Expand description
ACL enforcement: the boundary between the ACL field a client sees and the _rperm/_wperm
columns storage holds.
The rule that must not be got wrong: absent permission columns mean public.
addReadACL emits _rperm: {$in: [null, '*', ...acl]} and null in a Mongo $in matches a
document where the field is missing, which is how a row saved without an ACL stays readable.
Omitting the null silently hides every such row, and there is no error to notice.
Enums§
- AclScope
- Who a request is acting as, for ACL purposes.