solid_pod_rs/wac/
client.rs

1//! `acl:ClientCondition` — gate authorisation on the requesting client.
2//!
3//! A `ClientCondition` is satisfied when the request context's
4//! `client_id` matches one of the listed `acl:client` IRIs, when the
5//! client is a member of a listed `acl:clientGroup`, or when the
6//! condition names a public class (`foaf:Agent`).
7
8use serde::{Deserialize, Serialize};
9
10use crate::wac::conditions::{ConditionOutcome, RequestContext};
11use crate::wac::document::{get_ids, IdOrIds};
12use crate::wac::evaluator::GroupMembership;
13
14/// Body of an `acl:ClientCondition`.
15///
16/// Fields mirror the WAC 2.0 predicates: `acl:client`, `acl:clientGroup`,
17/// `acl:clientClass`. Any subset may be populated; evaluation is OR
18/// across the populated predicates (i.e. a client matching any of them
19/// satisfies the condition).
20#[derive(Debug, Clone, Default, Deserialize, Serialize)]
21pub struct ClientConditionBody {
22    #[serde(rename = "acl:client", default, skip_serializing_if = "Option::is_none")]
23    pub client: Option<IdOrIds>,
24
25    #[serde(
26        rename = "acl:clientGroup",
27        default,
28        skip_serializing_if = "Option::is_none"
29    )]
30    pub client_group: Option<IdOrIds>,
31
32    #[serde(
33        rename = "acl:clientClass",
34        default,
35        skip_serializing_if = "Option::is_none"
36    )]
37    pub client_class: Option<IdOrIds>,
38}
39
40/// Default evaluator for `acl:ClientCondition`.
41///
42/// The evaluator is stateless; it closes over the request context and
43/// (optionally) a group resolver supplied by `evaluate_access_ctx`.
44/// For the first-cut implementation, groups are resolved via the same
45/// `GroupMembership` trait used by `acl:agentGroup`.
46#[derive(Debug, Default, Clone, Copy)]
47pub struct ClientConditionEvaluator;
48
49impl ClientConditionEvaluator {
50    pub fn evaluate(
51        &self,
52        body: &ClientConditionBody,
53        ctx: &RequestContext<'_>,
54        groups: &dyn GroupMembership,
55    ) -> ConditionOutcome {
56        // Public class shortcut.
57        for cls in get_ids(&body.client_class) {
58            if cls == "foaf:Agent" || cls == "http://xmlns.com/foaf/0.1/Agent" {
59                return ConditionOutcome::Satisfied;
60            }
61        }
62
63        // Direct client-id match.
64        if let Some(cid) = ctx.client_id {
65            for c in get_ids(&body.client) {
66                if c == cid {
67                    return ConditionOutcome::Satisfied;
68                }
69            }
70            // Group membership — reuses the same resolver as agentGroup
71            // because WAC 2.0 treats group documents uniformly.
72            for g in get_ids(&body.client_group) {
73                if groups.is_member(g, cid) {
74                    return ConditionOutcome::Satisfied;
75                }
76            }
77        }
78
79        // No predicate matched. This is `Denied` (definite no-match),
80        // not `NotApplicable` — which is reserved for unknown condition
81        // types that the registry cannot dispatch at all.
82        ConditionOutcome::Denied
83    }
84}
solid_pod_rs/wac/client.rs

solid_pod_rs/wac/
client.rs
