OpenCyber Academy
Rapid course · Lesson 6 · English
Course code: OCA-013Lesson 06: OCA-013-A006

anyone-with-link is not the token public

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 06. Map, example, EX052.

flowchart TD
  S["A setting string"] --> M{"Is it a member of allowed for that Boolean?"}
  M -->|Yes| K["The triple stays out of bad"]
  M -->|No| B["The triple is printed"]

Membership is exact. It is not a rank.

Logical drawing

allowed when sensitive:     staff, admins
allowed when not sensitive: staff, admins, public
present failure token:      anyone-with-link
absent from this list:      a sensitive triple whose setting is public

Learning outcomes

After this chapter, you should be able to:

  1. Explain the failure test as set membership.
  2. Separate the string public from the string anyone-with-link.
  3. Refuse a claim that every failure in this run had to be sensitive.

6.1 The predicate does not rank the strings.

The comprehension asks one question: is this setting one of the strings in the set selected by the Boolean? It does not ask which string is narrower. staff and admins are both members of the sensitive set, so a sensitive triple using either string passes. The program never orders those two members.

public is a member only of the non-sensitive set. A sensitive triple whose setting was the string public would fail, because that string is absent from allowed[True]. No triple in the eight has that combination. The three failures all carry anyone-with-link, which is absent from both sets.

A non-sensitive triple with anyone-with-link would also fail. This file contains no such triple, so the failure list and the sensitive-failure list happen to name the same three objects. That coincidence is a property of these eight rows. It is not a definition of the predicate. price-list.pdf and logo.png pass only because their setting is the string public, not because a link was inspected.

The link text itself is absent from the triple. The setting name is what the filter reads. Constructing or guessing an address is outside this chapter and outside the clinic's authority.

6.2 Worked example

Lesson table; scroll horizontally to read all columns →

Claim about a triple Membership fact Decision
logo.png at public passes Non-sensitive, and public is allowed Keep
booking-app-config at admins passes Sensitive, and admins is allowed Keep
A sensitive public row would pass public is not in allowed[True] Refuse
"Too wide means sensitive" True only of this particular failure list Refuse

Synthetic case. No link string is stored beside the setting name.

Errors and limits

Do not promote the coincidence of three sensitive failures into the meaning of the test.

Apply

Worked answers

EX052. anyone-with-link and public are different strings. public is allowed only when the sensitive flag is false. A sensitive triple set to public would fail, and no such triple exists. The three failures are anyone-with-link. No link text is printed.