CSS Inconsistent permission setting for /profile/

Environment

• CSS version: 2.0.1
• Node.js version: v16.13.2
• npm version: 8.1.2

Description

I'm using CSS with mashlib recipe.

When creating a new user (with its own pod/namespace), CSS is able to create the /profile/ folder and the /profile/card file. They seem to be normal -- card is accessible to everyone.

Avatar file permission

However, after uploading an avatar through the web UI (top-right corner --> edit your profile --> edit your profile --> upload), the avatar is not shown -- it appears to be a not found image (or empty, on the top-right corner):

I then realized this is because of permission. Because of issue #113, I can not directly modify the permission through web UI. But manually creating the .acl file (copying and modifying the .acl file for card) makes the avatar appear.

This shows an inconsistent behaviour when creating the card and the avatar file -- one has its own .acl created, while the other doesn't.

/profile/ folder permission between CSS and NSS

But there is also an issue with the permission of /profile/: on solidcommunity.net (running NSS, as told by others), the folder /profile/ is readable by everyone; on my CSS instance, the folder /profile/ is only readable (and writable, etc) by myself. This is an inconsistent behaviour between different solid server applications.

This matters, because on solidcommunity.net (NSS), there is no need to have separate .acl file for each file under /profile/. It indeed does not have such separate .acl files there:

But on CSS, because /profile/ is not readable by everyone, contents under it need to have .acl files to be correctly readable by everyone.

User folder permission

The above issues do not happen when the user is created directly using the root of the CSS instance. This is because everyone has every permission for every folder under its name, and all sub-folders (recursively).

Reproduce profile creation and avatar upload on the CSS instance, then compare the resulting permissions and ACL files with the behavior described for NSS. Trace the profile-directory and avatar permission handling, including users created under the instance root versus a pod or namespace. Done means the profile folder and avatar have consistent, correctly readable permissions without requiring manually created ACL files.