@Override
    public boolean canAccessItems(Node node, JID owner, JID subscriber) {
        // Let node owners and sysadmins always get node items
        if (node.isAdmin(owner)) {
            return true;
        }
        NodeAffiliate nodeAffiliate = node.getAffiliate(owner);
        if  (nodeAffiliate == null) {
            // This is an unknown entity to the node so deny access
            return false;
        }
        // Any subscription of this entity that was approved will give him access
        // to retrieve the node items
        for (NodeSubscription subscription : nodeAffiliate.getSubscriptions()) {
            if (subscription.isActive()) {
                return true;
            }
        }
        // No approved subscription was found so deny access
        return false;
    }
Subscription requests must be approved and only subscribers may retrieve items.

@author Matt Tucker
xmppserver/src/main/java/org/jivesoftware/openfire/pubsub/models/AuthorizeAccess.java