Initial Editor’s Draft of the WAC specification

[csarven]

After processing an ocean of documentation, issues, meetings,.. with the goal of coming up with an accurate representation of the WAC specification, this PR includes the initial Editor’s Draft (ED).

Merging this PR will replace the documentation in the README (but move its content to README-v.0.5.0), follow-up on close/respond to all applicable issues, and use the ED as the reference point.

Feedback on errors, inaccuracies, clarifications are welcome. Any request to change features or add extensions to WAC should be followed up in new or existing issues.

After the merge, the Solid Protocol will be updated to remove/update all information related to WAC. A ~Working Draft (WD) PR to the solid/specification repository will follow.

Issues/Discussions referenced:

• WebAC link relation header specification#54
• Clarify use of acl:default in the WebAC inheritance algorithm specification#55
• Clarify what happens with semantically invalid WebAC resources specification#56
• Does the acl:Authorization need to be materialized in an ACL resource specification#57
• Loss of Control Mitigation specification#67
• Explain the ACL inheritance algorithm for clients specification#106
• What happens if there is no ACL? specification#130
• Recursive deletion of members on deletion of container specification#132
• Should it be possible to find controller of storage via resources? specification#153
• Shape of ACL specification#169
• Is WAC-Allow part of the solid spec? specification#170
• No way to find out if user is authorized to write to a container specification#171
• Document the WAC-Allow header in the spec. specification#181
• Can a non-default ACL apply to a child resource ? specification#186
• Decision: Access Rule with acl:default does not imply acl:accessTo specification#193
• Which permissions are required for deleting a resource? specification#197
• Should PUT-to-create c/r in existing container be allowed with only accessTo Write c/? specification#246
• acl:Authorization for multiple agents/targets specification#251
• ACL Inheritance Algorithm problem specification#257
• Add notion of "owner" and requirements specification#264
• Clarify: 'acl' rel link is a naming hint, not always points to existing file #8
• ACL Expiry #10
• acl:accessTo and rel="acl" #17
• object of statements with acl:default predicate #18
• IANA registration of Link: rel="acl" #21
• acl:accessToClass exclusion and pattern substitutes #22
• Control access on the container #33
• Circumventing Origin restriction with proxies #34
• Can ACL docs be in JSON-LD? #45
• [discuss] should we switch to requiring container-write instead of resource-write permissions for delete? #47
• request for clarification: access to resources in container you don't have access to #59
• Clarify where new acl files should be created #62
• Precise definition of acl:default #63
• Clarify if multiple accessTo can be used #68
• Is acl:Authorization mandatory? #78
• Add time constraints to WAC rules #87
• Express what expectations users should have of acl:AuthenticatedAgent #88
• Security implications of ACL resources on different servers #90
• Atomicity of creating a resource and its ACL #91
• Timestamps and ACL caching #37
• https://gitter.im/solid/specification?at=60101295d8bdab47395e6775
• Clarify what are recommendations of Solid Web ACL fcrepo/fcrepo-specification#145

Edit: Includes response to solid/specification#147 and https://github.com/solid/specification/blob/main/CONTRIBUTING.md#publication-rules

[VirginiaBalseiro]

Looks good to me!

[matthieubosquet]

So much work went into that, it's a really nice read, thank you @csarven!

I hope a few of my comments make sense and we can discuss before merging, but regardless of their resolution, I would echo the others that this is a very big step in the right direction and I'm happy to see this on main very soon! :)

[TallTed]

This PR is already SO HUGE, it seems long past time to close the door to further review on this PR, merge it, and perform any further review against the main branch (though it may be inspired by review of this PR).

[TallTed]

Of course, I've followed on my suggestion to stop accepting suggestions with another suggestion....

[matthieubosquet]

I think the only point worth addressing remaining in my review is the one about resources without conforming authorization: #83 (comment)

The rest of my points relate to consistent Access Control Resource discovery and I'll try to phrase a relevant issue in this repo shortly.

[csarven]

Thanks everyone for the reviews, feedback, emojis, etc. Merging the PR with no objections. Will follow up on issues/discussions.

Let's take a moment to congrats each other (in our minds) for getting the WAC spec to this point.

So there we have it. It is all sort of simple.