TiddlySpace/tiddlyspace — Issue #910: it is possible to clobber NONE or ANY in policies when doing member subscription
Author: cdent
Created: 2012-02-07 17:15:48+00:00
State: open

This (rejected) [pull request](https://github.com/TiddlySpace/tiddlyspace/pull/904) proposes a fix to a problem with policy handling on non-default space bags. The solution involves too much magic to be satisfactory, so instead tossing out an issue so we fix it for real. The situation is as follows:

* a policy is updated to be set to either NONE or ANY (nobody passes the constraint, any authed person passes the constraint)
* later someone adds a member to a space using that policy
* this makes the policy `['NONE', 'themember']` which is invalid

What needs to happen here is that the NONE or ANY needs to be seen and the member addition should fail with a message. The assumption is that any space which has NONE or ANY in the policies is doing it on purpose and doesn't want it broken.