javascript-solid-server 0.0.93 → 0.0.94

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "javascript-solid-server",
-  "version": "0.0.93",
+  "version": "0.0.94",
   "description": "A minimal, fast Solid server",
   "main": "src/index.js",
   "type": "module",

package/src/auth/middleware.js

@@ -9,7 +9,32 @@ import { checkAccess, getRequiredMode } from '../wac/checker.js';
 import { AccessMode } from '../wac/parser.js';
 import * as storage from '../storage/filesystem.js';
 import { getEffectiveUrlPath } from '../utils/url.js';
-import { generateDatabrowserHtml, generateSolidosUiHtml } from '../mashlib/index.js';
+import { generateDatabrowserHtml, generateModuleDatabrowserHtml, generateSolidosUiHtml } from '../mashlib/index.js';
+
+/**
+ * Build a resource URL for WAC checking, normalizing path-based pod access
+ * to subdomain form so URLs match ACL entries.
+ *
+ * In subdomain mode, ACLs reference subdomain URLs (e.g. https://alice.example.com/public/).
+ * Path-based access on the main domain (e.g. https://example.com/alice/public/) must be
+ * normalized to match.
+ *
+ * @param {object} request - Fastify request
+ * @param {string} urlPath - URL path (e.g. /alice/public/file.ttl)
+ * @returns {string} Normalized resource URL
+ */
+function buildResourceUrl(request, urlPath) {
+  if (request.subdomainsEnabled && request.baseDomain &&
+      request.hostname === request.baseDomain && !request.podName) {
+    const pathMatch = urlPath.match(/^\/([^/]+)(\/.*)?$/);
+    if (pathMatch && !pathMatch[1].startsWith('.')) {
+      const podName = pathMatch[1];
+      const remainder = pathMatch[2] || '/';
+      return `${request.protocol}://${podName}.${request.baseDomain}${remainder}`;
+    }
+  }
+  return `${request.protocol}://${request.hostname}${urlPath}`;
+}
 
 /**
  * Check if request is authorized
@@ -55,8 +80,8 @@ export async function authorize(request, reply, options = {}) {
   const resourceExists = stats !== null;
   const isContainer = stats?.isDirectory || urlPath.endsWith('/');
 
-  // Build resource URL (uses actual request hostname which may be subdomain)
-  const resourceUrl = `${request.protocol}://${request.hostname}${urlPath}`;
+  // Build resource URL, normalizing path-based pod access to subdomain form for WAC
+  const resourceUrl = buildResourceUrl(request, urlPath);
 
   // Get required access mode - use override if provided, otherwise derive from method
   const requiredMode = options.requiredMode || getRequiredMode(method);
@@ -70,9 +95,9 @@ export async function authorize(request, reply, options = {}) {
     // Check write permission on parent container
     const parentPath = getParentPath(storagePath);
     checkPath = parentPath;
-    // For URL, also need to get parent
+    // For URL, also need to get parent (normalized for subdomain WAC matching)
     const parentUrlPath = getParentPath(urlPath);
-    checkUrl = `${request.protocol}://${request.hostname}${parentUrlPath}`;
+    checkUrl = buildResourceUrl(request, parentUrlPath);
     checkIsContainer = true;
   }
 
@@ -123,10 +148,12 @@ export function handleUnauthorized(request, reply, isAuthenticated, wacAllow, au
     // If mashlib is enabled, serve mashlib instead of static error page
     // Mashlib has built-in login functionality via panes.runDataBrowser()
     if (request.mashlibEnabled) {
-      // Use SolidOS UI if enabled, otherwise fallback to classic mashlib
+      // Use SolidOS UI if enabled, ES module if configured, otherwise classic mashlib
       const html = request.solidosUiEnabled
         ? generateSolidosUiHtml()
-        : generateDatabrowserHtml(request.url, request.mashlibCdn ? request.mashlibVersion : null);
+        : request.mashlibModule
+          ? generateModuleDatabrowserHtml(request.mashlibModule)
+          : generateDatabrowserHtml(request.url, request.mashlibCdn ? request.mashlibVersion : null);
       return reply.code(statusCode).type('text/html').send(html);
     }
     return reply.code(statusCode).type('text/html').send(getErrorPage(statusCode, isAuthenticated, request));
@@ -379,7 +406,7 @@ async function authorizeAclAccess(request, urlPath, method, webId, authError) {
   // /foo/bar.acl protects /foo/bar (resource)
   const protectedPath = urlPath.replace(/\.acl$/, '');
   const isProtectedContainer = protectedPath.endsWith('/');
-  const protectedUrl = `${request.protocol}://${request.hostname}${protectedPath}`;
+  const protectedUrl = buildResourceUrl(request, protectedPath);
 
   // Get storage path for the protected resource
   const storagePath = getEffectiveUrlPath(request).replace(/\.acl$/, '');

package/src/idp/interactions.js

@@ -140,9 +140,9 @@ export async function handleLogin(request, reply, provider) {
       // Show passkey registration prompt before completing login
       // Store the pending login in the interaction
       interaction.result = {
+        passkeyPromptPending: true,
         login: { accountId: account.id, remember: true }
       };
-      interaction.passkeyPromptPending = true;
       await interaction.save(interaction.exp - Math.floor(Date.now() / 1000));
       return reply.type('text/html').send(passkeyPromptPage(uid, account.id));
     }
@@ -473,7 +473,7 @@ export async function handlePasskeyComplete(request, reply, provider) {
 
     // If this is a post-login passkey registration flow, validate accountId matches
     // the already-authenticated user to prevent account takeover
-    if (interaction.passkeyPromptPending && interaction.result?.login?.accountId) {
+    if (interaction.result?.passkeyPromptPending && interaction.result?.login?.accountId) {
       if (interaction.result.login.accountId !== accountId) {
         request.log.warn({ expected: interaction.result.login.accountId, provided: accountId }, 'AccountId mismatch in passkey complete');
         return reply.code(403).type('text/html').send(errorPage('Access denied', 'Account mismatch.'));
@@ -520,7 +520,7 @@ export async function handlePasskeySkip(request, reply, provider) {
     }
 
     // Validate the interaction is in the passkey prompt state
-    if (!interaction.passkeyPromptPending) {
+    if (!interaction.result?.passkeyPromptPending) {
       return reply.code(400).type('text/html').send(errorPage('Invalid state', 'Not in passkey prompt flow.'));
     }
 

package/test/auth.test.js

@@ -149,6 +149,69 @@ describe('Authentication', () => {
       const res = await request('/inboxread/inbox/');
       assertStatus(res, 401);
     });
+
+    it('should allow any authenticated user with acl:AuthenticatedAgent', async () => {
+      await createTestPod('authuser1');
+      await createTestPod('authuser2');
+
+      // Create a test resource with acl:AuthenticatedAgent ACL
+      const baseUrl = getBaseUrl();
+
+      // First, create a resource (this will create parent containers)
+      await request('/authuser1/authenticated-only/test.txt', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'text/plain' },
+        body: 'authenticated content',
+        auth: 'authuser1'
+      });
+
+      // Now create a custom ACL for the container with acl:AuthenticatedAgent
+      // Include owner with Control so they can manage the ACL
+      const acl = {
+        '@context': { 'acl': 'http://www.w3.org/ns/auth/acl#' },
+        '@graph': [
+          {
+            '@id': '#owner',
+            '@type': 'acl:Authorization',
+            'acl:agent': { '@id': `${baseUrl}/authuser1/profile/card#me` },
+            'acl:accessTo': { '@id': `${baseUrl}/authuser1/authenticated-only/` },
+            'acl:default': { '@id': `${baseUrl}/authuser1/authenticated-only/` },
+            'acl:mode': [
+              { '@id': 'acl:Read' },
+              { '@id': 'acl:Write' },
+              { '@id': 'acl:Control' }
+            ]
+          },
+          {
+            '@id': '#authenticated',
+            '@type': 'acl:Authorization',
+            'acl:agentClass': { '@id': 'acl:AuthenticatedAgent' },
+            'acl:accessTo': { '@id': `${baseUrl}/authuser1/authenticated-only/` },
+            'acl:default': { '@id': `${baseUrl}/authuser1/authenticated-only/` },
+            'acl:mode': [{ '@id': 'acl:Read' }]
+          }
+        ]
+      };
+
+      await request('/authuser1/authenticated-only/.acl', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(acl),
+        auth: 'authuser1'
+      });
+
+      // Test 1: Anonymous access should be denied
+      const res1 = await request('/authuser1/authenticated-only/test.txt');
+      assertStatus(res1, 401);
+
+      // Test 2: Owner should have access
+      const res2 = await request('/authuser1/authenticated-only/test.txt', { auth: 'authuser1' });
+      assertStatus(res2, 200);
+
+      // Test 3: Different authenticated user should also have access (key test!)
+      const res3 = await request('/authuser1/authenticated-only/test.txt', { auth: 'authuser2' });
+      assertStatus(res3, 200);
+    });
   });
 
   describe('WAC-Allow Header', () => {