Verify read and write permissions for patches.

Author: RubenVerborgh

lib/handlers/patch.js

@@ -44,10 +44,12 @@ function patchHandler (req, res, next) {
     return next(error(415, `Unsupported patch content type: ${patch.contentType}`))
   }
 
-  // Parse the target graph and the patch document
+  // Parse the target graph and the patch document,
+  // and verify permission for performing this specific patch
   Promise.all([
     readGraph(target),
     parsePatch(target.uri, patch.uri, patch.text)
+      .then(patchObject => checkPermission(target, req, patchObject))
   ])
   // Patch the graph and write it back to the file
   .then(([graph, patchObject]) => applyPatch(patchObject, graph, target))
@@ -96,6 +98,36 @@ function readGraph (resource) {
   })
 }
 
+// Verifies whether the user is allowed to perform the patch on the target
+function checkPermission (target, request, patchObject) {
+  // If no ACL object was passed down, assume permissions are okay.
+  if (!request.acl) return Promise.resolve(patchObject)
+  // At this point, we already assume append access,
+  // as this can be checked upfront before parsing the patch.
+  // Now that we know the details of the patch,
+  // we might need to perform additional checks.
+  var checks = []
+  // Read access is required for DELETE and WHERE.
+  // If we would allows users without read access,
+  // they could use DELETE or WHERE to trigger 200 or 409,
+  // and thereby guess the existence of certain triples.
+  // DELETE additionally requires write access.
+  if (patchObject.delete) {
+    checks = [hasPermission('Read'), hasPermission('Write')]
+  } else if (patchObject.where) {
+    checks = [hasPermission('Read')]
+  }
+  return Promise.all(checks).then(() => patchObject)
+
+  // Checks whether the user has the given permission on the target
+  function hasPermission (mode) {
+    return new Promise((resolve, reject) =>
+      request.acl.can(request.userId, mode, target.uri,
+                      err => err ? reject(err) : resolve())
+    )
+  }
+}
+
 // Applies the patch to the RDF graph
 function applyPatch (patchObject, graph, target) {
   debug('PATCH -- Applying patch')