Close the adversarial review round: auth hardening, data fidelity against the platform context, backend grants and docker coherence

backend/services/attendees.service.js

@@ -2,6 +2,14 @@ const urlJoin = require('url-join');
 const { PodCollectionsHandlerMixin } = require('@activitypods/app');
 const CONFIG = require('../config/config');
 
+// Visibility decision: the attendees collection is readable by ANY visitor, including
+// unauthenticated ones (acl:agentClass foaf:Agent). A meeting point's participant count and
+// its list of participants must be visible to non-contacts — the app shows outsiders the
+// anonymous participants plus the total counter, and that is a product feature, not a leak.
+// Member URIs are not secret; the anonymity guarantee lives in each profile's own WAC (a
+// participant whose profile is not shared simply renders as anonymous), not here. The
+// reference welcometomyplace grants this to its announces group, but Festipod has no
+// announces concept, so the grant is public.
 module.exports = {
   name: 'attendees',
   mixins: [PodCollectionsHandlerMixin],
@@ -13,5 +21,30 @@ module.exports = {
       summary: 'Meeting point attendees'
     },
     createWacGroup: true
+  },
+  actions: {
+    async givePublicReadPermission(ctx) {
+      const { collectionUri, actorUri } = ctx.params;
+
+      await ctx.call('pod-permissions.add', {
+        uri: collectionUri,
+        agentPredicate: 'acl:agentClass',
+        agentUri: 'http://xmlns.com/foaf/0.1/Agent',
+        mode: 'acl:Read',
+        actorUri
+      });
+    }
+  },
+  hooks: {
+    after: {
+      async createAndAttach(ctx, res) {
+        const { actorUri } = ctx.params;
+        const collectionUri = res;
+
+        await this.actions.givePublicReadPermission({ collectionUri, actorUri }, { parentCtx: ctx });
+
+        return res;
+      }
+    }
   }
 };