Cache the permission set.

Author: RubenVerborgh

lib/acl-checker.js

@@ -19,29 +19,32 @@ class ACLChecker {
     this.suffix = options.suffix || DEFAULT_ACL_SUFFIX
   }
 
+  // Returns a fulfilled promise when the user can access the resource
+  // in the given mode, or a rejected promise otherwise
   can (user, mode) {
-    const debug = this.debug
     this.debug(`Can ${user || 'an agent'} ${mode} ${this.resource}?`)
     // If this is an ACL, Control mode must be present for any operations
     if (this.isAcl(this.resource)) {
       mode = 'Control'
     }
 
-    // Check the permissions within the nearest ACL
-    return this.getNearestACL(this.resource)
-    .then(nearestAcl => {
-      const acls = this.getPermissionSet(nearestAcl)
-      return this.checkAccess(acls, user, mode, this.resource)
-    })
-    .then(() => { debug('ACL policy found') })
+    // Obtain the permission set for the resource
+    if (!this._permissionSet) {
+      this._permissionSet = this.getNearestACL()
+        .then(acl => this.getPermissionSet(acl))
+    }
+
+    // Check the permissions
+    return this._permissionSet.then(acls => this.checkAccess(acls, user, mode))
+    .then(() => { this.debug('ACL policy found') })
     .catch(err => {
-      debug(`Error: ${err.message}`)
+      this.debug(`Error: ${err.message}`)
       if (!user) {
-        debug('Authentication required')
+        this.debug('Authentication required')
         throw new HTTPError(401, `Access to ${this.resource} requires authorization`)
       } else {
-        debug(`${mode} access denied for ${user}`)
-        throw new HTTPError(403, `Access denied for ${user}`)
+        this.debug(`${mode} access denied for ${user}`)
+        throw new HTTPError(403, `Access to ${this.resource} denied for ${user}`)
       }
     })
   }
@@ -112,7 +115,7 @@ class ACLChecker {
     })
   }
 
-  // Gets the permission set for the given resource
+  // Gets the permission set for the given ACL
   getPermissionSet ({ acl, graph, isContainer }) {
     const debug = this.debug
     if (!graph || graph.length === 0) {