iframe-proxy | Sunbelt Computer Software

126 lines (104 loc) · 3.72 KB
import { createRequire } from 'module'
import fs from 'fs/promises'
import { $rdf } from './rdf.js'
import { HttpError } from './error.js'
import { debugACL as debug } from './utils.js'
const require = createRequire(import.meta.url)
const aclCheck = require('@solid/acl-check')
const ACL = $rdf.Namespace('http://www.w3.org/ns/auth/acl#')
export class ACLChecker {
  constructor ({ ldp, rootUrl }) {
    this.ldp = ldp
    this.rootUrl = rootUrl
  async can (user, resourceUrl, mode, isContainer) {
    const { aclUrl, aclBody, isDefault, directory } = await this.findACL(resourceUrl, isContainer)
    if (!aclBody) {
      throw new HttpError(500, 'No ACL found for ' + resourceUrl)
    const graph = $rdf.graph()
      $rdf.parse(aclBody, graph, aclUrl, 'text/turtle')
    } catch (e) {
      throw new HttpError(500, 'Error parsing ACL: ' + e.message)
    const doc = $rdf.sym(resourceUrl)
    const aclDoc = $rdf.sym(aclUrl)
    const agent = user ? $rdf.sym(user) : null
    const modes = [ACL(mode)]
    const dir = isDefault ? $rdf.sym(directory) : null
    const denied = aclCheck.accessDenied(graph, doc, dir, aclDoc, agent, modes, null, null)
    if (denied) {
      debug(`Access denied: ${user || 'anonymous'} ${mode} ${resourceUrl} — ${denied}`)
      const status = user ? 403 : 401
      throw new HttpError(status, denied)
  async getPermissions (user, resourceUrl, isContainer) {
    const { aclUrl, aclBody, isDefault, directory } = await this.findACL(resourceUrl, isContainer)
    if (!aclBody) return { user: [], public: [] }
    const graph = $rdf.graph()
      $rdf.parse(aclBody, graph, aclUrl, 'text/turtle')
    } catch {
      return { user: [], public: [] }
    const doc = $rdf.sym(resourceUrl)
    const aclDoc = $rdf.sym(aclUrl)
    const dir = isDefault ? $rdf.sym(directory) : null
    const modes = ['Read', 'Write', 'Append', 'Control']
    const userPerms = []
    const publicPerms = []
    for (const mode of modes) {
      const agent = user ? $rdf.sym(user) : null
      if (agent) {
        const denied = aclCheck.accessDenied(graph, doc, dir, aclDoc, agent, [ACL(mode)], null, null)
        if (!denied) userPerms.push(mode.toLowerCase())
      const pubDenied = aclCheck.accessDenied(graph, doc, dir, aclDoc, null, [ACL(mode)], null, null)
      if (!pubDenied) publicPerms.push(mode.toLowerCase())
    return { user: userPerms, public: publicPerms }
  async findACL (resourceUrl, isContainer) {
    let url = resourceUrl
    let isDefault = false
    // Walk up the hierarchy looking for .acl files
    for (let depth = 0; depth < 30; depth++) {
      const aclUrl = url.endsWith('/') ? url + '.acl' : url + '.acl'
      const aclPathname = aclUrl.slice(this.rootUrl.length)
      try {
        const filePath = this.ldp.resolve(aclPathname)
        const body = await fs.readFile(filePath, 'utf8')
        return {
          aclUrl,
          aclBody: body,
          isDefault,
          directory: isDefault ? url : null
      } catch {
        // No ACL here, go up
      if (url === this.rootUrl || url === this.rootUrl + '/') {
        break
      // Move to parent
      isDefault = true
      if (url.endsWith('/')) {
        url = url.slice(0, -1)
      const lastSlash = url.lastIndexOf('/')
      if (lastSlash <= url.indexOf('/', 8)) {
        url = this.rootUrl + '/'
      } else {
        url = url.slice(0, lastSlash + 1)
    return { aclUrl: null, aclBody: null, isDefault: false, directory: null }
export function wacAllowHeader (perms) {
  const u = perms.user.length ? perms.user.join(' ') : ''
  const p = perms.public.length ? perms.public.join(' ') : ''
  return `user="${u}",public="${p}"`
Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

FilesExpand file tree

acl.js

Latest commit

History

acl.js

File metadata and controls
