I've made changes to the ACL adding DOMAIN_OWNER and DOMAIN_ADMIN values to give use fine-grained permissions checking (some commands should be executed only by owner and some by owner and admins).

I've updated most of the commands to use them by replacing calls to RepositoryItem::isAdmin() and RepositoryItem::isOwner() with call of a new lambda method which is passed in bindings called isAllowedForDomain. To use it just call isAllowedForDomain.apply(domain) and it will return true or false depending on user(caller) permissions for modifying items in the domain (result of checking ACLs).

If DOMAIN_OWNER or DOMAIN_ADMIN are not set (but other values are), calls to isAllowedForDomain are still safe to use and will result values which should be returned in those situations.

Please check if this works ok for you.

As for CompRepoItemUpdate and CompRepoItemRemove, I've left there checking based on items owner and admins values as it looked saner (not all items are domains so we should not make checking based on domains there).

Andrzej Wójcik wrote:

Please check if this works ok for you.

I've adjusted configuration of tigase-testsuite and it caught error in UserRosterManagement which I fixed. Other that that it works great - thank you.

As for CompRepoItemUpdate and CompRepoItemRemove, I've left there checking based on items owner and admins values as it looked saner (not all items are domains so we should not make checking based on domains there).

Makes sense.