- Created by Collin Brittle, last modified by Danny Bernstein on Jun 28, 2018
You are viewing an old version of this page. View the current version.
Compare with Current View Page History
« Previous Version 100 Next »
Fedora's alignment with each category of the Fedora API Specification needs to be verified for completeness and correctness. Below is a listing of the specification categories, the person/people taking the lead on ensuring alignment, and the current status of alignment.
Legend
- Untested
- Tested, working
- Tested, not working
- Tested, not applicable
- Needs review
Environment
- Version of Fedora: https://github.com/fcrepo4/fcrepo4/commit/fe92e09c54949b930a27dbd5f24a591cbd4ed568 (as of 2018-06-12)
- Version of Fedora Specification: https://github.com/fcrepo/fcrepo-specification/commit/83b3bca9627e5ba9fda5b0c1718bea455747f559 (as of 2018-06-13)
- Test Compatibility Suite
- Legacy - Version of script: 9d20fad (repo and usage here: https://github.com/rotated8/fedora-spec-testing)
3 Resource Management
Lead
3.1 General (Jared Whiklo)
- Empty section
3.1.1 LDP Containers
MUST be able to create LDP Containers: Tested in 3.3
MUST distinguish between triple types OR MUST return 409 with constrainedBy Link in headers for ldp:contains membership predicate if server cannot distinguish between triple types
- We return a 409 because we can't distinguish and therefore the next 2 tests are not applicable.
MAY permit ldp:contains membership predicate if server can distinguish between triple types
SHOULD allow Prefer header in request to distinguish triple types if server can distinguish triple types
3.1.2 LDP-NR creation
SHOULD create an LDP-NR if creation request includes NonRDFSource type Link in headers, regardless of Content-Type headers
3.1.3 Constraints Document
SHOULD respond with <Link: http://www.w3.org/ns/ldp#constrainedBy> header on failures due to implementation choices
3.1.4 Data Model
MUST respond with <Link: http://www.w3.org/ns/ldp#constrainedBy > header on failures due to unallowed data model ... like single-subject-restriction scenario
3.2 HTTP GET
3.2.1 Additional values for the Prefer header
SHOULD support PreferInboundReferences URI in Prefer header
- Supports the old " http://fedora.info/definitions/v4/repository#InboundReferences " but not the one defined in the spec.
MAY support PreferContainedDescriptions URI in Prefer header
3.2.2 LDP-RSs
MUST return Preference-Applied header if request's Prefer header is honored (Always applied)
note: also test with a combinations of Prefer headers: some valid, some invalid
MUST return describes Link to LDP-NR if request is to associated LDP-RS
3.2.3 LDP-NRs
MUST return Digest header as directed by request's Want-Digest header
3.3 HTTP HEAD
MUST NOT return a body
SHOULD return same headers as if the request was a GET
Almost perfect: Binary resources have duplicate headers that are not seen on HEAD Unable to locate Jira server for this macro. It may be due to Application Link configuration.
MUST return a Digest header if the same request as a GET would have
MAY omit payload headers from response
3.4 HTTP OPTIONS (Yinlin Chen)
Any LDPR must support OPTIONS per [LDP] 4.2.8. 4.2. LDP servers must support the HTTP OPTIONS method.
3.5 HTTP POST
MUST be supported on LDPC
MAY not be supported on LDPCv
MUST include default interaction model in constrainedBy Link header
- Correct for both LDP-RS and LDP-NR
3.5.1 LDP-NRs
MUST support creation of LDP-NRs
MUST create and associate an LDP-RS when an LDP-NR is created
MUST return 409 if request Digest header does not match calculated value for content of new LDP-NR
SHOULD return 400 if request Digest header's type is not supported (Should 'type' be 'algorithm', like the RFC?)
3.6 HTTP PUT
MAY include type Link header in request
SHOULD return 409 if request's type Link is not resource's current type or subtype thereof, or not in LDP namespace
MUST change resource's type if request's type Link is a subtype of resource's current type
MUST change resource's interaction model if request's type Link has an LDP interaction model
3.6.1 LDP-RSs
MUST support PUT on LDP-RSs for non-server-managed triples
MUST return 4xx (409) if request modifies server-managed triples on a LDP-RS
MUST return constrainedBy Link in headers if request modifies server-managed triples on a LDP-RS
-
MUST return info in body about which statements could not be persisted if request modifies server-managed triples on a LDP-RS
Currently we allow the use of the -Dfcrepo.properties.management=relaxed option to allow updating server managed triples.
3.6.2 LDP-NRs (Danny Bernstein)
MUST support PUT on LDP-NRs to replace binary content
MUST return 409 if request Digest header does not match calculated value for new content of target LDP-NR
SHOULD return 400 if request Digest header's type is not supported
3.6.3 Creating resources with HTTP PUT
If PUT is supported for creation of LDP-NRs, MUST create and associate an LDP-RS when an LDP-NR is created
3.7 HTTP PATCH (Jared Whiklo)
MUST be supported on LDP-RSs
MUST support Content-Type: application/sparql-update
MAY support other update types
MUST return 4xx (409) when modifying protected resource statements
MUST return info in body about which statements could not be persisted when modifying protected resource statements
MUST return constrainedBy Link in headers when modifying protected resource statements
MUST return 2xx if successful
3.7.1 Containment Triples
SHOULD return 409 Conflict if PATCH attempts to update containment triples
3.7.2 Interaction models
MUST return 409 when modifying the interaction model to a type that is not a subtype of the current type
3.8 HTTP DELETE (Yinlin Chen)
MAY be supported
3.8.1 Recursive Delete
An implementation that cannot recurse should not advertise DELETE in response to OPTIONS requests for container with contained resources.
MUST use LDP containment relations for recursive deletion, if recursive deletion is supported
An implementation must not return a 200 (OK) or 204 (No Content) response unless the entire operation successfully completed.
An implementation must not emit a message that implies successful DELETE of a resource until the resource has been successfully removed.
Compliance with LDP 5.2.5.1 When a contained LDPR is deleted, the LDPC server must also remove the corresponding containment triple, which has the effect of removing the deleted LDPR from the containing LDPC.
Compliance with LDP 5.2.5.2 When a contained LDPR is deleted, and the LDPC server created an associated LDP-RS (see the LDPC POST section), the LDPC server must also delete the associated LDP-RS it created.
3.9 External Binary Content
Fedora servers should support the creation of LDP-NRs with content external to the request entity, as indicated by a link with
rel="http://fedora.info/definitions/fcrepo#ExternalContent"
and target that is the location of the external content.Fedora servers should support the update of LDP-NRs with content external to the request entity, as indicated by a link with
rel="http://fedora.info/definitions/fcrepo#ExternalContent"
and target that is the location of the external content.Fedora servers that do not support the creation of LDP-NRs with content external must reject with a 4xx range status code
Fedora servers that do not support the creation of LDP-NRs with content external must describe this restriction in a resource indicated by a
rel="http://www.w3.org/ns/ldp#constrainedBy"
link in theLink
response header.Fedora servers must use the
handling
attribute in the external content link to determine how to process the request.At least one of the following
handling
attributes must be supportedcopy
- requests that the server dereference the external content URI and treat that as if it were the entity body of the request.
- requests that the server record the location of the external content and handle requests for that content using HTTP redirect responses with theredirect
Content-Location
header specifying the external content location.
- requests that the server record the location of the external content and handle requests for that content by proxying. See also 3.9.3 Redirected and Proxied External Content .proxy
Fedora servers must reject with a 4xx range status code requests for which the
handling
attribute is not present or cannot be respected.In the case that the specified
handling
cannot be respected, the restrictions causing the request to fail must be described in a resource indicated by arel="http://www.w3.org/ns/ldp#constrainedBy"
link in theLink
response header.Fedora servers must use the value of the
type
attribute in the external content link as the media type of the external content, if provided.Fedora servers should ignore any
Content-Type
header in the request.- If there is no
type
attribute:Servers may use the media type obtained when accessing the external content via the specified scheme (e.g. the
Content-Type
header for external content accessed viahttp
).Servers may use a default media type.
Servers may reject the request with a 4xx range status code.
A Fedora server receiving requests that would create or update an LDP-NR with content external to the request entity must reject request if it cannot guarantee all of the response headers required by the LDP-NR interaction model in this specification
3.9.1 Advertising External Content Support
Fedora servers supporting external content MUST include "Accept-External-Content-Handling" header in response to "OPTIONS" request.
The value of the "Accept-External-Content-Handling" response header MUST be a comma-separated list of supported behaviors (copy|redirect|proxy).
3.9.2 External Content for RDF Resources
- Non-normative section
3.9.3 Redirected and Proxied External Content
Fedora servers supporting "redirect" or "proxy" external content types MUST correctly respond to the "Want-Digest" header
A successful response to a
GET
andHEAD
request for external content withhandling
ofredirect
must have status code of either 302 (Found) or 307 (Temporary Redirect)
4 Versioning
Leads
When an LDPR is created with a rel="type" link in the Link header specifying type http://mementoweb.org/ns#OriginalResource to indicate versioning, it must be created as an LDPRv
When an LDPR is created with a rel="type" link in the Link header specifying type http://mementoweb.org/ns#OriginalResource to indicate versioning, a version container (LDPCv) capturing time-varying representations of the LDPRv MUST be createde
4.1 Versioned Resources
- MUST provide TimeGate interaction model, detailed below
4.1.1 HTTP GET (LDPRv)
The Accept-Datetime header is used to request a past state, exactly as per [ RFC7089 ] section 2.1.1. A successful response must be a 302 (Found) redirect to the appropriate LDPRm
If no LDPRm is appropriate to the Accept-Datetime value, an implementation should return a 406 (Unacceptable).
- curl -v -X GET http://localhost:8080/rest/test -H "Accept-Datetime: Thu, 31 May 2007 20:35:00 GMT" returns 200.
- todo - ensure that 406 is return (instead of 404) when the LDPCv is empty. (dbernstein)
- The response to a GET request on an LDPRv must include the following headers:
A rel="original timegate" link in the Link header referencing itself (Jared Whiklo)
A <http://mementoweb.org/ns#TimeGate>; rel="type" link in the Link header (Jared Whiklo)
A <http://mementoweb.org/ns#OriginalResource>; rel="type" link in the Link header
At least one rel="timemap" link in the Link header referencing an associated LDPCv
A Vary: Accept-Datetime header, exactly as per [ RFC7089 ] section 2.1.2.
4.1.2 HTTP PUT (LDPRv) (Danny Bernstein)
An implementation must support PUT, as is the case for any LDPR.
4.2.1 HTTP GET (LDPRm)
An implementation must support GET, as is the case for any LDPR (LDP-RS memento)
An implementation must support GET, as is the case for any LDPR (LDP-NR memento)
The headers for GET requests and responses on this resource must conform to [ RFC7089 ] section 2.1 . Particularly it should be noted that the relevant TimeGate for an LDPRm is the original versioned LDPRv .
Any response to a GET request must include a <http://mementoweb.org/ns#Memento>; rel="type" link in the Link header.
An implementation must support OPTIONS.
A response to an OPTIONS request must include Allow: GET, HEAD, OPTIONS
An implementation may include Allow: DELETE if clients can remove a version from the version history
4.2.3 HTTP POST (LDPRm)
An implementation must not support POST for LDPRms.
4.2.4 HTTP PUT (LDPRm)
An implementation must not support PUT for LDPRms.
4.2.5 HTTP PATCH (LDPRm)
An implementation must not support PATCH for LDPRms.
4.2.6 HTTP DELETE (LDPRm)
An implementation may support DELETE for LDPRms. If DELETE is supported, the server is responsible for all behaviors implied by the LDP-containment of the LDPRm.
An implementation must indicate TimeMap in the same way it indicates the container interaction model of the resource via HTTP headers.
An implementation must not allow the creation of an LDPCv that is LDP-contained by its associated LDPRv.
4.3.1 HTTP GET (LDPCv) (Jared Whiklo)
An implementation must support GET, as is the case for any LDPR.
Any response to a GET request must include a <http://mementoweb.org/ns#TimeMap>; rel="type" link in the Link header.
An LDPCvmust respond to GET Accept: application/link-format as indicated in [ RFC7089 ] section 5 and specified in [ RFC6690 ] section 7.3.
An implementation must include the Allow header
If an LDPCv supports POST, then it must include the Accept-Post header
- Unable to locate Jira server for this macro. It may be due to Application Link configuration.
If an LDPCv supports PATCH, then it must include the Accept-Patch header - PATCH not supported
An LDPCv, being a container must have a "Link: <http://www.w3.org/ns/ldp#Container>;rel="type"" header
- Unable to locate Jira server for this macro. It may be due to Application Link configuration.
4.3.2 HTTP OPTIONS (LDPCv) (Jared Whiklo)
Implementations MUST support OPTIONS
Implementation's response to an OPTIONS request MUST include "Allow: GET, HEAD, OPTIONS"
Implementations may Allow: DELETE if the versioning behavior is removable by deleting the LDPCv
Implementations may Allow: PATCH if the LDPCv has mutable properties
Implementations may Allow: POST if versions can be explicitly minted by a client
If an LDPCv supports POST, the response MUST include the "Accept-Post" header
If an LDPCv supports PATCH, the response MUST include the "Accept-Patch" header
4.3.3 HTTP POST (LDPCv)
4.3.3.1 Implementations that allow POSTs for LDPCvs
If an LDPCv supports
POST
, aPOST
request that does not contain aMemento-Datetime
header should be understood to create a new LDPRm contained by the LDPCv, reflecting the state of the LDPRv at the time of thePOST
.If an LDPCv supports
POST
, aPOST
request that does not contain aMemento-Datetime
header MUST ignore any request bodyIf an LDPCv supports
POST
, aPOST
with aMemento-Datetime
header should be understood to create a new LDPRm contained by the LDPCv, with the state given in the request bodyIf an LDPCv supports
POST
, aPOST
with aMemento-Datetime
header should be understood to create a new LDPRm contained by the LDPCv, with the datetime given in theMemento-Datetime
request header.
4.3.3.2 Implementations that disallow POSTs for LDPCvs
If an implementation does not support one or both of
POST
cases above, it must respond to such requests with a 4xx range status code and a link to an appropriate constraints document
4.3.4 HTTP PUT (LDPCv)
Implementations MAY disallow PUT - we should disallow
todo: create JIRA to return a 405 instead of the current 400 on:
curl -i -u fedoraAdmin:fedoraAdmin -XPUT -H"Content-Type: application/sparql-update" @patch.ru localhost:8080/rest/test4/obj/fcr:versions/new
4.3.5 HTTP PATCH (LDPCv)
Implementations MAY disallow PATCH - disallowed
4.3.6 HTTP DELETE (LDPCv)
An implementation may support
DELETE
.An implementation that does support
DELETE
should do so by both removing the LDPCv and removing the versioning interaction model from the original LDPRv.
4.4 Implementation Patterns
- Non-normative section
5 Resource Authorization
Leads
5. Resource Authorization
Implementations MUST follow the recommendations of Web Access Control
acl:agentGroup appears to be implemented but it wasn't working for me (Danny Bernstein)
acl:default is not supported - currently behaves as "acl:default" exists without the acl:default defined.
-
Unable to locate Jira server for this macro. It may be due to Application Link configuration.
-
Unable to locate Jira server for this macro. It may be due to Application Link configuration.
Unable to locate Jira server for this macro. It may be due to Application Link configuration.
5.1 ACLs are LDP RDF Sources
5.2 ACL Representation and Interpretation (Danny Bernstein)
Implementations MUST inspect the ACL RDF for authorizations.
Implementations MUST use only statements associated with an authorization in the ACL RDF to determine access,
except in the case of
acl:agentGroup
statements where the group listing document is dereferenced.
The authorizations MUST be examined to see whether they grant the requested access to the controlled resource.
If none of the authorizations grant the requested access then the request MUST be denied.
5.3 ACLs are discoverable via Link Headers
A conforming server MUST advertise the individual resource ACL for every controlled resource in HTTP responses with a
rel="acl"
link in theLink
header, whether or not the ACL exists.The ACL resource SHOULD be located in the same server as the controlled resource.
5.4 ACL linking on resource creation
A client HTTP
POST
orPUT
request to create a new LDPR MAY include arel="acl"
link in theLink
header referencing an existing LDP-RS to use as the ACL for the new LDPR.The server MUST reject the request and respond with a 4xx or 5xx range status code, such as 409 (Conflict) if it isn't able to create the LDPR with the specified LDP-RS as the ACL.
In that response, the restrictions causing the request to fail MUST be described in a resource indicated by a
rel="http://www.w3.org/ns/ldp#constrainedBy"
link in theLink
response header
5.5 Cross-Domain ACLs
Implementations MAY restrict support for ACLs to local resources.
If an implementation chooses to reject requests concerning remote ACLs,
it MUST respond with a 4xx range status code
and MUST advertise the restriction with a
rel="http://www.w3.org/ns/ldp#constrainedBy"
link in theLink
response header.
5.6 Cross-Domain Group Listings
Implementations MAY restrict support for groups of agents to local Group Listing documents.
- If an implementation chooses to reject requests concerning remote Group Listings,
it MUST respond with a 4xx range status code
it MUST advertise the restriction with a
rel="http://www.w3.org/ns/ldp#constrainedBy"
link in theLink
response header.
5.7 Append Mode
In the context of a Fedora implementation,
acl:Append
should be understood as operations that only append, such asPOST
ing to a container, or performing aPATCH
that only adds triples.
5.7.1 LDP-RS (Append)
When a client is allowed to perform
acl:Append
but notacl:Write
operations on an LDP-RS:A
DELETE
request MUST be deniedA
PATCH
request that deletes triples MUST be deniedA
PATCH
request that only adds triples SHOULD be allowedA
PUT
request on an existing resource MUST be deniedA
PUT
request to create a new resource MUST be allowed if the implementation supports creating resources usingPUT
5.7.2 LDPC (Append)
When a client is allowed to perform
acl:Append
but notacl:Write
operations on an LDPC, aPOST
request MUST be allowed.
5.7.3 LDP-NR (Append)
When a client is allowed to perform
acl:Append
but notacl:Write
operations on an LDP-NR:All
DELETE
,POST
, andPUT
requests MUST be deniedA
PATCH
request that deletes or modifies existing content MUST be deniedA
PATCH
request that only adds content SHOULD be allowed
5.8 Access To Class
The
acl:accessToClass
predicate MUST be supported.When an ACL includes an
acl:accessToClass
statement, it gives access to all resources with the specified type, whether that type is client-managed or server-managed.Implementations MAY use inference to infer types not present in a resource's triples or
rel="type"
links in theLink
header.
5.9 Inheritance and Default ACLs
Inheritance of ACLs in Fedora implementations MUST be reckoned along the LDP containment relationships linking controlled resources, with the following modification:
In the case that the controlled resource is uncontained and has no ACL, or that there is no ACL at any point in the containment hierarchy of the controlled resource, then the server MUST supply a default ACL.
NB: acl:default
rather than outdated acl:defaultForNew should be used.
The default ACL resource SHOULD be located in the same server as the controlled resource.
6 Notifications
Lead
6.1 Notification Events
For every resource whose state is changed as a result of an HTTP operation, there must be a corresponding notification made available describing that change.
6.2 Notification Serialization
The notification serialization must conform to the [ activitystreams-core ] specification.
Wherever possible, data should be expressed using the [ activitystreams-vocabulary ].
- Each event described by a notification must contain:
The IRI of the resource that was created, modified or deleted
The event type(s) corresponding to the HTTP operation
- Each event described by a notification should contain:
The agent(s) that caused the change to occur
The RDF type(s) of the resource that was changed
The location of the
ldp:inbox
for the resource that was changed, if such an inbox link exists
Notifications should not contain the entire content of repository resources.
6.3 Examples
- Non-normative section
7 Binary Resource Fixity
Lead
7.1 Transmission Fixity
- non-normative section
7.2 Persistance Fixity
- non-normative section
- No labels