Skip to content

Commit 1fcaebb

Browse files
ylebreylebre
committed
removing public grants from user/origin grant checks, moved to own set
1 parent 9b828f3 commit 1fcaebb

1 file changed

Lines changed: 75 additions & 78 deletions

File tree

‎src/WAC.php‎

Lines changed: 75 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,9 @@ public function setBaseUrl($url) {
2222
}
2323

2424
public function addWACHeaders($request, $response, $webId) {
25-
$path = $request->getUri()->getPath();
26-
if ($this->basePath) {
27-
$path = str_replace($this->basePath, '', $path);
28-
}
29-
$userGrants = $this->getWACGrants($this->getUserGrants($path, $webId), $request->getUri());
30-
$publicGrants = $this->getWACGrants($this->getPublicGrants($path), $request->getUri());
25+
$uri = $request->getUri();
26+
$userGrants = $this->getWACGrants($this->getUserGrants($uri, $webId), $uri);
27+
$publicGrants = $this->getWACGrants($this->getPublicGrants($uri), $uri);
3128

3229
$wacHeaders = array();
3330
if ($userGrants) {
@@ -57,6 +54,9 @@ public function isAllowed($request, $webId, $origin=false) {
5754
foreach ($requestedGrants as $requestedGrant) {
5855
switch ($requestedGrant['type']) {
5956
case "resource":
57+
if ($this->isPublicGranted($requestedGrant['grants'], $uri)) {
58+
return true;
59+
}
6060
if (!$this->isUserGranted($requestedGrant['grants'], $uri, $webId)) {
6161
return false;
6262
}
@@ -65,6 +65,9 @@ public function isAllowed($request, $webId, $origin=false) {
6565
}
6666
break;
6767
case "parent":
68+
if ($this->isPublicGranted($requestedGrant['grants'], $uri)) {
69+
return true;
70+
}
6871
if (!$this->isUserGranted($requestedGrant['grants'], $parentUri, $webId)) {
6972
return false;
7073
}
@@ -77,19 +80,18 @@ public function isAllowed($request, $webId, $origin=false) {
7780
return true;
7881
}
7982

80-
private function isUserGranted($requestedGrants, $uri, $webId) {
81-
if (!$requestedGrants) {
82-
return true;
83-
}
84-
83+
private function getPathFromUri($uri) {
8584
$path = $uri->getPath();
8685
if ($this->basePath) {
8786
$path = str_replace($this->basePath, '', $path);
8887
}
89-
90-
// error_log("REQUESTED GRANT: " . join(" or ", $requestedGrants) . " on $uri");
91-
$grants = $this->getUserGrants($path, $webId);
92-
// error_log("GRANTED GRANTS for $webId: " . json_encode($grants));
88+
return $path;
89+
}
90+
private function checkGrants($requestedGrants, $uri, $grants) {
91+
if (!$requestedGrants) {
92+
return true;
93+
}
94+
$path = $this->getPathFromUri($uri);
9395
if (is_array($grants)) {
9496
foreach ($requestedGrants as $requestedGrant) {
9597
if ($grants['accessTo'] && $grants['accessTo'][$requestedGrant] && $this->arePathsEqual($grants['accessTo'][$requestedGrant], $uri)) {
@@ -104,39 +106,73 @@ private function isUserGranted($requestedGrants, $uri, $webId) {
104106
}
105107
return false;
106108
}
109+
110+
private function isPublicGranted($requestedGrants, $uri) {
111+
// error_log("REQUESTED GRANT: " . join(" or ", $requestedGrants) . " on $uri");
112+
$grants = $this->getPublicGrants($uri);
113+
// error_log("GRANTED GRANTS for public: " . json_encode($grants));
114+
return $this->checkGrants($requestedGrants, $uri, $grants);
115+
}
116+
117+
private function isUserGranted($requestedGrants, $uri, $webId) {
118+
// error_log("REQUESTED GRANT: " . join(" or ", $requestedGrants) . " on $uri");
119+
$grants = $this->getUserGrants($uri, $webId);
120+
// error_log("GRANTED GRANTS for user $webId: " . json_encode($grants));
121+
return $this->checkGrants($requestedGrants, $uri, $grants);
122+
}
107123

108124
private function isOriginGranted($requestedGrants, $uri, $origin) {
109-
if (!$requestedGrants) {
110-
return true;
111-
}
112125
if (!$origin) {
113126
return true;
114127
}
115128

116-
$path = $uri->getPath();
117-
if ($this->basePath) {
118-
$path = str_replace($this->basePath, '', $path);
129+
//error_log("REQUESTED GRANT: " . join(" or ", $requestedGrants) . " on $uri");
130+
$grants = $this->getOriginGrants($uri, $origin);
131+
//error_log("GRANTED GRANTS for origin $origin: " . json_encode($grants));
132+
return $this->checkGrants($requestedGrants, $uri, $grants);
133+
}
134+
135+
private function getPublicGrants($resourceUri) {
136+
$resourcePath = $this->getPathFromUri($resourceUri);
137+
$aclPath = $this->getAclPath($resourcePath);
138+
if (!$aclPath) {
139+
return array();
119140
}
141+
142+
$acl = $this->filesystem->read($aclPath);
120143

121-
//error_log("REQUESTED GRANT: " . join(" or ", $requestedGrants) . " on $uri");
122-
$grants = $this->getOriginGrants($path, $origin);
123-
//error_log("GRANTED GRANTS for $origin: " . json_encode($grants));
124-
if (is_array($grants)) {
125-
foreach ($requestedGrants as $requestedGrant) {
126-
if ($grants['accessTo'] && $grants['accessTo'][$requestedGrant] && $this->arePathsEqual($grants['accessTo'][$requestedGrant], $uri)) {
127-
return true;
128-
} else if ($grants['default'][$requestedGrant]) {
129-
if ($this->arePathsEqual($grants['default'][$requestedGrant], $uri)) {
130-
return false; // only use default for children, not for an exact match;
144+
$graph = new \EasyRdf_Graph();
145+
146+
// error_log("PARSE ACL from $aclPath with base " . $this->getAclBase($aclPath));
147+
$graph->parse($acl, Format::TURTLE, $this->getAclBase($aclPath));
148+
149+
$grants = array();
150+
151+
$foafAgent = "http://xmlns.com/foaf/0.1/Agent";
152+
$matching = $graph->resourcesMatching('http://www.w3.org/ns/auth/acl#agentClass');
153+
foreach ($matching as $match) {
154+
$agentClass = $match->get("<http://www.w3.org/ns/auth/acl#agentClass>");
155+
if ($agentClass == $foafAgent) {
156+
$accessTo = $match->get("<http://www.w3.org/ns/auth/acl#accessTo>");
157+
$default = $match->get("<http://www.w3.org/ns/auth/acl#default>");
158+
$modes = $match->all("<http://www.w3.org/ns/auth/acl#mode>");
159+
if ($default) {
160+
foreach ($modes as $mode) {
161+
$grants["default"][$mode->getUri()] = $default->getUri();
162+
}
163+
}
164+
if ($accessTo) {
165+
foreach ($modes as $mode) {
166+
$grants["accessTo"][$mode->getUri()] = $accessTo->getUri();
131167
}
132-
return true;
133168
}
134169
}
135170
}
136-
return false;
137-
}
171+
return $grants;
172+
}
138173

139-
private function getUserGrants($resourcePath, $webId) {
174+
private function getUserGrants($resourceUri, $webId) {
175+
$resourcePath = $this->getPathFromUri($resourceUri);
140176
$aclPath = $this->getAclPath($resourcePath);
141177
if (!$aclPath) {
142178
return array();
@@ -148,9 +184,7 @@ private function getUserGrants($resourcePath, $webId) {
148184

149185
// error_log("GET GRANTS for $webId");
150186

151-
// Start with grants that everyone has
152-
$grants = $this->getPublicGrants($resourcePath);
153-
187+
$grants = array();
154188
// Then get grants that are valid for any authenticated agent;
155189
$authenticatedAgent = "http://www.w3.org/ns/auth/acl#AuthenticatedAgent";
156190
$matching = $graph->resourcesMatching('http://www.w3.org/ns/auth/acl#agentClass');
@@ -200,7 +234,8 @@ private function getUserGrants($resourcePath, $webId) {
200234
return $grants;
201235
}
202236

203-
private function getOriginGrants($resourcePath, $origin) {
237+
private function getOriginGrants($resourceUri, $origin) {
238+
$resourcePath = $this->getPathFromUri($resourceUri);
204239
$aclPath = $this->getAclPath($resourcePath);
205240
if (!$aclPath) {
206241
return array();
@@ -212,8 +247,7 @@ private function getOriginGrants($resourcePath, $origin) {
212247

213248
// error_log("GET GRANTS for $origin");
214249

215-
$grants = $this->getPublicGrants($resourcePath);
216-
250+
$grants = array();
217251
$matching = $graph->resourcesMatching('http://www.w3.org/ns/auth/acl#origin');
218252
//error_log("MATCHING " . sizeof($matching));
219253
// Find all grants machting our origin;
@@ -474,41 +508,4 @@ private function grantToWac($grant) {
474508
private function getAclBase($aclPath) {
475509
return $this->baseUrl . $this->normalizePath(dirname($aclPath) . "/");
476510
}
477-
private function getPublicGrants($resourcePath) {
478-
$aclPath = $this->getAclPath($resourcePath);
479-
if (!$aclPath) {
480-
return array();
481-
}
482-
483-
$acl = $this->filesystem->read($aclPath);
484-
485-
$graph = new \EasyRdf_Graph();
486-
487-
// error_log("PARSE ACL from $aclPath with base " . $this->getAclBase($aclPath));
488-
$graph->parse($acl, Format::TURTLE, $this->getAclBase($aclPath));
489-
490-
$grants = array();
491-
492-
$foafAgent = "http://xmlns.com/foaf/0.1/Agent";
493-
$matching = $graph->resourcesMatching('http://www.w3.org/ns/auth/acl#agentClass');
494-
foreach ($matching as $match) {
495-
$agentClass = $match->get("<http://www.w3.org/ns/auth/acl#agentClass>");
496-
if ($agentClass == $foafAgent) {
497-
$accessTo = $match->get("<http://www.w3.org/ns/auth/acl#accessTo>");
498-
$default = $match->get("<http://www.w3.org/ns/auth/acl#default>");
499-
$modes = $match->all("<http://www.w3.org/ns/auth/acl#mode>");
500-
if ($default) {
501-
foreach ($modes as $mode) {
502-
$grants["default"][$mode->getUri()] = $default->getUri();
503-
}
504-
}
505-
if ($accessTo) {
506-
foreach ($modes as $mode) {
507-
$grants["accessTo"][$mode->getUri()] = $accessTo->getUri();
508-
}
509-
}
510-
}
511-
}
512-
return $grants;
513-
}
514511
}

0 commit comments

Comments
 (0)