Pass permission set to checkAccess.

Author: RubenVerborgh

lib/acl-checker.js

@@ -26,17 +26,10 @@ class ACLChecker {
 
     // Check the permissions within the nearest ACL
     return this.getNearestACL(resource)
-    .then(({ acl, graph, isContainer }) =>
-      this.checkAccess(
-        graph, // The ACL graph
-        user, // The webId of the user
-        mode, // Read/Write/Append
-        resource, // The resource we want to access
-        isContainer,
-        acl, // The current Acl file!
-        options
-      )
-    )
+    .then(nearestAcl => {
+      const acls = this.getPermissionSet(nearestAcl, resource, options)
+      return this.checkAccess(acls, user, mode, resource)
+    })
     .then(() => { debug('ACL policy found') })
     .catch(err => {
       debug(`Error: ${err.message}`)
@@ -95,32 +88,15 @@ class ACLChecker {
     return urls
   }
 
-  /**
-   * Tests whether a graph (parsed .acl resource) allows a given operation
-   * for a given user. Calls the provided callback with `null` if the user
-   * has access, otherwise calls it with an error.
-   * @method checkAccess
-   * @param graph {Graph} Parsed RDF graph of current .acl resource
-   * @param user {String} WebID URI of the user accessing the resource
-   * @param mode {String} Access mode, e.g. 'Read', 'Write', etc.
-   * @param resource {String} URI of the resource being accessed
-   * @param isContainer {boolean}
-   * @param acl {String} URI of this current .acl resource
-   * @param options {Object} Options hashmap
-   * @param [options.origin] Request's `Origin:` header
-   * @param [options.host] Request's host URI (with protocol)
-   */
-  checkAccess (graph, user, mode, resource, isContainer, acl, options = {}) {
-    const acls = this.getPermissionSet(graph, resource, isContainer, acl, options)
-
-    return acls.checkAccess(resource, user, mode)
+  // Tests whether the permissions allow a given operation
+  checkAccess (permissionSet, user, mode, resource) {
+    return permissionSet.checkAccess(resource, user, mode)
     .then(hasAccess => {
       if (hasAccess) {
         this.debug(`${mode} access permitted to ${user}`)
         return true
       } else {
-        this.debug(`${mode} access NOT permitted to ${user}` +
-          this.strictOrigin ? ` and origin ${options.origin}` : '')
+        this.debug(`${mode} access NOT permitted to ${user}`)
         throw new Error('ACL file found but no matching policy found')
       }
     })
@@ -132,7 +108,7 @@ class ACLChecker {
   }
 
   // Gets the permission set for the given resource
-  getPermissionSet (graph, resource, isContainer, acl, options = {}) {
+  getPermissionSet ({ acl, graph, isContainer }, resource, options = {}) {
     const debug = this.debug
     if (!graph || graph.length === 0) {
       debug('ACL ' + acl + ' is empty')

test/unit/acl-checker-test.js

@@ -29,7 +29,8 @@ describe('ACLChecker unit test', () => {
     let graph = {}
     let user, mode, resource, aclUrl
     let acl = new ACLChecker({ debug })
-    return expect(acl.checkAccess(graph, user, mode, resource, true, aclUrl))
+    let acls = acl.getPermissionSet({ graph, acl: aclUrl }, resource)
+    return expect(acl.checkAccess(acls, user, mode, resource))
     .to.eventually.be.true
   })
   it('should callback with error on grant failure', () => {
@@ -39,7 +40,8 @@ describe('ACLChecker unit test', () => {
     let graph = {}
     let user, mode, resource, aclUrl
     let acl = new ACLChecker({ debug })
-    return expect(acl.checkAccess(graph, user, mode, resource, true, aclUrl))
+    let acls = acl.getPermissionSet({ graph, acl: aclUrl }, resource)
+    return expect(acl.checkAccess(acls, user, mode, resource))
     .to.be.rejectedWith('ACL file found but no matching policy found')
   })
   it('should callback with error on grant error', () => {
@@ -49,7 +51,8 @@ describe('ACLChecker unit test', () => {
     let graph = {}
     let user, mode, resource, aclUrl
     let acl = new ACLChecker({ debug })
-    return expect(acl.checkAccess(graph, user, mode, resource, true, aclUrl))
+    let acls = acl.getPermissionSet({ graph, acl: aclUrl }, resource)
+    return expect(acl.checkAccess(acls, user, mode, resource))
     .to.be.rejectedWith('Error thrown during checkAccess()')
   })
 })