Testing existence of "default ACL"

[awoods]

https://fedora.info/2018/06/25/spec/#inheritance states:

In the case that the controlled resource is uncontained and has no ACL, or that there is no ACL at any point in the containment hierarchy of the controlled resource, then the server must supply a default ACL.

There are open questions in the context of the API Test Suite about how to determine if such a "default ACL" exists. The specification says that the ACL for any resource must be returned in a Link header. For an ACL on the root resource... there are interaction questions along the lines of:

1. What does the Link: acl header return when there is only the "default ACL"?
2. Is it required that the "default ACL" be web-accessible to users?
3. What should the user to do install a client-provided ACL at the root?
   • In this case, is it expected that the Link: acl header would change?

It may be that these questions all go away if the answer to the second question above is "yes".

[acoburn]

FWIW, when Trellis is first started, it automatically initializes two resources: a root container (an LDP-BC) and an ACL for that resource. That ACL is a web resource like every other ACL resource in Trellis, and it can be modified via PATCH or PUT. This satisfies the SOLID WebAC spec that states:

The root container of a user's account MUST have an ACL resource specified.

In that sense, this default ACL in Trellis is web-accessible to users (i.e. whoever has acl:Control access).

[zimeon]

I think that whether or not the default ACL is web-accessible to users, there is currently no way to find out where/what it is. That is because we use the Link: <...>; rel="acl" to say where an individual resource ACL may be created. So the answer to 1) is:

1. a) if an individual ACL can be created then this is the location to create it, else b) could be the default or some other existing ACL

FWIW, in playing with trilpy I assumed that the default ACL would be web accessible, and that default and root ACL would be set by configuration. So:

2. I had assumed it would be web accessible but if there is no way to find it that may be moot. It seems suggested but not required by the spec at present

3. There is no specified means to change the individual ACL location (although doing so by other means is not forbidden) so I would not expect the ACL header location to change

[escowles]

Decision in 10/31/18 editor's call: by definition, there must be some default behavior. But there's no requirement that it's web-accessible for the server to link to. So we are closing this issue.