Restrictive parent locks nested path - Githubissues

OptimalBits / node_acl

Access control lists for node applications

2.62k stars 369 forks source link

Restrictive parent locks nested path #195

Open sielay opened 8 years ago

sielay commented 8 years ago

I have two rules

/api/cms/.*:
    - get
    - delete
    - post
    - put
/api/.*
    - get

Expected behaviour

GET /api/whatever TRUE
POST /api/whatever FALSE
GET /api/cms/whatever TRUE
POST /api/cms/whatever TRUE

Actual behaviour

GET /api/whatever TRUE
POST /api/whatever FALSE
GET /api/cms/whatever TRUE
POST /api/cms/whatever FALSE <- this seems working wrong

Why?

In this line

https://github.com/OptimalBits/node_acl/blob/master/lib/acl.js#L883

You use union instead of unions

What do you think about it?

sielay commented 8 years ago

Anyone?