ModeShape/modeshape — pull request #905 by rhauch (2013-08-06 18:54:59+00:00)
Title: MODE-2004 Access control checks only occur in repositories that have ACLs

Implemented this by adding an "accessControl" boolean field in the repository's metadata document. The field is "false" by default, but is changed to "true" as soon as the first ACL is created and added to a node in the repository (any workspace). This means that for any repository that does not use ACLs, there is almost no overhead to the ACL checks. However, as soon as the first ACL is created, then from that point forward all permission checks look for ACLs on the specified node or any of its ancestors.

RepositoryCache was also changed to efficiently expose this setting to other components: the JcrSession class was changed to use it to determine if the ACLs should even be checked, while AccessControlManagerImpl was changed to set this value to true when ACLs are created. (RepositoryCache only updates the metadata document if the value is different from its existing value, and notification of the changes is propagated to other nodes in the cluster.)