Permission Model Validator

Permission Model Validator

Validate the given custom Alfresco permission model and dynamic authorities against these rules.

XML Structure Validation

• The file must be well-formed XML with root element ``.
• Each ` must declare a type` attribute bound to a custom type or aspect

({prefix}:...), not a redefinition of a core type that removes built-in groups.

• Each ` and must declare a name`.

Built-in Name Collision

• FLAG as ERROR any ` or ` whose name

collides with a built-in Alfresco permission group/permission: Read, Write, Delete, AddChildren, ReadProperties, ReadChildren, WriteProperties, Consumer, Contributor, Editor, Collaborator, Coordinator, SiteManager, SiteCollaborator, SiteContributor, SiteConsumer, FullControl, All.

• Why it breaks: redefining a core group name corrupts the global permission model and can

silently alter access across the whole repository.

• Fix: use a project-scoped PascalCase name; compose on top of a core group with

``.

Registration Validation

• The model must be registered as an extension model, not a replacement: look for a Spring

bean with parent="permissionModelBootstrap" and a model property pointing at the permissionDefinitions.xml under alfresco/extension/.

• WARN if no such registration bean is found in a companion *-context.xml.
• The registering context must be imported from module-context.xml.

Dynamic Authority Validation

• If a *DynamicAuthority.java exists:
• It must implements DynamicAuthority (from org.alfresco.repo.security.permissions).
• It must implement hasAuthority, getAuthority, and requiredFor.
• FLAG as ERROR runAsSystem inside hasAuthority (privilege escalation + per-node perf

hazard).

• WARN if hasAuthority does not guard with nodeService.exists().
• The bean must be registered (id {prefix}.{name}DynamicAuthority) and added to the global

dynamicAuthorities list.

• WARN if a permission/group omits requiresType where it logically applies only to the

bound type.

Output

Report all violations with file path, line number, rule violated, and suggested fix. If no violations found, confirm the permission model is valid.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: aborroy
• Source: aborroy/aiup-alfresco
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.