Security - eXist: A NoSQL Database and Application Development Platform - page 137

If a user class does not have execute permission on a collection,
then the collection is closed to it, and the user(s) in question may
neither list the collection's contents, nor read or write documents
in that collection.
If you unset the read bit on a collection and set the execute bit, this
allows a user or group to read resources in the collection, but not to
list the contents of the collection. In effect, users can only access a
resource in that collection if they know the resource's name in
advance and have appropriate permissions on it. If the collection is
accessed from the REST Server, it effectively disables collection
listings.

Internally in eXist, the mode is held as a series of binary bits, but they are typically
represented in one of two ways: either as an octal number or as a mode string (as you
have just seen). eXist supports both approaches and provides assistance for convert‐
ing from one to the other (see Table 8-4 ).

Table 8-4. Mode bits

Character representation Octal number representation Binary representation

Read ( r )

04 100

Write ( w )

02 010

Execute ( x )

01 001

When octal numbers are used, the sum of each user class is placed side by side. For
example, rwxrwxrwx would equate to:

04 + 02 + 01 = 07

for each user class (i.e., 0777 ). As another example, 0744 would equate to rwxr--r-- .
eXist provides XQuery functions for converting between integer and octal values in
the Util module (see util ), while several of the security functions in eXist can use
either octal or character representations as arguments.