Inheritable ACEs should be passed down to instantiated child resources

[wsanchez@…]

12/7/06 6:53 PM Wilfredo Sanchez: Inheritable ACEs should be passed down to instantiated child resources

This keeps them easily available for ACL queries, rather than having to computer them (at least once) by walking the URL tree.

[wsanchez@…]

12/11/06 2:49 PM Cyrus Daboo: There is another optimization we can make that will make a big difference: in the vast majority of cases the child resources in a calendar collection will not have their own ACL - instead they just rely on inherited privileges. Given that, what we can do in e.g., PROPFIND, is pre-calculate the checkPrivileges for the inherited aces only. Then if the resource has none of its own we can use the pre-calculated value. This gets rid of the need to do privilege determination for each child resource as we have to do now. That is an expense part of checkPrivileges as it involves resolving principal resources, groups, calculating grant/deny/invert etc.

I may undertake this change as part of performance work. If we do that there is less need to pass in inherited ACEs at resource instantiation time.

12/11/06 2:58 PM Wilfredo Sanchez: I'm starting to think that the DAVResource object should have a little friend called DAVInheritedData or some such, into which we can park ACEs, principal collections, etc. That way, when we add another inheritable whozzit, we don't need to change the init APIs everywhere.