diff --git a/index.html b/index.html index 5acf759..08d0949 100644 --- a/index.html +++ b/index.html @@ -613,6 +613,12 @@

ACL Resource Representation

When an authorized HTTP GET or HEAD request targets an ACL resource without an existing representation, the server MUST respond with the 404 status code as per [RFC9110].

When an authorized HTTP GET or HEAD request targets root container’s ACL resource, the server MUST respond with a representation.

The ACL resource of the root container MUST include an Authorization allowing the acl:Control access privilege (acl:Control access mode).

+
+

Note: IRIs and Blank Nodes

+
+

Implementations are encouraged to use named resources (IRIs) rather than blank nodes when describing Authorizations and their properties, as blank nodes may not be referenceable by operations that require explicit node identification.

+
+

Source: issues/45

@@ -946,9 +952,13 @@

Authorization Matching

acl:accessTo $resource ; acl:agent $agent ; acl:mode $mode ; - acl:condition - [ a acl:ClientCondition ; acl:client $client ] , - [ a acl:IssuerCondition ; acl:issuer $issuer ] . + acl:condition ?clientCondition, ?issuerCondition . + ?clientCondition + a acl:ClientCondition ; + acl:client $client . + ?issuerCondition + a acl:IssuerCondition ; + acl:issuer $issuer . } }

ASK query matching an Authorization given inputs resource, agent, mode, client and issuer.

@@ -1232,6 +1242,11 @@

Changelog

#consider-condition-control Add security consideration advisement for preserving Authorization integrity with conditions. + + 2 + #iri-blank-node + Add note encouraging use of IRIs over blank nodes for describing Authorizations. +