A member of a private group can't access a file shared with the group by other member

Start by reproducing the 403 using the private-group.ttl and document-private-group-solidcommunity.ttl ACL examples described in the issue, including access as the third account. Trace how the server resolves private group membership across the referenced resources; done means a group member can read the shared document without weakening access for non-members.

By private group we mean a group defined in a file that has permission to be viewed by the group itself (detailed description follows).

The issue

When we

0. set up three accounts on NSS (v5.7.2) (1, 2, 3),
1. create a group on the first account, containing all three accounts, defined as follows

   @prefix : <#>.
   @prefix vcard: <http://www.w3.org/2006/vcard/ns#>.
   @prefix p1: <https://grouptest1.solidcommunity.net/profile/card#me>.
   @prefix p2: <https://grouptest1.solidweb.org/profile/card#me>.
   @prefix p3: <https://grouptest2.solidcommunity.net/profile/card#me>.
   
   :group
       a vcard:Group;
       vcard:hasMember p1:, p2:, p3:.
   

   (a similar group, but public, is here),
2. give the group permission to view itself (i.e. set up .acl file for the group file as follows)

   @prefix : <#>.
   @prefix acl: <http://www.w3.org/ns/auth/acl#>.
   @prefix c: </profile/card#>.
   @prefix priv: <private-group.ttl#>.
   
   :ControlReadWrite
       a acl:Authorization;
       acl:accessTo <private-group.ttl>;
       acl:agent c:me;
       acl:mode acl:Control, acl:Read, acl:Write.
   :Read
       a acl:Authorization;
       acl:accessTo <private-group.ttl>;
       acl:agentGroup priv:group;
       acl:mode acl:Read.
   

   (Here we already have a major win, because group members can see the group. Compare to CSS, which currently fails at this task (https://github.com/CommunitySolidServer/CommunitySolidServer/issues/1442) 🎉),
3. create a document on the second account

   @prefix : <https://example.com/>.
   :this :is :test.
   

   😄,
4. give the group permission to view the document (i.e. set up .acl file for the document as follows)

   @prefix : <#>.
   @prefix acl: <http://www.w3.org/ns/auth/acl#>.
   @prefix c: </profile/card#>.
   @prefix priv: <https://grouptest1.solidcommunity.net/group-test/private-group.ttl#>.
   
   :ControlReadWrite
       a acl:Authorization;
       acl:accessTo <document-private-group-solidcommunity.ttl>;
       acl:agent c:me;
       acl:mode acl:Control, acl:Read, acl:Write.
   :Read
       a acl:Authorization;
       acl:accessTo <document-private-group-solidcommunity.ttl>;
       acl:agentGroup priv:group;
       acl:mode acl:Read.
   

   (this step already failed with the SolidOS, we needed to set up the .acl manually),
5. and attempt to access the document with the third account,

it fails with 403 Forbidden.

Expected result

A member of a private group (i.e. a group viewable by itself) can read documents that other members share with the group.

Context and motivation

context and more tests here

This bugfix/feature is a necessary step towards fully functional private groups on Solid. E.g. there are non-public Solid groups, and members of the groups can share (sensitive) data with other group members only.

We stumbled upon this issue when developing a hospitality exchange based on Solid (WIP).