EliChin/frostfs-s3-gw
1
0
Fork 0
forked from TrueCloudLab/frostfs-s3-gw
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#590] Make service records valid

Browse source 
Signed-off-by: Denis Kirillov <denis@nspcc.ru>
This commit is contained in:
Denis Kirillov 2022-07-20 16:38:22 +03:00 committed by Alex Vanin
parent 1e26cf1541
commit 7ba7e7dc4d
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
api/handler/acl.go
View file

@ -150,8 +150,11 @@ type ServiceRecord struct {
func (s ServiceRecord) ToEACLRecord() *eacl.Record {
serviceRecord := eacl.NewRecord()
serviceRecord.SetAction(eacl.ActionAllow)
serviceRecord.SetOperation(eacl.OperationGet)
serviceRecord.AddFilter(eacl.HeaderFromService, eacl.MatchUnknown, serviceRecordResourceKey, s.Resource)
serviceRecord.AddFilter(eacl.HeaderFromService, eacl.MatchUnknown, serviceRecordGroupLengthKey, strconv.Itoa(s.GroupRecordsLength))
eacl.AddFormedTarget(serviceRecord, eacl.RoleSystem)
return serviceRecord
}
@ -876,8 +879,13 @@ func astToTable(ast *ast) (*eacl.Table, error) {
}
func tryServiceRecord(record eacl.Record) *ServiceRecord {
if record.Action() != eacl.ActionUnknown || len(record.Targets()) != 0 ||
len(record.Filters()) != 2 {
if record.Action() != eacl.ActionAllow || record.Operation() != eacl.OperationGet ||
len(record.Targets()) != 1 || len(record.Filters()) != 2 {
return nil
}
target := record.Targets()[0]
if target.Role() != eacl.RoleSystem {
return nil
}