[Netconf] NACM and "when" statements

[Robert Wilton <[e-mail]>]

Hi Andy, Martin,

I've got a question about 'when' statement handling related to NACM.

Due to when statements, it is possible that a client could implicitly 
cause a change to a part of the data tree that they have no write access 
to because they cause a when condition to evaluate to a different 
answer.  Am I correct in presuming that this implicit change is allowed?

E.g. in the following example, a user may only have write access to 
"baz" but not "bar". If they create "baz" then that may implicitly cause 
"bar" to be deleted.  Further, even if this implicit delete to "bar" is 
allowed, I presume that the equivalent explicit change or creating "baz" 
and deleting "bar" would still be rejected because there is no explicit 
write access to bar.

container foo {
   leaf bar {
    when "not(../baz)";
   }
   leaf baz {
   }
}

Should this be mentioned in the NACM draft at all?  I'm not convinced 
that the draft makes the correct behaviour for handling 'when' 
statements obvious.

Similar considerations could also apply when writing to choice statements.

Thanks,
Rob