(req, res, next)
| 112 | |
| 113 | // Adds a header that describes the user's permissions |
| 114 | export async function addPermissions (req, res, next) { |
| 115 | const { acl, session } = req |
| 116 | if (!acl) return next() |
| 117 | |
| 118 | // Turn permissions for the public and the user into a header |
| 119 | const ldp = req.app.locals.ldp |
| 120 | const resource = ldp.resourceMapper.resolveUrl(req.hostname, req.path) |
| 121 | let [publicPerms, userPerms] = await Promise.all([ |
| 122 | getPermissionsFor(acl, null, req), |
| 123 | getPermissionsFor(acl, session.userId, req) |
| 124 | ]) |
| 125 | if (resource.endsWith('.acl') && userPerms === '' && await ldp.isOwner(session.userId, req.hostname)) userPerms = 'control' |
| 126 | debug.ACL(`Permissions on ${resource} for ${session.userId || '(none)'}: ${userPerms}`) |
| 127 | debug.ACL(`Permissions on ${resource} for public: ${publicPerms}`) |
| 128 | // Set the header |
| 129 | res.set('WAC-Allow', `user="${userPerms}",public="${publicPerms}"`) |
| 130 | next() |
| 131 | } |
| 132 | |
| 133 | // Gets the permissions string for the given user and resource |
| 134 | async function getPermissionsFor (acl, user, req) { |
nothing calls this directly
no test coverage detected