Mirroristas/CommunitySolidServer
2
0
Fork 0
mirror of https://github.com/CommunitySolidServer/CommunitySolidServer.git synced 2024-10-03 14:55:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Only require append when creating with PUT

Browse Source
This commit is contained in:
Joachim Van Herwegen 2024-01-04 14:44:10 +01:00
parent 716c3c3089
commit a0b7ee42f3
3 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/authorization/permissions/MethodModesExtractor.ts
View File

@ -39,11 +39,13 @@ export class MethodModesExtractor extends ModesExtractor {
if (READ_METHODS.has(method)) {
requiredModes.add(target, AccessMode.read);
}
// Setting a resource's representation requires Write permissions
if (method === 'PUT') {
requiredModes.add(target, AccessMode.write);
// …and, if the resource does not exist yet, Create permissions are required as well
if (!await this.resourceSet.hasResource(target)) {
if (await this.resourceSet.hasResource(target)) {
// Replacing a resource's representation with PUT requires Write permissions
requiredModes.add(target, AccessMode.write);
} else {
// ... while creating a new resource with PUT requires Append and Create permissions.
requiredModes.add(target, AccessMode.append);
requiredModes.add(target, AccessMode.create);
}
}

2
test/integration/PermissionTable.test.ts
View File

@ -83,7 +83,7 @@ const table: [string, string, AM[], AM[] | undefined, string, string, number, nu
[ 'PUT', 'C/R', [], [ AM.append ], '', TXT, 401, 401 ],
[ 'PUT', 'C/R', [], [ AM.write ], '', TXT, 205, 401 ],
[ 'PUT', 'C/R', [ AM.read ], undefined, '', TXT, 401, 401 ],
[ 'PUT', 'C/R', [ AM.append ], undefined, '', TXT, 401, 401 ],
[ 'PUT', 'C/R', [ AM.append ], undefined, '', TXT, 401, 201 ],
[ 'PUT', 'C/R', [ AM.write ], undefined, '', TXT, 205, 201 ],
[ 'PUT', 'C/R', [ AM.append ], [ AM.write ], '', TXT, 205, 201 ],

4
test/unit/authorization/permissions/MethodModesExtractor.test.ts
View File

@ -58,11 +58,11 @@ describe('A MethodModesExtractor', (): void => {
compareMaps(await extractor.handle({ ...operation, method: 'PUT' }), getMap([ AccessMode.write ]));
});
it('requires create for PUT operations if the target does not exist.', async(): Promise<void> => {
it('requires append/create for PUT operations if the target does not exist.', async(): Promise<void> => {
resourceSet.hasResource.mockResolvedValueOnce(false);
compareMaps(
await extractor.handle({ ...operation, method: 'PUT' }),
getMap([ AccessMode.write, AccessMode.create ]),
getMap([ AccessMode.append, AccessMode.create ]),
);
});