solid-contrib / web-access-control-tests

Tests if a Solid server implements web access control correctly
MIT License
2 stars 5 forks source link

Require write on container for DELETE #42

Closed michielbdejong closed 2 years ago

michielbdejong commented 3 years ago

See https://gitter.im/solid/test-suite?at=617fd9a9fb3dcd4e885f2ab5

Kjetil Kjernsmo @kjetilk 13:12 I found that NSS isn't checking write on the container for deletes, which is in the draft spec. Just wondering what you're checking in the test-suite, is it checked there?

and

Michiel de Jong @michielbdejong 14:15 Hm, odd. That indeed seems to be what https://github.com/solid/web-access-control-tests/blob/main/test/surface/delete.test.ts is checking, and indeed it doesn't make sense. if PUT-to-create and PATCH-to-create require write access on the container to create the containment triple, then DELETE should also require write access on the container to remove it.

michielbdejong commented 2 years ago

As expected (see #41), this increases the number of WAC test failures for CSS v2.0.1 from 6 to 7: ● Create › Using PUT in existing container › is disallowed without accessTo Write or Append ● Create › Using PATCH in existing container › is disallowed without default Write ● Create › Using PATCH in existing container › is disallowed without accessTo Write or Append ● Create › Using PUT in non-existing container › is disallowed without accessTo Write or Append ● Create › Using PATCH in non-existing container › is disallowed without default Write ● Create › Using PATCH in non-existing container › is disallowed without accessTo Write or Append ● Delete › Is disallowed without Write on parent