Modifying AccessControlLists on DataFactory events
Modifying a page's ACL on one of the DataFactory events sounds like an easy task at first, but there is one hole to get stuck in.
If you attempt to just fiddle around with the PageData's ACL property inside events like SavedPage and PublishedPage and then run Save() you will simply get a huge yellow screen of death telling you that Cannot save ACL with no page link set. This could be due to a page provider not properly setting PageLink.
Since this behaviour is neither intuitive (I mean, you get the PageData object after it's saved/published in the event handler) nor documented anywhere, I'm sharing the solution to the problem here. And it's really quite simple:
The following will not work:
The solution:
EPiServer: Since this is not really intuitive behaviour, this should be documented either in tutorials somewhere or in the SDK.