deny() s Permission::ALL – divna feature nebo BUG?

Na projektu jsme narazili na dost divne chovani Nette\Security\Permission::deny().
Zde je mnou provedeny test na cistem sandboxu:

use Nette\Security\Permission;

abstract class BasePresenter extends Nette\Application\UI\Presenter
{

	protected function startup() {
		parent::startup();

		if(!$this->user->loggedIn){
			$this->user->login("testuser", "12345");
			echo "Logged in";
		}
		if(!$this->user->isInRole("Test")){
			$this->user->identity->setRoles( array("Test") );
		}

		$acl = new Permission;
		echo "Test: ";
		$acl->addRole("Test");
		$acl->addResource("Test");

		$acl->allow("Test", "Test", Permission::ALL);
		$acl->deny("Test", Permission::ALL, "approve");
		var_dump($acl->isAllowed("Test", "Test", "approve"));
		echo "<br />";

		$acl2 = new Permission;
		echo "Test2: ";
		$acl2->addRole("Test");
		$acl2->addResource("Test");

		$acl2->allow("Test",  Permission::ALL, Permission::ALL);
		$acl2->deny("Test", "Test", "approve");
		var_dump($acl2->isAllowed("Test", "Test", "approve"));
		echo "<br />";

		$acl3 = new Permission;
		echo "Test3: ";
		$acl3->addRole("Test");
		$acl3->addResource("Test");

		$acl3->allow("Test",  Permission::ALL, Permission::ALL);
		$acl3->deny("Test", Permission::ALL, "approve");
		var_dump($acl3->isAllowed("Test", "Test", "approve"));
		echo "<br />";

		die();
	}

}

Problem a naprosto neocekavane chovani je v 1. pripade, kdy je ocekavano, ze uzivatelske roli „Test“ na vsech resourcich bude zakazano opravneni „approve“

$acl->deny("Test", Permission::ALL, "approve");

Tak se ale nestane! Pokud bylo predtim opravneni uzivateli udeleno na 1 konkretni resource a ne pomoci Permission::ALL isAllowed() na toto resource s privilege „approve“ stale vraci true. Takze si myslite ze jste uspesne uzivateli zakazali nejakou akci, ale uzivatel ji vesele provadi dale.

Pokud je toto feature, bylo by dobre to nekam napsat a zvyraznit, protoze je to naprosto neocekavane chovani!

Pridavam link na cisty sandbox ke stazeni s vyse uvedenym kodem.

neminifikovana verze Nette Framework (version 2.0.10 released on 2013–03–08) PHP 5.4