Mirroristas/CommunitySolidServer
2
0
Fork 0
mirror of https://github.com/CommunitySolidServer/CommunitySolidServer.git synced 2024-10-03 14:55:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Use root ACL with relative URLs.

Browse Source
This commit is contained in:
Ruben Verborgh 2021-01-15 00:02:27 +01:00 committed by Joachim Van Herwegen
parent a5413a64d3
commit 87f1450d0d
2 changed files with 19 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/init/AclInitializer.ts
View File

@ -1,3 +1,4 @@
import { promises as fsPromises } from 'fs';
import type { AclManager } from '../authorization/AclManager'; import type { AclManager } from '../authorization/AclManager';
import { BasicRepresentation } from '../ldp/representation/BasicRepresentation'; import { BasicRepresentation } from '../ldp/representation/BasicRepresentation';
import type { ResourceIdentifier } from '../ldp/representation/ResourceIdentifier'; import type { ResourceIdentifier } from '../ldp/representation/ResourceIdentifier';
@ -5,7 +6,7 @@ import { getLoggerFor } from '../logging/LogUtil';
import type { ResourceStore } from '../storage/ResourceStore'; import type { ResourceStore } from '../storage/ResourceStore';
import { containsResource } from '../storage/StoreUtil'; import { containsResource } from '../storage/StoreUtil';
import { TEXT_TURTLE } from '../util/ContentTypes'; import { TEXT_TURTLE } from '../util/ContentTypes';
import { ensureTrailingSlash } from '../util/PathUtil'; import { ensureTrailingSlash, joinFilePath } from '../util/PathUtil';
import { Initializer } from './Initializer'; import { Initializer } from './Initializer';
/** /**
@ -15,7 +16,7 @@ export class AclInitializer extends Initializer {
protected readonly logger = getLoggerFor(this); protected readonly logger = getLoggerFor(this);
private readonly store: ResourceStore; private readonly store: ResourceStore;
private readonly aclManager: AclManager; private readonly aclManager: AclManager;
private readonly baseUrl: string; private readonly root: ResourceIdentifier;
public constructor( public constructor(
baseUrl: string, baseUrl: string,
@ -23,13 +24,13 @@ export class AclInitializer extends Initializer {
aclManager: AclManager, aclManager: AclManager,
) { ) {
super(); super();
this.baseUrl = ensureTrailingSlash(baseUrl);
this.store = store; this.store = store;
this.aclManager = aclManager; this.aclManager = aclManager;
this.root = { path: ensureTrailingSlash(baseUrl) };
} }
public async handle(): Promise<void> { public async handle(): Promise<void> {
const rootAcl = await this.aclManager.getAclDocument({ path: this.baseUrl }); const rootAcl = await this.aclManager.getAclDocument(this.root);
if (!await containsResource(this.store, rootAcl)) { if (!await containsResource(this.store, rootAcl)) {
await this.setRootAclDocument(rootAcl); await this.setRootAclDocument(rootAcl);
} else { } else {
@ -37,26 +38,11 @@ export class AclInitializer extends Initializer {
} }
} }
// Set up ACL so everything can still be done by default
// Note that this will need to be adapted to go through all the correct channels later on
//
// Solid, §4.1: "The root container (pim:Storage) MUST have an ACL auxiliary resource directly associated to it. // Solid, §4.1: "The root container (pim:Storage) MUST have an ACL auxiliary resource directly associated to it.
// The associated ACL document MUST include an authorization policy with acl:Control access privilege." // The associated ACL document MUST include an authorization policy with acl:Control access privilege."
// https://solid.github.io/specification/protocol#storage // https://solid.github.io/specification/protocol#storage
protected async setRootAclDocument(rootAcl: ResourceIdentifier): Promise<void> { protected async setRootAclDocument(rootAcl: ResourceIdentifier): Promise<void> {
const acl = `@prefix acl: <http://www.w3.org/ns/auth/acl#>. const acl = await fsPromises.readFile(joinFilePath(__dirname, '../../templates/root/.acl'), 'utf8');
@prefix foaf: <http://xmlns.com/foaf/0.1/>.
<#authorization>
a acl:Authorization;
acl:agentClass foaf:Agent;
acl:mode acl:Read;
acl:mode acl:Write;
acl:mode acl:Append;
acl:mode acl:Delete;
acl:mode acl:Control;
acl:accessTo <${this.baseUrl}>;
acl:default <${this.baseUrl}>.`;
this.logger.debug(`Installing root ACL document at ${rootAcl.path}`); this.logger.debug(`Installing root ACL document at ${rootAcl.path}`);
await this.store.setRepresentation(rootAcl, new BasicRepresentation(acl, rootAcl, TEXT_TURTLE)); await this.store.setRepresentation(rootAcl, new BasicRepresentation(acl, rootAcl, TEXT_TURTLE));
} }

13
templates/root/.acl Normal file
View File

@ -0,0 +1,13 @@
@prefix acl: <http://www.w3.org/ns/auth/acl#>.
@prefix foaf: <http://xmlns.com/foaf/0.1/>.
<#authorization>
a acl:Authorization;
acl:agentClass foaf:Agent;
acl:mode acl:Read;
acl:mode acl:Write;
acl:mode acl:Append;
acl:mode acl:Delete;
acl:mode acl:Control;
acl:accessTo <./>;
acl:default <./>.