Investigate how descendent roles are handled regarding read

[thehenrytsai]

Goal: confirm with @csuwildcat on expected behavior, investigate if actual behavior matches outcome, write tests if they don't already exist.

Maybe everything works, but it is unclear to me how the descendent (context) role declared in thread-role.json is being used for protocol authorization:

    "thread": {
      "$actions": [
        {
          "role": "thread/participant",
          "can": "read"
        }
      ],

It would be good to investigate if this is a special case only because we so happen to have the contextId of the thread? What happens if the descendent role specified is deeper, e.g. thread/foo/bar/baz, just to make sure there is no security holes.

Additional info I added at the time of this issue creation, but no longer remember/understand why but afraid to remove:

---

If we were to disallow descendent roles, we'd do:

      // Validate the `role` property of an `action` if exists.
      if (action.role !== undefined) {
        // make sure the role specified is self, or uncle, or great uncle, or separate root record
        // ie. the role record specified should must share the same "ancestor-chain" with the record of this rule set
        // e.g. if the rule set protocol path is `a1/b1/c1` then the role record can be `a2` (an edge case), `a1/b2`, `a1/b1/c1`, `a1/b1/c2`
        // but NOT `a1/b2/c3`, or `a1/b2/c1/d1`.
        const ruleSetParentProtocolPath = ruleSetProtocolPath.substring(0, ruleSetProtocolPath.lastIndexOf('/')); // NOTE: substring(0, negative-number) returns empty string which is what we want
        const roleParentProtocolPath = action.role.substring(0, action.role.lastIndexOf('/'));
        if (!ruleSetParentProtocolPath.startsWith(roleParentProtocolPath)) {
          throw new DwnError(
            DwnErrorCode.ProtocolsConfigureRoleDoesNotShareSameAncestorsAsRuleSetRecord,
            `Role in action ${JSON.stringify(action)} for rule set ${ruleSetProtocolPath} does not share the same ancestors as the rule set record.`
          );
        }

[Atharva1723]

Can I work on this issue?

[taniashiba]

Yes you may! I've assigned it to you. @Atharva1723