Restrictive parent locks nested path

[sielay]

I have two rules

/api/cms/.*:
    - get
    - delete
    - post
    - put
/api/.*
    - get

Expected behaviour

• GET /api/whatever TRUE
• POST /api/whatever FALSE
• GET /api/cms/whatever TRUE
• POST /api/cms/whatever TRUE

Actual behaviour

• GET /api/whatever TRUE
• POST /api/whatever FALSE
• GET /api/cms/whatever TRUE
• POST /api/cms/whatever FALSE <- this seems working wrong

Why?

In this line

https://github.com/OptimalBits/node_acl/blob/master/lib/acl.js#L883

You use union instead of unions

What do you think about it?

[sielay]

Anyone?