feat(storage): guard the profile card of registered WebIDs

config/dev-http-subdomain.json

@@ -29,6 +29,7 @@
     "css:config/storage/key-value/resource-store.json",
     "css:config/storage/location/pod.json",
     "pivot:config/storage/middleware/default.json",
+    "pivot:config/storage/profile-card-guard.json",
     "css:config/util/auxiliary/acl.json",
     "css:config/util/identifiers/subdomain.json",
 

config/dev-http-suffix.json

@@ -29,6 +29,7 @@
     "css:config/storage/key-value/resource-store.json",
     "css:config/storage/location/pod.json",
     "pivot:config/storage/middleware/default.json",
+    "pivot:config/storage/profile-card-guard.json",
     "css:config/util/auxiliary/acl.json",
     "css:config/util/identifiers/suffix.json",
 

config/prod.json

@@ -29,6 +29,7 @@
     "css:config/storage/key-value/resource-store.json",
     "css:config/storage/location/pod.json",
     "pivot:config/storage/middleware/default.json",
+    "pivot:config/storage/profile-card-guard.json",
     "css:config/util/auxiliary/acl.json",
     "css:config/util/identifiers/subdomain.json",
     "css:config/util/logging/winston.json",

config/storage/profile-card-guard.json

@@ -0,0 +1,48 @@
+{
+  "@context": [
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/community-server/^7.0.0/components/context.jsonld",
+    "https://linkedsoftwaredependencies.org/bundles/npm/@solid/pivot/^1.0.0/components/context.jsonld"
+  ],
+  "comment": "Guards the profile card of WebIDs registered on this server, keeping the `solid:oidcIssuer` triple.",
+  "@graph": [
+    {
+      "comment": "Guards registered WebID cards from being deleted or losing their `solid:oidcIssuer` triple.",
+      "@id": "urn:solid-server:default:ResourceStore_CardGuard",
+      "@type": "ProfileCardGuard",
+      "source": { "@id": "urn:solid-server:default:ResourceStore_Converting" },
+      "webIdStore": { "@id": "urn:solid-server:default:WebIdStore" },
+      "baseUrl": { "@id": "urn:solid-server:default:variable:baseUrl" },
+      "converter": { "@id": "urn:solid-server:default:RepresentationConverter" },
+      "relativeWebIdPaths": [
+        "/profile/card#me"
+      ]
+    },
+    {
+      "comment": "WebID store that also exposes whether a WebID is registered (hasWebId), as required by the card guard.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:WebIdStore" },
+      "overrideParameters": {
+        "@type": "GuardedWebIdStore",
+        "storage": { "@id": "urn:solid-server:default:AccountStorage" }
+      }
+    },
+    {
+      "comment": "Insert the card guard between pivot's RDF patching store and the converting store, so PUT/POST as well as PATCH results are all validated.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:ResourceStore_RdfPatching" },
+      "overrideParameters": {
+        "@type": "RdfPatchingStore",
+        "source": { "@id": "urn:solid-server:default:ResourceStore_CardGuard" }
+      }
+    },
+    {
+      "comment": "Route the internal key-value storage (accounts, WebID links, ...) through the converting store directly, bypassing the guard.",
+      "@type": "Override",
+      "overrideInstance": { "@id": "urn:solid-server:default:JsonResourceStorage" },
+      "overrideParameters": {
+        "@type": "JsonResourceStorage",
+        "source": { "@id": "urn:solid-server:default:ResourceStore_Converting" }
+      }
+    }
+  ]
+}

config/suffix.json

@@ -29,6 +29,7 @@
     "css:config/storage/key-value/resource-store.json",
     "css:config/storage/location/pod.json",
     "pivot:config/storage/middleware/default.json",
+    "pivot:config/storage/profile-card-guard.json",
     "css:config/util/auxiliary/acl.json",
     "css:config/util/identifiers/suffix.json",
     "css:config/util/logging/winston.json",

package.json

@@ -37,7 +37,9 @@
   ],
   "dependencies": {
     "@inrupt/solid-client-authn-core": "^3.1.1",
+    "@rdfjs/types": "^1.1.2",
     "@solid/community-server": "^7.2.0",
+    "arrayify-stream": "^2.0.1",
     "mashlib": "^2.3.3",
     "patch-package": "^8.0.1",
     "rdflib": "^2.4.0"
@@ -47,8 +49,10 @@
     "@types/jest": "^30.0.0",
     "@types/node-fetch": "^2.6.13",
     "componentsjs-generator": "^3.1.2",
+    "cross-fetch": "^4.1.0",
     "jest": "^30.3.0",
     "jest-rdf": "^2.0.0",
+    "n3": "^1.26.0",
     "node-fetch": "^3.3.2",
     "ts-jest": "^29.4.6",
     "typescript": "^5.9.3"

src/identity/interaction/webid/util/GuardedWebIdStore.ts

@@ -0,0 +1,36 @@
+import {
+  AccountLoginStorage,
+  BaseWebIdStore,
+  WEBID_STORAGE_DESCRIPTION,
+  WEBID_STORAGE_TYPE,
+} from '@solid/community-server';
+
+type WebIdStorage = AccountLoginStorage<{ [WEBID_STORAGE_TYPE]: typeof WEBID_STORAGE_DESCRIPTION }>;
+
+/**
+ * A {@link BaseWebIdStore} that also determines whether a WebID is registered
+ * to any account on this server (`hasWebId`).
+ *
+ * The card guard needs to know whether a WebID is registered, which the
+ * upstream WebIdStore does not expose (yet). This subclass keeps the full
+ * upstream behavior and only adds the exact indexed lookup on the webId index.
+ */
+export class GuardedWebIdStore extends BaseWebIdStore {
+  private readonly webIdStorage: WebIdStorage;
+
+  // Loosely typed so the Components.js generator does not need to resolve the
+  // external generic; Components.js does not type-check constructor arguments.
+  public constructor(storage: any) {
+    super(storage);
+    this.webIdStorage = storage as unknown as WebIdStorage;
+  }
+
+  /**
+   * Determines if the given WebID is registered to an account on this server.
+   *
+   * @param webId - WebID to check.
+   */
+  public async hasWebId(webId: string): Promise<boolean> {
+    return (await this.webIdStorage.find(WEBID_STORAGE_TYPE, { webId })).length > 0;
+  }
+}

src/index.ts

@@ -1,6 +1,8 @@
 export * from "./storage/RdfPatchingStore";
+export * from './storage/ProfileCardGuard';
 export * from "./storage/patch/ThrowingN3Patcher";
 export * from './FedcmHttpHandler';
 export * from './http/output/PivotResponseWriter';
 export * from './identity/interaction/password/MigratedPasswordLoginHandler';
+export * from './identity/interaction/webid/util/GuardedWebIdStore';
 export * from './identity/PivotOidcHttpHandler';