Path match rules

[ip1981]

There is an old design flaw in privilege schema, that multiple privileges may match the same path. It is described in README:

However of all the matching rules only the rule with the longest path pattern will be used to determine whether a user is allowed to perform a request. This is often a bit surprising.

This is implemented as:

ORDER BY length(path) - length(replace(path, '/', '')) DESC

To make it less "surprising" we can use ordered rules (the first to match wins).

E. g.

privilege	domain	path	method	order
basic	wiki.example.com	/%	GET	10
read	wiki.example.com	/wiki/%	GET	5
edit	wiki.example.com	/wiki/edit/%	GET	1
edit	wiki.example.com	/wiki/edit/%	POST	1
admin	wiki.example.com	/admin/%	GET	5
admin	wiki.example.com	/admin/%	POST	5
admin	wiki.example.com	/admin/%	DELETE	5

[ip1981]

Instead of order, this might be, reversed, weight. With the default value length(path) - length(replace(path, '/', '')) in SQLite, and something like that on Postgres side.