janschill / solid-comment Goto Github PK

Currently when the agent logs in and posts a comment, without having given the application control access mode it does not overwrite the ACLs and therefore cannot set them to the correct access permissions and thus they cannot be pulled from the pod.

Should this module (or rather Indico) check and synchronize the references that Indico holds to the comments? When a comment is saved to the pod, but there is a problem with the creation of the reference to it in Indico.

To-do

• Write integration tests
  • Deletion of comments
  • From pod
  • From interface
  • From Indico?
• Write unit tests
• Perfomance
  • Caching?
• Security
  • Confidentiality
  • Integrity
  • Availability
  • Think of how to make URL to comment for private event truly random and not guessable.

Questions

• How do I mock a pod locally/in test?
• How do I test performance? I can reason about it: a request per comment etc.

Do I need to make sure that the comment says that it was updated?

The comment should hold a reference on where they are being used in.

• schema:about
• schema:disscusses

Write tests for covering these scenarios

This would mean the comments are not depended on each other and they can be all added asynchronously. This would make the performance of the module better as the different pod hosts will have different latencies.

https://github.com/janschill/solid-comment/runs/2200667051#step:6:35

Currently, all resources get a dedicated ACL file, this can be changed to the following to enable the same functionality.

World read on container resources:

@prefix acl: <http://www.w3.org/ns/auth/acl#>.
@prefix foaf: <http://xmlns.com/foaf/0.1/>.
@prefix target: <./>.

:ReadDefault
    a acl:Authorization;
    acl:default target:;
    acl:agentClass foaf:Agent;
    acl:mode acl:Read.

:ReadWriteControl
    a acl:Authorization;
    acl:accessTo target:;
    acl:default target:;
    acl:agent </profile/card#me>;
    acl:mode acl:Read, acl:Write, acl:Control.

When a new comment is created by submission the generated time differs to the received time when fetching the comment from the pod later on

20210325T100058487Z.ttl

becomes

20210325T100058000Z.ttl

• Add missing protocol in the input form
• Have some IDPs as clickable anchors

In Indico’s case they would also need a pod then, but here maybe multiple storage mechanisms could be supported.

• Database
• Solid pod

When the protection of an event is changed, it will save comments in a different container.

For the integration with Indico one thing is still needed, which is the persistence layer within Indico to store the references to the pods.
As a temporary solution the EventSettingsProxy can be used.
The event_core_settings is probably a good candidate to be enriched.

It is not possible to delete the reference in Indico.
We do not do any authentication/authorization against Indico, therefore, it is not possible to delete the reference that is kept with Indico. If the DELETE does not require authentication, everyone can obviously just delete comments.

Solution: keep the reference in Indico and render (as already implemented) the “Comment is unavailable” message. We could even hide all deleted comments from the currently logged in author …

Extract time from comment file name and add to the comment object.
Careful, because then the comment object is not empty anymore and the rendering of the empty comment HTML needs to be caught differently.