parsav  Diff

Differences From Artifact [c0f2a21443]:

• File doc/acl.md — part of check-in [d3fe1d11af] at 2021-01-13 00:04:54 on branch trunk — add full relationship control screen, more timelines, minor fixes and cleanups (user: lexi, size: 3811) [annotate] [blame] [check-ins using]

To Artifact [82ba9b6168]:

• File doc/acl.md — part of check-in [0814075eff] at 2025-02-07 12:23:05 on branch trunk — misc corrections (user: lexi, size: 3812) [annotate] [blame] [check-ins using]

    19     19   * **<**_title_**>**: matches peers of the net who have been created *title* by the sovereign
    20     20   * **#**_room_**<**_title_**>**: matches peers of the chat who have been created *title* by *room* staff
    21     21   
    22     22   to evaluate an ACL expression, `parsav` reads each term from start to finish. for each term, it considers whether it describes the user who is attempting to access the content. if the term matches, its policy is applied and the expression completes. if the term doesn't match, the server proceeds on to the next term and the process repeats until it finds a matching term or runs out of terms, applying the fallback policy.
    23     23   
    24         -**policy** is whether a term grants or denies access. the default term policy is **allow**, but you can control the policy with the keywords `allow` and `deny`. if a term finishes evaluating without any match being found, a fallback policy is applied; this fallback is the opposite of whatever the current policy is. this sounds confusing but makes ACL expressions much more intuitive; `allow @bob` and `deny trent` do exactly what you'd expect — the former allows bob and only bob in; the latter denies access only to trent, but grants access to the rest of the world.
           24  +**policy** is whether a term grants or denies access. the default term policy is **allow**, but you can control the policy with the keywords `allow` and `deny`. if a term finishes evaluating without any match being found, a fallback policy is applied; this fallback is the opposite of whatever the current policy is. this sounds confusing but makes ACL expressions much more intuitive; `allow @bob` and `deny @trent` do exactly what you'd expect — the former allows bob and only bob in; the latter denies access only to trent, but grants access to the rest of the world.
    25     25   
    26     26   expressions must contain at least one term to be valid. if they consist only of policy keywords, they will be rejected.
    27     27   
    28     28   in effect, this all means that an ACL expression can be treated as a simple list of who is allowed to view your post. for instance, an expression of `local` means only local users can view it. however, much more complex expressions are possible.
    29     29