@@ -5,7 +5,6 @@ const { dirname } = require('path')
5
5
const rdf = require ( 'rdflib' )
6
6
const debug = require ( './debug' ) . ACL
7
7
// const debugCache = require('./debug').cache
8
- // const debugAccounts = require('./debug').accounts
9
8
const HTTPError = require ( './http-error' )
10
9
const aclCheck = require ( '@solid/acl-check' )
11
10
const { URL } = require ( 'url' )
@@ -56,6 +55,7 @@ class ACLChecker {
56
55
}
57
56
this . messagesCached [ cacheKey ] = this . messagesCached [ cacheKey ] || [ ]
58
57
58
+ // for method DELETE nearestACL and ACL from parent resource
59
59
const acl = await this . getNearestACL ( method ) . catch ( err => {
60
60
this . messagesCached [ cacheKey ] . push ( new HTTPError ( err . status || 500 , err . message || err ) )
61
61
} )
@@ -95,56 +95,56 @@ class ACLChecker {
95
95
// FIXME: https://github.com/solid/acl-check/issues/23
96
96
// console.error(e.message)
97
97
}
98
+
98
99
function resourceAccessDenied ( modes ) {
99
- accessDenied = aclCheck . accessDenied ( aclGraph , resource , directory , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
100
+ return aclCheck . accessDenied ( aclGraph , resource , directory , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
100
101
}
101
-
102
102
function accessDeniedForAccessTo ( modes ) {
103
103
const accessDeniedAccessTo = aclCheck . accessDenied ( aclGraph , directory , null , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
104
104
const accessResult = ! accessDenied && ! accessDeniedAccessTo
105
- accessDenied = accessResult ? false : accessDenied || accessDeniedAccessTo
106
- // debugCache('accessDenied result ' + accessDenied)
105
+ return accessResult ? false : accessDenied || accessDeniedAccessTo
107
106
}
108
107
async function accessdeniedFromParent ( modes ) {
109
108
const parentAclDirectory = ACLChecker . getDirectory ( acl . parentAcl )
110
109
const parentDirectory = parentResource === parentAclDirectory ? null : rdf . sym ( parentAclDirectory )
111
- // if (acl.parentAcl.endWith('/.acl')) parentDirectory = rdf.sym(parentAclDirectory)
112
110
const accessDeniedParent = aclCheck . accessDenied ( acl . parentGraph , parentResource , parentDirectory , rdf . sym ( acl . parentAcl ) , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
113
111
const accessResult = ! accessDenied && ! accessDeniedParent
114
- accessDenied = accessResult ? false : accessDenied || accessDeniedParent
115
- // debugCache('accessDenied result ' + accessDenied)
112
+ return accessResult ? false : accessDenied || accessDeniedParent
116
113
}
117
114
118
- let accessDenied
119
- resourceAccessDenied ( modes )
115
+ let accessDenied = resourceAccessDenied ( modes )
116
+ // debugCache('accessDenied resource ' + accessDenied)
117
+
120
118
// For create and update HTTP methods
121
119
if ( ( method === 'PUT' || method === 'PATCH' || method === 'COPY' ) ) {
122
120
// if resource and acl have same parent container,
123
121
// and resource does not exist, then accessTo Append from parent is required
124
122
if ( directory && directory . value === dirname ( aclFile . value ) + '/' && ! resourceExists ) {
125
- accessDeniedForAccessTo ( [ ACL ( 'Append' ) ] )
123
+ accessDenied = accessDeniedForAccessTo ( [ ACL ( 'Append' ) ] )
126
124
}
125
+ // debugCache('accessDenied PUT/PATCH ' + accessDenied)
127
126
}
128
127
129
128
// For delete HTTP method
130
129
if ( ( method === 'DELETE' ) ) {
131
130
if ( resourceExists ) {
132
131
// deleting a Container
133
132
// without Read, the response code will reveal whether a Container is empty or not
134
- if ( directory && this . resource . endsWith ( '/' ) ) resourceAccessDenied ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
133
+ if ( directory && this . resource . endsWith ( '/' ) ) accessDenied = resourceAccessDenied ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
135
134
// if resource and acl have same parent container,
136
135
// then both Read and Write on parent is required
137
- else if ( ! directory && aclFile . value . endsWith ( `/${ this . suffix } ` ) ) await accessdeniedFromParent ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
136
+ else if ( ! directory && aclFile . value . endsWith ( `/${ this . suffix } ` ) ) accessDenied = await accessdeniedFromParent ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
138
137
139
138
// deleting a Document
140
139
else if ( directory && directory . value === dirname ( aclFile . value ) + '/' ) {
141
- accessDeniedForAccessTo ( [ ACL ( 'Write' ) ] )
140
+ accessDenied = accessDeniedForAccessTo ( [ ACL ( 'Write' ) ] )
142
141
} else {
143
- await accessdeniedFromParent ( [ ACL ( 'Write' ) ] )
142
+ accessDenied = await accessdeniedFromParent ( [ ACL ( 'Write' ) ] )
144
143
}
145
144
146
145
// https://github.com/solid/specification/issues/14#issuecomment-1712773516
147
146
} else { accessDenied = true }
147
+ // debugCache('accessDenied DELETE ' + accessDenied)
148
148
}
149
149
150
150
if ( accessDenied && user ) {
@@ -184,7 +184,6 @@ class ACLChecker {
184
184
let parentGraph = null
185
185
let docAcl = null
186
186
let docGraph = null
187
- // while (possibleACLs.length > 0 && !returnParentAcl) {
188
187
while ( possibleACLs . length > 0 && ! returnParentAcl ) {
189
188
const acl = possibleACLs . shift ( )
190
189
let graph
@@ -193,7 +192,7 @@ class ACLChecker {
193
192
graph = await this . requests [ acl ]
194
193
} catch ( err ) {
195
194
if ( err && ( err . code === 'ENOENT' || err . status === 404 ) ) {
196
- // only set isContainer before docAcl // alain
195
+ // only set isContainer before docAcl
197
196
if ( ! docAcl ) isContainer = true
198
197
continue
199
198
}
@@ -205,7 +204,7 @@ class ACLChecker {
205
204
if ( ! docAcl ) {
206
205
docAcl = acl
207
206
docGraph = graph
208
- // parentAcl is only needed for DELETE // alain
207
+ // parentAcl is only needed for DELETE
209
208
if ( method !== 'DELETE' ) returnParentAcl = true
210
209
} else {
211
210
parentAcl = acl
0 commit comments