You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<pid="req-server-link-acl">When a server wants to enable applications to discover <ahref="#authorization">Authorizations</a> associated with a given <ahref="#resource">resource</a>, the server MUST advertise the <ahref="#acl-resource">ACL resource</a> that is associated with a resource by responding to an HTTP request including a <code>Link</code> header with the <code>rel</code> value of <code>acl</code> (<cite><ahref="#acl-link-relation" rel="rdfs:seeAlso">acl Link Relation</a></cite>) and the ACL resource as link target [<cite><aclass="bibref" href="#bib-rfc8288">RFC8288</a></cite>].</p>
506
+
<pid="server-link-acl">When a server wants to enable applications to discover <ahref="#authorization">Authorizations</a> associated with a given <ahref="#resource">resource</a>, the server MUST advertise the <ahref="#acl-resource">ACL resource</a> that is associated with a resource by responding to an HTTP request including a <code>Link</code> header with the <code>rel</code> value of <code>acl</code> (<cite><ahref="#acl-link-relation" rel="rdfs:seeAlso">acl Link Relation</a></cite>) and the ACL resource as link target [<cite><aclass="bibref" href="#bib-rfc8288">RFC8288</a></cite>].</p>
507
507
508
508
<p>ACL Resource Discovery is used towards determining the <cite><ahref="#effective-acl-resource" rel="rdfs:seeAlso">Effective ACL Resource</a></cite> of a resource.</p>
509
509
@@ -514,7 +514,7 @@ <h4 property="schema:name"><span>Issue</span>: Link Relation Type</h4>
514
514
</div>
515
515
</div>
516
516
517
-
<pid="req-server-resource-acl-max">Servers MUST NOT directly associate more than one ACL resource to a resource.</p>
517
+
<pid="server-resource-acl-max">Servers MUST NOT directly associate more than one ACL resource to a resource.</p>
518
518
519
519
<pid="client-link-acl">Clients can discover the ACL resource associated with a resource by making an HTTP request on the target URL, and checking the HTTP <code>Link</code> header with the <code>rel</code> parameter.</p>
520
520
@@ -532,7 +532,7 @@ <h4 property="schema:name"><span>Note</span>: URI Origin</h4>
532
532
</div>
533
533
</div>
534
534
535
-
<pid="req-client-acl-uri">Clients MUST NOT derive the URI of the ACL resource through string operations on the URI of the resource.</p>
535
+
<pid="client-acl-uri">Clients MUST NOT derive the URI of the ACL resource through string operations on the URI of the resource.</p>
<p>An ACL resource is an <em>RDF document</em> [<cite><aclass="bibref" href="#bib-rdf11-concepts">RDF11-CONCEPTS</a></cite>] that can hold any information, typically comprises an unordered set of <ahref="#authorization">Authorizations</a>, any of which could permit an attempted access.</p>
545
545
546
-
<pid="req-server-get-acl-turtle">Servers MUST accept an HTTP <code>GET</code> and <code>HEAD</code> request targeting an ACL resource when the value of the <code>Accept</code> header requests a representation in <code>text/turtle</code> [<cite><aclass="bibref" href="#bib-turtle">TURTLE</a></cite>].</p>
546
+
<pid="server-get-acl-turtle">Servers MUST accept an HTTP <code>GET</code> and <code>HEAD</code> request targeting an ACL resource when the value of the <code>Accept</code> header requests a representation in <code>text/turtle</code> [<cite><aclass="bibref" href="#bib-turtle">TURTLE</a></cite>].</p>
547
547
548
-
<pid="req-server-acl-without-representation">Servers who want a resource to inherit Authorizations (<cite><ahref="#effective-acl-resource" rel="rdfs:seeAlso">Effective ACL Resource</a></cite>) from a container resource MUST NOT have a representation for the ACL resource that is associated with the resource.</p>
548
+
<pid="server-acl-without-representation">Servers who want a resource to inherit Authorizations (<cite><ahref="#effective-acl-resource" rel="rdfs:seeAlso">Effective ACL Resource</a></cite>) from a container resource MUST NOT have a representation for the ACL resource that is associated with the resource.</p>
549
549
550
-
<pid="req-server-get-acl-without-representation">When an authorized HTTP <code>GET</code> or <code>HEAD</code> request targets an ACL resource without an existing representation, the server MUST respond with the <code>404</code> status code as per [<cite><aclass="bibref" href="#bib-rfc7231">RFC7231</a></cite>].</p>
550
+
<pid="server-get-acl-without-representation">When an authorized HTTP <code>GET</code> or <code>HEAD</code> request targets an ACL resource without an existing representation, the server MUST respond with the <code>404</code> status code as per [<cite><aclass="bibref" href="#bib-rfc7231">RFC7231</a></cite>].</p>
551
551
552
-
<pid="req-server-root-container-acl">The <ahref="#root-container">root container</a> MUST have an ACL resource with a representation.</p>
552
+
<pid="server-root-container-acl">The <ahref="#root-container">root container</a> MUST have an ACL resource with a representation.</p>
553
553
554
-
<pid="req-server-root-container-acl-authorization-control">The ACL resource of the root container MUST include an Authorization allowing the <code>acl:Control</code> access privilege (<cite><ahref="#acl-mode-control" rel="rdfs:seeAlso"><code>acl:Control</code></a></cite> access mode).</p>
554
+
<pid="server-root-container-acl-authorization-control">The ACL resource of the root container MUST include an Authorization allowing the <code>acl:Control</code> access privilege (<cite><ahref="#acl-mode-control" rel="rdfs:seeAlso"><code>acl:Control</code></a></cite> access mode).</p>
<pid="effective-acl-resource-container-hierarchy">WAC has the property of being recursive with respect to container hierarchy, meaning that a member resource inherits Authorizations from the closest container resource (heading towards the root container).</p>
<p>To determine the <em>effective ACL resource</em> of a resource, perform the following steps. Returns <ahref="https://infra.spec.whatwg.org/#strings">string</a> (the URI of an ACL Resource).</p>
@@ -755,13 +755,13 @@ <h4 property="schema:name">Reading and Writing Resources</h4>
755
755
756
756
<p>As container resources and member resources are hierarchically organised, requests to perform operations on resources are in the context of the applicable container (<cite><ahref="#effective-acl-resource" rel="rdfs:seeAlso">Effective ACL Resource</a></cite>).</p>
757
757
758
-
<pid="req-server-read-resource">When an operation requests to read a resource, the server MUST match an Authorization allowing the <code>acl:Read</code> access privilege on the resource.</p>
758
+
<pid="server-read-resource">When an operation requests to read a resource, the server MUST match an Authorization allowing the <code>acl:Read</code> access privilege on the resource.</p>
759
759
760
-
<pid="req-server-create-operation">When an operation requests to create a resource as a member of a container resource, the server MUST match an Authorization allowing the <code>acl:Append</code> or <code>acl:Write</code> access privilege on the container for new members.</p>
760
+
<pid="server-create-operation">When an operation requests to create a resource as a member of a container resource, the server MUST match an Authorization allowing the <code>acl:Append</code> or <code>acl:Write</code> access privilege on the container for new members.</p>
761
761
762
-
<pid="req-server-update-operation">When an operation requests to update a resource, the server MUST match an Authorization allowing the <code>acl:Append</code> or <code>acl:Write</code> access privilege on the resource.</p>
762
+
<pid="server-update-operation">When an operation requests to update a resource, the server MUST match an Authorization allowing the <code>acl:Append</code> or <code>acl:Write</code> access privilege on the resource.</p>
763
763
764
-
<pid="req-server-delete-operation">When an operation requests to delete a resource, the server MUST match Authorizations allowing the <code>acl:Write</code> access privilege on the resource and the containing container.</p>
764
+
<pid="server-delete-operation">When an operation requests to delete a resource, the server MUST match Authorizations allowing the <code>acl:Write</code> access privilege on the resource and the containing container.</p>
<pid="req-server-control-operation">When an operation requests to read and write an ACL resource, the server MUST match an Authorization allowing the <code>acl:Control</code> access privilege on the resource.</p>
782
+
<pid="server-control-operation">When an operation requests to read and write an ACL resource, the server MUST match an Authorization allowing the <code>acl:Control</code> access privilege on the resource.</p>
<p>User agents include the HTTP <code>Origin</code> header field to isolate different origins and permit controlled communication between origins. The <code>Origin</code> header warns the server that a possibly untrusted Web application is being used.</p>
811
811
812
-
<pid="req-server-origin-authorization">When an HTTP request includes the <code>Origin</code> header, the requested operation is granted on the target resource when there is a match for:</p>
812
+
<pid="server-origin-authorization">When an HTTP request includes the <code>Origin</code> header, the requested operation is granted on the target resource when there is a match for:</p>
813
813
814
814
<ul>
815
815
<li>an Authorization allowing access to the requesting agent (<code>acl:agent</code>, <code>acl:agentGroup</code>, <code>acl:agentClass</code>);</li>
816
816
<li>an Authorization with an <code>acl:origin</code> property value that of <code>Origin</code>’s field-value, when the required access mode is not available to all agents (<code>acl:agentClass foaf:Agent</code>); and</li>
817
817
<li>the required access mode is allowed for the requesting agent and the origin.</li>
818
818
</ul>
819
819
820
-
<pid="req-server-cors-acao-acah">When a server participates in the <abbrtitle="Cross-Origin Resource Sharing">CORS</abbr> protocol [<cite><aclass="bibref" href="#bib-fetch">FETCH</a></cite>] and authorization is granted to an HTTP request including the <code>Origin</code> header, the server MUST include the HTTP <code>Access-Control-Allow-Origin</code> and <code>Access-Control-Allow-Headers</code> headers in the response of the HTTP request.</p>
820
+
<pid="server-cors-acao-acah">When a server participates in the <abbrtitle="Cross-Origin Resource Sharing">CORS</abbr> protocol [<cite><aclass="bibref" href="#bib-fetch">FETCH</a></cite>] and authorization is granted to an HTTP request including the <code>Origin</code> header, the server MUST include the HTTP <code>Access-Control-Allow-Origin</code> and <code>Access-Control-Allow-Headers</code> headers in the response of the HTTP request.</p>
<pid="req-server-wac-allow">Servers MUST advertise client’s access privileges on a resource by including the <code>WAC-Allow</code> HTTP header (<cite><ahref="#wac-allow" rel="rdfs:seeAlso">WAC-Allow</a></cite>) in the response of HTTP <code>GET</code> and <code>HEAD</code> requests.</p>
920
+
<pid="server-wac-allow">Servers MUST advertise client’s access privileges on a resource by including the <code>WAC-Allow</code> HTTP header (<cite><ahref="#wac-allow" rel="rdfs:seeAlso">WAC-Allow</a></cite>) in the response of HTTP <code>GET</code> and <code>HEAD</code> requests.</p>
921
921
922
922
<pid="clients-discovering-access-privileges">Clients can discover access privileges on a resource by making an HTTP <code>GET</code> or <code>HEAD</code> request on the target resource, and checking the <code>WAC-Allow</code> header value for access parameters listing the allowed access modes per permission group (<cite><ahref="#wac-allow" rel="rdfs:seeAlso">WAC-Allow</a></cite>).</p>
923
923
924
-
<pid="req-server-cors-aceh-wac-allow">When a server participates in the <abbrtitle="Cross-Origin Resource Sharing">CORS</abbr> protocol [<cite><aclass="bibref" href="#bib-fetch">FETCH</a></cite>], the server MUST include <code>WAC-Allow</code> in the <code>Access-Control-Expose-Headers</code> field-value in the HTTP response.</p>
924
+
<pid="server-cors-aceh-wac-allow">When a server participates in the <abbrtitle="Cross-Origin Resource Sharing">CORS</abbr> protocol [<cite><aclass="bibref" href="#bib-fetch">FETCH</a></cite>], the server MUST include <code>WAC-Allow</code> in the <code>Access-Control-Expose-Headers</code> field-value in the HTTP response.</p>
<pid="req-extension-acl-mode">An extension to access modes is any mode that is defined in the <cite><ahref="http://www.w3.org/ns/auth/acl" rel="cito:citesAsAuthority">ACL ontology</a></cite>, i.e., as a subclass of <code>acl:Access</code>, but not described in this specification (<cite><ahref="#access-modes" rel="rdfs:seeAlso">Access Modes</a></cite>). Consumers of Authorizations that encounter unrecognised access modes MUST NOT stop processing or signal an error and MUST continue processing the access modes as if those properties were not present.</p>
1015
+
<pid="extension-acl-mode">An extension to access modes is any mode that is defined in the <cite><ahref="http://www.w3.org/ns/auth/acl" rel="cito:citesAsAuthority">ACL ontology</a></cite>, i.e., as a subclass of <code>acl:Access</code>, but not described in this specification (<cite><ahref="#access-modes" rel="rdfs:seeAlso">Access Modes</a></cite>). Consumers of Authorizations that encounter unrecognised access modes MUST NOT stop processing or signal an error and MUST continue processing the access modes as if those properties were not present.</p>
1016
1016
1017
1017
<p>Foreign-namespaced access modes are allowed in ACL resources, but they MUST NOT cause increased access.</p>
0 commit comments