Node-solid-server: Missing root .acl on new and existing servers

[rubensworks]

With the recent acl-check changes, .acl on root (such as data/localhost/.acl) is required.
However, this is not being generated because it is missing in default-templates.

An even bigger problem is that existing servers also won't have this .acl file, so all servers that upgrade will suddenly throw 401's everywhere.
An easy fix would be to auto-generate this root .acl file (from default-templates) when it can not be found at startup time.

[kjetilk]

Good catch!

Indeed, the root ACL is required by the spec, so we need to have it there.

[kjetilk]

Just to add a clarification: This is an issue on multi-user servers, not on single-user or accounts generated on multi-user servers, there the root ACL is sourced from new-account.

BTW, it is the integration code that croaks when it doesn't find the root ACL, not the acl-check module itself.

[megoth]

I would imagine localhost/.acl would give READ-access to the public (at least when it's a multiuser) and full control for the owner? Then it should be something like

@prefix acl: <http://www.w3.org/ns/auth/acl#>.
@prefix foaf: <http://xmlns.com/foaf/0.1/>.

<#owner>
    a acl:Authorization;
    acl:agent <OWNERS-WEBID>;
    acl:accessTo <./>;
    acl:defaultForNew <./>;
    acl:mode acl:Read, acl:Write, acl:Control.

# The public has read permissions
<#public>
    a acl:Authorization;
    acl:agentClass foaf:Agent;
    acl:accessTo <./>;
    acl:defaultForNew <./>;
    acl:mode acl:Read.

Edit: Removed example for non-multiuser server, as @kjetilk already explained that.

[kjetilk]

I started thinking that there is an index.html.acl and that is practically the same as the root...

I think that I would not have a default in there, but read for the container, indeed.

[kjetilk]

Perhaps:

@prefix acl: <http://www.w3.org/ns/auth/acl#>.
@prefix foaf: <http://xmlns.com/foaf/0.1/>.

<#public>
    a acl:Authorization;
    acl:agentClass foaf:Agent;  # everyone
    acl:accessTo </>;
    acl:mode acl:Read.

[megoth]

@kjetilk just to verify; so we would not give owners full control of the root by default, but add ACLs for files that would give them full control to those files (e.g. index.html)?

[rubensworks]

I'm doing some testing, and acl:defaultForNew </> would be needed if we also want to allow default access to /common.

Unless we want to add dedicated .acl files for those?

[kjetilk]

@kjetilk just to verify; so we would not give owners full control of the root by default, but add ACLs for files that would give them full control to those files (e.g. index.html)?

I'm not sure, because we don't really have a clear concept of "owner", i.e. owner is just whoever has read-write-control. So, I just opted for the most conservative option.

[kjetilk]

So, first, acl:defaultForNew is deprecated in 5.0.0 and replaced by simply acl:default.

I'm not sure how the access to /common is enforced in the code, but couldn't we have a triple

<#public> acl:default </common/>  .

in the root ACL?

[rubensworks]

Sure, that also works :-)

[rubensworks]

Done in #984