Closed kwin closed 2 months ago
This is probably a regression of #155.
The clean up of ACEs outside managed paths, happens outside in https://github.com/Netcentric/accesscontroltool/blob/6499e07816c37d82147b0e5954b0db15704fa400/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/impl/AcInstallationServiceImpl.java#L334 therefore it works as expected.
The code at https://github.com/Netcentric/accesscontroltool/blob/6499e07816c37d82147b0e5954b0db15704fa400/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/aceinstaller/AceBeanInstallerIncremental.java#L65 tries to detect if ACEs need to be installed. For that it compares the config from the YAML with the state from the repo. Unfortunately it only considers ACEs in the repo at paths managed in the YAML (https://github.com/Netcentric/accesscontroltool/blob/6499e07816c37d82147b0e5954b0db15704fa400/accesscontroltool-bundle/src/main/java/biz/netcentric/cq/tools/actool/aceinstaller/BaseAceBeanInstaller.java#L68) but not anywhere else.
The main advantage of the ACTool is that it also cleans up ACEs for managed authorizables which are not mentioned in the YAML config.
However this case is not considered for the default
AceBeanInstallerIncremental
service.