Merge pull request #1050 from solid/fix/unauth-reflect-status

Returns more specific statusMessage when failing on acl-check

Author: kjetilk

lib/acl-checker.js

@@ -58,11 +58,13 @@ class ACLChecker {
     const trustedOrigins = this.trustedOrigins ? this.trustedOrigins.map(trustedOrigin => rdf.sym(trustedOrigin)) : null
     const accessDenied = aclCheck.accessDenied(acl.graph, resource, directory, aclFile, agent, modes, agentOrigin, trustedOrigins)
     if (accessDenied && this.agentOrigin && this.resourceUrl.origin !== this.agentOrigin) {
-      this.messagesCached[cacheKey].push(new HTTPError(403, accessDenied))
+      this.messagesCached[cacheKey].push(HTTPError(403, accessDenied))
     } else if (accessDenied && user) {
-      this.messagesCached[cacheKey].push(new HTTPError(403, accessDenied))
+      this.messagesCached[cacheKey].push(HTTPError(403, accessDenied))
+    } else if (accessDenied && !user) {
+      this.messagesCached[cacheKey].push(HTTPError(401, 'Unauthenticated'))
     } else if (accessDenied) {
-      this.messagesCached[cacheKey].push(new HTTPError(401, accessDenied))
+      this.messagesCached[cacheKey].push(HTTPError(401, accessDenied))
     }
     this.aclCached[cacheKey] = Promise.resolve(!accessDenied)
     return this.aclCached[cacheKey]

lib/handlers/error-pages.js

@@ -32,7 +32,7 @@ function handler (err, req, res, next) {
       renderLoginRequired(req, res, err)
       break
     case 403:
-      renderNoPermission(req, res)
+      renderNoPermission(req, res, err)
       break
     default:
       if (ldp.noErrorPages) {
@@ -131,10 +131,10 @@ function sendErrorPage (statusCode, res, err, ldp) {
  * @param req {IncomingRequest}
  * @param res {ServerResponse}
  */
-function renderLoginRequired (req, res, error) {
+function renderLoginRequired (req, res, err) {
   const currentUrl = util.fullUrlForReq(req)
   debug(`Display login-required for ${currentUrl}`)
-  res.statusMessage = error.statusText
+  res.statusMessage = err.message
   res.status(401)
   res.render('auth/login-required', { currentUrl })
 }
@@ -145,10 +145,11 @@ function renderLoginRequired (req, res, error) {
  * @param req {IncomingRequest}
  * @param res {ServerResponse}
  */
-function renderNoPermission (req, res) {
+function renderNoPermission (req, res, err) {
   const currentUrl = util.fullUrlForReq(req)
   const webId = req.session.userId
   debug(`Display no-permission for ${currentUrl}`)
+  res.statusMessage = err.message
   res.status(403)
   res.render('auth/no-permission', { currentUrl, webId })
 }