[OAK-9059] Moving nodes doesn't remove source path(s) from HIDDEN_NESTED_CUGS

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.22.4, 1.30.0
• Component/s: authorization-cug
• Assignee: Angela Schreiber
• Reporter: Angela Schreiber
• Created: 12/May/20 08:46
• Updated: 27/May/20 06:19
• Resolved: 14/May/20 11:03

Description

when moving a tree that hold a nested CUG structure the HIDDEN_NESTED_CUGS property gets updated to contain the new destination path (i.e. during the second 'add'-phase of the move) but doesn't remove the original source path.

while permission evaluation is correct, this may lead to IllegalArgumentException raised by org.apache.jackrabbit.oak.commons.PathUtils.relativize called during NestedCugHook$Diff.childNodeDeleted, when the policy node containing the HIDDEN_NESTED_CUGS property is removed later on.

proposed fix:

• clear source-path(s) from HIDDEN_NESTED_CUGS during commits that contain move operation(s)
• prevent NestedCugHook$Diff.childNodeDeleted to fail but rather ignore paths that cannot be 'relativized' during the reconnect preparation (i.e. not moving those entries to the hidden property with the next parent CUG upon policy removal). this will also make sure inconsistencies introduced by past move operations get cleared upon policy removal.