package object import ( "context" "github.com/nspcc-dev/neofs-api-go/service" crypto "github.com/nspcc-dev/neofs-crypto" "github.com/nspcc-dev/neofs-node/pkg/core/container/storage" "github.com/pkg/errors" ) type bearerTokenVerifier interface { verifyBearerToken(context.Context, CID, service.BearerToken) error } type complexBearerVerifier struct { items []bearerTokenVerifier } type bearerActualityVerifier struct { epochRecv EpochReceiver } type bearerOwnershipVerifier struct { cnrStorage storage.Storage } type bearerSignatureVerifier struct{} var errWrongBearerOwner = errors.New("bearer author is not a container owner") func (s complexBearerVerifier) verifyBearerToken(ctx context.Context, cid CID, token service.BearerToken) error { for i := range s.items { if err := s.items[i].verifyBearerToken(ctx, cid, token); err != nil { return err } } return nil } func (s bearerActualityVerifier) verifyBearerToken(_ context.Context, _ CID, token service.BearerToken) error { local := s.epochRecv.Epoch() validUntil := token.ExpirationEpoch() if local > validUntil { return errors.Errorf("bearer token is expired (local %d, valid until %d)", local, validUntil, ) } return nil } func (s bearerOwnershipVerifier) verifyBearerToken(ctx context.Context, cid CID, token service.BearerToken) error { isOwner, err := isContainerOwner(s.cnrStorage, cid, token.GetOwnerID()) if err != nil { return err } else if !isOwner { return errWrongBearerOwner } return nil } func (s bearerSignatureVerifier) verifyBearerToken(_ context.Context, _ CID, token service.BearerToken) error { return service.VerifySignatureWithKey( crypto.UnmarshalPublicKey(token.GetOwnerKey()), service.NewVerifiedBearerToken(token), ) }