Module acl 

ACL enforcement: the boundary between the ACL field a client sees and the _rperm/_wperm columns storage holds.

The rule that must not be got wrong: absent permission columns mean public. addReadACL emits _rperm: {$in: [null, '*', ...acl]} and null in a Mongo $in matches a document where the field is missing, which is how a row saved without an ACL stays readable. Omitting the null silently hides every such row, and there is no error to notice.

Two known differences from upstream live in lower_acl, both recorded as deliberate differences and both deferred rather than fixed here.

It reads principals from a map and nothing else, so an ACL that is an array takes the truthy-non-object path below: two empty columns, which is a master-only row rather than a column-less public one. Upstream enumerates the array, so [{"read":true}] grants principal "0" there, an index being a property name. That does change who may read the row, in the restrictive direction: a principal upstream grants is granted nothing here.

And the columns come out in wire order, where upstream enumerates a JavaScript object and puts integer-like keys first. That one grants the same rights to the same principals and is visible only to a client preserving map order, or to a mixed fleet comparing stored rows.

Enums

AclScope

Who a request is acting as, for ACL purposes.

Functions

default_acl_for_create

Resolve a class’s declared default ACL into the value a create should carry.

lower_acl

Split an ACL field out of a row into the two storage columns.

raise_acl

Rebuild the ACL field from the two storage columns, then drop them.