可以诠释Jackrabbit ACL 最好的一段代码(Resource Based)

http://wiki.apache.org/jackrabbit/AccessControl里解释道， A core concept of resource-based ACLs is that they inherit the ACLs from the parent node, thus for each node, all the ACLs of its ancestor come into play as well.意思就是resource-based ACL 会从父节点继承权限并应用到所有的node。但是这里却没有说明是rep:GrantACE可以继承还是rep:DenyACE可以被继承。经过实验，应该是rep:GrantACE可以被继承，而rep:DenyACE在应用到子节点的时候会被其rep:GrantACE的属性所覆盖，而rep:GrantACE却不能够被覆盖。一旦使用，那么子节点就都具有这个权限。PS，和操作系统一样。
使用代码解释为，
JackrabbitSession session = (JackrabbitSession)loginWithAdminRepository();
Node node = session.getRootNode();
node.addNode("shmily");
node.addNode("shmily/test");
node.addNode("george");
node.addNode("george/test");
session.save();
session.logout();

session = (JackrabbitSession)loginWithShmilyRepository();
Principal p = session.getPrincipalManager().getPrincipal(session.getUserID());
removeACLForCurrentNode("/");
grantDenyAllPrevilige("/", EveryonePrincipal.getInstance());

removeACLForCurrentNode("/shmily");
grantPrevilige("/shmily", p, Privilege.JCR_READ);
session.getNode("/shmily");
session.getNode("/shmily/test");

try{
session.getNode("/george");
}catch(javax.jcr.PathNotFoundException e){
grantPrevilige("/george", p, Privilege.JCR_READ);
session.getNode("/george");
}
session.logout();