address comments

Author: rjernst

libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTree.java

@@ -53,7 +53,7 @@ private FileAccessTree(FilesEntitlement filesEntitlement, PathLookup pathLookup)
         this.writePaths = pruneSortedPaths(writePaths).toArray(new String[0]);
     }
 
-    public static List<String> pruneSortedPaths(List<String> paths) {
+    private static List<String> pruneSortedPaths(List<String> paths) {
         List<String> prunedReadPaths = new ArrayList<>();
         if (paths.isEmpty() == false) {
             String currentPath = paths.get(0);

libs/entitlement/src/test/java/org/elasticsearch/entitlement/runtime/policy/FileAccessTreeTests.java

@@ -104,6 +104,9 @@ public void testPrunedPaths() {
         assertThat(tree.canWrite(path("foo/bar")), is(false));
         assertThat(tree.canRead(path("foo/baz")), is(true));
         assertThat(tree.canWrite(path("foo/baz")), is(false));
+        // also test a non-existent subpath
+        assertThat(tree.canRead(path("foo/barf")), is(true));
+        assertThat(tree.canWrite(path("foo/barf")), is(false));
 
         tree = accessTree(entitlement("foo", "read", "foo/bar", "read_write"));
         assertThat(tree.canRead(path("foo")), is(true));