Skip to content

Commit 1f8f524

Browse files
namedgraphnamedgraph
authored
Request access modal form (#204)
* New endpoint that show's agents ACL authorizations * Modal access request form * Reloading access matrix when agent select changes * RDF/POST inputs in form-request-access * Access request endpoint * Moved access endpoints to the admin app * Fixed authorization request form * CSS fixes * Request access form fixes SPARQL endpoint is now read-only accessible for authenticated agents * Check acl:mode in AuthorizationFilter instead of authQuery * Access endpoint uses SPARQL query to load document types and injects them into the ACL query * `AuthorizationFilter` uses new `SERVICE`-less queries and gets `VALUES ?Type` injected All endpoints now have to be described in RDF with types (otherwise empty `VALUES` makes the ACL query return empty result) * If accessTo document does not exist (has no types), retry PUT authorization with a parent URI * ACL query fixes * AuthorizationFilter fixes * Restored $base binding * Included nfo:FileDataObject case in the document type query * Include `ontologies/namespace/` as a special case in ownerAclQuery * Fixrd ACL for the `admin/clear` endpoint * Only containers allow child documents * Only root *and* containers allow child documents * Fixed parent type value * Aligned HTTP tests with the new `AuthorizationFilter` behavior * HTTP test fixes * Cleanup * Improved Java syntax * Removed `$Container` bindings * XSLT cleanup * Create document owner authorization on the fly `xhtml:Input` and `ldh:parse-rdf-post` fixes * Check owner of parent document after checking its type * Extracted common utility functions from `AuthorizationFilter` and the `Access` endpoint * Moved document type/owner query into the web.xml config * Access endpoint returns `lacl:OwnerAuthorization` as well
1 parent f1fe8c5 commit 1f8f524

43 files changed

Lines changed: 1581 additions & 758 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎http-tests/admin/POST-request-access.sh‎

Lines changed: 7 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,20 @@ curl -w "%{http_code}\n" -o /dev/null -k -s \
1313
--data-urlencode "rdf=" \
1414
--data-urlencode "sb=request" \
1515
--data-urlencode "pu=http://www.w3.org/1999/02/22-rdf-syntax-ns#type" \
16-
--data-urlencode "ou=https://w3id.org/atomgraph/linkeddatahub/admin/acl#AuthorizationRequest" \
17-
--data-urlencode "pu=https://w3id.org/atomgraph/linkeddatahub/admin/acl#requestAccessTo" \
16+
--data-urlencode "ou=http://www.w3.org/ns/auth/acl#Authorization" \
17+
--data-urlencode "pu=http://www.w3.org/ns/auth/acl#accessTo" \
1818
--data-urlencode "ou=${END_USER_BASE_URL}sparql" \
19-
--data-urlencode "pu=https://w3id.org/atomgraph/linkeddatahub/admin/acl#requestAccessToClass" \
19+
--data-urlencode "pu=http://www.w3.org/ns/auth/acl#accessToClass" \
2020
--data-urlencode "ou=https://w3id.org/atomgraph/linkeddatahub/default#Root" \
2121
--data-urlencode "ou=https://www.w3.org/ns/ldt/document-hierarchy#Container" \
2222
--data-urlencode "ou=https://www.w3.org/ns/ldt/document-hierarchy#Item" \
2323
--data-urlencode "ou=http://www.semanticdesktop.org/ontologies/2007/03/22/nfo#FileDataObject" \
24-
--data-urlencode "pu=https://w3id.org/atomgraph/linkeddatahub/admin/acl#requestMode" \
24+
--data-urlencode "pu=http://www.w3.org/ns/auth/acl#mode" \
2525
--data-urlencode "ou=http://www.w3.org/ns/auth/acl#Read" \
2626
--data-urlencode "ou=http://www.w3.org/ns/auth/acl#Write" \
2727
--data-urlencode "pu=http://www.w3.org/2000/01/rdf-schema#label" \
2828
--data-urlencode "ol=Access request by Test Agent" \
29-
--data-urlencode "pu=https://w3id.org/atomgraph/linkeddatahub/admin/acl#requestAgent" \
29+
--data-urlencode "pu=http://www.w3.org/ns/auth/acl#agent" \
3030
--data-urlencode "ou=${AGENT_URI}" \
31-
--data-urlencode "sb=request-item" \
32-
--data-urlencode "pu=http://www.w3.org/1999/02/22-rdf-syntax-ns#type" \
33-
--data-urlencode "ou=https://www.w3.org/ns/ldt/document-hierarchy#Item" \
34-
--data-urlencode "pu=http://rdfs.org/sioc/ns#has_container" \
35-
--data-urlencode "ou=${ADMIN_BASE_URL}acl/authorization-requests/" \
36-
--data-urlencode "pu=http://xmlns.com/foaf/0.1/primaryTopic" \
37-
--data-urlencode "ob=request" \
38-
"${ADMIN_BASE_URL}request%20access" \
39-
| grep -q "$STATUS_CREATED"
31+
"${ADMIN_BASE_URL}access/request" \
32+
| grep -q "$STATUS_OK"

http-tests/admin/GET-request-access-html.sh renamed to http-tests/document-hierarchy/DELETE-403.sh

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@ initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPO
55
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
66
purge_cache "$END_USER_VARNISH_SERVICE"
77
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
89

9-
# test the "Request access" HTML form
10+
# check that write access without authorization is forbidden
1011

11-
curl -k -w "%{http_code}\n" -o /dev/null -f -s \
12-
-G \
12+
curl -k -w "%{http_code}\n" -o /dev/null -s \
13+
-X DELETE \
1314
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
14-
-H 'Accept: text/html' \
15-
--data-urlencode "access-to=${END_USER_BASE_URL}" \
16-
"${ADMIN_BASE_URL}request%20access" \
17-
| grep -q "$STATUS_OK"
15+
-H "Accept: application/n-triples" \
16+
"$END_USER_BASE_URL" \
17+
| grep -q "$STATUS_FORBIDDEN"

http-tests/document-hierarchy/DELETE-404.sh renamed to http-tests/document-hierarchy/DELETE-non-existing-403.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,11 @@ add-agent-to-group.sh \
1515
--agent "$AGENT_URI" \
1616
"${ADMIN_BASE_URL}acl/groups/writers/"
1717

18-
# check that access to graph with parent is allowed, but the graph is not found
18+
# check that access to non-existing graph is forbidden
1919

2020
curl -k -w "%{http_code}\n" -o /dev/null -s -G \
2121
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
2222
-X DELETE \
2323
-H "Accept: application/n-triples" \
2424
"${END_USER_BASE_URL}non-existing/" \
25-
| grep -q "$STATUS_NOT_FOUND"
25+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/document-hierarchy/DELETE.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,4 +45,4 @@ curl -k -w "%{http_code}\n" -o /dev/null -s -G \
4545
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
4646
-H "Accept: application/n-triples" \
4747
"$container" \
48-
| grep -q "$STATUS_NOT_FOUND"
48+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/document-hierarchy/GET-403.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ purge_cache "$END_USER_VARNISH_SERVICE"
77
purge_cache "$ADMIN_VARNISH_SERVICE"
88
purge_cache "$FRONTEND_VARNISH_SERVICE"
99

10-
# check that non-existing graph is forbidden
10+
# check that read access without authorization is forbidden
1111

1212
curl -k -w "%{http_code}\n" -o /dev/null -s -G \
1313
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
14-
"${END_USER_BASE_URL}non-existing/" \
14+
"$END_USER_BASE_URL" \
1515
| grep -q "$STATUS_FORBIDDEN"

http-tests/document-hierarchy/GET-404.sh renamed to http-tests/document-hierarchy/GET-non-existing-403.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,4 @@ curl -k -w "%{http_code}\n" -o /dev/null -s -G \
2121
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
2222
-H "Accept: application/n-triples" \
2323
"${END_USER_BASE_URL}non-existing/" \
24-
| grep -q "$STATUS_NOT_FOUND"
24+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/document-hierarchy/GET.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ add-agent-to-group.sh \
1515
--agent "$AGENT_URI" \
1616
"${ADMIN_BASE_URL}acl/groups/readers/"
1717

18-
# GET the graph (use Chrome's default Accept value)
18+
# GET the graph
1919

2020
curl -k -w "%{http_code}\n" -o /dev/null -f -s -G \
2121
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \

‎http-tests/document-hierarchy/PATCH-403.sh‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
initialize_dataset "$END_USER_BASE_URL" "$TMP_END_USER_DATASET" "$END_USER_ENDPOINT_URL"
5+
initialize_dataset "$ADMIN_BASE_URL" "$TMP_ADMIN_DATASET" "$ADMIN_ENDPOINT_URL"
6+
purge_cache "$END_USER_VARNISH_SERVICE"
7+
purge_cache "$ADMIN_VARNISH_SERVICE"
8+
purge_cache "$FRONTEND_VARNISH_SERVICE"
9+
10+
# check that write access without authorization is forbidden
11+
12+
update=$(cat <<EOF
13+
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
14+
15+
INSERT
16+
{
17+
<${END_USER_BASE_URL}> rdf:_2 <${END_USER_BASE_URL}#whateverest>
18+
}
19+
WHERE
20+
{}
21+
EOF
22+
)
23+
24+
curl -k -w "%{http_code}\n" -o /dev/null -s \
25+
-E "$AGENT_CERT_FILE":"$AGENT_CERT_PWD" \
26+
-X PATCH \
27+
-H "Content-Type: application/sparql-update" \
28+
"$END_USER_BASE_URL" \
29+
--data-binary "$update" \
30+
| grep -q "$STATUS_FORBIDDEN"

http-tests/document-hierarchy/PATCH-404.sh renamed to http-tests/document-hierarchy/PATCH-non-existing-403.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ add-agent-to-group.sh \
1515
--agent "$AGENT_URI" \
1616
"${ADMIN_BASE_URL}acl/groups/writers/"
1717

18-
# check that access to graph with parent is allowed, but the graph is not found
18+
# check that write access to non-existing graph is forbidden
1919

2020
update=$(cat <<EOF
2121
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
@@ -37,4 +37,4 @@ curl -k -w "%{http_code}\n" -o /dev/null -s \
3737
"${END_USER_BASE_URL}non-existing/" \
3838
--data-binary "$update"
3939
) \
40-
| grep -q "$STATUS_NOT_FOUND"
40+
| grep -q "$STATUS_FORBIDDEN"

‎http-tests/document-hierarchy/POST-403.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ purge_cache "$END_USER_VARNISH_SERVICE"
77
purge_cache "$ADMIN_VARNISH_SERVICE"
88
purge_cache "$FRONTEND_VARNISH_SERVICE"
99

10-
# check that non-existing graph is forbidden
10+
# check that append access without authorization is forbidden
1111

1212
(
1313
curl -k -w "%{http_code}\n" -o /dev/null -s \

0 commit comments

Comments
 (0)