Websockets does not check .acl

[jaxoncreed]

From
nodeSolidServer/node-solid-ws#1
inrupt/websockets-pubsub#5

The fix:
https://github.com/inrupt/websockets-pubsub/blob/2c5e097c670a679d2f2072683c88e1216de3a307/src/lib/hub.ts#L76

[michielbdejong]

See also https://github.com/solid/specification/issues/52#issuecomment-682491952

[melvincarvalho]

Can I just check to see we are talking about the websockets in:

https://github.com/nodeSolidServer/node-solid-ws

I have tested this now with two fresh apps, and I'm happy to report it's still working very well.

Is the issue that we should do an ACL check on the resource before sending a pub notification? That sounds like it would be a good idea.

[melvincarvalho]

Hey all! 👋

Just wanted to share a possible approach for this - turns out the fix is pretty straightforward: check WAC read permission on each sub command. If authorized, send ack as usual. If not, send err <url> forbidden. Fully backwards-compatible.

Happy to take a stab at a PR if that would be helpful!

Thanks to everyone who's contributed to this discussion over the years - it helped clarify what the fix needed to be. 🙏