Package io.jenkins.plugins.batchcontrol.security

Class BatchControlMatrixAuthorizationStrategy

java.lang.Object
hudson.security.AuthorizationStrategy
hudson.security.GlobalMatrixAuthorizationStrategy
hudson.security.ProjectMatrixAuthorizationStrategy
io.jenkins.plugins.batchcontrol.security.BatchControlMatrixAuthorizationStrategy
All Implemented Interfaces:
ExtensionPoint, Describable<AuthorizationStrategy>, GrantLayeredStrategy, org.jenkinsci.plugins.matrixauth.AuthorizationContainer<AuthorizationStrategy>
public class BatchControlMatrixAuthorizationStrategy extends ProjectMatrixAuthorizationStrategy implements GrantLayeredStrategy
matrix-auth's project-based matrix with Batch Control grants layered on top (D-35a, ARCHITECTURE section 4). Being a ProjectMatrixAuthorizationStrategy, it passes every instanceof check matrix-auth makes, so job, folder and agent authorization properties stay configurable and effective, and matrix-auth's own logic runs underneath the grant layer.

Every getACL overload the parent overrides is wrapped in a GrantAwareACL. The root and agent ACLs carry no grant scope (S-13: grants never apply there), so for them the wrapper passes every decision through. With no active grant, or while change control is off, the strategy behaves exactly like its parent.

Persistence: matrix-auth's XStream converter matches its exact class and is restricted, so BatchControlMatrixAuthorizationStrategy.ConverterImpl writes the same <permission>TYPE:id:sid</permission> lines through public API. JCasC support is BatchControlMatrixCascConfigurator.

matrix-auth is an optional dependency; the descriptor is an optional extension, so without matrix-auth this class is simply never loaded.