Function checkPermission

lib/handlers/patch.mjs:147–182

(request, patchObject, resourceExists)

// Verifies whether the user is allowed to perform the patch on the target
async function checkPermission (request, patchObject, resourceExists) {
  // If no ACL object was passed down, assume permissions are okay.
  if (!request.acl) return Promise.resolve(patchObject)
  // At this point, we already assume append access,
  // as this can be checked upfront before parsing the patch.
  // Now that we know the details of the patch,
  // we might need to perform additional checks.
  let modes = []
  const { acl, session: { userId } } = request
  // Read access is required for DELETE and WHERE.
  // If we would allows users without read access,
  // they could use DELETE or WHERE to trigger 200 or 409,
  // and thereby guess the existence of certain triples.
  // DELETE additionally requires write access.
  if (patchObject.delete) {
    // ACTUALLY Read not needed by solid/test-suite only Write
    modes = ['Read', 'Write']
    // checks = [acl.can(userId, 'Read'), acl.can(userId, 'Write')]
  } else if (patchObject.where) {
    modes = modes.concat(['Read'])
    // checks = [acl.can(userId, 'Read')]
  }
  const allowed = await Promise.all(modes.map(mode => acl.can(userId, mode, request.method, resourceExists)))
  const allAllowed = allowed.reduce((memo, allowed) => memo && allowed, true)
  if (!allAllowed) {
    // check owner with Control
    const ldp = request.app.locals.ldp
    if (request.path.endsWith('.acl') && await ldp.isOwner(userId, request.hostname)) return Promise.resolve(patchObject)

    const errors = await Promise.all(modes.map(mode => acl.getError(userId, mode)))
    const error = errors.filter(error => !!error)
      .reduce((prevErr, err) => prevErr.status > err.status ? prevErr : err, { status: 0 })
    return Promise.reject(error)
  }
  return Promise.resolve(patchObject)
}

// Applies the patch to the RDF graph
function applyPatch (patchObject, graph, url) {