;
 import com.google.common.base.Joiner;
 import com.google.common.base.Strings;
 import com.sismics.docs.core.constant.Constants;
+import com.sismics.docs.core.constant.PermType;
+import com.sismics.docs.core.dao.jpa.AclDao;
 import com.sismics.docs.core.dao.jpa.DocumentDao;
 import com.sismics.docs.core.dao.jpa.FileDao;
-import com.sismics.docs.core.dao.jpa.ShareDao;
 import com.sismics.docs.core.dao.jpa.TagDao;
 import com.sismics.docs.core.dao.jpa.criteria.DocumentCriteria;
+import com.sismics.docs.core.dao.jpa.dto.AclDto;
 import com.sismics.docs.core.dao.jpa.dto.DocumentDto;
 import com.sismics.docs.core.dao.jpa.dto.TagDto;
 import com.sismics.docs.core.event.DocumentCreatedAsyncEvent;
@@ -45,9 +47,9 @@ import com.sismics.docs.core.event.DocumentDeletedAsyncEvent;
 import com.sismics.docs.core.event.DocumentUpdatedAsyncEvent;
 import com.sismics.docs.core.event.FileDeletedAsyncEvent;
 import com.sismics.docs.core.model.context.AppContext;
+import com.sismics.docs.core.model.jpa.Acl;
 import com.sismics.docs.core.model.jpa.Document;
 import com.sismics.docs.core.model.jpa.File;
-import com.sismics.docs.core.model.jpa.Share;
 import com.sismics.docs.core.model.jpa.Tag;
 import com.sismics.docs.core.util.jpa.PaginatedList;
 import com.sismics.docs.core.util.jpa.PaginatedLists;
@@ -67,7 +69,7 @@ public class DocumentResource extends BaseResource {
     /**
      * Returns a document.
      * 
-     * @param id Document ID
+     * @param documentId Document ID
      * @return Response
      * @throws JSONException
      */
@@ -75,22 +77,22 @@ public class DocumentResource extends BaseResource {
     @Path("{id: [a-z0-9\\-]+}")
     @Produces(MediaType.APPLICATION_JSON)
     public Response get(
-            @PathParam("id") String id,
+            @PathParam("id") String documentId,
             @QueryParam("share") String shareId) throws JSONException {
         authenticate();
         
         DocumentDao documentDao = new DocumentDao();
-        ShareDao shareDao = new ShareDao();
+        AclDao aclDao = new AclDao();
         Document documentDb;
         try {
-            documentDb = documentDao.getDocument(id);
+            documentDb = documentDao.getDocument(documentId);
             
             // Check document visibility
-            if (!shareDao.checkVisibility(documentDb, principal.getId(), shareId)) {
+            if (!aclDao.checkPermission(documentId, PermType.READ, shareId == null ? principal.getId() : shareId)) {
                 throw new ForbiddenClientException();
             }
         } catch (NoResultException e) {
-            throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", id));
+            throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", documentId));
         }
 
         JSONObject document = new JSONObject();
@@ -99,10 +101,11 @@ public class DocumentResource extends BaseResource {
         document.put("description", documentDb.getDescription());
         document.put("create_date", documentDb.getCreateDate().getTime());
         document.put("language", documentDb.getLanguage());
+        document.put("creator", documentDb.getUserId());
         
         // Add tags
         TagDao tagDao = new TagDao();
-        List<TagDto> tagDtoList = tagDao.getByDocumentId(id);
+        List<TagDto> tagDtoList = tagDao.getByDocumentId(documentId);
         List<JSONObject> tags = new ArrayList<>();
         for (TagDto tagDto : tagDtoList) {
             JSONObject tag = new JSONObject();
@@ -113,16 +116,24 @@ public class DocumentResource extends BaseResource {
         }
         document.put("tags", tags);
         
-        // Add shares
-        List<Share> shareDbList = shareDao.getByDocumentId(id);
-        List<JSONObject> shareList = new ArrayList<>();
-        for (Share shareDb : shareDbList) {
-            JSONObject share = new JSONObject();
-            share.put("id", shareDb.getId());
-            share.put("name", shareDb.getName());
-            shareList.add(share);
+        // Add ACL
+        List<AclDto> aclDtoList = aclDao.getBySourceId(documentId);
+        List<JSONObject> aclList = new ArrayList<>();
+        boolean writable = false;
+        for (AclDto aclDto : aclDtoList) {
+            JSONObject acl = new JSONObject();
+            acl.put("perm", aclDto.getPerm().name());
+            acl.put("id", aclDto.getTargetId());
+            acl.put("name", aclDto.getTargetName());
+            acl.put("type", aclDto.getTargetType());
+            aclList.add(acl);
+            
+            if (aclDto.getTargetId().equals(principal.getId()) && aclDto.getPerm() == PermType.WRITE) {
+                writable = true;
+            }
         }
-        document.put("shares", shareList);
+        document.put("acls", aclList);
+        document.put("writable", writable);
         
         return Response.ok().entity(document).build();
     }
@@ -341,6 +352,21 @@ public class DocumentResource extends BaseResource {
         }
         String documentId = documentDao.create(document);
         
+        // Create read ACL
+        AclDao aclDao = new AclDao();
+        Acl acl = new Acl();
+        acl.setPerm(PermType.READ);
+        acl.setSourceId(documentId);
+        acl.setTargetId(principal.getId());
+        aclDao.create(acl);
+        
+        // Create write ACL
+        acl = new Acl();
+        acl.setPerm(PermType.WRITE);
+        acl.setSourceId(documentId);
+        acl.setTargetId(principal.getId());
+        aclDao.create(acl);
+        
         // Update tags
         updateTagList(documentId, tagList);
         
@@ -389,7 +415,7 @@ public class DocumentResource extends BaseResource {
         DocumentDao documentDao = new DocumentDao();
         Document document;
         try {
-            document = documentDao.getDocument(id, principal.getId());
+            document = documentDao.getDocument(id, PermType.WRITE, principal.getId());
         } catch (NoResultException e) {
             throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", id));
         }
@@ -470,7 +496,7 @@ public class DocumentResource extends BaseResource {
         Document document;
         List<File> fileList;
         try {
-            document = documentDao.getDocument(id, principal.getId());
+            document = documentDao.getDocument(id, PermType.WRITE, principal.getId());
             fileList = fileDao.getByDocumentId(principal.getId(), id);
         } catch (NoResultException e) {
             throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", id));

docs-web/src/main/java/com/sismics/docs/rest/resource/FileResource.java

@@ -36,9 +36,10 @@ import org.codehaus.jettison.json.JSONObject;
 import com.google.common.base.Strings;
 import com.google.common.collect.Lists;
 import com.google.common.io.ByteStreams;
+import com.sismics.docs.core.constant.PermType;
+import com.sismics.docs.core.dao.jpa.AclDao;
 import com.sismics.docs.core.dao.jpa.DocumentDao;
 import com.sismics.docs.core.dao.jpa.FileDao;
-import com.sismics.docs.core.dao.jpa.ShareDao;
 import com.sismics.docs.core.dao.jpa.UserDao;
 import com.sismics.docs.core.event.FileCreatedAsyncEvent;
 import com.sismics.docs.core.event.FileDeletedAsyncEvent;
@@ -97,7 +98,7 @@ public class FileResource extends BaseResource {
         } else {
             DocumentDao documentDao = new DocumentDao();
             try {
-                document = documentDao.getDocument(documentId, principal.getId());
+                document = documentDao.getDocument(documentId, PermType.WRITE, principal.getId());
             } catch (NoResultException e) {
                 throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", documentId));
             }
@@ -194,7 +195,7 @@ public class FileResource extends BaseResource {
         File file;
         try {
             file = fileDao.getFile(id, principal.getId());
-            document = documentDao.getDocument(documentId, principal.getId());
+            document = documentDao.getDocument(documentId, PermType.WRITE, principal.getId());
         } catch (NoResultException e) {
             throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", documentId));
         }
@@ -254,7 +255,7 @@ public class FileResource extends BaseResource {
         // Get the document
         DocumentDao documentDao = new DocumentDao();
         try {
-            documentDao.getDocument(documentId, principal.getId());
+            documentDao.getDocument(documentId, PermType.WRITE, principal.getId());
         } catch (NoResultException e) {
             throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", documentId));
         }
@@ -293,10 +294,8 @@ public class FileResource extends BaseResource {
         // Check document visibility
         if (documentId != null) {
             try {
-                DocumentDao documentDao = new DocumentDao();
-                Document document = documentDao.getDocument(documentId);
-                ShareDao shareDao = new ShareDao();
-                if (!shareDao.checkVisibility(document, principal.getId(), shareId)) {
+                AclDao aclDao = new AclDao();
+                if (!aclDao.checkPermission(documentId, PermType.READ, shareId == null ? principal.getId() : shareId)) {
                     throw new ForbiddenClientException();
                 }
             } catch (NoResultException e) {
@@ -354,7 +353,7 @@ public class FileResource extends BaseResource {
                     throw new ForbiddenClientException();
                 }
             } else {
-                documentDao.getDocument(file.getDocumentId(), principal.getId());
+                documentDao.getDocument(file.getDocumentId(), PermType.WRITE, principal.getId());
             }
         } catch (NoResultException e) {
             throw new ClientException("FileNotFound", MessageFormat.format("File not found: {0}", id));
@@ -398,11 +397,8 @@ public class FileResource extends BaseResource {
         
         // Get the file
         FileDao fileDao = new FileDao();
-        DocumentDao documentDao = new DocumentDao();
         UserDao userDao = new UserDao();
         File file;
-        Document document;
-        String userId;
         try {
             file = fileDao.getFile(fileId);
             
@@ -412,16 +408,10 @@ public class FileResource extends BaseResource {
                     // But not ours
                     throw new ForbiddenClientException();
                 }
-                
-                userId = file.getUserId();
             } else {
-                // It's a file linked to a document
-                document = documentDao.getDocument(file.getDocumentId());
-                userId = document.getUserId();
-                
-                // Check document visibility
-                ShareDao shareDao = new ShareDao();
-                if (!shareDao.checkVisibility(document, principal.getId(), shareId)) {
+                // Check document accessibility
+                AclDao aclDao = new AclDao();
+                if (!aclDao.checkPermission(file.getDocumentId(), PermType.READ, shareId == null ? principal.getId() : shareId)) {
                     throw new ForbiddenClientException();
                 }
             }
@@ -451,7 +441,8 @@ public class FileResource extends BaseResource {
         
         // Stream the output and decrypt it if necessary
         StreamingOutput stream;
-        User user = userDao.getById(userId);
+        // A file is always encrypted by the creator of it
+        User user = userDao.getById(file.getUserId());
         try {
             InputStream fileInputStream = new FileInputStream(storedfile);
             final InputStream responseInputStream = decrypt ?
@@ -500,8 +491,8 @@ public class FileResource extends BaseResource {
             document = documentDao.getDocument(documentId);
             
             // Check document visibility
-            ShareDao shareDao = new ShareDao();
-            if (!shareDao.checkVisibility(document, principal.getId(), shareId)) {
+            AclDao aclDao = new AclDao();
+            if (!aclDao.checkPermission(documentId, PermType.READ, shareId == null ? principal.getId() : shareId)) {
                 throw new ForbiddenClientException();
             }
         } catch (NoResultException e) {
@@ -510,9 +501,8 @@ public class FileResource extends BaseResource {
         
         // Get files and user associated with this document
         FileDao fileDao = new FileDao();
-        UserDao userDao = new UserDao();
+        final UserDao userDao = new UserDao();
         final List<File> fileList = fileDao.getByDocumentId(principal.getId(), documentId);
-        final User user = userDao.getById(document.getUserId());
         
         // Create the ZIP stream
         StreamingOutput stream = new StreamingOutput() {
@@ -526,6 +516,8 @@ public class FileResource extends BaseResource {
                         InputStream fileInputStream = new FileInputStream(storedfile);
                         
                         // Add the decrypted file to the ZIP stream
+                        // Files are encrypted by the creator of them
+                        User user = userDao.getById(file.getUserId());
                         try (InputStream decryptedStream = EncryptionUtil.decryptInputStream(fileInputStream, user.getPrivateKey())) {
                             ZipEntry zipEntry = new ZipEntry(index + "." + MimeTypeUtil.getFileExtension(file.getMimeType()));
                             zipOutputStream.putNextEntry(zipEntry);

docs-web/src/main/java/com/sismics/docs/rest/resource/ShareResource.java

@@ -2,6 +2,7 @@ package com.sismics.docs.rest.resource;
 
 
 import java.text.MessageFormat;
+import java.util.List;
 
 import javax.persistence.NoResultException;
 import javax.ws.rs.DELETE;
@@ -16,8 +17,12 @@ import javax.ws.rs.core.Response;
 import org.codehaus.jettison.json.JSONException;
 import org.codehaus.jettison.json.JSONObject;
 
+import com.sismics.docs.core.constant.AclTargetType;
+import com.sismics.docs.core.constant.PermType;
+import com.sismics.docs.core.dao.jpa.AclDao;
 import com.sismics.docs.core.dao.jpa.DocumentDao;
 import com.sismics.docs.core.dao.jpa.ShareDao;
+import com.sismics.docs.core.model.jpa.Acl;
 import com.sismics.docs.core.model.jpa.Share;
 import com.sismics.rest.exception.ClientException;
 import com.sismics.rest.exception.ForbiddenClientException;
@@ -53,7 +58,7 @@ public class ShareResource extends BaseResource {
         // Get the document
         DocumentDao documentDao = new DocumentDao();
         try {
-            documentDao.getDocument(documentId, principal.getId());
+            documentDao.getDocument(documentId, PermType.WRITE, principal.getId());
         } catch (NoResultException e) {
             throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", documentId));
         }
@@ -61,14 +66,23 @@ public class ShareResource extends BaseResource {
         // Create the share
         ShareDao shareDao = new ShareDao();
         Share share = new Share();
-        share.setDocumentId(documentId);
         share.setName(name);
         shareDao.create(share);
+        
+        // Create the ACL
+        AclDao aclDao = new AclDao();
+        Acl acl = new Acl();
+        acl.setSourceId(documentId);
+        acl.setPerm(PermType.READ);
+        acl.setTargetId(share.getId());
+        aclDao.create(acl);
 
-        // Always return ok
+        // Returns the created ACL
         JSONObject response = new JSONObject();
-        response.put("status", "ok");
-        response.put("id", share.getId());
+        response.put("perm", acl.getPerm().name());
+        response.put("id", acl.getTargetId());
+        response.put("name", name);
+        response.put("type", AclTargetType.SHARE);
         return Response.ok().entity(response).build();
     }
 
@@ -88,23 +102,21 @@ public class ShareResource extends BaseResource {
             throw new ForbiddenClientException();
         }
 
-        // Get the share
-        ShareDao shareDao = new ShareDao();
-        DocumentDao documentDao = new DocumentDao();
-        Share share = shareDao.getShare(id);
-        if (share == null) {
+        // Check that the user can share the linked document
+        AclDao aclDao = new AclDao();
+        List<Acl> aclList = aclDao.getByTargetId(id);
+        if (aclList.size() == 0) {
             throw new ClientException("ShareNotFound", MessageFormat.format("Share not found: {0}", id));
         }
         
-        // Check that the user is the owner of the linked document
-        try {
-            documentDao.getDocument(share.getDocumentId(), principal.getId());
-        } catch (NoResultException e) {
-            throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", share.getDocumentId()));
+        Acl acl = aclList.get(0);
+        if (!aclDao.checkPermission(acl.getSourceId(), PermType.WRITE, principal.getId())) {
+            throw new ClientException("DocumentNotFound", MessageFormat.format("Document not found: {0}", acl.getSourceId()));
         }
 
         // Delete the share
-        shareDao.delete(share.getId());
+        ShareDao shareDao = new ShareDao();
+        shareDao.delete(id);
         
         // Always return ok
         JSONObject response = new JSONObject();

docs-web/src/main/java/com/sismics/docs/rest/resource/UserResource.java

@@ -4,6 +4,7 @@ import com.sismics.docs.core.constant.Constants;
 import com.sismics.docs.core.dao.jpa.AuthenticationTokenDao;
 import com.sismics.docs.core.dao.jpa.RoleBaseFunctionDao;
 import com.sismics.docs.core.dao.jpa.UserDao;
+import com.sismics.docs.core.dao.jpa.criteria.UserCriteria;
 import com.sismics.docs.core.dao.jpa.dto.UserDto;
 import com.sismics.docs.core.model.jpa.AuthenticationToken;
 import com.sismics.docs.core.model.jpa.User;
@@ -19,6 +20,7 @@ import com.sismics.rest.util.ValidationUtil;
 import com.sismics.security.UserPrincipal;
 import com.sismics.util.LocaleUtil;
 import com.sismics.util.filter.TokenBasedSecurityFilter;
+
 import org.apache.commons.lang.StringUtils;
 import org.codehaus.jettison.json.JSONArray;
 import org.codehaus.jettison.json.JSONException;
@@ -517,7 +519,7 @@ public class UserResource extends BaseResource {
         SortCriteria sortCriteria = new SortCriteria(sortColumn, asc);
 
         UserDao userDao = new UserDao();
-        userDao.findAll(paginatedList, sortCriteria);
+        userDao.findByCriteria(paginatedList, new UserCriteria(), sortCriteria);
         for (UserDto userDto : paginatedList.getResultList()) {
             JSONObject user = new JSONObject();
             user.put("id", userDto.getId());