authzpolicy FineGrainedPermissions: configuration file order matters, but more/less specific patterns don't

[ch.lange@…]

When using FineGrainedPermissions and authzpolicy, we had the following configuration:

@group = user

[wiki:Page*] # the page and all subpages
@group = WIKI_VIEW

[wiki:Page/SpecificSubpage] # a specific subpage
@group = WIKI_VIEW, WIKI_MODIFY

The intention was that the given user group should be allowed to edit the specific subpage, but only view the Page and its other subpages.

However, the user was not able to edit Page/SpecificSubpage.

Reversing the order of both entries helps.

Although the Subversion authz documentation says that "the most specific path always matches first", Trac's implementation of authz apparently takes the first pattern that matches.

[Christian Boos]

Although the Subversion authz documentation says that "the most specific path always matches first", Trac's implementation of authz apparently takes the first pattern that matches.

Those are two different things.

On one hand side you have the Subversion authz conventions that we try to apply on Subversion repositories (see SvnAuthz), on the other side we have something similar (AuthzPolicy) that we apply on all Trac resources. We never said that our authz policy should behave like the Subversion authz.

Trying to apply the most specific rules regardless of the order would be significantly harder to do than what we currently do.

(bordering wontfix, but I'll let other people comment on this before doing so)