Adapting for the privilege change regarding resource annotations in redback.

archiva-modules/archiva-base/archiva-security-common/src/main/java/org/apache/archiva/security/common/ArchivaRoleConstants.java

 
     public static final String OPERATION_REPOSITORY_UPLOAD = "archiva-upload-repository";
 
+    public static final String OPERATION_FILE_UPLOAD = "archiva-upload-file";
+
     public static final String OPERATION_REPOSITORY_DELETE = "archiva-delete-artifact";
 
     public static final String OPERATION_MERGE_REPOSITORY = "archiva-merge-repository";

archiva-modules/archiva-base/archiva-security-common/src/main/resources/META-INF/redback/redback.xml

           <name>archiva-upload-repository</name>
           <description>Upload Archiva Repository</description>
         </operation>
+        <operation>
+          <id>archiva-upload-file</id>
+          <name>archiva-upload-file</name>
+          <description>Upload File to Archiva</description>
+        </operation>
         <operation>
           <id>archiva-access-repository</id>
           <name>archiva-access-repository</name>
               <operation>archiva-upload-repository</operation>
               <resource>${resource}</resource>
             </permission>
+            <permission>
+              <id>archiva-upload-file</id>
+              <name>Archiva Upload File to Archiva</name>
+              <operation>archiva-upload-file</operation>
+              <resource>global</resource>
+            </permission>
             <permission>
               <id>archiva-view-audit-logs</id>
               <name>Archiva View Audit Logs</name>

archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/BrowseService.java

     @Path("metadata/{g}/{a}/{v}/{key}/{value}")
     @PUT
     @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
     ActionStatus addMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
                               @PathParam("v") String version, @PathParam("key") String key, @PathParam("value") String value,
                               @QueryParam("repositoryId") String repositoryId )
     @Path("metadata/{g}/{a}/{v}/{key}")
     @DELETE
     @Produces({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repositoryId}")
     ActionStatus deleteMetadata( @PathParam("g") String groupId, @PathParam("a") String artifactId,
                                  @PathParam("v") String version, @PathParam("key") String key,
                                  @QueryParam("repositoryId") String repositoryId )
 
     @Path("importMetadata")
     @POST
-    @RedbackAuthorization(noPermission = false, noRestriction = false, permissions = "archiva-add-metadata")
+    @RedbackAuthorization( permissions = "archiva-add-metadata", resource = "{repository}")
     ActionStatus importMetadata( MetadataAddRequest metadataAddRequest, @QueryParam("repository") String repository )
         throws ArchivaRestServiceException;
 

archiva-modules/archiva-web/archiva-rest/archiva-rest-api/src/main/java/org/apache/archiva/rest/api/services/MergeRepositoriesService.java

     @Path ("mergeConflictedArtifacts/{sourceRepositoryId}/{targetRepositoryId}")
     @GET
     @Produces ({ MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML })
-    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
     List<Artifact> getMergeConflictedArtifacts( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
                                                 @PathParam ("targetRepositoryId") String targetRepositoryId )
         throws ArchivaRestServiceException;
      */
     @Path ("mergeRepositories/{sourceRepositoryId}/{targetRepositoryId}/{skipConflicts}")
     @GET
-    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY)
+    @RedbackAuthorization (permissions = ArchivaRoleConstants.OPERATION_MERGE_REPOSITORY, resource = "{sourceRepositoryId}")
     void mergeRepositories( @PathParam ("sourceRepositoryId") String sourceRepositoryId,
                             @PathParam ("targetRepositoryId") String targetRepositoryId,
                             @PathParam ("skipConflicts") boolean skipConflicts )

archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/FileUploadService.java

     @POST
     @Consumes( MediaType.MULTIPART_FORM_DATA )
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     FileMetadata post( MultipartBody multipartBody )
         throws ArchivaRestServiceException;
 
     @Path( "{fileName}" )
     @DELETE
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     Boolean deleteFile( @PathParam( "fileName" ) String fileName )
         throws ArchivaRestServiceException;
 
     @Path( "sessionFileMetadatas" )
     @GET
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     List<FileMetadata> getSessionFileMetadatas()
         throws ArchivaRestServiceException;
 
     @Path( "clearUploadedFiles" )
     @GET
     @Produces( { MediaType.APPLICATION_JSON, MediaType.APPLICATION_XML } )
-    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_REPOSITORY_UPLOAD )
+    @RedbackAuthorization( permissions = ArchivaRoleConstants.OPERATION_FILE_UPLOAD )
     Boolean clearUploadedFiles()
         throws ArchivaRestServiceException;