assemblee-virtuelle / assemblee-virtuelle/semapps

Check WAC permissions on middleware

Open
#1,189 0 comments 0 reactions 0 assignees View on GitHub
acl
Dominant language
TypeScript
Stars
103
Forks
14
Avg merge
1m
Merged PRs (30d)
2

Description

**Problem**
Actually we are stuck with Jena Fuseki as a triple store because the ACL check is done on @nikoPLP WAC extension. We cannot move to other (potentially faster) triple stores like [Oxygraph](https://github.com/oxigraph/oxigraph) and upgrading Jena Fuseki can be difficult as it may break the WAC extension (we use v3.17 while the latest version is v4.8).

**Proposal**
If we did the ACL check on the middleware (in particular in the WebAclMiddleware), we could switch to another triple store without losing WAC permissions check. The only thing that wouldn't be possible anymore would be WAC permissions check on an open SPARQL endpoint (but if we implemented [LDP paging](https://github.com/assemblee-virtuelle/semapps/issues/176), we could do without ?).

Anyway, if someone still needs WAC permissions check on SPARQL endpoint, he could use the Jena Fuseki 3.17 with WAC extension. And if someone doesn't need this, he could move to other triple stores.

**Implementation**
Extend the WebAclMiddleware, and call `webacl.resource.hasRight` before all calls to LDP services. The `webacl.resource.hasRight` action can be cached with Redis, so the performances could be fast, perhaps even faster than now.

**Linked issues**

This will probably requires refactoring of some WAC actions, including:

- #908
- #1219

We also need to add tests for the webacl.resource service, as right now it is only tested on the API layer and many new "util" services are not tested.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with WebAclMiddleware and the webacl.resource service, then review linked issues #908 and #1219 to understand the proposed WAC-action refactoring. Add coverage for webacl.resource, which is currently tested only at the API layer, and verify that hasRight is applied before LDP service calls; investigate Redis caching as part of the design.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js, redis, typescript
Domain
api, authorization, backend
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.