fix(acl): allow dragging Everyone directly from the sharing chooser

[jeswr]

Dragging the Add Everyone globe directly from the sharing chooser currently drops the SVG URL. The ACL editor then tries to load that image as an RDF access target, which can produce a GitHub Pages CORS preflight error and prevents the permission change. This matches the recent report in the solidcommunity.net channel.

Make the button draggable through the existing makeDraggable helper using foaf:Agent, and disable native dragging on its child image. Users can drop Everyone directly onto the desired access level; clicking to add Everyone as a Viewer still works. No server CORS or authentication changes are needed.

Fixes #448. Fixes #419.

Validation:

• Added regression tests for URI-list and plain-text drops into Editors, the absence of an RDF/icon fetch, and the existing click-to-Viewer behavior. The drag tests fail on main with the SVG URL and pass with this fix.
• Native browser drag check: the original button drops https://solidos.github.io/solid-ui/src/icons/noun_98053.svg; the patched button drops http://xmlns.com/foaf/0.1/Agent.
• NODE_OPTIONS=--no-experimental-webstorage npm test -- --maxWorkers=2: 660 passed, 46 skipped, including test type checking. On this Node 25.1.0 workstation, the unmodified test command hits three login-component failures because localStorage.clear is unavailable; disabling Node's experimental web storage lets jsdom provide it. CI uses Node 22/24.
• npm run build: passed, including source type checking, library/CDN bundles and Storybook.
• ESLint for both changed files and git diff --check: passed.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused fix correctly uses the existing drag helper and includes comprehensive regression coverage.

Review effort: Balanced
Findings: None

What changed in this PR

Enables dragging “Everyone” directly to an ACL access level without dropping the globe icon URL.

Changes:

• Makes the button draggable as foaf:Agent.
• Disables native image dragging.
• Adds regression tests for drag-and-drop and click behavior.

File	Description
src/​acl/​add-agent-buttons.ts	Configures semantic dragging for “Everyone.”
test/​unit/​acl/​add-agent-buttons.test.ts	Tests URI-list, plain-text, and click workflows.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[TallTed]

A perhaps silly question — does "Everyone" in this context equate to World access? to all users known to the Solid system? to something else?

Whatever the answer, I strongly advise that it be provided via mouseover help text, at the least. If I wonder at this, others will (or should!)...

[bourgeoa]

Everyone means really everyone. It means that the quoted ACL permissions applies to everyone (world access with the described permissions).
The icon visibility is limited to WebID's having Control permissions.