solid_pod_rs/wac/
resolver.rs

1//! ACL resolver — locates the effective ACL document for a given path.
2//!
3//! `find_effective_acl` walks the storage tree from the resource path
4//! up to the root, returning the first `*.acl` sibling that parses as
5//! JSON-LD or Turtle.
6
7use async_trait::async_trait;
8
9use crate::error::PodError;
10// `Storage` lives behind `tokio-runtime`; the storage-backed resolver
11// impl below is gated to match. The `AclResolver` trait is pure and
12// remains available under `core` so wasm32 consumers can implement
13// their own KV-backed resolver against the same contract.
14#[cfg(feature = "tokio-runtime")]
15use crate::storage::Storage;
16use crate::wac::document::AclDocument;
17#[cfg(feature = "tokio-runtime")]
18use crate::wac::parse_jsonld_acl;
19#[cfg(feature = "tokio-runtime")]
20use crate::wac::parser::parse_turtle_acl;
21
22/// Resolves the effective ACL document for a resource using the WAC walk-up-the-tree algorithm.
23///
24/// Starting at the resource path, the resolver looks for an `.acl` sidecar at each ancestor
25/// container up to the root. The first parseable ACL document found (JSON-LD or Turtle) is
26/// returned. If no ACL is found at any level, returns `Ok(None)` -- callers must deny access
27/// when no ACL exists (deny-by-default).
28#[async_trait]
29pub trait AclResolver: Send + Sync {
30    /// Locate the nearest ACL document that governs `resource_path`.
31    async fn find_effective_acl(
32        &self,
33        resource_path: &str,
34    ) -> Result<Option<AclDocument>, PodError>;
35}
36
37/// `AclResolver` backed by a [`Storage`] implementation.
38#[cfg(feature = "tokio-runtime")]
39pub struct StorageAclResolver<S: Storage> {
40    storage: std::sync::Arc<S>,
41}
42
43#[cfg(feature = "tokio-runtime")]
44impl<S: Storage> StorageAclResolver<S> {
45    /// Wrap a shared storage handle in a resolver.
46    pub fn new(storage: std::sync::Arc<S>) -> Self {
47        Self { storage }
48    }
49}
50
51#[cfg(feature = "tokio-runtime")]
52#[async_trait]
53impl<S: Storage> AclResolver for StorageAclResolver<S> {
54    /// Walk from `resource_path` toward `/`, returning the first valid `.acl` sidecar found.
55    async fn find_effective_acl(
56        &self,
57        resource_path: &str,
58    ) -> Result<Option<AclDocument>, PodError> {
59        let mut path = resource_path.to_string();
60        loop {
61            let acl_key = if path == "/" {
62                "/.acl".to_string()
63            } else {
64                format!("{}.acl", path.trim_end_matches('/'))
65            };
66            if let Ok((body, meta)) = self.storage.get(&acl_key).await {
67                // JSON-LD first (with bounded parser). A body that
68                // exceeds byte or depth caps returns BadRequest or
69                // PayloadTooLarge and bubbles up so the caller can
70                // reject with 400/413.
71                match parse_jsonld_acl(&body) {
72                    Ok(doc) => return Ok(Some(doc)),
73                    Err(PodError::BadRequest(_)) => {
74                        return Err(PodError::BadRequest(
75                            "ACL document exceeds bounds".into(),
76                        ));
77                    }
78                    Err(PodError::PayloadTooLarge(msg)) => {
79                        return Err(PodError::PayloadTooLarge(msg));
80                    }
81                    Err(_) => {}
82                }
83                let ct = meta.content_type.to_ascii_lowercase();
84                let looks_turtle = ct.starts_with("text/turtle")
85                    || ct.starts_with("application/turtle")
86                    || ct.starts_with("application/x-turtle");
87                let text = std::str::from_utf8(&body).unwrap_or("");
88                if looks_turtle || text.contains("@prefix") || text.contains("acl:Authorization") {
89                    if let Ok(doc) = parse_turtle_acl(text) {
90                        return Ok(Some(doc));
91                    }
92                }
93            }
94            if path == "/" || path.is_empty() {
95                break;
96            }
97            let trimmed = path.trim_end_matches('/');
98            path = match trimmed.rfind('/') {
99                Some(0) => "/".to_string(),
100                Some(pos) => trimmed[..pos].to_string(),
101                None => "/".to_string(),
102            };
103        }
104        Ok(None)
105    }
106}
solid_pod_rs/wac/resolver.rs

solid_pod_rs/wac/
resolver.rs
