Restrict published data to a public channel - pubnub

Question

I thought I understood what was going on here. But, apparently not. If I set up permissions like this, NO one receives published data.
{
"channels": {
"myChannel": {
"auths": {
"51EF3B88-3245-4CF1-B324-979F8E8A9EEF": {
"r": 1,
"w": 1
},
"F4EA7F64-27E3-4877-A86C-371FF7A9ABF2": {
"r": 1,
"w": 1
}
},
"r": 0, // I thought this would turn OFF published data for the world
"w": 0, // And the above auths would turn ON published data for the given keys
"ttl": 1
}
},
"subscribe_key": "my-sub-key",
"level": "channel"
}
If I set it up like this, EVERYONE gets published data.
{
"channels": {
"myChannel": {
"auths": {
"51EF3B88-3245-4CF1-B324-979F8E8A9EEF": {
"r": 1,
"w": 1
},
"F4EA7F64-27E3-4877-A86C-371FF7A9ABF2": {
"r": 1,
"w": 1
}
},
"r": 1, // this is the difference
"w": 1, // this is the difference
}
},
"subscribe_key": "my-sub-key",
"level": "channel"
}
My test clients are Java. I have one setting an AuthKey to one of the above keys. The other is not setting an auth key. I can share that code if needed.
What am I not getting here?
Edit
Here are a couple code snippets. I am trying to set up a public channel for all users and then a private channel. What I see is clients that do not set a uuid can still see the published data.
The server permission setting code:
pubnub = new Pubnub("myPubKey", "mySubKey", "mySecretKey");
// the public channel
pubnub.pamGrant("myChannel", true, true, ttl, callback);
pubnub.pamGrant("myChannel", "F4EA7F64-27E3-4877-A86C-371FF7A9ABF2", true, true, ttl, callback);
pubnub.pamGrant("myChannel", "51EF3B88-3245-4CF1-B324-979F8E8A9EEF", true, true, ttl, callback);
// the private channels
pubnub.pamGrant("F4EA7F64-27E3-4877-A86C-371FF7A9ABF2", "F4EA7F64-27E3-4877-A86C-371FF7A9ABF2", true, true, ttl, callback);
pubnub.pamGrant("F4EA7F64-27E3-4877-A86C-371FF7A9ABF2", true, true, ttl, callback);
pubnub.pamGrant("51EF3B88-3245-4CF1-B324-979F8E8A9EEF", "51EF3B88-3245-4CF1-B324-979F8E8A9EEF", true, true, ttl, callback);
pubnub.pamGrant("51EF3B88-3245-4CF1-B324-979F8E8A9EEF", true, true, ttl, callback);
Edit 2
Here is my new attempt at granting permissions. This works, based on help from Craig.
pubnub.pamGrant(Common.channelSummaries, Common.AuthKeyApp1, true, true, Common.ttl, callback);
// grant read and write access to AuthKeyApp1 on the channel AuthKeyApp1
pubnub.pamGrant(Common.AuthKeyApp1, Common.AuthKeyApp1, true, true, Common.ttl, callback);
// grant read and write access to serverUUID on the channel AuthKeyApp1
pubnub.pamGrant(Common.AuthKeyApp1, Common.serverUUID, true, true, Common.ttl, callback);
pubnub.pamGrant(Common.channelSummaries, Common.AuthKeyApp2, true, true, Common.ttl, callback);
// grant read and write access to AuthKeyApp1 on the channel AuthKeyApp1
pubnub.pamGrant(Common.AuthKeyApp2, Common.AuthKeyApp2, true, true, Common.ttl, callback);
// grant read and write access to serverUUID on the channel AuthKeyApp1
pubnub.pamGrant(Common.AuthKeyApp2, Common.serverUUID, true, true, Common.ttl, callback);
// grant read and write access to serverUUID on the channel channelNameGameSummaries
pubnub.pamGrant(Common.channelSummaries, Common.serverUUID, true, true, Common.ttl, callback);
// grant read and write access to serverUUID on the channel channelNameGameSummariesPresense
pubnub.pamGrant(Common.channelSummariesPresense, Common.serverUUID, true, true, Common.ttl, callback);
pubnub.pamGrant("", false, false, Common.ttl, callback);
// Set the servers UUID to serverUUID
pubnub.setUUID(Common.serverUUID);
pubnub.setAuthKey(Common.serverUUID);
Thanks,
Scott

Answer 1

Scott,
I know you answered it already but just to make this official, the issue is that you granted at the channel level then granted at the auth-key level. Access Manager grants are like CSS in reverse: the more general rule overrides the more specific. So the auth-key grant is specific to that auth-key and only users that init PubNub using that auth-key have those access rights.
But a channel level grant (no auth-key specified) opens the channel up to all users. No auth-key required. If true/true is granted on a particular channel, then it is like you turned Access Manager off for that one channel.
If you grant access true/true at the subscriber-key level, it is the same as disabling Access Manager completely. This is typically not useful for anything other than programatically disabling/enabling Access Manager (for whatever reason).
To remove a grant from an auth-key, channel or sub-key (in other words, revoke it), you just grant with false/false. So to revoke at the sub-key level. And in our Java SDK there are revoke methods (many SDKs just rely on grant with false/false access.
See details on our docs site: http://www.pubnub.com/docs/java/javase/api/reference.html#_pubnub_access_manager
That should just about wrap up all your questions above. Let me know if I missed anything.