codeforpdx / codeforpdx/PASS

Revoking viewing permissions to a document does not revoke viewing permissions to its entry in the documents list

Open
#342 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
JavaScript
Stars
38
Forks
23
Avg merge
11m
Merged PRs (30d)
4

Description

Bug Description:
If you revoke someone's permission to read a document in your pod, the entry for the document will still appear in the documents table when they view your pod.

This is because we store information on the document in 2 places: the document file itself, and in the documentsList.ttl, which acts as an index of all the documents in your pod and a source of metadata. When a user revokes permission to view the document, it does not revoke permission to view the entry in documentsList.ttl.

Additional Context:
We use documentsList.ttl in order to fetch all information necessary to display documents in one request. The documents container maintains an index of all its children, but we can't get document description or expiry date from that. Having separate metadata files for each document will increase load time of the documents table significantly, as we will need to perform a separate network fetch for each row in the table.

Possible Solution (optional):
I can think of a few possible approaches:

  • Set ACL permissions to individual things in .ttl documents. I don't know if this is possible to do in solid. My current impression is that permissions can only be applied on the document level, not the line level.
  • Break up documentsList.ttl into several separate documents, then find a way to get back several documents in a single request, or bite the bullet on the performance loss of the multiple fetches. Many APIs allow you to retrieve multiple separate resources in a single response for performance reasons. This could be possible using SPARQL, but SPARQL is not available by default from solid servers. By default only LDP is available. I don't believe it's possible to get multiple documents back in a single request using LDP, but I could be wrong.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how documentsList.ttl is exposed and how document read permissions are revoked. Compare access to the document file with access to its indexed entry, then investigate the Solid/LDP permission constraints described in the issue. Done means revoking document viewing permission also prevents the corresponding entry from appearing in the documents table.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authorization
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.