Skip to content

docs(acl): describe the two-phase native ACL check - #91

Merged
opendev9 merged 1 commit into
devfrom
docs/cf-acl-native-check-lock-scope
Oct 25, 2026
Merged

opendev9 merged 1 commit into
devfrom
docs/cf-acl-native-check-lock-scope

Conversation

@opendev9

Copy link
Copy Markdown

What

Comment-only update to NativeACLCheck's docstring. It still claimed native code invokes the
Hub ACL check "under Branch(master) at final commit", which stopped being true with
eaopen/cloudfile-server#42:

  • native write authorization now runs in a pre-lock preflight (no Branch row locked);
  • the final Branch(master) transaction only re-reads the bounded ACL row/revision proof.

Keeping the old sentence would invite new callers to add Hub HTTP inside the Branch
transaction, which is exactly the lock/HTTP ordering fixed by #42 and tracked for cf-edit in
eaopen/cloudfile-server#43.

Verification

Docstring only; python3 -m py_compile cloudfile_ext/v2/acl_http.py passes. No behaviour change.

Refs eaopen/cloudfile-server#42, eaopen/cloudfile-server#43.

#42 moved native commit authorization into a pre-lock preflight and keeps
only the ACL row/revision proof inside Branch(master). Update the
NativeACLCheck docstring, which still claimed the Hub decision runs under the
Branch lock at final commit. Comment-only change; no behaviour change.

Refs eaopen/cloudfile-server#43
@opendev9
opendev9 merged commit 18f938c into dev Oct 25, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant