Skip to content

Consent: keep the account's agents apart (#25) - #32

Merged
nicolasdb merged 1 commit into
mainfrom
consent-agents-apart
Nov 3, 2026
Merged

nicolasdb merged 1 commit into
mainfrom
consent-agents-apart

Conversation

@nicolasdb

Copy link
Copy Markdown
Owner

Closes #25.

What changes (overlay/templates/identity/oidc/consent.html.ejs, overlay/main.css)

  • Before listing, the page reads the public profiles of the account's WebIDs (as N-Triples, which CSS converts; no RDF library in the page).
  • A WebID that another listed WebID acl:delegates goes under a closed Your agents (n) disclosure, below the person's own. It is not removed.
  • It opens by itself only if this browser last chose that agent, so a selected radio is never hidden.
  • Bounds: only this server's WebIDs are read (another server is not told someone signs in here); at most 12 profiles, 3 s in all, no cookies.
  • Never hides on failure: an unreadable profile moves nothing. If every WebID would be an agent, nothing moves.
  • Stock ids and hooks kept; the header lists the addition (#agents, #agentList, #agentCount).

Proposal points not done here

Tests

  • Smoke (test/smoke.mjs): links profile/agent#me to the test account (allowed without an ownership check, since the account made that pod) and adds the delegation triple to the served card via Playwright's route. The run has no Solid session to write the card for real. It then checks that the agent is listed apart, closed, with the card still in the main list. With the card fetch aborted, nothing moves. Screenshot 06c-consent-agents.
  • Both layouts passed locally. CI is the reference run (local podman/SELinux differs from the VPS).
  • check-overrides.sh is not affected (baseline unchanged).

🤖 Generated with Claude Code

A WebID another listed WebID declares as its agent (acl:delegates, read from
the public profile as N-Triples) moves under a closed "Your agents"
disclosure. Only this server's profiles are read, bounded in count and time,
without cookies; an unreadable profile moves nothing, and the person is never
left with only agents in view.

Smoke: links an agent WebID to the test account, adds the delegation to the
served card, checks the agent is apart and closed; with the card unreadable,
nothing moves.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nicolasdb
nicolasdb merged commit 6347197 into main Nov 3, 2026
2 checks passed
@nicolasdb
nicolasdb deleted the consent-agents-apart branch November 3, 2026 10:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Consent page: keep agents' WebIDs out of the way of the person's own

1 participant