Merge pull request #1177 from solid/fix/#1176

Users with invalid tokens can now access public resources

Author: jaxoncreed

lib/api/authn/webid-oidc.js

@@ -31,7 +31,17 @@ function initialize (app, argv) {
   app.use('/', middleware(oidc))
 
   // Perform the actual authentication
-  app.use('/', oidc.rs.authenticate())
+  app.use('/', async (req, res, next) => {
+    oidc.rs.authenticate()(req, res, (err) => {
+      // Error handling should be deferred to the ldp in case a user with a bad token is trying
+      // to access a public resource
+      if (err) {
+        req.authError = err
+        res.status(200)
+      }
+      next()
+    })
+  })
 
   // Expose session.userId
   app.use('/', (req, res, next) => {

lib/handlers/allow.js

@@ -66,7 +66,7 @@ function allow (mode, checkPermissionsForDirectory) {
         }
       }
     }
-    const error = await req.acl.getError(userId, mode)
+    const error = req.authError || await req.acl.getError(userId, mode)
     debug(`${mode} access denied to ${userId || '(none)'}: ${error.status} - ${error.message}`)
     next(error)
   }

test/integration/errors-oidc-test.js

@@ -94,6 +94,12 @@ describe('OIDC error handling', function () {
           .expect('WWW-Authenticate', 'Bearer realm="https://localhost:3457", scope="openid webid", error="invalid_token", error_description="Access token is expired"')
           .expect(401)
       })
+
+      it('should return a 200 if the resource is public', () => {
+        return server.get('/public/')
+          .set('Authorization', 'Bearer ' + expiredToken)
+          .expect(200)
+      })
     })
   })
 })

test/resources/accounts/errortests/public/.acl

@@ -0,0 +1,19 @@
+# ACL resource for the public folder
+@prefix acl: <http://www.w3.org/ns/auth/acl#>.
+@prefix foaf: <http://xmlns.com/foaf/0.1/>.
+
+# The owner has all permissions
+<#owner>
+    a acl:Authorization;
+    acl:agent <https://localhost:3457/profile/card#me>;
+    acl:accessTo <./>;
+    acl:default <./>;
+    acl:mode acl:Read, acl:Write, acl:Control.
+
+# The public has read permissions
+<#public>
+    a acl:Authorization;
+    acl:agentClass foaf:Agent;
+    acl:accessTo <./>;
+    acl:default <./>;
+    acl:mode acl:Read.