Sylvain Duchesne
51 lines
1.8 KiB
JavaScript
51 lines
1.8 KiB
JavaScript
const urlJoin = require('url-join');
|
|
const { PodCollectionsHandlerMixin } = require('@activitypods/app');
|
|
const CONFIG = require('../config/config');
|
|
|
|
// Visibility decision: the attendees collection is readable by ANY visitor, including
|
|
// unauthenticated ones (acl:agentClass foaf:Agent). A meeting point's participant count and
|
|
// its list of participants must be visible to non-contacts — the app shows outsiders the
|
|
// anonymous participants plus the total counter, and that is a product feature, not a leak.
|
|
// Member URIs are not secret; the anonymity guarantee lives in each profile's own WAC (a
|
|
// participant whose profile is not shared simply renders as anonymous), not here. The
|
|
// reference welcometomyplace grants this to its announces group, but Festipod has no
|
|
// announces concept, so the grant is public.
|
|
module.exports = {
|
|
name: 'attendees',
|
|
mixins: [PodCollectionsHandlerMixin],
|
|
settings: {
|
|
shapeTreeUri: urlJoin(CONFIG.SHAPE_REPOSITORY_URL, 'shapetrees/as/Event'),
|
|
attachPredicate: 'http://activitypods.org/ns/core#attendees',
|
|
collectionOptions: {
|
|
ordered: false,
|
|
summary: 'Meeting point attendees'
|
|
},
|
|
createWacGroup: true
|
|
},
|
|
actions: {
|
|
async givePublicReadPermission(ctx) {
|
|
const { collectionUri, actorUri } = ctx.params;
|
|
|
|
await ctx.call('pod-permissions.add', {
|
|
uri: collectionUri,
|
|
agentPredicate: 'acl:agentClass',
|
|
agentUri: 'http://xmlns.com/foaf/0.1/Agent',
|
|
mode: 'acl:Read',
|
|
actorUri
|
|
});
|
|
}
|
|
},
|
|
hooks: {
|
|
after: {
|
|
async createAndAttach(ctx, res) {
|
|
const { actorUri } = ctx.params;
|
|
const collectionUri = res;
|
|
|
|
await this.actions.givePublicReadPermission({ collectionUri, actorUri }, { parentCtx: ctx });
|
|
|
|
return res;
|
|
}
|
|
}
|
|
}
|
|
};
|