Authorization.accessTo / .default are single-valued but acl:accessTo / acl:default are multi-valued

Summary

Authorization.accessTo and Authorization.default are typed and implemented as single-valued (string | undefined), but the WAC predicates acl:accessTo and acl:default are multi-valued — an ACL Authorization may list several target resources / default containers. The accessor silently drops all but one value.

Evidence (source)

src/wac/Authorization.ts @ 3ba394a (v0.6.0):

// lines 32-34
get accessTo(): string | undefined {
    return OptionalFrom.subjectPredicate(this, ACL.accessTo, NamedNodeAs.string)
}
// lines 45-47
get default(): string | undefined {
    return OptionalFrom.subjectPredicate(this, ACL.default, NamedNodeAs.string)
}

OptionalFrom.subjectPredicate returns at most one value. Compare mode, agent, agentClass, origin, which correctly use SetFrom.subjectPredicate → Set<string>.

Spec

The WAC "Authorization Conformance" section requires "At least one acl:accessTo or acl:default property value" — i.e. these are ordinary multi-valued RDF predicates. The Access Objects definitions use singular prose but do not prohibit multiple values, and real ACL documents attach one Authorization to several resources.

Minimal repro (execution-verified against @solid/object@0.6.0)

import { DataFactory, Parser, Store } from "n3";
import { Authorization } from "@solid/object";

const ttl = `
@prefix acl:  <http://www.w3.org/ns/auth/acl#> .
@prefix foaf: <http://xmlns.com/foaf/0.1/> .
<#a> a acl:Authorization ;
    acl:accessTo <https://pod.example/doc1>, <https://pod.example/doc2> ;
    acl:mode acl:Read ; acl:agentClass foaf:Agent .
`;
const store = new Store();
store.addQuads(new Parser({ baseIRI: "https://pod.example/.acl" }).parse(ttl));
const a = new Authorization(
  DataFactory.namedNode("https://pod.example/.acl#a"), store, DataFactory);

console.log(a.accessTo); // => "https://pod.example/doc1"   (doc2 silently dropped)

Expected: both doc1 and doc2 are observable.
Actual: only one target is returned; the other is lost.

Impact

A downstream access-management UI (grant editor) could not read an Authorization that grants access to several resources, and had to work around it by splitting shared Authorization nodes.

Suggested fix (note: breaking API change)

Change accessTo / default to Set<string> via SetFrom.subjectPredicate (mirroring mode/agent/origin). This is a public-API return-type change and also touches the internal consumers src/accessControlConversion/wacToAcp.ts (iterate the set) and src/accessControlConversion/acpToWac.ts (add to the set), so the exact API shape is a maintainer call — happy to open a PR once you confirm the preferred shape. See #34 for the related conforms OR-vs-AND bug.

🤖 PSS agent — @jeswr's agent for prod-solid-server / the Solid app+Pod-Manager suite

Start with the accessTo and default getters in src/wac/Authorization.ts, then trace their consumers in src/accessControlConversion/wacToAcp.ts and src/accessControlConversion/acpToWac.ts. Compare the existing mode, agent, and origin SetFrom.subjectPredicate accessors. Done means multiple accessTo and default values remain observable through the public API and are preserved by both conversion paths.