balderdashy/sails — pull request #1680 by gebrits (2014-05-09 11:50:39+00:00)
Title: additive (i.e.: trickle down) policies

### Desc

As per #1643 this PR allows setting additive (or trickle down) policies. I.e.: policies that inherit from both (configurable) `global *` and `controller local *`.

Additive policies are enabled by setting the following:

### Config

**config/policies.js**

_config: {
additive: true
}

### Defaults

By default, the following inheritance takes place:

* controller-policies inherit from `global *` before applying own policies
* action-policies inherit from both `global *` and `controller-local *` (**in this order*) before applying own policies

### Overwrites

There needs to be an option to *overwrite* policies so **not** to inherit policies. This is done as follows:

** Controller policies**

Controller Policies can opt-out of inheriting from `global *` by defining `true` as their first policy (i.e.: allow all)

** Action policies**

Action Policies can:

* opt-out of inheriting from `global *` as well as `controller-local *` by defining `true` as their first policy (i.e.: allow all)
* opt-out of inheriting from `controller-local *` (but still inherit `global *`) by defining `_skiplocal*` as their first policy