ws check ACL Read

Author: bourgeoa

lib/create-server.mjs

@@ -6,6 +6,8 @@ import SolidWs from 'solid-ws'
 import globalTunnel from 'global-tunnel-ng'
 import debug from './debug.mjs'
 import createApp from './create-app.mjs'
+import ACLChecker from './acl-checker.mjs'
+import url from 'url'
 
 function createServer (argv, app) {
   argv = argv || {}
@@ -96,7 +98,183 @@ function createServer (argv, app) {
 
   // Setup Express app
   if (ldp.live) {
-    const solidWs = SolidWs(server, ldpApp)
+    // Get reference to session middleware for WebSocket upgrade parsing
+    // The session middleware is stored on the Express app
+    const sessionParser = ldpApp._router.stack.find(
+      layer => layer.name === 'session' && layer.handle
+    )?.handle
+
+    // Extract WebID during WebSocket upgrade (before connection established)
+    server.on('upgrade', function (request, socket, head) {
+      // Create an authentication promise that resolves when auth is complete
+      request.authPromise = (async () => {
+        try {
+          let webId = null
+
+          // Parse session cookie manually (session middleware doesn't run on upgrade)
+          if (sessionParser) {
+          // Create a minimal response object for session parser
+            const res = {
+              getHeader: () => {},
+              setHeader: () => {},
+              end: () => {}
+            }
+
+            await new Promise((resolve, reject) => {
+              sessionParser(request, res, (err) => {
+                if (err) reject(err)
+                else resolve()
+              })
+            })
+
+            // Now req.session is available if cookie was valid
+            if (request.session && request.session.userId) {
+              webId = request.session.userId
+              debug.ACL(`WebSocket upgrade: Found WebID in session: ${webId}`)
+            }
+          } else {
+            debug.ACL('WebSocket upgrade: Session parser not found')
+          }
+
+          // Check Authorization header for Bearer token (alternative auth method)
+          if (!webId && request.headers.authorization) {
+            const authHeader = request.headers.authorization
+            debug.ACL(`WebSocket upgrade: Found Authorization header: ${authHeader.substring(0, 20)}...`)
+            if (authHeader.startsWith('Bearer ')) {
+              try {
+                const oidc = ldpApp.locals.oidc
+                if (oidc && oidc.rs) {
+                  debug.ACL('WebSocket upgrade: Attempting Bearer token authentication')
+                  // Authenticate using OIDC Resource Server
+                  await new Promise((resolve, reject) => {
+                    const res = {
+                      getHeader: () => {},
+                      setHeader: () => {},
+                      status: () => res,
+                      send: () => {},
+                      end: () => {}
+                    }
+
+                    const tokenTypesSupported = ldp.tokenTypesSupported || ['DPoP', 'Bearer']
+                    debug.ACL(`WebSocket upgrade: Token types supported: ${JSON.stringify(tokenTypesSupported)}`)
+                    oidc.rs.authenticate({ tokenTypesSupported })(request, res, async (err) => {
+                      if (err) {
+                        debug.ACL(`WebSocket upgrade: Bearer token authentication failed: ${err.message}`)
+                        debug.ACL(`WebSocket upgrade: Error stack: ${err.stack}`)
+                        // Don't reject - just continue without auth
+                        resolve()
+                      } else {
+                        debug.ACL(`WebSocket upgrade: Bearer token authenticated, claims: ${JSON.stringify(request.claims)}`)
+                        // Extract WebID from token claims
+                        try {
+                          const tokenWebId = await oidc.webIdFromClaims(request.claims)
+                          debug.ACL(`WebSocket upgrade: webIdFromClaims returned: ${tokenWebId}`)
+                          if (tokenWebId) {
+                            webId = tokenWebId
+                            debug.ACL(`WebSocket upgrade: Found WebID in Bearer token: ${webId}`)
+                          } else {
+                            debug.ACL('WebSocket upgrade: webIdFromClaims returned null/undefined')
+                          }
+                          resolve()
+                        } catch (claimErr) {
+                          debug.ACL(`WebSocket upgrade: Could not extract WebID from claims: ${claimErr.message}`)
+                          debug.ACL(`WebSocket upgrade: Claim error stack: ${claimErr.stack}`)
+                          // Don't reject - just continue without auth
+                          resolve()
+                        }
+                      }
+                    })
+                  })
+                } else {
+                  debug.ACL('WebSocket upgrade: OIDC not initialized, cannot verify Bearer token')
+                }
+              } catch (tokenErr) {
+                debug.ACL(`WebSocket upgrade: Bearer token verification error: ${tokenErr.message}`)
+              // Continue without auth
+              }
+            }
+          }
+
+          // Store WebID on request for use in authorizeSubscription callback
+          request.webId = webId
+          debug.ACL(`WebSocket upgrade: ${webId ? 'Authenticated as ' + webId : 'Anonymous connection'}`)
+          debug.ACL(`WebSocket upgrade: Set request.webId to ${request.webId}`)
+          debug.ACL(`WebSocket upgrade: request object keys: ${Object.keys(request).join(', ')}`)
+        } catch (error) {
+          debug.ACL(`WebSocket upgrade error: ${error.message}`)
+          // Don't block the upgrade on errors, just proceed without auth
+          request.webId = null
+        }
+      })()
+    })
+
+    // Authorization callback for WebSocket subscriptions
+    // Checks ACL read permission before allowing subscription
+    const authorizeSubscription = async function (iri, req, callback) {
+      // Wait for authentication to complete
+      if (req.authPromise) {
+        try {
+          await req.authPromise
+        } catch (err) {
+          debug.ACL(`WebSocket authorization: auth promise failed: ${err.message}`)
+        }
+      }
+
+      // Extract userId from the request (set during upgrade event)
+      const userId = req.webId || null
+      debug.ACL(`WebSocket authorization callback: iri=${iri}, userId=${userId}, req.webId=${req.webId}`)
+
+      try {
+        // Security: Validate URL length to prevent DoS
+        const MAX_URL_LENGTH = 2048
+        if (iri.length > MAX_URL_LENGTH) {
+          debug.ACL(`WebSocket subscription DENIED: URL too long (${iri.length} > ${MAX_URL_LENGTH})`)
+          return callback(null, false)
+        }
+
+        const parsedUrl = url.parse(iri)
+        const resourcePath = decodeURIComponent(parsedUrl.pathname)
+        const hostname = parsedUrl.hostname || req.headers.host?.split(':')[0]
+        const rootUrl = ldp.resourceMapper.resolveUrl(hostname)
+        const resourceUrl = rootUrl + resourcePath
+
+        // Security: Prevent SSRF - only allow subscriptions to this server
+        // Check if requested hostname matches the request's host
+        const requestHost = req.headers.host?.split(':')[0]
+        if (parsedUrl.hostname && parsedUrl.hostname !== requestHost && parsedUrl.hostname !== hostname) {
+          debug.ACL(`WebSocket subscription DENIED: Cross-origin subscription attempt (${parsedUrl.hostname} !== ${requestHost})`)
+          return callback(null, false)
+        }
+
+        // Create a minimal request-like object for ACLChecker
+        const pseudoReq = {
+          hostname,
+          path: resourcePath,
+          headers: req.headers,
+          get: (header) => {
+            const headerLower = header.toLowerCase()
+            return req.headers[headerLower]
+          }
+        }
+
+        const aclChecker = ACLChecker.createFromLDPAndRequest(resourceUrl, ldp, pseudoReq)
+
+        aclChecker.can(userId, 'Read')
+          .then(allowed => {
+            debug.ACL(`WebSocket subscription ${allowed ? 'ALLOWED' : 'DENIED'} for ${iri} (user: ${userId || 'anonymous'})`)
+            callback(null, allowed)
+          })
+          .catch(err => {
+            debug.ACL(`WebSocket ACL check error for ${iri}: ${err.message}`)
+            callback(null, false)
+          })
+      } catch (err) {
+        debug.ACL(`WebSocket authorization error: ${err.message}`)
+        callback(null, false)
+      }
+    }
+
+    const solidWs = SolidWs(server, ldpApp, { authorize: authorizeSubscription })
     ldpApp.locals.ldp.live = solidWs.publish.bind(solidWs)
   }
 

package-lock.json

@@ -109,7 +109,8 @@
     "rimraf": "^3.0.2",
     "solid-auth-client": "^2.5.6",
     "solid-namespace": "^0.5.4",
-    "solid-ws": "^0.4.3",
+    "solid-server": "^6.0.0",
+    "solid-ws": "^0.5.0-bbdbf094",
     "text-encoder-lite": "^2.0.0",
     "the-big-username-blacklist": "^1.5.2",
     "ulid": "^3.0.2",