AEM: After deleting user groups, rep:policy nodes remain intact

Question

I'm quite stunned at what I have found while tinkering with AEM (don't think it matters but for accuracy of my reporting I'm using 6.1) trying to automate my group permission creation. I have this group called aem-tools-readonly that has a specific set of permissions on it. No problem there, the thing that kind of surprises me is the following, if I happen to delete said group it does not delete the respective rep:policy nodes that correspond to that group. So if I re-create aem-tools-readonly it picks up the same config for my group. I am wondering a couple of things.

Should I be concerned security wise of creating holes in my permission scheme if groups get deleted as I move along with my projects ?

Why aren't these rep:policy nodes not getting deleted, is there a valid reason ?

How can I easily delete all rep:policy nodes of for example my aem-tools-readonly group ?

Any information/thoughts are welcomed ...

Thanks

Answer 1

As far as I know this has always been this way.

This is how the ACL's implementation works in CRX.

To fix that prior to deleting a group you could clear its whole accesses - probably by deleting the proper entries lying under any rep:policy. There is no easy (automatic way) to do that. just code. it should be quite easy though to find any descendant of any rep:policy that has your group name within it.