You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Changing a container's ldp:constrainedBy binding is an ordinary write to the container's own graph, so it takes acl:Write on the container. Decide whether that is the right bar or whether it should take acl:Control.
Why
The binding is not content, it is policy about content: it decides what every future write into that container must satisfy. An agent granted Write on a container to put documents in it can also remove the constraint those documents were supposed to meet, and nothing in the response says a constraint was dropped.
acl:Control is the mode that already means "may change the rules rather than the data".
Whether shape validation counts as rules is the actual question: it is arguable that a shape
is part of what a container is, and that Write is correct.
How
Settle it as a decision, not an implementation detail; docs/decisions.md if the answer is anything other than "Write, obviously".
What
Changing a container's
ldp:constrainedBybinding is an ordinary write to the container's own graph, so it takesacl:Writeon the container. Decide whether that is the right bar or whether it should takeacl:Control.Why
The binding is not content, it is policy about content: it decides what every future write into that container must satisfy. An agent granted
Writeon a container to put documents in it can also remove the constraint those documents were supposed to meet, and nothing in the response says a constraint was dropped.acl:Controlis the mode that already means "may change the rules rather than the data".Whether shape validation counts as rules is the actual question: it is arguable that a shape
is part of what a container is, and that
Writeis correct.How
docs/decisions.mdif the answer is anything other than "Write, obviously".Control, the check belongs beside the shape lookup on the write path (Fold the shape binding lookup into a store call the write path already makes #7), not as a second pass.docs/uri-space.mdnext to the auxiliary table, which already states the authorizing mode for every other kind.