Fix relative URI resolution for acl:agent #65
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Resolve agent URIs against the ACL URL so that relative references like `./#me` in an ACL file correctly match the authenticated WebID. Previously, `accessTo` and `default` were resolved but `agents` were not, causing 403 Forbidden when using relative URIs for agent WebIDs. Fixes #64
There was a problem hiding this comment.
Pull request overview
This PR fixes a bug where relative agent URIs (like ./#me) in ACL files were not being resolved, causing authorization failures when the authenticated WebID didn't match the unresolved relative reference.
- Adds URI resolution for
acl:agentvalues to resolve them against the ACL URL - Ensures consistency with how
acl:accessToandacl:defaultURIs are already resolved - Enables the use of relative WebID references in ACL files (e.g.,
./#mein/.aclresolves tohttps://example.com/#me)
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+148
to
+149
| auth.agents = parseUriArray(node['acl:agent'] || node['agent']) | ||
| .map(uri => resolveUri(uri, aclUrl)); |
There was a problem hiding this comment.
This change adds support for resolving relative agent URIs, but there's no test coverage for this new behavior. Consider adding a test case similar to the existing tests for relative accessTo and default URLs (lines 138-171) that verifies relative agent URIs like './#me' are properly resolved against the ACL URL.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
./#mecorrectly match the authenticated WebIDProblem
When using a relative URI like
./#mein an ACL file to reference the owner's WebID, it wasn't matching the authenticated user's WebID during authorization checks, resulting in 403 Forbidden.The issue was that
accessToanddefaultURIs were being resolved against the base URL, butagentswere not:Fix
One-line change to resolve agent URIs against the ACL URL:
Note: We resolve against
aclUrl(notbaseUrl) because./#mein/.aclshould resolve tohttps://example.com/#me.Test plan
./#mein ACL matches authenticated WebIDFixes #64