tree 8385b77fb5f01dab3fa6caa117916d4603bc93bc
parent 588371b3dcf745ad68abc4791d213cdd2c2f6b4a
author Eric Anderson <ejona@google.com> 1378486841 -0700
committer Eric Anderson <ejona@google.com> 1378934285 -0700

Add transform for Principals in ACLs

This is not part of the transform pipeline because the pipeline doesn't
handle arbitrary objects well. This ACL transform support does not allow
arbitrary ACL transforms but instead only simple replacements.

The ACL transforming is intended to be a mostly hidden feature that is
only used when absolutely necessary. That won't quite be the case, but
the intention is to 1) learn the cases that people are trying to solve
and then 2) find better solutions for those cases. This likely won't
ever go away, but we should consider transforming ACLs here a hack.

Note that transforming ACLs does not change late binding behavior, so
the two can be out-of-sync.