[ https://issues.apache.org/jira/browse/SLING-9871?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17306048#comment-17306048 ]
Angela Schreiber commented on SLING-9871: ----------------------------------------- [~ashishc], [~enorman], IMHO there one piece missing in the discussion here: the default implementation in Oak will perform some automatic cleanup and {{AccessControlList.addAccessControlEntry}} (and the jackrabbit variants of it) are not guaranteed to result in a new ACE being added at the end of the list (see oak docu and exercises for examples). Since repo-init only uses JCR and Jackrabbit API the re-ordering might only work under special circumstances..... so I am not sure this is doable except for very limited cases. > Specifying order of ACEs through repoinit directives > ---------------------------------------------------- > > Key: SLING-9871 > URL: https://issues.apache.org/jira/browse/SLING-9871 > Project: Sling > Issue Type: Improvement > Components: Repoinit > Reporter: Ashish Chopra > Priority: Major > > As of writing this, repoinit processor (among other things not relevant to > this JIRA) collects {{create path}} statements and {{set ACL}} statements > declared in all the feature-models applicable to feature-aggregate under > consideration. > Upon repository initialization, it applies all the {{create path}} > statements, followed by all the {{set ACL}} statements. However, the order in > which {{set ACL}} statements declared across feature models are applied isn't > defined (currently, it seems to be based on feature-model-name, > alphabetically ascending). > This causes issues at times because we want the order of the ACEs to be > maintained (e.g., "deny"s for everyone at a given path must be the first ACE, > followed by "allow"s for specific, non-system-user principals) > Repoinit should be able to support this requirement. -- This message was sent by Atlassian Jira (v8.3.4#803005)