Skip to content

Commit c2fd39d

Browse files
bourgeoabourgeoa
committed
move getOwner() to ldp.js and add tests
1 parent f95745e commit c2fd39d

7 files changed

Lines changed: 110 additions & 47 deletions

File tree

‎lib/handlers/allow.js‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ module.exports = allow
44
const ACL = require('../acl-checker')
55
const debug = require('../debug.js').ACL
66
// const error = require('../http-error')
7-
const { getOwner } = require('../utils')
87

98
function allow (mode) {
109
return async function allowHandler (req, res, next) {
@@ -42,14 +41,17 @@ function allow (mode) {
4241
}
4342
// Obtain and store the ACL of the requested resource
4443
const resourceUrl = rootUrl + resourcePath
45-
req.acl = ACL.createFromLDPAndRequest(resourceUrl, ldp, req)
46-
4744
// Ensure the user has the required permission
4845
const userId = req.session.userId
49-
const isAllowed = await req.acl.can(userId, mode, req.method, stat)
50-
if (isAllowed) {
51-
return next()
52-
}
46+
try {
47+
req.acl = ACL.createFromLDPAndRequest(resourceUrl, ldp, req)
48+
49+
// if (resourceUrl.endsWith('.acl')) mode = 'Control'
50+
const isAllowed = await req.acl.can(userId, mode, req.method, stat)
51+
if (isAllowed) {
52+
return next()
53+
}
54+
} catch (error) { next(error) }
5355
if (mode === 'Read' && (resourcePath === '' || resourcePath === '/')) {
5456
// This is a hack to make NSS check the ACL for representation that is served for root (if any)
5557
// See https://github.com/solid/node-solid-server/issues/1063 for more info
@@ -71,7 +73,7 @@ function allow (mode) {
7173
}
7274

7375
// check user is owner. Find owner from /.meta
74-
if (resourceUrl.endsWith('.acl') && userId === await getOwner(req)) return next()
76+
if (resourceUrl.endsWith('.acl') && userId === await ldp.getOwner(req.hostname)) return next()
7577

7678
const error = req.authError || await req.acl.getError(userId, mode)
7779
debug(`${mode} access denied to ${userId || '(none)'}: ${error.status} - ${error.message}`)

‎lib/handlers/patch.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ const debug = require('../debug').handlers
88
const error = require('../http-error')
99
const $rdf = require('rdflib')
1010
const crypto = require('crypto')
11-
const { overQuota, getContentType, getOwner } = require('../utils')
11+
const { overQuota, getContentType } = require('../utils')
1212
const withLock = require('../lock')
1313

1414
// Patch parsers by request body content type
@@ -146,7 +146,8 @@ async function checkPermission (request, patchObject, resourceExists) {
146146
const allAllowed = allowed.reduce((memo, allowed) => memo && allowed, true)
147147
if (!allAllowed) {
148148
// check owner with Control
149-
if (request.path.endsWith('.acl') && userId === await getOwner(request)) return Promise.resolve(patchObject)
149+
const ldp = request.app.locals.ldp
150+
if (request.path.endsWith('.acl') && userId === await ldp.getOwner(request.hostname)) return Promise.resolve(patchObject)
150151

151152
const errors = await Promise.all(modes.map(mode => acl.getError(userId, mode)))
152153
const error = errors.filter(error => !!error)

‎lib/header.js‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,12 +115,13 @@ async function addPermissions (req, res, next) {
115115
if (!acl) return next()
116116

117117
// Turn permissions for the public and the user into a header
118-
const resource = req.app.locals.ldp.resourceMapper.resolveUrl(req.hostname, req.path)
118+
const ldp = req.app.locals.ldp
119+
const resource = ldp.resourceMapper.resolveUrl(req.hostname, req.path)
119120
let [publicPerms, userPerms] = await Promise.all([
120121
getPermissionsFor(acl, null, req),
121122
getPermissionsFor(acl, session.userId, req)
122123
])
123-
if (resource.endsWith('.acl') && userPerms === '' && session.userId === await utils.getOwner(req)) userPerms = 'control'
124+
if (resource.endsWith('.acl') && userPerms === '' && session.userId === await ldp.getOwner(req.hostname)) userPerms = 'control'
124125
debug.ACL(`Permissions on ${resource} for ${session.userId || '(none)'}: ${userPerms}`)
125126
debug.ACL(`Permissions on ${resource} for public: ${publicPerms}`)
126127
res.set('WAC-Allow', `user="${userPerms}",public="${publicPerms}"`)

‎lib/ldp.js‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -433,6 +433,24 @@ class LDP {
433433
})
434434
}
435435

436+
// this is a hack to replace solid:owner, using solid:account in /.meta to avoid NSS migration
437+
// this /.meta has no functionality in actual NSS
438+
// comment https://github.com/solid/node-solid-server/pull/1604#discussion_r652903546
439+
async getOwner (hostname) {
440+
// const ldp = req.app.locals.ldp
441+
const rootUrl = this.resourceMapper.resolveUrl(hostname)
442+
let graph
443+
try {
444+
// TODO check for permission ?? Owner is a MUST
445+
graph = await this.getGraph(rootUrl + '/.meta')
446+
const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#')
447+
const owner = await graph.any(null, SOLID('account'), $rdf.sym(rootUrl + '/'))
448+
return owner.uri
449+
} catch (error) {
450+
throw new Error(`Failed to get owner from ${rootUrl}/.meta, got ` + error)
451+
}
452+
}
453+
436454
async get (options, searchIndex = true) {
437455
let path, contentType, stats
438456
try {

‎lib/utils.js‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ module.exports.getQuota = getQuota
1313
module.exports.overQuota = overQuota
1414
module.exports.getContentType = getContentType
1515
module.exports.parse = parse
16-
module.exports.getOwner = getOwner
1716

1817
const fs = require('fs')
1918
const path = require('path')
@@ -253,18 +252,3 @@ function getContentType (headers) {
253252
const value = headers.get ? headers.get('content-type') : headers['content-type']
254253
return value ? value.replace(/;.*/, '') : ''
255254
}
256-
257-
async function getOwner (req) {
258-
const ldp = req.app.locals.ldp
259-
const rootUrl = ldp.resourceMapper.resolveUrl(req.hostname) // alain
260-
let graph
261-
try {
262-
// TODO check for permission ?? Owner is a MUST
263-
graph = await ldp.getGraph(rootUrl + '/.meta')
264-
const SOLID = $rdf.Namespace('http://www.w3.org/ns/solid/terms#')
265-
const owner = await graph.any(null, SOLID('account'), $rdf.sym(rootUrl + '/'))
266-
return owner.uri
267-
} catch (error) {
268-
throw new Error(`Failed to get owner from ${rootUrl}/.meta, got ` + error)
269-
}
270-
}

‎test/integration/acl-oidc-test.js‎

Lines changed: 60 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ const request = require('request')
44
const path = require('path')
55
const { loadProvider, rm, checkDnsSettings, cleanDir } = require('../utils')
66
const IDToken = require('@solid/oidc-op/src/IDToken')
7-
const { clearAclCache } = require('../../lib/acl-checker')
7+
// const { clearAclCache } = require('../../lib/acl-checker')
88
const ldnode = require('../../index')
99

1010
const port = 7777
@@ -57,7 +57,7 @@ const argv = {
5757
}
5858

5959
// FIXME #1502
60-
describe.skip('ACL with WebID+OIDC over HTTP', function () {
60+
describe('ACL with WebID+OIDC over HTTP', function () {
6161
let ldp, ldpHttpsServer
6262

6363
before(checkDnsSettings)
@@ -80,9 +80,9 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
8080
}).catch(console.error)
8181
})
8282

83-
afterEach(() => {
83+
/* afterEach(() => {
8484
clearAclCache()
85-
})
85+
}) */
8686

8787
after(() => {
8888
if (ldpHttpsServer) ldpHttpsServer.close()
@@ -138,17 +138,34 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
138138
done()
139139
})
140140
})
141-
it('should not let edit the .acl', function (done) {
141+
it('user1 as solid:owner should let edit the .acl', function (done) {
142+
const options = createOptions('/empty-acl/.acl', 'user1', 'text/turtle')
143+
options.body = ''
144+
request.put(options, function (error, response, body) {
145+
assert.equal(error, null)
146+
assert.equal(response.statusCode, 201)
147+
done()
148+
})
149+
})
150+
it('user1 as solid:owner should let read the .acl', function (done) {
142151
const options = createOptions('/empty-acl/.acl', 'user1')
152+
request.get(options, function (error, response, body) {
153+
assert.equal(error, null)
154+
assert.equal(response.statusCode, 200)
155+
done()
156+
})
157+
})
158+
it('user2 should not let edit the .acl', function (done) {
159+
const options = createOptions('/empty-acl/.acl', 'user2', 'text/turtle')
143160
options.body = ''
144161
request.put(options, function (error, response, body) {
145162
assert.equal(error, null)
146163
assert.equal(response.statusCode, 403)
147164
done()
148165
})
149166
})
150-
it('should not let read the .acl', function (done) {
151-
const options = createOptions('/empty-acl/.acl', 'user1')
167+
it('user2 should not let read the .acl', function (done) {
168+
const options = createOptions('/empty-acl/.acl', 'user2')
152169
request.get(options, function (error, response, body) {
153170
assert.equal(error, null)
154171
assert.equal(response.statusCode, 403)
@@ -193,11 +210,11 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
193210
})
194211
})
195212
it('Should not create empty acl file', function (done) {
196-
const options = createOptions('/write-acl/empty-acl/another-empty-folder/test-file.acl', 'user1')
213+
const options = createOptions('/write-acl/empty-acl/another-empty-folder/.acl', 'user1', 'text/turtle')
197214
options.body = ''
198215
request.put(options, function (error, response, body) {
199216
assert.equal(error, null)
200-
assert.equal(response.statusCode, 403)
217+
assert.equal(response.statusCode, 201) // 403) is this a must ?
201218
done()
202219
})
203220
})
@@ -210,11 +227,11 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
210227
done()
211228
})
212229
})
213-
it('should fail as acl:default it used to try to authorize', function (done) {
230+
it('should fail as acl:default is used to try to authorize', function (done) {
214231
const options = createOptions('/write-acl/bad-acl-access/.acl', 'user1')
215232
request.get(options, function (error, response, body) {
216233
assert.equal(error, null)
217-
assert.equal(response.statusCode, 403)
234+
assert.equal(response.statusCode, 200) // 403) is this a must ?
218235
done()
219236
})
220237
})
@@ -240,7 +257,7 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
240257
const options = createOptions('/write-acl/test-file.acl', 'user1')
241258
request.get(options, function (error, response, body) {
242259
assert.equal(error, null)
243-
assert.equal(response.statusCode, 403)
260+
assert.equal(response.statusCode, 200) // 403) is this a must ?
244261
done()
245262
})
246263
})
@@ -255,6 +272,37 @@ describe.skip('ACL with WebID+OIDC over HTTP', function () {
255272
})
256273
})
257274

275+
describe('no-control', function () {
276+
it('user1 as owner should edit acl file', function (done) {
277+
const options = createOptions('/no-control/.acl', 'user1', 'text/turtle')
278+
options.body = '<#0>' +
279+
'\n a <http://www.w3.org/ns/auth/acl#Authorization>;' +
280+
'\n <http://www.w3.org/ns/auth/acl#default> <https://tim.localhost:7777/no-control/> ;' +
281+
'\n <http://www.w3.org/ns/auth/acl#accessTo> <https://tim.localhost:7777/no-control/> ;' +
282+
'\n <http://www.w3.org/ns/auth/acl#agent> <https://tim.localhost:7777/profile/card#me> ;' +
283+
'\n <http://www.w3.org/ns/auth/acl#mode> <http://www.w3.org/ns/auth/acl#Read>.'
284+
request.put(options, function (error, response, body) {
285+
assert.equal(error, null)
286+
assert.equal(response.statusCode, 201)
287+
done()
288+
})
289+
})
290+
it('user2 should not edit acl file', function (done) {
291+
const options = createOptions('/no-control/.acl', 'user2', 'text/turtle')
292+
options.body = '<#0>' +
293+
'\n a <http://www.w3.org/ns/auth/acl#Authorization>;' +
294+
'\n <http://www.w3.org/ns/auth/acl#default> <https://tim.localhost:7777/no-control/> ;' +
295+
'\n <http://www.w3.org/ns/auth/acl#accessTo> <https://tim.localhost:7777/no-control/> ;' +
296+
'\n <http://www.w3.org/ns/auth/acl#agent> <https://tim.localhost:7777/profile/card#me> ;' +
297+
'\n <http://www.w3.org/ns/auth/acl#mode> <http://www.w3.org/ns/auth/acl#Read>.'
298+
request.put(options, function (error, response, body) {
299+
assert.equal(error, null)
300+
assert.equal(response.statusCode, 403)
301+
done()
302+
})
303+
})
304+
})
305+
258306
describe('Origin', function () {
259307
before(function () {
260308
rm('/accounts-acl/tim.localhost/origin/test-folder/.acl')

‎test/integration/ldp-test.js‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -65,30 +65,39 @@ describe('LDP', function () {
6565

6666
describe('readContainerMeta', () => {
6767
it('should return 404 if .meta is not found', () => {
68-
return ldp.readContainerMeta('/resources/').catch(err => {
68+
return ldp.readContainerMeta('/resources/sampleContainer/').catch(err => {
6969
assert.equal(err.status, 404)
7070
})
7171
})
7272

7373
it('should return content if metaFile exists', () => {
7474
// file can be empty as well
75-
write('This function just reads this, does not parse it', '.meta')
76-
return ldp.readContainerMeta('/resources/').then(metaFile => {
77-
rm('.meta')
75+
write('This function just reads this, does not parse it', 'sampleContainer/.meta')
76+
return ldp.readContainerMeta('/resources/sampleContainer/').then(metaFile => {
77+
rm('sampleContainer/.meta')
7878
assert.equal(metaFile, 'This function just reads this, does not parse it')
7979
})
8080
})
8181

8282
it('should work also if trailing `/` is not passed', () => {
8383
// file can be empty as well
84-
write('This function just reads this, does not parse it', '.meta')
85-
return ldp.readContainerMeta('/resources').then(metaFile => {
86-
rm('.meta')
84+
write('This function just reads this, does not parse it', 'sampleContainer/.meta')
85+
return ldp.readContainerMeta('/resources/sampleContainer').then(metaFile => {
86+
rm('sampleContainer/.meta')
8787
assert.equal(metaFile, 'This function just reads this, does not parse it')
8888
})
8989
})
9090
})
9191

92+
describe('getOwner', () => {
93+
it('should return acl:owner', () => {
94+
const owner1 = 'https://tim.localhost:7777/profile/card#me'
95+
return ldp.getOwner('/resources/')
96+
.then(owner => {
97+
assert.equal(owner, owner1)
98+
})
99+
})
100+
})
92101
describe('getGraph', () => {
93102
it('should read and parse an existing file', () => {
94103
const uri = 'https://localhost:8443/resources/sampleContainer/example1.ttl'

0 commit comments

Comments
 (0)