The way to grant modified privilege for the ':childOrder' hidden property.

[norsasaki]

Hi, all

I'm trying to grant some privileges to a parent node without granting any privileges to the child and descendant nodes, and grant different privileges to the child nodes.

The yaml[1], which grants a privilege for the parent node only itself, was made referring to the document [2]. It can apply only the parent node as expected, however the error[3] happens when the order of any child node is changed.

When the yaml[4] is applied, the order can be changed, but this yaml affects all child and descendant nodes.

Reading the error message[3], this error is caused by not granting the modified privilege for the ':childOrder' hidden property on the parent node, however, I couldn't find how to grant modified privilege for the ':childOrder' hidden property without granting any privilege to the child and descendant nodes.

Could you give me some suggestion to solve this problem?

[1]

- path: /content/we-retail/us/en
  permission: allow
  actions: 
  privileges: jcr:read,jcr:modifyProperties,jcr:addChildNodes,jcr:removeChildNodes
  repGlob: ""  # matches node /foo only (no descendants, not even properties)

- path: /content/we-retail/us/en
  permission: allow
  actions: 
  privileges: jcr:read,jcr:modifyProperties,jcr:addChildNodes,jcr:removeChildNodes
  repGlob: /jcr:*

[2] https://github.com/Netcentric/accesscontroltool/blob/develop/docs/BestPractices.md

[3]

Exception happen on Move javax.jcr.AccessDeniedException: OakAccess0000: Access denied
*DEBUG* /etc/acs-tools/aem-fiddle/_jcr_content.run.html HTTP/1.1] org.apache.jackrabbit.oak.plugins.observation.ChangeCollectorProvider Collected changeSet for commit CommitInfo{sessionId=session-100704, userId=demo, external=false, date=1712530897959, info={user-data=acs-aem-tools.aem-fiddle, oak.commitAttributes=CommitContext[attrs={oak.observation.changeSet=ChangeSet{paths[maxDepth:9]=[/content/we-retail/us/en], propertyNames=[:childOrder], parentNodeNames=[en], parentNodeTypes=[rep:AccessControllable, cq:Page], allNodeTypes=[rep:AccessControllable, cq:Page, sling:OrderedFolder], any overflow: false, hits max path depth: false}}]}} is ChangeSet{paths[maxDepth:9]=[/content/we-retail/us/en], propertyNames=[:childOrder], parentNodeNames=[en], parentNodeTypes=[rep:AccessControllable, cq:Page], allNodeTypes=[rep:AccessControllable, cq:Page, sling:OrderedFolder], any overflow: false, hits max path depth: false}

[4]

- path: /content/we-retail/us/en
  permission: allow
  actions: 
  privileges: jcr:read,jcr:modifyProperties,jcr:addChildNodes,jcr:removeChildNodes
  repGlob:   # remove ""

- path: /content/we-retail/us/en
  permission: allow
  actions: 
  privileges: jcr:read,jcr:modifyProperties,jcr:addChildNodes,jcr:removeChildNodes
  repGlob: /jcr:*