ref right '-refs/heads/*' doesn't block parent's 'refs/heads/*'

[GoogleCodeExporter]

Affected Version: 2.1.4

What steps will reproduce the problem?
1. In "All Projects" add a ref right 'Registered Users' 'code review' 
'refs/heads/*' '-2/+2'
2. In "testPproject" add a ref right 'special group' 'code review' 
'-refs/heads/*' '-2/+2'

What is the expected output? What do you see instead?
Expect that only users in 'special group' can set -2/+2 CRVW, but Registered 
Users can still set -2/+2 as well.

Original issue reported on code.google.com by nas...@chromium.org on 3 Sep 2010 at 4:11

[GoogleCodeExporter]

I just wrote a unit test that confirms the behavior
is as you describe in the bug.

But unfortunately what you are expecting isn't the
meaning of the '-' exclusive flag.  When we added
'-' and exclusive rights, we only intended for this
to stop inheritance up the branch hierarchy.  So it
won't look at refs/* here.  But it does still keep
going up the project hierarchy to find other rights
that match the same ref name.  And that exists.

IIRC this was intentional on our part when we wrote
the exclusive code.  We wanted to be able to put in
a rule at the All Projects level to inherit down the
entire tree.

Right now with master you can add:

  testPproject  'Registered Users'  'code review'  'refs/heads/*' 0

to block the same rule from inheriting from the parent.
Or, use a different parent project which doesn't have
this particular rule on it.

But I'm not sure we want to change the meaning of '-' to
mean also stop inheriting from the parent.

Original comment by sop@google.com on 3 Sep 2010 at 7:11

• Changed title: ref right '-refs/heads/' doesn't block parent's 'refs/heads/'
• Changed state: AwaitingInformation