@Nonnull

    public AccessControlManager getAccessControlManager() throws RepositoryException {

        if (accessControlManager == null) {

                    .getAccessControlManager(delegate.getRoot(), namePathMapper);

            if (acm instanceof JackrabbitAccessControlManager) {

                accessControlManager = new JackrabbitAccessControlManagerDelegator(

                        delegate, (JackrabbitAccessControlManager) acm);

            } else {

    }

    @Test

    public void testDuplicateAce() throws Exception {

        JackrabbitAccessControlList acl = org.apache.jackrabbit.commons.jackrabbit.authorization.AccessControlUtils.getAccessControlList(acMgr, testPath);

        acl.addAccessControlEntry(testPrincipal, privilegesFromNames(PrivilegeConstants.JCR_ADD_CHILD_NODES));

        // add duplicate ac-entry on OAK-API

        NodeUtil policy = new NodeUtil(root.getTree(testPath + "/rep:policy"));

        NodeUtil ace = policy.addChild("duplicateAce", NT_REP_GRANT_ACE);

        ace.setString(REP_PRINCIPAL_NAME, testPrincipal.getName());

    }

    public void testInheritance() throws RepositoryException, NotExecutableException {

        Session testSession = getTestSession();

        /* precondition:

          testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        checkReadOnly(childNPath);

        // give 'modify_properties' and 'remove_node' privilege on 'path'

        Privilege[] privileges = privilegesFromNames(new String[] {

                Privilege.JCR_REMOVE_NODE, Privilege.JCR_MODIFY_PROPERTIES});

        givePrivileges(path, privileges, getRestrictions(superuser, path));

        // give 'add-child-nodes', remove_child_nodes' on 'childNPath'

        privileges = privilegesFromNames(new String[] {

                Privilege.JCR_ADD_CHILD_NODES, Privilege.JCR_REMOVE_CHILD_NODES});

        givePrivileges(childNPath, privileges, getRestrictions(superuser, childNPath));

        /*

        since evaluation respects inheritance through the node

        hierarchy, the following privileges must now be given at 'childNPath':

        - jcr:read

        - jcr:modifyProperties

        - jcr:addChildNodes

        - jcr:removeChildNodes

        - jcr:removeNode

        */

        Privilege[] expectedPrivileges =  privilegesFromNames(new String[] {

                Privilege.JCR_READ,

                Privilege.JCR_ADD_CHILD_NODES,

                Privilege.JCR_REMOVE_CHILD_NODES,

                Privilege.JCR_REMOVE_NODE,

                Privilege.JCR_MODIFY_PROPERTIES

        });

        /*

         ... permissions granted at childNPath:

         - read

         - set-property

         BUT NOT:

         - add-node

         - remove.

         */

        String aActions = javax.jcr.Session.ACTION_SET_PROPERTY + "," + javax.jcr.Session.ACTION_READ;

        assertTrue(testSession.hasPermission(childNPath, aActions));

        String dActions = javax.jcr.Session.ACTION_REMOVE + "," + javax.jcr.Session.ACTION_ADD_NODE;

        assertFalse(testSession.hasPermission(childNPath, dActions));

        /*

        ... permissions granted at any child item of child-path:

        - read

        - set-property

        - add-node

        - remove

        */

        String nonExistingItemPath = childNPath + "/anyItem";

        assertTrue(testSession.hasPermission(nonExistingItemPath, aActions + "," + dActions));

        /* try adding a new child node -> must succeed. */

        Node childN = testSession.getNode(childNPath);

        String testPath = childN.addNode(nodeName2).getPath();

        /* test privileges on the 'new' child node */

        /* repeat test after save. */

        testSession.save();

    }

        assertFalse(testSession.hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

    }

    public void testRemovePermission3() throws NotExecutableException, RepositoryException {

        /*

          precondition:

          testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        checkReadOnly(childNPath);

        Session testSession = getTestSession();

        Privilege[] privs = privilegesFromNames(new String[] {

                Privilege.JCR_REMOVE_CHILD_NODES, Privilege.JCR_REMOVE_NODE

        });

        // add 'remove_node' and 'remove_child_nodes' privilege at 'path'

        givePrivileges(path, privs, getRestrictions(superuser, path));

        /*

         expected result:

         - missing remove permission at path since REMOVE_CHILD_NODES present

           at path only applies for nodes below. REMOVE_CHILD_NODES must

           be present at the parent instead (which isn't)

         - remove permission is however granted at childNPath.

         - privileges: both at path and at childNPath 'remove_node' and

           'remove_child_nodes' are present.

        */

        assertFalse(testSession.hasPermission(path, javax.jcr.Session.ACTION_REMOVE));

        assertTrue(testSession.hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

    }

    }

    public void testRemovePermission4() throws NotExecutableException, RepositoryException {

        Session testSession = getTestSession();

        /*

          precondition:

          testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        checkReadOnly(childNPath);

        Privilege[] rmChildNodes = privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES);

        Privilege[] rmNode = privilegesFromName(Privilege.JCR_REMOVE_NODE);

        // add 'remove_child_nodes' privilege at 'path'...

        givePrivileges(path, rmChildNodes, getRestrictions(superuser, path));

        // ... and add 'remove_node' privilege at 'childNPath'

        givePrivileges(childNPath, rmNode, getRestrictions(superuser, childNPath));

        /*

         expected result:

         - remove not allowed for node at path

         - remove-permission present for node at childNPath

         - both remove_node and remove_childNodes privilege present at childNPath

         */

        assertFalse(testSession.hasPermission(path, javax.jcr.Session.ACTION_REMOVE));

        assertTrue(testSession.hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

    }

    }

    public void testRemovePermission7() throws NotExecutableException, RepositoryException {

        Session testSession = getTestSession();

        /*

          precondition:

          testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        checkReadOnly(childNPath);

        Privilege[] rmChildNodes = privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES);

        Privilege[] rmNode = privilegesFromName(Privilege.JCR_REMOVE_NODE);

        // deny 'remove_child_nodes' at 'path'

        withdrawPrivileges(path, rmChildNodes, getRestrictions(superuser, path));

        // ... but allow 'remove_node' at childNPath

        givePrivileges(childNPath, rmNode, getRestrictions(superuser, childNPath));

        /*

         expected result:

         - node at childNPath can't be removed.

         */

        assertFalse(testSession.hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

        // additionally add remove_child_nodes privilege at 'childNPath'

        givePrivileges(childNPath, rmChildNodes, getRestrictions(superuser, childNPath));

        /*

         expected result:

         - node at childNPath still can't be removed.

         - but both privileges (remove_node, remove_child_nodes) are present.

         */

        assertFalse(testSession.hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

    }

        assertTrue(testAcMgr.hasPrivileges(childNPath, new Privilege[] {rmChildNodes[0], rmNode[0]}));

    }

    public void testRemovePermission8() throws NotExecutableException, RepositoryException {

        /*

          precondition:

          testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        checkReadOnly(childNPath);

        Privilege[] rmChildNodes = privilegesFromName(Privilege.JCR_REMOVE_CHILD_NODES);

        Privilege[] rmNode = privilegesFromName(Privilege.JCR_REMOVE_NODE);

        // add 'remove_child_nodes' at 'path

        givePrivileges(path, rmChildNodes, getRestrictions(superuser, path));

        // deny 'remove_node' at 'path'

        withdrawPrivileges(path, rmNode, getRestrictions(superuser, path));

        // and allow 'remove_node' at childNPath

        givePrivileges(childNPath, rmNode, getRestrictions(superuser, childNPath));

        /*

         expected result:

         - remove permission must be granted at childNPath

         */

        assertTrue(getTestSession().hasPermission(childNPath, javax.jcr.Session.ACTION_REMOVE));

    }

    }

    public void testGroupPermissions() throws NotExecutableException, RepositoryException {

        Group testGroup = getTestGroup();

        /*

         precondition:

         testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        /* add privileges for the Group the test-user is member of */

        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);

        givePrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));

        /* testuser must get the permissions/privileges inherited from

           the group it is member of.

         */

        String actions = javax.jcr.Session.ACTION_SET_PROPERTY + "," + javax.jcr.Session.ACTION_READ;

        assertTrue(getTestSession().hasPermission(path, actions));

        Privilege[] privs = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);

    }

    }

    public void testMixedUserGroupPermissions() throws NotExecutableException, RepositoryException {

        Group testGroup = getTestGroup();

        /*

         precondition:

         testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        /* explicitly withdraw MODIFY_PROPERTIES for the user */

        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);

        withdrawPrivileges(path, testUser.getPrincipal(), privileges, getRestrictions(superuser, path));

        /* give MODIFY_PROPERTIES privilege for a Group the test-user is member of */

        givePrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));

        /*

         since user-permissions overrule the group permissions, testuser must

         not have set_property action / modify_properties privilege.

         */

        String actions = javax.jcr.Session.ACTION_SET_PROPERTY;

        assertFalse(getTestSession().hasPermission(path, actions));

    }

    }

   

    public void testInheritanceAndMixedUserGroupPermissions() throws RepositoryException, NotExecutableException {

        Group testGroup = getTestGroup();

        /*

         precondition:

         testuser must have READ-only permission on test-node and below

        */

        checkReadOnly(path);

        Privilege[] privileges = privilegesFromName(Privilege.JCR_MODIFY_PROPERTIES);

        /* give MODIFY_PROPERTIES privilege for testGroup at 'path' */

        givePrivileges(path, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));

        /* withdraw MODIFY_PROPERTIES for the user at 'path' */

        withdrawPrivileges(path, testUser.getPrincipal(), privileges, getRestrictions(superuser, path));

        /*

         since user-permissions overrule the group permissions, testuser must

         not have set_property action / modify_properties privilege.

         */

        /*

         give MODIFY_PROPERTIES privilege for everyone at 'childNPath'

         -> user-privileges still overrule group privileges

         */

        givePrivileges(childNPath, testGroup.getPrincipal(), privileges, getRestrictions(superuser, path));

    }