deteministically search via subject

node/api/entitlement_store.go

@@ -81,8 +81,9 @@ func (e entitlementMap) FindForSubject(subject utils.Subject) (Entitlement, bool
 	perms := subject.Perms()
 
 	// TODO : optimise optimise optimise - rewrite as a trie
-	for _, ent := range e.store {
-		for _, s := range perms {
+	for _, s := range perms {
+		for _, ent := range e.store {
+
 			if ent.Subject == s {
 				return ent, true
 			}
@@ -135,6 +136,7 @@ func (e entitlementMap) AppendOrReplaceOnSubject(ent Entitlement) {
 
 	if found {
 		ent.UID = existing.UID
+		ent.AccessLevel = existing.AccessLevel
 		e.store[existing.UID] = ent
 		return
 	}

node/api/metadata_store.go

@@ -37,8 +37,9 @@ func (m *MetadataStore) FindBySubject(subject utils.Subject) (Metadata, bool) {
 	perms := subject.Perms()
 
 	// TODO : optimise optimise optimise - rewrite as a trie
-	for _, m := range m.store {
-		for _, s := range perms {
+
+	for _, s := range perms {
+		for _, m := range m.store {
 			if m.Subject == s {
 				return m, true
 			}

node/device_manager.go

@@ -85,7 +85,7 @@ func (d *device_manager) loop() {
 				// ensure we have metadata for the key
 				// the default is to copy the subjects parents metadata.
 				// Our system is loosely bound between devices
-				// and data - we don't catalog a fixed dataset from the devices.
+				// and data - we don't know the fixed dataset from a specific device.
 				m, found := d.metaStore.FindBySubject(subject)
 
 				if !found {
@@ -95,6 +95,7 @@ func (d *device_manager) loop() {
 
 				currentSubject := subject.String()
 				ss, _ := utils.ParseSubject(ent.Subject)
+
 				if ss.IsRoot() {
 
 					m.Subject = currentSubject