fix: Correctly override policies on PUT requests

Author: joachimvh

packages/uma/src/controller/PolicyRequestController.ts

@@ -1,7 +1,7 @@
+import { Store } from 'n3';
 import { UCRulesStorage } from "../ucp/storage/UCRulesStorage";
 import { BaseController } from "./BaseController";
 import {
-    deletePolicy,
     getPolicies,
     getPolicy,
     patchPolicy,
@@ -18,10 +18,17 @@ export class PolicyController extends BaseController {
         super(
             store,
             postPolicy,
-            deletePolicy,
+            null as any,
             getPolicies,
             getPolicy,
             patchPolicy,
         );
+        this.sanitizeDelete = this.deletePolicy.bind(this);
+    }
+
+    // TODO: quick ugly workaround for delete not removing constraints
+    protected async deletePolicy(store: Store, policyID: string, resourceOwner: string): Promise<void> {
+        const policy = await getPolicy(store, policyID, resourceOwner);
+        store.removeQuads([ ...policy ]);
     }
 }

packages/uma/src/util/routeSpecific/delete.ts

@@ -1,5 +1,4 @@
 export * from './post';
-export * from './delete';
 export * from './get';
 export * from './patch';
 

packages/uma/src/util/routeSpecific/index.ts

@@ -1,3 +1,4 @@
+import 'jest-rdf';
 import { App } from '@solid/community-server';
 import { ODRL } from '@solidlab/uma';
 import { setGlobalLoggerFactory, WinstonLoggerFactory } from 'global-logger-factory';
@@ -151,6 +152,57 @@ describe('A policy server setup', (): void => {
     expect(response.status).toBe(204);
   });
 
+  it('can replace policies using PUT.', async(): Promise<void> => {
+    const policyA = `
+        @prefix ex: <http://example.org/>.
+        @prefix odrl: <http://www.w3.org/ns/odrl/2/> .
+
+        ex:purposePolicy a odrl:Agreement ;
+          odrl:uid ex:purposePolicy ;
+          odrl:permission ex:purposePermission .
+        ex:purposePermission a odrl:Permission ;
+          odrl:action odrl:read ;
+          odrl:target ex:target ;
+          odrl:assignee ex:assignee ;
+          odrl:assigner <${webIds.a}> ;
+          odrl:constraint ex:constraint1 .
+        ex:constraint1 a odrl:Constraint ;
+          odrl:leftOperand odrl:purpose ;
+          odrl:operator odrl:eq ;
+          odrl:rightOperand ex:purpose1 .
+      `;
+    // There was an issue where constraints were not fully removed when replacing policies with PUT
+    let response = await fetchPolicy('PUT', webIds.a, 'http://example.org/purposePolicy', policyA);
+    expect(response.status).toBe(204);
+
+    const policyB = `
+        @prefix ex: <http://example.org/>.
+        @prefix odrl: <http://www.w3.org/ns/odrl/2/> .
+
+        ex:purposePolicy a odrl:Agreement ;
+          odrl:uid ex:purposePolicy ;
+          odrl:permission ex:purposePermission .
+        ex:purposePermission a odrl:Permission ;
+          odrl:action odrl:read ;
+          odrl:target ex:target ;
+          odrl:assignee ex:assignee ;
+          odrl:assigner <${webIds.a}> ;
+          odrl:constraint ex:constraint1 .
+        ex:constraint1 a odrl:Constraint ;
+          odrl:leftOperand odrl:purpose ;
+          odrl:operator odrl:eq ;
+          odrl:rightOperand ex:purpose3 .
+      `;
+    response = await fetchPolicy('PUT', webIds.a, 'http://example.org/purposePolicy', policyB);
+    expect(response.status).toBe(204);
+
+    response = await fetchPolicy('GET', webIds.a, 'http://example.org/purposePolicy');
+    expect(response.status).toBe(200);
+    const getResponse = await response.text();
+    const parser = new Parser();
+    expect(parser.parse(policyB)).toBeRdfIsomorphic(parser.parse(getResponse));
+  });
+
   it('can show a user their policies.', async(): Promise<void> => {
     let response = await fetch(policyEndpoint);
     expect(response.status).toBe(401);
@@ -160,6 +212,7 @@ describe('A policy server setup', (): void => {
     let store = new Store(new Parser().parse(await response.text()));
     let policies = store.getSubjects(ODRL.terms.uid, null, null);
     expect(policies.map((term) => term.value).sort()).toEqual([
+      'http://example.org/purposePolicy',
       'http://example.org/usagePolicy1',
       'http://example.org/usagePolicy1a',
       'urn:uuid:95efe0e8-4fb7-496d-8f3c-4d78c97829bc',