Add public attr for rawr resources

Author: bitfl0wer

api/src/core/main.tsp

@@ -159,6 +159,9 @@ namespace models {
         @doc("Whether the resource should be private by default. Private resources can only be accessed by the uploader and by instances and actors declared in the `allowlist`.")
         private: boolean = false;
 
+        @doc("Whether the resource should be publicly retrievable, i.e. without requiring authentication. If this is `true`, the allow- and denylists are ignored.")
+        public: boolean = false;
+
         @doc("A list of actors and/or instances allowed to access this resource.")
         @example(#["[email protected]", "instance.example.com"])
         allowlist?: string[];

api/src/core/routes/rawr.tsp

@@ -30,6 +30,7 @@ namespace ResourceAddressingWithRelativeRoots {
          */
         @route("/{rid}")
         @get
+        @useAuth(BearerAuth | NoAuth)
         @added(Version.`v1.0-beta.1`)
         @summary("Get resource by resource ID")
         op getResource(@path rid: string):
@@ -39,10 +40,62 @@ namespace ResourceAddressingWithRelativeRoots {
               }
             | {
                   @statusCode _: 308;
+
                   @header({
                       name: "Location",
                   })
                   location: url;
+
+                  @body reason: "ROOT_CHANGED";
+              }
+            | {
+                  @statusCode _: 403;
+                  @body reason: "ACCESS_FORBIDDEN";
+              }
+            | {
+                  @statusCode _: 401;
+                  @body reason: "NEEDS_AUTHENTICATION";
+              }
+            | {
+                  @statusCode _: 404;
+                  @body reason: "NOT_FOUND";
+              };
+
+        /**
+         * Query the server for information about a RawR resource.
+         * This route accepts a Bearer token, but public resources may also be queried without
+         * specifying a token.
+         * @param rid The resource ID of the resource which you'd like to query information of.
+         *
+         * @returns
+         * - `200`: Found, contains resource information
+         * - `308`: URI root has changed.
+         * - `401`: Server or resource requires authentication to access this endpoint.
+         * - `403`: Server or resource not accessible for the actor making this request.
+         * - `404`: Resource not found.
+         */
+        @route("/{rid}/info/")
+        @get
+        @useAuth(BearerAuth | NoAuth)
+        @added(Version.`v1.0-beta.1`)
+        @summary("Retrieve information about a RawR resource")
+        op getResourceInfos(@path rid: string):
+            | {
+                  @statusCode statusCode: 200;
+                  @body body: {
+                      resourceId: string;
+                      size: uint64;
+                      access: polyproto.core.models.ResourceAccessProperties;
+                  }[];
+              }
+            | {
+                  @statusCode _: 308;
+
+                  @header({
+                      name: "Location",
+                  })
+                  location: url;
+
                   @body reason: "ROOT_CHANGED";
               }
             | {
@@ -83,12 +136,15 @@ namespace ResourceAddressingWithRelativeRoots {
         @summary("Upload RawR resource")
         op postResource(
             @path rid: string,
+
             @header({
                 name: "Content-Length",
             })
             contentLength: uint64,
+
             @query
             resourceAccessProperties: polyproto.core.models.ResourceAccessProperties,
+
             @body file: File,
         ):
             | {
@@ -119,6 +175,7 @@ namespace ResourceAddressingWithRelativeRoots {
               }
             | {
                   @statusCode _: 204;
+
                   @header({
                       name: "Content-Length",
                   })
@@ -145,33 +202,16 @@ namespace ResourceAddressingWithRelativeRoots {
         @summary("Update RawR resource access properties")
         op modifyResource(
             @path rid: string,
+
             @body
             resourceAccessProperties: polyproto.core.models.ResourceAccessProperties,
         ): {
             @header({
                 name: "Content-Length",
             })
             contentLength: 0;
-            @statusCode _: 204;
-        };
 
-        /**
-         * @param rid The resource ID of the resource which you'd like to query information of.
-         */
-        @route("/{rid}/info/")
-        @get
-        @added(Version.`v1.0-beta.1`)
-        @summary("Retrieve information about one of your RawR resources")
-        op getResourceInfos(@path rid: string): {
-            @statusCode statusCode: 200;
-            @body body: {
-                resourceId: string;
-                size: uint64;
-                access: polyproto.core.models.ResourceAccessProperties;
-            }[];
-        } | {
-            @statusCode statusCode: 404;
-            @body reason: "NOT_FOUND";
+            @statusCode _: 204;
         };
 
         /**
@@ -195,6 +235,7 @@ namespace ResourceAddressingWithRelativeRoots {
             }[];
         } | {
             @statusCode _: 204;
+
             @header({
                 name: "Content-Length",
             })

docs/Protocol Specifications/core.md

@@ -2147,11 +2147,14 @@ The URI for resource addressing with relative roots is formatted as follows:
 
 `<server_url>/.p2/core/resource/<resource_id>`
 
-Uploaded resources can be made private, and access to them can be controlled via allow- and deny lists,
-specifying access properties for each individual resource. Individual actors and entire instances can
-be part of these allow- and deny lists. Marking a resource as private restricts access to only the
-uploader and the actors and instances that are part of the allow list. APIs and JSON schemas
-associated with access control are part of the [API documentation](https://apidocs.polyproto.org).
+Uploaded resources can be made private or private, and access to them can be controlled via
+allow- and deny lists, specifying access properties for each individual resource. Individual
+actors and entire instances can be part of these allow- and deny lists. Marking a resource as
+private restricts access to only the uploader and the actors and instances that are part of the
+allow list. Marking a resource as public will mean that the allow- and deny lists are ignored, and that
+the resource is accessible to anyone who has the link. Marking a resource as both public and private
+is an illegal state. APIs and JSON schemas associated with access control are part of the
+[API documentation](https://apidocs.polyproto.org).
 
 The API routes for resource addressing with relative roots are documented more thoroughly in the
 [API documentation](https://apidocs.polyproto.org).