Skip to content

Commit 004dfe8

Browse files
ylebreylebre
committed
rewriting grants to allow and/or grants, added required read for PATCH request when the resource exists
1 parent 53945c4 commit 004dfe8

1 file changed

Lines changed: 115 additions & 32 deletions

File tree

‎src/WAC.php‎

Lines changed: 115 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -54,15 +54,27 @@ public function isAllowed($request, $webId, $origin=false) {
5454
$uri = $request->getUri();
5555
$parentUri = $this->getParentUri($uri);
5656

57-
if (
58-
$this->isUserGranted($requestedGrants['resource'], $uri, $webId) &&
59-
$this->isUserGranted($requestedGrants['parent'], $parentUri, $webId) &&
60-
$this->isOriginGranted($requestedGrants['resource'], $uri, $origin) &&
61-
$this->isOriginGranted($requestedGrants['parent'], $parentUri, $origin)
62-
) {
63-
return true;
57+
foreach ($requestedGrants as $requestedGrant) {
58+
switch ($requestedGrant['type']) {
59+
case "resource":
60+
if (!$this->isUserGranted($requestedGrant['grants'], $uri, $webId)) {
61+
return false;
62+
}
63+
if (!$this->isOriginGranted($requestedGrant['grants'], $uri, $origin)) {
64+
return false;
65+
}
66+
break;
67+
case "parent":
68+
if (!$this->isUserGranted($requestedGrant['grants'], $parentUri, $webId)) {
69+
return false;
70+
}
71+
if (!$this->isOriginGranted($requestedGrant['grants'], $parentUri, $origin)) {
72+
return false;
73+
}
74+
break;
75+
}
6476
}
65-
return false;
77+
return true;
6678
}
6779

6880
private function isUserGranted($requestedGrants, $uri, $webId) {
@@ -250,6 +262,30 @@ private function getParentAcl($path) {
250262
}
251263

252264
public function getRequestedGrants($request) {
265+
/*
266+
Build up the grants that are accepted as valid. The structure is as follows:
267+
- Each entry of the result is treated as an 'and'.
268+
- Each entry want a grant for either 'resource' or 'parent'
269+
- Each entry contains a list of grants that can satisfy the request, treated as an 'or';
270+
271+
Examples:
272+
A request that requires 'read' and 'write' on the targeted resource:
273+
[
274+
["type" => "resource", "grants" => ["http://www.w3.org/ns/auth/acl#Read"]],
275+
["type" => "resource", "grants" => ["http://www.w3.org/ns/auth/acl#Write"]]
276+
]
277+
278+
A request that requires 'write' on the resource and 'append' on the parent:
279+
[
280+
["type" => "resource", "grants" => ["http://www.w3.org/ns/auth/acl#Write"]],
281+
["type" => "parent", "grants" => ["http://www.w3.org/ns/auth/acl#Append"]]
282+
]
283+
284+
A request that requires 'append' or 'write' on the resource
285+
[
286+
["type" => "resource", "grants" => ["http://www.w3.org/ns/auth/acl#Append", "http://www.w3.org/ns/auth/acl#Write"]]
287+
]
288+
*/
253289
$method = strtoupper($request->getMethod());
254290
$path = $request->getUri()->getPath();
255291
if ($this->basePath) {
@@ -261,67 +297,114 @@ public function getRequestedGrants($request) {
261297
// having Control allows all operations.
262298
if (preg_match('/.acl$/', $path)) {
263299
return array(
264-
"resource" => array('http://www.w3.org/ns/auth/acl#Control')
300+
array(
301+
"type" => "resource",
302+
"grants" => array('http://www.w3.org/ns/auth/acl#Control')
303+
)
265304
);
266305
}
267306

268307
switch ($method) {
269308
case "GET":
270309
case "HEAD":
271310
return array(
272-
"resource" => array('http://www.w3.org/ns/auth/acl#Read')
311+
array(
312+
"type" => "resource",
313+
"grants" => array('http://www.w3.org/ns/auth/acl#Read')
314+
)
273315
);
274316
break;
275317
case "DELETE":
276318
return array(
277-
"resource" => array('http://www.w3.org/ns/auth/acl#Write')
319+
array(
320+
"type" => "resource",
321+
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
322+
)
278323
);
279324
break;
280325
case "PUT":
281326
if ($this->filesystem->has($path)) {
282327
return array(
283-
"resource" => array('http://www.w3.org/ns/auth/acl#Write')
328+
array(
329+
"type" => "resource",
330+
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
331+
)
284332
);
285333
} else {
286334
// FIXME: to add a new file, Append is needed on the parent container;
287335
return array(
288-
"resource" => array('http://www.w3.org/ns/auth/acl#Write'),
289-
"parent" => array('http://www.w3.org/ns/auth/acl#Append', 'http://www.w3.org/ns/auth/acl#Write')
336+
array(
337+
"type" => "resource",
338+
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
339+
),
340+
array(
341+
"type" => "parent",
342+
"grants" => array(
343+
'http://www.w3.org/ns/auth/acl#Append',
344+
'http://www.w3.org/ns/auth/acl#Write'
345+
)
346+
)
290347
);
291348
}
292349
break;
293350
case "POST":
294351
return array(
295-
"resource" => array(
296-
'http://www.w3.org/ns/auth/acl#Write', // We need 'append' for this, but because Write trumps Append, also allow it when we have Write;
297-
'http://www.w3.org/ns/auth/acl#Append'
352+
array(
353+
"type" => "resource",
354+
"grants" => array(
355+
'http://www.w3.org/ns/auth/acl#Write', // We need 'append' for this, but because Write trumps Append, also allow it when we have Write;
356+
'http://www.w3.org/ns/auth/acl#Append'
357+
)
298358
)
299359
);
300360
break;
301361
case "PATCH";
302362
$grants = array();
363+
if ($this->filesystem->has($path)) {
364+
$grants[] = array(
365+
"type" => "resource",
366+
"grants" => array(
367+
'http://www.w3.org/ns/auth/acl#Read'
368+
)
369+
);
370+
} else {
371+
$grants[] = array(
372+
"type" => "parent",
373+
"grants" => array(
374+
'http://www.w3.org/ns/auth/acl#Append',
375+
'http://www.w3.org/ns/auth/acl#Write'
376+
)
377+
);
378+
}
379+
303380
$body = $request->getBody()->getContents();
381+
$request->getBody()->rewind();
382+
304383
if (strstr($body, "DELETE")) {
305-
$grants[] = 'http://www.w3.org/ns/auth/acl#Write';
384+
$grants[] = array(
385+
"type" => "resource",
386+
"grants" => array('http://www.w3.org/ns/auth/acl#Write')
387+
);
306388
}
307389
if (strstr($body, "INSERT")) {
308390
if ($this->filesystem->has($path)) {
309-
$grants[] = 'http://www.w3.org/ns/auth/acl#Append';
391+
$grants[] = array(
392+
"type" => "resource",
393+
"grants" => array(
394+
'http://www.w3.org/ns/auth/acl#Append',
395+
'http://www.w3.org/ns/auth/acl#Write'
396+
)
397+
);
398+
} else {
399+
$grants[] = array(
400+
"type" => "resource",
401+
"grants" => array(
402+
'http://www.w3.org/ns/auth/acl#Write'
403+
)
404+
);
310405
}
311-
$grants[] = 'http://www.w3.org/ns/auth/acl#Write';
312-
}
313-
// error_log($body);
314-
$request->getBody()->rewind();
315-
if ($this->filesystem->has($path)) {
316-
return array(
317-
"resource" => $grants
318-
);
319-
} else {
320-
return array(
321-
"resource" => $grants,
322-
"parent" => array('http://www.w3.org/ns/auth/acl#Append', 'http://www.w3.org/ns/auth/acl#Write')
323-
);
324406
}
407+
return $grants;
325408
break;
326409
}
327410
}

0 commit comments

Comments
 (0)