acl get policy breaks octavia and not working as expected

[Sam Morrison]

Steps to produce.

env
Barbican 2024.1 with enforce_new_defaults=True
2 users in the same project with member role each

user 1: create a secret with default acl eg. {"read": {"project-access": true}

user 2: can decrypt secret but can't read the acl (openstack acl get)

The policy is:
"True:%(enforce_new_defaults)s and (rule:secret_project_admin or (rule:secret_project_member and rule:secret_owner) or (rule:secret_project_member and rule:secret_is_not_private))"

Which should allow user 2 to read as the acl however a 403 is returned

The rule:secret_is_not_private part doesn't seem to be working as expected. Removing this part makes the call work.

This is an issue as when creating a octavia listener with a barbican secret it will fail as octavia attempts to GET the acl

[Sam Morrison (sorrison)]

Should also mention this also affects the secret_acls:put_patch and secret_acls:delete rules too which needs to change to allow octavia to work.