// SecurityContext.cpp

#include <errno.h>
#include <string.h>
#include <sys/stat.h>

#include <AutoDeleter.h>
#include <AutoLocker.h>
#include <Entry.h>
#include <HashMap.h>
#include <Message.h>
#include <Path.h>

#include "Compatibility.h"
#include "Node.h"
#include "SecurityContext.h"
#include "UserSecurityContext.h"

typedef AutoLocker<SecurityContext> ContextLocker;

// get_node_ref_for_path
static
status_t
get_node_ref_for_path(const char* path, node_ref* ref)
{
	if (!path || !ref)
		return B_BAD_VALUE;
	struct stat st;
	if (lstat(path, &st) < 0)
		return errno;
	ref->device = st.st_dev;
	ref->node = st.st_ino;
	return B_OK;
}

// #pragma mark -
// #pragma mark ----- User -----

// constructor
User::User()
	: BReferenceable(),
	  BArchivable(),
	  fName(),
	  fPassword()
{
}

// constructor
User::User(BMessage* archive)
	: BReferenceable(),
	  BArchivable(archive),
	  fName(),
	  fPassword()
{
	Unarchive(archive);
}

// destructor
User::~User()
{
}

// Archive
status_t
User::Archive(BMessage* archive, bool deep) const
{
	if (!archive)
		return B_BAD_VALUE;
	// name
	status_t error = B_OK;
	if (error == B_OK && fName.GetLength() > 0)
		error = archive->AddString("name", fName.GetString());
	// password
	if (error == B_OK && fPassword.GetLength() > 0)
		error = archive->AddString("password", fPassword.GetString());
	return error;
}

// Instantiate
BArchivable*
User::Instantiate(BMessage* archive)
{
	if (!validate_instantiation(archive, "User"))
		return NULL;
	return new(std::nothrow) User(archive);
}

// Init
status_t
User::Init(const char* name, const char* password)
{
	if (!name)
		return B_BAD_VALUE;
	if (!fName.SetTo(name))
		return B_NO_MEMORY;
	if (password && !fPassword.SetTo(password))
		return B_NO_MEMORY;
	return B_OK;
}

// InitCheck
status_t
User::InitCheck() const
{
	if (fName.GetLength() == 0)
		return B_NO_INIT;
	return B_OK;
}

// Unarchive
status_t
User::Unarchive(const BMessage* archive)
{
	// name
	const char* name;
	if (archive->FindString("name", &name) != B_OK)
		return B_BAD_DATA;
	fName.SetTo(name);
	// password
	const char* password;
	if (archive->FindString("password", &password) == B_OK)
		fPassword.SetTo(password);
	else
		fPassword.Unset();
	return B_OK;
}

// GetName
const char*
User::GetName() const
{
	return fName.GetString();
}

// GetPassword
const char*
User::GetPassword() const
{
	return fPassword.GetString();
}


// #pragma mark -
// #pragma mark ----- Share -----

// constructor
Share::Share()
	: BReferenceable(),
	  BArchivable(),
	  fName(),
	  fNodeRef(),
	  fPath()
{
}

// constructor
Share::Share(BMessage* archive)
	: BReferenceable(),
	  BArchivable(archive),
	  fName(),
	  fNodeRef(),
	  fPath()
{
	Unarchive(archive);
}

// destructor
Share::~Share()
{
}

// Archive
status_t
Share::Archive(BMessage* archive, bool deep) const
{
	if (!archive)
		return B_BAD_VALUE;
	// name
	status_t error = B_OK;
	if (error == B_OK && fName.GetLength() > 0)
		error = archive->AddString("name", fName.GetString());
	// path
	if (error == B_OK && fPath.GetLength() > 0)
		error = archive->AddString("path", fPath.GetString());
	return error;
}

// Instantiate
BArchivable*
Share::Instantiate(BMessage* archive)
{
	if (!validate_instantiation(archive, "Share"))
		return NULL;
	return new(std::nothrow) Share(archive);
}

// Init
status_t
Share::Init(const char* name, const node_ref& ref, const char* path)
{
	// check params
	if (!name)
		return B_BAD_VALUE;
	// if a path is not given, retrieve it
	BPath localPath;
	if (!path) {
		entry_ref entryRef(ref.device, ref.node, ".");
		status_t error = localPath.SetTo(&entryRef);
		if (error != B_OK)
			return error;
		path = localPath.Path();
	}
	// set the attributes
	if (!fName.SetTo(name))
		return B_NO_MEMORY;
	if (!fPath.SetTo(path))
		return B_NO_MEMORY;
	fNodeRef = ref;
	return B_OK;
}

// Init
status_t
Share::Init(const char* name, const char* path)
{
	if (!name || !path)
		return B_BAD_VALUE;
	node_ref nodeRef;
	if (get_node_ref_for_path(path, &nodeRef) != B_OK) {
		nodeRef.device = -1;
		nodeRef.node = -1;
	}
	return Init(name, nodeRef, path);
}

// InitCheck
status_t
Share::InitCheck() const
{
	if (fName.GetLength() == 0 || fPath.GetLength() == 0)
		return B_NO_INIT;
	return B_OK;
}

// Unarchive
status_t
Share::Unarchive(const BMessage* archive)
{
	// name
	const char* name = NULL;
	if (archive->FindString("name", &name) != B_OK)
		return B_BAD_DATA;
	// path
	const char* path = NULL;
	if (archive->FindString("path", &path) != B_OK)
		return B_BAD_DATA;
	return Init(name, path);
}

// GetName
const char*
Share::GetName() const
{
	return fName.GetString();
}

// DoesExist
bool
Share::DoesExist() const
{
	return (fNodeRef.device >= 0);
}

// GetNodeRef
const node_ref&
Share::GetNodeRef() const
{
	return fNodeRef;
}

// GetVolumeID
dev_t
Share::GetVolumeID() const
{
	return fNodeRef.device;
}

// GetNodeID
ino_t
Share::GetNodeID() const
{
	return fNodeRef.node;
}

// GetPath
const char*
Share::GetPath() const
{
	return fPath.GetString();
}


// #pragma mark -
// #pragma mark ----- SecurityContext -----

// UserMap
struct SecurityContext::UserMap : HashMap<HashString, User*> {
};

// ShareMap
struct SecurityContext::ShareMap : HashMap<HashString, Share*> {
};

// UserPath
struct SecurityContext::UserPath {
	UserPath() {}

	UserPath(const char* path, User* user)
		: path(path),
		  user(user)
	{
	}

	UserPath(const UserPath& other)
		: path(other.path),
		  user(other.user)
	{
	}

	uint32 GetHashCode() const
	{
#ifdef B_HAIKU_64_BIT
		uint64 v = (uint64)user;
		return (path.GetHashCode() * 31) + ((uint32)(v >> 32) ^ (uint32)v);
#else
		return path.GetHashCode() * 31 + (uint32)user;
#endif
	}

	UserPath& operator=(const UserPath& other)
	{
		path = other.path;
		user = other.user;
		return *this;
	}

	bool operator==(const UserPath& other) const
	{
		return (path == other.path && user == other.user);
	}

	bool operator!=(const UserPath& other) const
	{
		return !(*this == other);
	}

	HashString	path;
	User*		user;
};

// PermissionMap
struct SecurityContext::PermissionMap
	: HashMap<SecurityContext::UserPath, Permissions> {
};

// NodePathMap
struct SecurityContext::NodePathMap : HashMap<NodeRef, HashString> {
};

// PathNodeMap
struct SecurityContext::PathNodeMap : HashMap<HashString, NodeRef> {
};

// constructor
SecurityContext::SecurityContext()
	: BArchivable(),
	  BLocker("security context"),
	  fUsers(new(std::nothrow) UserMap),
	  fShares(new(std::nothrow) ShareMap),
	  fPermissions(new(std::nothrow) PermissionMap),
	  fNode2Path(new(std::nothrow) NodePathMap),
	  fPath2Node(new(std::nothrow) PathNodeMap)
{
}

// constructor
SecurityContext::SecurityContext(BMessage* archive)
	: BArchivable(archive),
	  fUsers(new(std::nothrow) UserMap),
	  fShares(new(std::nothrow) ShareMap),
	  fPermissions(new(std::nothrow) PermissionMap),
	  fNode2Path(new(std::nothrow) NodePathMap),
	  fPath2Node(new(std::nothrow) PathNodeMap)
{
	if (InitCheck() != B_OK)
		return;
	status_t error = B_OK;

	// users
	BMessage userArchive;
	for (int32 i = 0;
		 archive->FindMessage("users", i, &userArchive) == B_OK;
		 i++) {
		User tmpUser;
		error = tmpUser.Unarchive(&userArchive);
		if (error != B_OK)
			return;
		error = AddUser(tmpUser.GetName(), tmpUser.GetPassword());
		if (error != B_OK)
			return;
	}

	// shares
	BMessage shareArchive;
	for (int32 i = 0;
		 archive->FindMessage("shares", i, &shareArchive) == B_OK;
		 i++) {
		Share tmpShare;
		error = tmpShare.Unarchive(&shareArchive);
		if (error != B_OK)
			return;
		error = AddShare(tmpShare.GetName(), tmpShare.GetPath());
		if (error != B_OK)
			return;
	}

	// permissions
	BMessage permissionsArchive;
	if (archive->FindMessage("permissions", &permissionsArchive) != B_OK)
		return;
	#ifdef HAIKU_TARGET_PLATFORM_DANO
		const char* userName;
	#else
		char* userName;
	#endif
	type_code type;
	for (int32 userIndex = 0;
		 permissionsArchive.GetInfo(B_MESSAGE_TYPE, userIndex, &userName, &type)
		 	== B_OK;
		 userIndex++) {
		User* user = FindUser(userName);
		if (!user)
			return;
		BReference<User> userReference(user, true);
		error = permissionsArchive.FindMessage(userName, &userArchive);
		if (error != B_OK)
			return;

		// got a user: iterate through its permissions
		#ifdef HAIKU_TARGET_PLATFORM_DANO
			const char* path;
		#else
			char* path;
		#endif
		for (int32 i = 0;
			 userArchive.GetInfo(B_INT32_TYPE, i, &path, &type) == B_OK;
			 i++) {
			uint32 permissions;
			error = userArchive.FindInt32(path, (int32*)&permissions);
			if (error == B_OK)
				error = SetNodePermissions(path, user, permissions);
		}
	}
}

// destructor
SecurityContext::~SecurityContext()
{
	// remove all user references
	for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();) {
		User* user = it.Next().value;
		user->ReleaseReference();
	}

	// remove all share references
	for (ShareMap::Iterator it = fShares->GetIterator(); it.HasNext();) {
		Share* share = it.Next().value;
		share->ReleaseReference();
	}

	delete fUsers;
	delete fShares;
	delete fPermissions;
	delete fNode2Path;
	delete fPath2Node;
}

// Archive
status_t
SecurityContext::Archive(BMessage* archive, bool deep) const
{
	if (!archive)
		return B_BAD_VALUE;
	status_t error = B_OK;
	ContextLocker _(const_cast<SecurityContext*>(this));

	// users
	int32 userCount = fUsers->Size();
	for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();) {
		User* user = it.Next().value;
		BMessage userArchive;
		error = user->Archive(&userArchive, deep);
		if (error != B_OK)
			return error;
		error = archive->AddMessage("users", &userArchive);
		if (error != B_OK)
			return error;
	}

	// shares
	for (ShareMap::Iterator it = fShares->GetIterator(); it.HasNext();) {
		Share* share = it.Next().value;
		BMessage shareArchive;
		error = share->Archive(&shareArchive, deep);
		if (error != B_OK)
			return error;
		error = archive->AddMessage("shares", &shareArchive);
		if (error != B_OK)
			return error;
	}

	// permissions
	// we slice them per user
	BMessage* tmpUserArchives = new(std::nothrow) BMessage[userCount];
	if (!tmpUserArchives)
		return B_NO_MEMORY;
	ArrayDeleter<BMessage> deleter(tmpUserArchives);
	HashMap<HashKeyPointer<User*>, BMessage*> userArchives;
	int32 i = 0;
	for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();) {
		User* user = it.Next().value;
		error = userArchives.Put(user, tmpUserArchives + i);
		if (error != B_OK)
			return error;
		i++;
	}

	// fill the per user archives
	for (PermissionMap::Iterator it = fPermissions->GetIterator();
		 it.HasNext();) {
		PermissionMap::Entry entry = it.Next();
		BMessage* userArchive = userArchives.Get(entry.key.user);
		error = userArchive->AddInt32(entry.key.path.GetString(),
			entry.value.GetPermissions());
		if (error != B_OK)
			return error;
	}

	// put the user permissions together
	BMessage permissionsArchive;
	for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();) {
		User* user = it.Next().value;
		error = permissionsArchive.AddMessage(user->GetName(),
			userArchives.Get(user));
		if (error != B_OK)
			return error;
	}
	error = archive->AddMessage("permissions", &permissionsArchive);
	if (error != B_OK)
		return error;
	return B_OK;
}

// Instantiate
BArchivable*
SecurityContext::Instantiate(BMessage* archive)
{
	if (!validate_instantiation(archive, "SecurityContext"))
		return NULL;
	return new(std::nothrow) SecurityContext(archive);
}


// InitCheck
status_t
SecurityContext::InitCheck() const
{
	if (!fUsers || !fShares || !fPermissions || !fNode2Path || !fPath2Node)
		return B_NO_MEMORY;

	if (fUsers->InitCheck() != B_OK)
		return fUsers->InitCheck();

	if (fShares->InitCheck() != B_OK)
		return fShares->InitCheck();

	if (fPermissions->InitCheck() != B_OK)
		return fPermissions->InitCheck();

	if (fNode2Path->InitCheck() != B_OK)
		return fNode2Path->InitCheck();

	if (fPath2Node->InitCheck() != B_OK)
		return fPath2Node->InitCheck();

	return B_OK;
}

// AddUser
//
// The caller gets a reference, if _user is not NULL.
status_t
SecurityContext::AddUser(const char* name, const char* password, User** _user)
{
	if (!name)
		return B_BAD_VALUE;

	// check, if the user does already exist
	ContextLocker _(this);
	if (fUsers->Get(name))
		return B_BAD_VALUE;

	// create a the user
	User* user = new(std::nothrow) User;
	if (!user)
		return B_NO_MEMORY;
	BReference<User> userReference(user, true);
	status_t error = user->Init(name, password);
	if (error != B_OK)
		return error;

	// add the user
	error = fUsers->Put(name, user);
	if (error != B_OK)
		return error;

	userReference.Detach();
	if (_user) {
		*_user = user;
		user->AcquireReference();
	}
	return B_OK;
}

// RemoveUser
//
// The caller gets a reference, if _user is not NULL.
status_t
SecurityContext::RemoveUser(const char* name, User** _user)
{
	if (!name)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// get the user
	User* user = FindUser(name);
	if (!user)
		return B_ENTRY_NOT_FOUND;
	BReference<User> userReference(user, true);

	// remove it
	status_t error = RemoveUser(user);
	if (error == B_OK && _user) {
		*_user = user;
		user->AcquireReference();
	}

	return error;
}

// RemoveUser
status_t
SecurityContext::RemoveUser(User* user)
{
	if (!user)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// find and remove it
	if (fUsers->Get(user->GetName()) != user)
		return B_BAD_VALUE;
	fUsers->Remove(user->GetName());

	// remove all permission entries for this user
	for (PermissionMap::Iterator it = fPermissions->GetIterator();
		 it.HasNext();) {
		PermissionMap::Entry entry = it.Next();
		if (entry.key.user == user)
			fPermissions->Remove(it);
	}

	// surrender our user reference
	user->ReleaseReference();

	return B_OK;
}

// FindUser
//
// The caller gets a reference.
User*
SecurityContext::FindUser(const char* name)
{
	if (!name)
		return NULL;

	ContextLocker _(this);
	User* user = fUsers->Get(name);
	if (user)
		user->AcquireReference();
	return user;
}

// AuthenticateUser
//
// The caller gets a reference.
status_t
SecurityContext::AuthenticateUser(const char* name, const char* password,
	User** _user)
{
	if (!_user)
		return B_BAD_VALUE;

	// find user
	ContextLocker _(this);
	User* user = FindUser(name);
	if (!user)
		return B_PERMISSION_DENIED;
	BReference<User> userReference(user, true);

	// check password
	if (user->GetPassword()) {
		if (!password || strcmp(user->GetPassword(), password) != 0)
			return B_PERMISSION_DENIED;
	} else if (password)
		return B_PERMISSION_DENIED;

	*_user = user;
	userReference.Detach();
	return B_OK;
}

// CountUsers
int32
SecurityContext::CountUsers()
{
	ContextLocker _(this);
	return fUsers->Size();
}

// GetUsers
status_t
SecurityContext::GetUsers(BMessage* users)
{
	if (!users)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// iterate through all users and add their names to the message
	for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();) {
		User* user = it.Next().value;
		status_t error = users->AddString("users", user->GetName());
		if (error != B_OK)
			return error;
	}

	return B_OK;
}

// AddShare
//
// The caller gets a reference, if _share is not NULL.
status_t
SecurityContext::AddShare(const char* name, const node_ref& ref, Share** _share)
{
	if (!name)
		return B_BAD_VALUE;

	// check, if the share does already exist
	ContextLocker _(this);
	if (fShares->Get(name))
		return B_BAD_VALUE;

	// create a the share
	Share* share = new(std::nothrow) Share;
	if (!share)
		return B_NO_MEMORY;
	BReference<Share> shareReference(share, true);
	status_t error = share->Init(name, ref);
	if (error != B_OK)
		return error;

	// add the share
	error = fShares->Put(name, share);
	if (error != B_OK)
		return error;

	shareReference.Detach();
	if (_share) {
		*_share = share;
		share->AcquireReference();
	}
	return B_OK;
}

// AddShare
//
// The caller gets a reference, if _share is not NULL.
status_t
SecurityContext::AddShare(const char* name, const char* path, Share** _share)
{
	if (!name)
		return B_BAD_VALUE;

	// check, if the share does already exist
	ContextLocker _(this);
	if (fShares->Get(name))
		return B_BAD_VALUE;

	// create a the share
	Share* share = new(std::nothrow) Share;
	if (!share)
		return B_NO_MEMORY;
	BReference<Share> shareReference(share, true);
	status_t error = share->Init(name, path);
	if (error != B_OK)
		return error;

	// add the share
	error = fShares->Put(name, share);
	if (error != B_OK)
		return error;

	shareReference.Detach();
	if (_share) {
		*_share = share;
		share->AcquireReference();
	}
	return B_OK;
}

// RemoveShare
//
// The caller gets a reference, if _share is not NULL.
status_t
SecurityContext::RemoveShare(const char* name, Share** _share)
{
	if (!name)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// get the share
	Share* share = FindShare(name);
	if (!share)
		return B_ENTRY_NOT_FOUND;
	BReference<Share> shareReference(share, true);

	// remove it
	status_t error = RemoveShare(share);
	if (error == B_OK && _share) {
		*_share = share;
		share->AcquireReference();
	}

	return error;
}

// RemoveShare
status_t
SecurityContext::RemoveShare(Share* share)
{
	if (!share)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// find and remove it
	if (fShares->Get(share->GetName()) != share)
		return B_BAD_VALUE;
	fShares->Remove(share->GetName());

	// surrender our share reference
	share->ReleaseReference();

	return B_OK;
}

// FindShare
//
// The caller gets a reference.
Share*
SecurityContext::FindShare(const char* name)
{
	if (!name)
		return NULL;

	ContextLocker _(this);
	Share* share = fShares->Get(name);
	if (share)
		share->AcquireReference();
	return share;
}

// CountShares
int32
SecurityContext::CountShares()
{
	ContextLocker _(this);
	return fShares->Size();
}

// GetShares
status_t
SecurityContext::GetShares(BMessage* shares)
{
	if (!shares)
		return B_BAD_VALUE;

	ContextLocker _(this);

	// iterate through all shares and add their names to the message
	for (ShareMap::Iterator it = fShares->GetIterator(); it.HasNext();) {
		Share* share = it.Next().value;
		// add name
		status_t error = shares->AddString("shares", share->GetName());
		if (error != B_OK)
			return error;

		// add path
		error = shares->AddString("paths", share->GetPath());
		if (error != B_OK)
			return error;
	}

	return B_OK;
}

// SetNodePermissions
status_t
SecurityContext::SetNodePermissions(const node_ref& ref, User* user,
	Permissions permissions)
{
	if (!user)
		return B_BAD_VALUE;

	ContextLocker _(this);
	// check, whether we know the user
	if (fUsers->Get(user->GetName()) != user)
		return B_BAD_VALUE;

	HashString path;
	status_t error = _AddNodePath(ref, &path);
	if (error != B_OK)
		return error;
	return fPermissions->Put(UserPath(path.GetString(), user), permissions);
}

// SetNodePermissions
status_t
SecurityContext::SetNodePermissions(const char* path, User* user,
	Permissions permissions)
{
	if (!user || !path)
		return B_BAD_VALUE;

	ContextLocker _(this);
	// check, whether we know the user
	if (fUsers->Get(user->GetName()) != user)
		return B_BAD_VALUE;

	_AddNodePath(path);
	return fPermissions->Put(UserPath(path, user), permissions);
}

// ClearNodePermissions
void
SecurityContext::ClearNodePermissions(const node_ref& ref, User* user)
{
	ContextLocker _(this);
	HashString path;
	status_t error = _AddNodePath(ref, &path);
	if (error != B_OK)
		return;

	if (user) {
		fPermissions->Remove(UserPath(path.GetString(), user));
	} else {
		for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();)
			fPermissions->Remove(UserPath(path.GetString(), it.Next().value));
	}
}

// ClearNodePermissions
void
SecurityContext::ClearNodePermissions(const char* path, User* user)
{
	if (!path)
		return;

	ContextLocker _(this);
	_AddNodePath(path);

	if (user) {
		fPermissions->Remove(UserPath(path, user));
	} else {
		for (UserMap::Iterator it = fUsers->GetIterator(); it.HasNext();)
			fPermissions->Remove(UserPath(path, it.Next().value));
	}
}

// GetNodePermissions
Permissions
SecurityContext::GetNodePermissions(const node_ref& ref, User* user)
{
	if (!user)
		return Permissions();

	ContextLocker _(this);
	HashString path;
	status_t error = _AddNodePath(ref, &path);
	if (error != B_OK)
		return Permissions();

	return fPermissions->Get(UserPath(path.GetString(), user));
}

// GetNodePermissions
Permissions
SecurityContext::GetNodePermissions(const char* path, User* user)
{
	if (!user || !path)
		return Permissions();

	ContextLocker _(this);
	_AddNodePath(path);

	return fPermissions->Get(UserPath(path, user));
}

// GetUserSecurityContext
status_t
SecurityContext::GetUserSecurityContext(User* user,
	UserSecurityContext* userContext)
{
	if (!userContext)
		return B_BAD_VALUE;

	status_t error = userContext->Init(user);
	if (error != B_OK)
		return error;

	// iterate through all permission entries and add the ones whose user
	// matches
	ContextLocker _(this);
	for (PermissionMap::Iterator it = fPermissions->GetIterator();
		 it.HasNext();) {
		PermissionMap::Entry entry = it.Next();
		node_ref ref;
		if (entry.key.user == user
			&& _GetNodeForPath(entry.key.path.GetString(), &ref)) {
			error = userContext->AddNode(ref.device, ref.node, entry.value);
			if (error != B_OK)
				return error;
		}
	}
	return B_OK;
}

// _AddNodePath
status_t
SecurityContext::_AddNodePath(const char* path, node_ref* _ref)
{
	if (!fPath2Node->ContainsKey(path)) {
		node_ref ref;
		status_t error = get_node_ref_for_path(path, &ref);
		if (error == B_OK)
			error = _EnterNodePath(path, ref);
		if (error != B_OK)
			return error;
	}

	if (_ref)
		*_ref = fPath2Node->Get(path);
	return B_OK;
}

// _AddNodePath
status_t
SecurityContext::_AddNodePath(const node_ref& ref, HashString* _path)
{
	if (!fNode2Path->ContainsKey(ref)) {
		BPath path;
		entry_ref entryRef(ref.device, ref.node, ".");
		status_t error = path.SetTo(&entryRef);
		if (error == B_OK)
			error = _EnterNodePath(path.Path(), ref);
		if (error != B_OK)
			return error;
	}

	if (_path)
		*_path = fNode2Path->Get(ref);
	return B_OK;
}

// _EnterNodePath
status_t
SecurityContext::_EnterNodePath(const char* path, const node_ref& ref)
{
	status_t error = fNode2Path->Put(ref, path);
	if (error == B_OK) {
		error = fPath2Node->Put(path, ref);
		if (error != B_OK)
			fNode2Path->Remove(ref);
	}
	return error;
}

// _GetNodeForPath
bool
SecurityContext::_GetNodeForPath(const char* path, node_ref* ref)
{
	if (path && fPath2Node->ContainsKey(path)) {
		if (ref)
			*ref = fPath2Node->Get(path);
		return true;
	}
	return false;
}