Path-Based Authorization for Tags

From: Luiz Guilherme Kimel <lkimel_at_dba.com.br>
Date: Wed, 28 Jul 2010 14:59:32 -0300

Hello there,

I'm implementing a subversion repository that keeps project management
artefacts. In other words, we are using SVN for document management. And
everything was going right until we find that managers need to keep status
of allocated human resources salaries and this can't be accessed by everyone
in the project. Ok, let's use path-based auth, but then comes a question:
what to do with tags?

Example path-based settings for a project:

[svn:/projects/project-abc/tags/]

@team=r

@cm=rw

[svn:/projects/project-abc/trunk/]

@team=rw

[svn:/projects/project-abc/trunk/releases]

@team=r

@cm=rw

[svn:/projects/project-abc/trunk/planning]

# no change

[svn:/projects/project-abc/trunk/costs]

@team=

@maganement=rw

My requirements:

1) I want that the "costs" directory will be writeable only by
management group while under the trunk folder;

2) I want that the "costs" directory will be readeable and just
readeable to management group once under tags folder;

3) I don't want to have to specify different path-based auth rules for
each new tag.

4) It's desireable that the configuration management group (cm group)
is able to generate tags, but still can't read the "costs" directory!

Am I dreaming? It would be wonderful if I were able to specify path-based
auth like this:

[svn:/projects/project-abc/tags/*/costs]

@maganement=r

[svn:/projects/project-abc/trunk/costs]

@maganement=rw

But I can't. I need to keep costs status linked to project baseline saved
when we have a complete milestone. I thought about an structure like this:

Project1

Team

Trunk

Planning

Branches