@@ -5,7 +5,6 @@ const { dirname } = require('path')
55const rdf = require ( 'rdflib' )
66const debug = require ( './debug' ) . ACL
77// const debugCache = require('./debug').cache
8- // const debugAccounts = require('./debug').accounts
98const HTTPError = require ( './http-error' )
109const aclCheck = require ( '@solid/acl-check' )
1110const { URL } = require ( 'url' )
@@ -56,6 +55,7 @@ class ACLChecker {
5655 }
5756 this . messagesCached [ cacheKey ] = this . messagesCached [ cacheKey ] || [ ]
5857
58+ // for method DELETE nearestACL and ACL from parent resource
5959 const acl = await this . getNearestACL ( method ) . catch ( err => {
6060 this . messagesCached [ cacheKey ] . push ( new HTTPError ( err . status || 500 , err . message || err ) )
6161 } )
@@ -95,56 +95,56 @@ class ACLChecker {
9595 // FIXME: https://github.com/solid/acl-check/issues/23
9696 // console.error(e.message)
9797 }
98+
9899 function resourceAccessDenied ( modes ) {
99- accessDenied = aclCheck . accessDenied ( aclGraph , resource , directory , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
100+ return aclCheck . accessDenied ( aclGraph , resource , directory , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
100101 }
101-
102102 function accessDeniedForAccessTo ( modes ) {
103103 const accessDeniedAccessTo = aclCheck . accessDenied ( aclGraph , directory , null , aclFile , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
104104 const accessResult = ! accessDenied && ! accessDeniedAccessTo
105- accessDenied = accessResult ? false : accessDenied || accessDeniedAccessTo
106- // debugCache('accessDenied result ' + accessDenied)
105+ return accessResult ? false : accessDenied || accessDeniedAccessTo
107106 }
108107 async function accessdeniedFromParent ( modes ) {
109108 const parentAclDirectory = ACLChecker . getDirectory ( acl . parentAcl )
110109 const parentDirectory = parentResource === parentAclDirectory ? null : rdf . sym ( parentAclDirectory )
111- // if (acl.parentAcl.endWith('/.acl')) parentDirectory = rdf.sym(parentAclDirectory)
112110 const accessDeniedParent = aclCheck . accessDenied ( acl . parentGraph , parentResource , parentDirectory , rdf . sym ( acl . parentAcl ) , agent , modes , agentOrigin , trustedOrigins , originTrustedModes )
113111 const accessResult = ! accessDenied && ! accessDeniedParent
114- accessDenied = accessResult ? false : accessDenied || accessDeniedParent
115- // debugCache('accessDenied result ' + accessDenied)
112+ return accessResult ? false : accessDenied || accessDeniedParent
116113 }
117114
118- let accessDenied
119- resourceAccessDenied ( modes )
115+ let accessDenied = resourceAccessDenied ( modes )
116+ // debugCache('accessDenied resource ' + accessDenied)
117+
120118 // For create and update HTTP methods
121119 if ( ( method === 'PUT' || method === 'PATCH' || method === 'COPY' ) ) {
122120 // if resource and acl have same parent container,
123121 // and resource does not exist, then accessTo Append from parent is required
124122 if ( directory && directory . value === dirname ( aclFile . value ) + '/' && ! resourceExists ) {
125- accessDeniedForAccessTo ( [ ACL ( 'Append' ) ] )
123+ accessDenied = accessDeniedForAccessTo ( [ ACL ( 'Append' ) ] )
126124 }
125+ // debugCache('accessDenied PUT/PATCH ' + accessDenied)
127126 }
128127
129128 // For delete HTTP method
130129 if ( ( method === 'DELETE' ) ) {
131130 if ( resourceExists ) {
132131 // deleting a Container
133132 // without Read, the response code will reveal whether a Container is empty or not
134- if ( directory && this . resource . endsWith ( '/' ) ) resourceAccessDenied ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
133+ if ( directory && this . resource . endsWith ( '/' ) ) accessDenied = resourceAccessDenied ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
135134 // if resource and acl have same parent container,
136135 // then both Read and Write on parent is required
137- else if ( ! directory && aclFile . value . endsWith ( `/${ this . suffix } ` ) ) await accessdeniedFromParent ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
136+ else if ( ! directory && aclFile . value . endsWith ( `/${ this . suffix } ` ) ) accessDenied = await accessdeniedFromParent ( [ ACL ( 'Read' ) , ACL ( 'Write' ) ] )
138137
139138 // deleting a Document
140139 else if ( directory && directory . value === dirname ( aclFile . value ) + '/' ) {
141- accessDeniedForAccessTo ( [ ACL ( 'Write' ) ] )
140+ accessDenied = accessDeniedForAccessTo ( [ ACL ( 'Write' ) ] )
142141 } else {
143- await accessdeniedFromParent ( [ ACL ( 'Write' ) ] )
142+ accessDenied = await accessdeniedFromParent ( [ ACL ( 'Write' ) ] )
144143 }
145144
146145 // https://github.com/solid/specification/issues/14#issuecomment-1712773516
147146 } else { accessDenied = true }
147+ // debugCache('accessDenied DELETE ' + accessDenied)
148148 }
149149
150150 if ( accessDenied && user ) {
@@ -184,7 +184,6 @@ class ACLChecker {
184184 let parentGraph = null
185185 let docAcl = null
186186 let docGraph = null
187- // while (possibleACLs.length > 0 && !returnParentAcl) {
188187 while ( possibleACLs . length > 0 && ! returnParentAcl ) {
189188 const acl = possibleACLs . shift ( )
190189 let graph
@@ -193,7 +192,7 @@ class ACLChecker {
193192 graph = await this . requests [ acl ]
194193 } catch ( err ) {
195194 if ( err && ( err . code === 'ENOENT' || err . status === 404 ) ) {
196- // only set isContainer before docAcl // alain
195+ // only set isContainer before docAcl
197196 if ( ! docAcl ) isContainer = true
198197 continue
199198 }
@@ -205,7 +204,7 @@ class ACLChecker {
205204 if ( ! docAcl ) {
206205 docAcl = acl
207206 docGraph = graph
208- // parentAcl is only needed for DELETE // alain
207+ // parentAcl is only needed for DELETE
209208 if ( method !== 'DELETE' ) returnParentAcl = true
210209 } else {
211210 parentAcl = acl
0 commit comments