assemblee-virtuelle / assemblee-virtuelle/semapps
Use N3-Patch for WAC permissions
- Dominant language
- TypeScript
- Stars
- 103
- Forks
- 14
- Avg merge
- 1m
- Merged PRs (30d)
- 2
Description
Currently WAC permissions use a special format to update WAC permissions through PATCH, as can be seen here:
https://github.com/assemblee-virtuelle/semapps/blob/next/src/frontend/packages/auth-provider/src/authProvider.js#L296-L310
If we used [N3-patch](https://github.com/assemblee-virtuelle/semapps/issues/1252) like we do for containers and resources, it would uniformize our API and it would also allow to remove permissions without risks (right now we first GET the WAC permissions, filter out the permissions we don't want anymore, and then do a PUT, but if the resource is modified between the GET and the PUT, data may be lost).
Of course we could also support Sparql-Patch if we keep this format for other resources...
Even if nothing in the WAC spec prevent someone with a `acl:Control` right to write whatever they want in a WAC permission, we should probably check that only WAC-related predicates are added or removed. The `@type` and `acl:accessTo` triples (added automatically on creation) should not be modified.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with src/frontend/packages/auth-provider/src/authProvider.js#L296-L310 to understand the current WAC PATCH format, then compare it with the N3-Patch handling described in issue 1252. The change is complete when WAC permissions use a consistent patch format, removals avoid the GET/PUT race, and non-WAC predicates plus @type and acl:accessTo are protected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, typescript
- Domain
- api, authorization
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100