My client is having an issue with permission inheritance down their page tree. Here's a small sample of the page hierachy we are dealing with:
- F0 (sling:OrderedFolder)
- F1 (sling:OrderedFolder)
- jcr:content (nt:unstructured)
- P1 (cq:Page)
- P2 (cq:Page)
- P3 (cq:Page)
- F1 (sling:OrderedFolder)
We need to be able to ALLOW the "modify" and "create" actions for F0 and have it inherit all the way down through the pages. However, when we do this, the inheritance for "modify" stops after F1. F0 will allow "modify" (this is where we set ALLOW). F1 will allow it. F1's jcr:content node will allow it. None of the children of F1 that are pages will allow "modify". However, the "create" action will inherit all the way down through just fine.
It gets weirder. If we add ALLOW "delete" to F0 it fixes the problem. All three of the actions inherit all the way down through. So we tried setting them one at a time. Setting just "delete" inherits all the way down through. Setting just "create" does too. Setting just "modify" does not work. It has the same unexpected behavior where the cq:Page nodes do not inherit the permission.
I'm not completely convinced this is a product bug because it only happens in the client's application. I tried to replicate the same scenario on a standalone instance on my dev machine using the Geometrixx site and everything worked as expected. So I'm looking for some feedback...
Is there something about the permission model that I'm not thinking about correctly that would explain this behavior? Are there any node-types, properties, etc. that I should be looking out for (maybe something that has given you trouble in the past)? Really I would appreciate any feedback on the issue, because this is a pretty strange one. I plan to cross post this to the Google Group as well. Thanks a lot!