acl-checker.js rewrite parentAcl

Author: bourgeoa

README.md

@@ -69,6 +69,15 @@ $ solid start --root path/to/folder --port 8443 --ssl-key path/to/ssl-key.pem --
 # Solid server (solid v0.2.24) running on https://localhost:8443/
 ```
 
+By default `solid` runs in debug all mode. To stop the debug logs use `-q`, the quiet parameter.
+
+```bash
+$ DEBUG="solid:*" solid start -q
+# use quiet mode and set debug to all
+# DEBUG="solid:ACL" logs only debug.ACL's
+
+```
+
 ### Running in development environments
 
 Solid requires SSL certificates to be valid, so you cannot use self-signed certificates. To switch off this security feature in development environments, you can use the `bin/solid-test` executable, which unsets the `NODE_TLS_REJECT_UNAUTHORIZED` flag and sets the `rejectUnauthorized` option.

lib/acl-checker.js

@@ -1,10 +1,10 @@
 'use strict'
 /* eslint-disable node/no-deprecated-api */
 
-const { dirname } = require('path')
+// const { dirname } = require('path')
 const rdf = require('rdflib')
 const debug = require('./debug').ACL
-const debugCache = require('./debug').cache
+// const debugCache = require('./debug').cache
 const HTTPError = require('./http-error')
 const aclCheck = require('@solid/acl-check')
 const { URL } = require('url')
@@ -63,59 +63,62 @@ class ACLChecker {
       return this.aclCached[cacheKey]
     }
     let resource = rdf.sym(this.resource)
+    let parentResource = resource
+    if (!this.resource.endsWith('/')) { parentResource = rdf.sym(ACLChecker.getDirectory(this.resource)) }
     if (this.resource.endsWith('/' + this.suffix)) {
       resource = rdf.sym(ACLChecker.getDirectory(this.resource))
+      parentResource = resource
     }
     // If this is an ACL, Control mode must be present for any operations
     if (this.isAcl(this.resource)) {
       mode = 'Control'
-      resource = rdf.sym(this.resource.substring(0, this.resource.length - this.suffix.length))
+      const thisResource = this.resource.substring(0, this.resource.length - this.suffix.length)
+      resource = rdf.sym(thisResource)
+      parentResource = resource
+      if (!thisResource.endsWith('/')) parentResource = rdf.sym(ACLChecker.getDirectory(thisResource))
     }
     // If the slug is an acl, reject
     /* if (this.isAcl(this.slug)) {
       this.aclCached[cacheKey] = Promise.resolve(false)
       return this.aclCached[cacheKey]
     } */
-    const directory = acl.isContainer ? rdf.sym(ACLChecker.getDirectory(acl.acl)) : null
-    const aclFile = rdf.sym(acl.acl)
+    const directory = acl.isContainer ? rdf.sym(ACLChecker.getDirectory(acl.docAcl)) : null
+    const aclFile = rdf.sym(acl.docAcl)
+    const aclGraph = acl.docGraph
     const agent = user ? rdf.sym(user) : null
     const modes = [ACL(mode)]
     const agentOrigin = this.agentOrigin
     const trustedOrigins = this.trustedOrigins
     let originTrustedModes = []
     try {
       this.fetch(aclFile.doc().value)
-      originTrustedModes = await aclCheck.getTrustedModesForOrigin(acl.graph, resource, directory, aclFile, agentOrigin, (uriNode) => {
-        return this.fetch(uriNode.doc().value, acl.graph)
+      originTrustedModes = await aclCheck.getTrustedModesForOrigin(aclGraph, resource, directory, aclFile, agentOrigin, (uriNode) => {
+        return this.fetch(uriNode.doc().value, aclGraph)
       })
     } catch (e) {
       // FIXME: https://github.com/solid/acl-check/issues/23
       // console.error(e.message)
     }
-    let accessDenied = aclCheck.accessDenied(acl.graph, resource, directory, aclFile, agent, modes, agentOrigin, trustedOrigins, originTrustedModes)
+    let accessDenied = aclCheck.accessDenied(aclGraph, resource, directory, aclFile, agent, modes, agentOrigin, trustedOrigins, originTrustedModes)
 
     function accessDeniedForAccessTo (mode) {
-      const accessDeniedAccessTo = aclCheck.accessDenied(acl.graph, directory, null, aclFile, agent, [ACL(mode)], agentOrigin, trustedOrigins, originTrustedModes)
+      const parentAclDirectory = ACLChecker.getDirectory(acl.parentAcl)
+      const parentDirectory = parentResource === parentAclDirectory ? null : rdf.sym(parentAclDirectory)
+      const accessDeniedAccessTo = aclCheck.accessDenied(acl.parentGraph, parentResource, parentDirectory, rdf.sym(acl.parentAcl), agent, [ACL(mode)], agentOrigin, trustedOrigins, originTrustedModes)
       const accessResult = !accessDenied && !accessDeniedAccessTo
       accessDenied = accessResult ? false : accessDenied || accessDeniedAccessTo
       // debugCache('accessDenied result ' + accessDenied)
     }
     // For create and update HTTP methods
-    if ((method === 'PUT' || method === 'PATCH' || method === 'COPY') && directory) {
-      // if resource and acl have same parent container,
-      // and resource does not exist, then accessTo Append from parent is required
-      if (directory.value === dirname(aclFile.value) + '/' && !resourceExists) {
-        accessDeniedForAccessTo('Append')
-      }
+    if ((method === 'PUT' || method === 'PATCH' || method === 'COPY')) { // && !aclFile.value.endsWith('/.acl')) {
+      // accessTo Append from parent is required
+      accessDeniedForAccessTo('Append')
     }
 
     // For delete HTTP method
-    if ((method === 'DELETE') && directory) {
-      // if resource and acl have same parent container,
-      // then accessTo Write from parent is required
-      if (directory.value === dirname(aclFile.value) + '/') {
-        accessDeniedForAccessTo('Write')
-      }
+    if ((method === 'DELETE')) { // } && !aclFile.value.endsWith('/.acl')) {
+      // accessTo Write from parent is required
+      accessDeniedForAccessTo('Write')
     }
     if (accessDenied && user) {
       this.messagesCached[cacheKey].push(HTTPError(403, accessDenied))
@@ -147,7 +150,12 @@ class ACLChecker {
     const possibleACLs = this.getPossibleACLs()
     const acls = [...possibleACLs]
     let returnAcl = null
-    while (possibleACLs.length > 0 && !returnAcl) {
+    let returnParentAcl = null
+    let parentAcl = null
+    let parentGraph = null
+    let docAcl = null
+    let docGraph = null
+    while (possibleACLs.length > 0 && !returnParentAcl) {
       const acl = possibleACLs.shift()
       let graph
       try {
@@ -161,19 +169,32 @@ class ACLChecker {
         debug(err)
         throw err
       }
-      const relative = resource.replace(acl.replace(/[^/]+$/, ''), './')
-      debug(`Using ACL ${acl} for ${relative}`)
-      returnAcl = { acl, graph, isContainer }
+      // const relative = resource.replace(acl.replace(/[^/]+$/, ''), './')
+      // debug(`Using ACL ${acl} for ${relative}`)
+      if (!docAcl) {
+        docAcl = acl
+        docGraph = graph
+        if ((possibleACLs.length === 0) || docAcl.endsWith('/.acl')) {
+          parentAcl = acl // alain
+          parentGraph = graph // alain
+          returnParentAcl = true
+        }
+      } else {
+        parentAcl = acl
+        parentGraph = graph
+        returnParentAcl = true
+      }
+      returnAcl = { docAcl, docGraph, isContainer, parentAcl, parentGraph }
     }
-    if (!returnAcl) {
+    if (!returnParentAcl) {
       throw new HTTPError(500, `No ACL found for ${resource}, searched in \n- ${acls.join('\n- ')}`)
     }
-    const groupNodes = returnAcl.graph.statementsMatching(null, ACL('agentGroup'), null)
+    const groupNodes = returnAcl.docGraph.statementsMatching(null, ACL('agentGroup'), null)
     const groupUrls = groupNodes.map(node => node.object.value.split('#')[0])
     await Promise.all(groupUrls.map(async groupUrl => {
       try {
-        const graph = await this.fetch(groupUrl, returnAcl.graph)
-        this.requests[groupUrl] = this.requests[groupUrl] || graph
+        const docGraph = await this.fetch(groupUrl, returnAcl.docGraph)
+        this.requests[groupUrl] = this.requests[groupUrl] || docGraph
       } catch (e) {} // failed to fetch groupUrl
     }))
 
@@ -264,7 +285,7 @@ function fetchLocalOrRemote (mapper, serverUri) {
           // debugCache('Expunging from cache', url)
           delete temporaryCache[url]
           if (Object.keys(temporaryCache).length === 0) {
-            debugCache('Cache is empty again')
+            // debugCache('Cache is empty again')
           }
         }, EXPIRY_MS),
         promise: doFetch(url)

lib/handlers/allow.js

@@ -2,7 +2,7 @@ module.exports = allow
 
 // const path = require('path')
 const ACL = require('../acl-checker')
-const debug = require('../debug.js').ACL
+// const debug = require('../debug.js').ACL
 // const error = require('../http-error')
 
 function allow (mode) {
@@ -77,7 +77,7 @@ function allow (mode) {
       if (resourceUrl.endsWith('.acl') && (await ldp.isOwner(userId, req.hostname))) return next()
     } catch (err) {}
     const error = req.authError || await req.acl.getError(userId, mode)
-    debug(`${mode} access denied to ${userId || '(none)'}: ${error.status} - ${error.message}`)
+    // debug(`${mode} access denied to ${userId || '(none)'}: ${error.status} - ${error.message}`)
     next(error)
   }
 }

test/resources/accounts-acl/tim.localhost/append-acl/.acl

@@ -0,0 +1,19 @@
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+
+<#authorization1>
+    a acl:Authorization;
+
+    acl:agent
+        <https://tim.localhost:7777/profile/card#me>;
+    acl:accessTo <./>;
+    acl:mode
+        acl:Read, acl:Write, acl:Control;
+
+    acl:default <./>.
+
+<#AppendOnly>
+    a <http://www.w3.org/ns/auth/acl#Authorization>;
+    <http://www.w3.org/ns/auth/acl#accessTo> <./>;
+    acl:default <./>;
+    <http://www.w3.org/ns/auth/acl#agentClass> <http://xmlns.com/foaf/0.1/Agent>;
+    <http://www.w3.org/ns/auth/acl#mode> <http://www.w3.org/ns/auth/acl#Read>, <http://www.w3.org/ns/auth/acl#Append> .