Repository: valkey-io/valkey
File: src/acl.c (C)

Code before:

    /* We never assign the last bit in the user commands bitmap structure,
     * this way we can later check if this bit is set, understanding if the
     * current ACL for the user was created starting with a +@all to add all
     * the possible commands and just subtracting other single commands or
     * categories, or if, instead, the ACL was created just adding commands
     * and command categories from scratch, not allowing future commands by
     * default (loaded via modules). This is useful when rewriting the ACLs
     * with ACL SAVE. */
    if (nextid == USER_COMMAND_BITS_COUNT - 1) nextid++;
    return thisid;
}

/* Return an username by its name, or NULL if the user does not exist. */
user *ACLGetUserByName(const char *name, size_t namelen) {
    void *myuser = NULL;
    raxFind(Users, (unsigned char *)name, namelen, &myuser);
    return myuser;
}

/* =============================================================================
 * ACL permission checks
 * ==========================================================================*/

/**
 * Checks whether a given key is allowed for the specified ACL selector.
 *
 * The function evaluates the key against the selector's patterns, taking into account
 * the requested key access flags (read/write) and whether the key should be
 * treated as a prefix. If the selector has the SELECTOR_FLAG_ALLKEYS flag set,
 * the check always succeeds.
 *
 * - selector The ACL selector containing the allowed key patterns.
 * - key           Pointer to the key string to check.
 * - keylen        Length of the key in bytes.
 * - keyspec_flags Bitmask of requested key operations (e.g., CMD_KEY_ACCESS,
 *                 CMD_KEY_INSERT, CMD_KEY_DELETE, CMD_KEY_UPDATE).
 * - is_prefix     If true, the key is compared as a prefix against the selector's
 *                 patterns using prefixmatchlen rather than a full string match.
 *
 * This function returns ACL_OK if the key matches at least one pattern that allows the requested
 * operations; otherwise ACL_DENIED_KEY.
 */
static int ACLSelectorCheckKey(aclSelector *selector, const char *key, int keylen, int keyspec_flags, bool is_prefix) {
    /* The selector can access any key */
    if (selector->flags & SELECTOR_FLAG_ALLKEYS) return ACL_OK;

    listIter li;
    listNode *ln;
    listRewind(selector->patterns, &li);


Review comment (suggestion):
```suggestion
/* Checks whether a given key is allowed for the specified ACL selector.
```

Code after:
    unsigned long thisid = nextid;
    nextid++;

    /* We never assign the last bit in the user commands bitmap structure,
     * this way we can later check if this bit is set, understanding if the
     * current ACL for the user was created starting with a +@all to add all
     * the possible commands and just subtracting other single commands or
     * categories, or if, instead, the ACL was created just adding commands
     * and command categories from scratch, not allowing future commands by
     * default (loaded via modules). This is useful when rewriting the ACLs
     * with ACL SAVE. */
    if (nextid == USER_COMMAND_BITS_COUNT - 1) nextid++;
    return thisid;
}

/* Return an username by its name, or NULL if the user does not exist. */
user *ACLGetUserByName(const char *name, size_t namelen) {
    void *myuser = NULL;
    raxFind(Users, (unsigned char *)name, namelen, &myuser);
    return myuser;
}

/* =============================================================================
 * ACL permission checks
 * ==========================================================================*/

/* Checks whether a given key is allowed for the specified ACL selector.
 *
 * The function evaluates the key against the selector's patterns, taking into account
 * the requested key access flags (read/write) and whether the key should be
 * treated as a prefix. If the selector has the SELECTOR_FLAG_ALLKEYS flag set,
 * the check always succeeds.
 *
 * - selector The ACL selector containing the allowed key patterns.
 * - key           Pointer to the key string to check.
 * - keylen        Length of the key in bytes.
 * - keyspec_flags Bitmask of requested key operations (e.g., CMD_KEY_ACCESS,
 *                 CMD_KEY_INSERT, CMD_KEY_DELETE, CMD_KEY_UPDATE).
 * - is_prefix     If true, the key is compared as a prefix against the selector's
 *                 patterns using prefixmatchlen rather than a full string match.
 *
 * This function returns ACL_OK if the key matches at least one pattern that allows the requested
 * operations; otherwise ACL_DENIED_KEY.
 */
static int ACLSelectorCheckKey(aclSelector *selector, const char *key, int keylen, int keyspec_flags, bool is_prefix) {
    /* The selector can access any key */
    if (selector->flags & SELECTOR_FLAG_ALLKEYS) return ACL_OK;

    listIter li;
    listNode *ln;
    listRewind(selector->patterns, &li);