[#1157] object: Make APE checker use Bearer-token's APE overrides
Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
parent
4edff5eea6
commit
04a3f891fd
6 changed files with 358 additions and 168 deletions
|
@ -463,6 +463,7 @@ func createAPEService(c *cfg, splitSvc *objectService.TransportSplitter) *object
|
||||||
objectAPE.NewStorageEngineHeaderProvider(c.cfgObject.cfgLocalStorage.localStorage, c.cfgObject.getSvc),
|
objectAPE.NewStorageEngineHeaderProvider(c.cfgObject.cfgLocalStorage.localStorage, c.cfgObject.getSvc),
|
||||||
c.shared.frostfsidClient,
|
c.shared.frostfsidClient,
|
||||||
c.netMapSource,
|
c.netMapSource,
|
||||||
|
c.cfgNetmap.state,
|
||||||
c.cfgObject.cnrSource,
|
c.cfgObject.cnrSource,
|
||||||
c.binPublicKey,
|
c.binPublicKey,
|
||||||
),
|
),
|
||||||
|
|
|
@ -118,6 +118,7 @@ func (w *wrappedGetObjectStream) Context() context.Context {
|
||||||
SenderKey: w.requestInfo.SenderKey(),
|
SenderKey: w.requestInfo.SenderKey(),
|
||||||
Role: w.requestInfo.RequestRole(),
|
Role: w.requestInfo.RequestRole(),
|
||||||
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
||||||
|
BearerToken: w.requestInfo.Bearer(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -143,6 +144,7 @@ func (w *wrappedRangeStream) Context() context.Context {
|
||||||
SenderKey: w.requestInfo.SenderKey(),
|
SenderKey: w.requestInfo.SenderKey(),
|
||||||
Role: w.requestInfo.RequestRole(),
|
Role: w.requestInfo.RequestRole(),
|
||||||
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
||||||
|
BearerToken: w.requestInfo.Bearer(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -168,6 +170,7 @@ func (w *wrappedSearchStream) Context() context.Context {
|
||||||
SenderKey: w.requestInfo.SenderKey(),
|
SenderKey: w.requestInfo.SenderKey(),
|
||||||
Role: w.requestInfo.RequestRole(),
|
Role: w.requestInfo.RequestRole(),
|
||||||
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
SoftAPECheck: w.requestInfo.IsSoftAPECheck(),
|
||||||
|
BearerToken: w.requestInfo.Bearer(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -479,6 +482,7 @@ func requestContext(ctx context.Context, reqInfo RequestInfo) context.Context {
|
||||||
SenderKey: reqInfo.SenderKey(),
|
SenderKey: reqInfo.SenderKey(),
|
||||||
Role: reqInfo.RequestRole(),
|
Role: reqInfo.RequestRole(),
|
||||||
SoftAPECheck: reqInfo.IsSoftAPECheck(),
|
SoftAPECheck: reqInfo.IsSoftAPECheck(),
|
||||||
|
BearerToken: reqInfo.Bearer(),
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -2,13 +2,17 @@ package ape
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
|
"crypto/ecdsa"
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
|
||||||
objectV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
|
objectV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
|
||||||
frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
|
frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
|
||||||
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
||||||
oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
|
oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
|
||||||
|
@ -23,16 +27,18 @@ type checkerImpl struct {
|
||||||
headerProvider HeaderProvider
|
headerProvider HeaderProvider
|
||||||
frostFSIDClient frostfsidcore.SubjectProvider
|
frostFSIDClient frostfsidcore.SubjectProvider
|
||||||
nm netmap.Source
|
nm netmap.Source
|
||||||
|
st netmap.State
|
||||||
cnrSource container.Source
|
cnrSource container.Source
|
||||||
nodePK []byte
|
nodePK []byte
|
||||||
}
|
}
|
||||||
|
|
||||||
func NewChecker(chainRouter policyengine.ChainRouter, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, cnrSource container.Source, nodePK []byte) Checker {
|
func NewChecker(chainRouter policyengine.ChainRouter, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, st netmap.State, cnrSource container.Source, nodePK []byte) Checker {
|
||||||
return &checkerImpl{
|
return &checkerImpl{
|
||||||
chainRouter: chainRouter,
|
chainRouter: chainRouter,
|
||||||
headerProvider: headerProvider,
|
headerProvider: headerProvider,
|
||||||
frostFSIDClient: frostFSIDClient,
|
frostFSIDClient: frostFSIDClient,
|
||||||
nm: nm,
|
nm: nm,
|
||||||
|
st: st,
|
||||||
cnrSource: cnrSource,
|
cnrSource: cnrSource,
|
||||||
nodePK: nodePK,
|
nodePK: nodePK,
|
||||||
}
|
}
|
||||||
|
@ -67,9 +73,69 @@ type Prm struct {
|
||||||
|
|
||||||
// If true, object headers will not retrieved from storage engine.
|
// If true, object headers will not retrieved from storage engine.
|
||||||
WithoutHeaderRequest bool
|
WithoutHeaderRequest bool
|
||||||
|
|
||||||
|
// The request's bearer token. It is used in order to check APE overrides with the token.
|
||||||
|
BearerToken *bearer.Token
|
||||||
}
|
}
|
||||||
|
|
||||||
var errMissingOID = errors.New("object ID is not set")
|
var (
|
||||||
|
errMissingOID = errors.New("object ID is not set")
|
||||||
|
errInvalidTargetType = errors.New("bearer token defines non-container target override")
|
||||||
|
errBearerExpired = errors.New("bearer token has expired")
|
||||||
|
errBearerInvalidSignature = errors.New("bearer token has invalid signature")
|
||||||
|
errBearerInvalidContainerID = errors.New("bearer token was created for another container")
|
||||||
|
errBearerNotSignedByOwner = errors.New("bearer token is not signed by the container owner")
|
||||||
|
errBearerInvalidOwner = errors.New("bearer token owner differs from the request sender")
|
||||||
|
)
|
||||||
|
|
||||||
|
// isValidBearer checks whether bearer token was correctly signed by authorized
|
||||||
|
// entity. This method might be defined on whole ACL service because it will
|
||||||
|
// require fetching current epoch to check lifetime.
|
||||||
|
func isValidBearer(token *bearer.Token, ownerCnr user.ID, containerID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
|
||||||
|
if token == nil {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// 1. First check token lifetime. Simplest verification.
|
||||||
|
if token.InvalidAt(st.CurrentEpoch()) {
|
||||||
|
return errBearerExpired
|
||||||
|
}
|
||||||
|
|
||||||
|
// 2. Then check if bearer token is signed correctly.
|
||||||
|
if !token.VerifySignature() {
|
||||||
|
return errBearerInvalidSignature
|
||||||
|
}
|
||||||
|
|
||||||
|
// 3. Then check if container is either empty or equal to the container in the request.
|
||||||
|
apeOverride := token.APEOverride()
|
||||||
|
if apeOverride.Target.TargetType != ape.TargetTypeContainer {
|
||||||
|
return errInvalidTargetType
|
||||||
|
}
|
||||||
|
|
||||||
|
var targetCnr cid.ID
|
||||||
|
err := targetCnr.DecodeString(apeOverride.Target.Name)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
|
||||||
|
}
|
||||||
|
if !containerID.Equals(targetCnr) {
|
||||||
|
return errBearerInvalidContainerID
|
||||||
|
}
|
||||||
|
|
||||||
|
// 4. Then check if container owner signed this token.
|
||||||
|
if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
|
||||||
|
return errBearerNotSignedByOwner
|
||||||
|
}
|
||||||
|
|
||||||
|
// 5. Then check if request sender has rights to use this token.
|
||||||
|
var usrSender user.ID
|
||||||
|
user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
|
||||||
|
|
||||||
|
if !token.AssertUser(usrSender) {
|
||||||
|
return errBearerInvalidOwner
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
// CheckAPE checks if a request or a response is permitted creating an ape request and passing
|
// CheckAPE checks if a request or a response is permitted creating an ape request and passing
|
||||||
// it to chain router.
|
// it to chain router.
|
||||||
|
@ -99,6 +165,26 @@ func (c *checkerImpl) CheckAPE(ctx context.Context, prm Prm) error {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if prm.BearerToken != nil && !prm.BearerToken.Impersonate() {
|
||||||
|
if err := isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, pub, c.st); err != nil {
|
||||||
|
return fmt.Errorf("bearer token validation error: %w", err)
|
||||||
|
}
|
||||||
|
btRouter, err := router.SingleUseRouterWithBearerTokenChains([]bearer.APEOverride{prm.BearerToken.APEOverride()})
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
status, found, err := btRouter.IsAllowed(apechain.Ingress, policyengine.NewRequestTargetWithContainer(prm.Container.EncodeToString()), r)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if found && status == apechain.Allow {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if status != apechain.NoRuleFound {
|
||||||
|
return fmt.Errorf("bearer token: method %s: %s", prm.Method, status)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, pub.Address()), nil)
|
rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, pub.Address()), nil)
|
||||||
status, ruleFound, err := c.chainRouter.IsAllowed(apechain.Ingress, rt, r)
|
status, ruleFound, err := c.chainRouter.IsAllowed(apechain.Ingress, rt, r)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
|
|
@ -2,6 +2,7 @@ package ape
|
||||||
|
|
||||||
import (
|
import (
|
||||||
"context"
|
"context"
|
||||||
|
"crypto/ecdsa"
|
||||||
"encoding/hex"
|
"encoding/hex"
|
||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
|
@ -12,6 +13,8 @@ import (
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-contract/frostfsid/client"
|
"git.frostfs.info/TrueCloudLab/frostfs-contract/frostfsid/client"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
|
||||||
frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
|
frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
|
||||||
|
apeSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/checksum"
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/checksum"
|
||||||
containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
|
containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
|
||||||
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
||||||
|
@ -228,8 +231,7 @@ func (f *frostfsIDProviderMock) GetSubjectExtended(key util.Uint160) (*client.Su
|
||||||
return v, nil
|
return v, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func TestAPECheck(t *testing.T) {
|
var apeCheckTestCases = []struct {
|
||||||
for _, test := range []struct {
|
|
||||||
name string
|
name string
|
||||||
container string
|
container string
|
||||||
object *string
|
object *string
|
||||||
|
@ -237,7 +239,7 @@ func TestAPECheck(t *testing.T) {
|
||||||
header testHeader
|
header testHeader
|
||||||
containerRules []chain.Rule
|
containerRules []chain.Rule
|
||||||
expectAPEErr bool
|
expectAPEErr bool
|
||||||
}{
|
}{
|
||||||
{
|
{
|
||||||
name: "oid required requests are allowed",
|
name: "oid required requests are allowed",
|
||||||
container: containerID,
|
container: containerID,
|
||||||
|
@ -391,7 +393,87 @@ func TestAPECheck(t *testing.T) {
|
||||||
},
|
},
|
||||||
expectAPEErr: true,
|
expectAPEErr: true,
|
||||||
},
|
},
|
||||||
} {
|
}
|
||||||
|
|
||||||
|
type stMock struct{}
|
||||||
|
|
||||||
|
func (m *stMock) CurrentEpoch() uint64 {
|
||||||
|
return 8
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAPECheck_BearerTokenOverrides(t *testing.T) {
|
||||||
|
for _, test := range apeCheckTestCases {
|
||||||
|
t.Run(test.name, func(t *testing.T) {
|
||||||
|
chain := chain.Chain{
|
||||||
|
Rules: test.containerRules,
|
||||||
|
MatchType: chain.MatchTypeFirstMatch,
|
||||||
|
}
|
||||||
|
chainSDK := apeSDK.Chain{
|
||||||
|
Raw: chain.Bytes(),
|
||||||
|
}
|
||||||
|
bt := new(bearer.Token)
|
||||||
|
bt.SetIat(1)
|
||||||
|
bt.SetExp(10)
|
||||||
|
bt.SetAPEOverride(bearer.APEOverride{
|
||||||
|
Target: apeSDK.ChainTarget{
|
||||||
|
TargetType: apeSDK.TargetTypeContainer,
|
||||||
|
Name: test.container,
|
||||||
|
},
|
||||||
|
Chains: []apeSDK.Chain{chainSDK},
|
||||||
|
})
|
||||||
|
bt.Sign(senderPrivateKey.PrivateKey)
|
||||||
|
var cnrOwner user.ID
|
||||||
|
user.IDFromKey(&cnrOwner, (ecdsa.PublicKey)(*senderPrivateKey.PublicKey()))
|
||||||
|
|
||||||
|
for _, method := range test.methods {
|
||||||
|
t.Run(method, func(t *testing.T) {
|
||||||
|
headerProvider := newHeaderProviderMock()
|
||||||
|
frostfsidProvider := newFrostfsIDProviderMock(t)
|
||||||
|
|
||||||
|
cnr := newContainerIDSDK(t, test.container)
|
||||||
|
obj := newObjectIDSDK(t, test.object)
|
||||||
|
|
||||||
|
ls := inmemory.NewInmemoryLocalStorage()
|
||||||
|
ms := inmemory.NewInmemoryMorphRuleChainStorage()
|
||||||
|
r := policyengine.NewDefaultChainRouterWithLocalOverrides(ms, ls)
|
||||||
|
|
||||||
|
checker := NewChecker(r, headerProvider, frostfsidProvider, nil, &stMock{}, nil, nil)
|
||||||
|
|
||||||
|
prm := Prm{
|
||||||
|
Method: method,
|
||||||
|
Container: cnr,
|
||||||
|
Object: obj,
|
||||||
|
Role: role,
|
||||||
|
ContainerOwner: cnrOwner,
|
||||||
|
SenderKey: senderKey,
|
||||||
|
BearerToken: bt,
|
||||||
|
}
|
||||||
|
|
||||||
|
var headerObjSDK *objectSDK.Object
|
||||||
|
if test.header.headerObjSDK != nil {
|
||||||
|
headerObjSDK = newHeaderObjectSDK(cnr, obj, test.header.headerObjSDK)
|
||||||
|
if test.header.fromHeaderProvider {
|
||||||
|
require.NotNil(t, obj, "oid is required if a header is expected to be found in header provider")
|
||||||
|
headerProvider.addHeader(cnr, *obj, headerObjSDK)
|
||||||
|
} else if test.header.fromRequestResponseHeader {
|
||||||
|
prm.Header = headerObjSDK.ToV2().GetHeader()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
err := checker.CheckAPE(context.Background(), prm)
|
||||||
|
if test.expectAPEErr {
|
||||||
|
require.Error(t, err)
|
||||||
|
} else {
|
||||||
|
require.NoError(t, err)
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestAPECheck(t *testing.T) {
|
||||||
|
for _, test := range apeCheckTestCases {
|
||||||
t.Run(test.name, func(t *testing.T) {
|
t.Run(test.name, func(t *testing.T) {
|
||||||
for _, method := range test.methods {
|
for _, method := range test.methods {
|
||||||
t.Run(method, func(t *testing.T) {
|
t.Run(method, func(t *testing.T) {
|
||||||
|
@ -411,7 +493,7 @@ func TestAPECheck(t *testing.T) {
|
||||||
|
|
||||||
router := policyengine.NewDefaultChainRouterWithLocalOverrides(ms, ls)
|
router := policyengine.NewDefaultChainRouterWithLocalOverrides(ms, ls)
|
||||||
|
|
||||||
checker := NewChecker(router, headerProvider, frostfsidProvider, nil, nil, nil)
|
checker := NewChecker(router, headerProvider, frostfsidProvider, nil, &stMock{}, nil, nil)
|
||||||
|
|
||||||
prm := Prm{
|
prm := Prm{
|
||||||
Method: method,
|
Method: method,
|
||||||
|
@ -544,7 +626,7 @@ func TestPutECChunk(t *testing.T) {
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
checker := NewChecker(router, headerProvider, frostfsidProvider, nm, cs, node1Key.PublicKey().Bytes())
|
checker := NewChecker(router, headerProvider, frostfsidProvider, nm, &stMock{}, cs, node1Key.PublicKey().Bytes())
|
||||||
|
|
||||||
ecParentID := oidtest.ID()
|
ecParentID := oidtest.ID()
|
||||||
chunkHeader := newHeaderObjectSDK(cnr, obj, nil).ToV2().GetHeader()
|
chunkHeader := newHeaderObjectSDK(cnr, obj, nil).ToV2().GetHeader()
|
||||||
|
@ -586,7 +668,7 @@ func TestPutECChunk(t *testing.T) {
|
||||||
t.Run("access allowed for non container node", func(t *testing.T) {
|
t.Run("access allowed for non container node", func(t *testing.T) {
|
||||||
otherKey, err := keys.NewPrivateKey()
|
otherKey, err := keys.NewPrivateKey()
|
||||||
require.NoError(t, err)
|
require.NoError(t, err)
|
||||||
checker = NewChecker(router, headerProvider, frostfsidProvider, nm, cs, otherKey.PublicKey().Bytes())
|
checker = NewChecker(router, headerProvider, frostfsidProvider, nm, &stMock{}, cs, otherKey.PublicKey().Bytes())
|
||||||
prm := Prm{
|
prm := Prm{
|
||||||
Method: nativeschema.MethodPutObject,
|
Method: nativeschema.MethodPutObject,
|
||||||
Container: cnr,
|
Container: cnr,
|
||||||
|
|
|
@ -13,6 +13,7 @@ import (
|
||||||
getsvc "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/get"
|
getsvc "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/get"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/util"
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/util"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
|
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
|
||||||
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
|
||||||
objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
|
objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
|
||||||
oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
|
oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
|
||||||
|
@ -88,6 +89,8 @@ type getStreamBasicChecker struct {
|
||||||
role string
|
role string
|
||||||
|
|
||||||
softAPECheck bool
|
softAPECheck bool
|
||||||
|
|
||||||
|
bearerToken *bearer.Token
|
||||||
}
|
}
|
||||||
|
|
||||||
func (g *getStreamBasicChecker) Send(resp *objectV2.GetResponse) error {
|
func (g *getStreamBasicChecker) Send(resp *objectV2.GetResponse) error {
|
||||||
|
@ -107,6 +110,7 @@ func (g *getStreamBasicChecker) Send(resp *objectV2.GetResponse) error {
|
||||||
ContainerOwner: g.containerOwner,
|
ContainerOwner: g.containerOwner,
|
||||||
Role: g.role,
|
Role: g.role,
|
||||||
SoftAPECheck: g.softAPECheck,
|
SoftAPECheck: g.softAPECheck,
|
||||||
|
BearerToken: g.bearerToken,
|
||||||
}
|
}
|
||||||
|
|
||||||
if err := g.apeChecker.CheckAPE(g.Context(), prm); err != nil {
|
if err := g.apeChecker.CheckAPE(g.Context(), prm); err != nil {
|
||||||
|
@ -149,6 +153,7 @@ func (c *Service) Get(request *objectV2.GetRequest, stream objectSvc.GetObjectSt
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
WithoutHeaderRequest: true,
|
WithoutHeaderRequest: true,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return toStatusErr(err)
|
return toStatusErr(err)
|
||||||
|
@ -161,6 +166,7 @@ func (c *Service) Get(request *objectV2.GetRequest, stream objectSvc.GetObjectSt
|
||||||
senderKey: reqCtx.SenderKey,
|
senderKey: reqCtx.SenderKey,
|
||||||
role: nativeSchemaRole(reqCtx.Role),
|
role: nativeSchemaRole(reqCtx.Role),
|
||||||
softAPECheck: reqCtx.SoftAPECheck,
|
softAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
bearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -192,6 +198,7 @@ func (p *putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutR
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
Role: nativeSchemaRole(reqCtx.Role),
|
Role: nativeSchemaRole(reqCtx.Role),
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
}
|
}
|
||||||
|
|
||||||
if err := p.apeChecker.CheckAPE(ctx, prm); err != nil {
|
if err := p.apeChecker.CheckAPE(ctx, prm); err != nil {
|
||||||
|
@ -236,6 +243,7 @@ func (c *Service) Head(ctx context.Context, request *objectV2.HeadRequest) (*obj
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
WithoutHeaderRequest: true,
|
WithoutHeaderRequest: true,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, toStatusErr(err)
|
return nil, toStatusErr(err)
|
||||||
|
@ -275,6 +283,7 @@ func (c *Service) Head(ctx context.Context, request *objectV2.HeadRequest) (*obj
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, toStatusErr(err)
|
return nil, toStatusErr(err)
|
||||||
|
@ -303,6 +312,7 @@ func (c *Service) Search(request *objectV2.SearchRequest, stream objectSvc.Searc
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return toStatusErr(err)
|
return toStatusErr(err)
|
||||||
|
@ -331,6 +341,7 @@ func (c *Service) Delete(ctx context.Context, request *objectV2.DeleteRequest) (
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return nil, toStatusErr(err)
|
return nil, toStatusErr(err)
|
||||||
|
@ -364,6 +375,7 @@ func (c *Service) GetRange(request *objectV2.GetRangeRequest, stream objectSvc.G
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
})
|
})
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return toStatusErr(err)
|
return toStatusErr(err)
|
||||||
|
@ -392,6 +404,7 @@ func (c *Service) GetRangeHash(ctx context.Context, request *objectV2.GetRangeHa
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
}
|
}
|
||||||
|
|
||||||
if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
|
if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
|
||||||
|
@ -430,6 +443,7 @@ func (c *Service) PutSingle(ctx context.Context, request *objectV2.PutSingleRequ
|
||||||
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
SenderKey: hex.EncodeToString(reqCtx.SenderKey),
|
||||||
ContainerOwner: reqCtx.ContainerOwner,
|
ContainerOwner: reqCtx.ContainerOwner,
|
||||||
SoftAPECheck: reqCtx.SoftAPECheck,
|
SoftAPECheck: reqCtx.SoftAPECheck,
|
||||||
|
BearerToken: reqCtx.BearerToken,
|
||||||
}
|
}
|
||||||
|
|
||||||
if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
|
if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
|
||||||
|
|
|
@ -1,6 +1,7 @@
|
||||||
package object
|
package object
|
||||||
|
|
||||||
import (
|
import (
|
||||||
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
|
||||||
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
|
"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
|
||||||
)
|
)
|
||||||
|
@ -20,4 +21,6 @@ type RequestContext struct {
|
||||||
Role acl.Role
|
Role acl.Role
|
||||||
|
|
||||||
SoftAPECheck bool
|
SoftAPECheck bool
|
||||||
|
|
||||||
|
BearerToken *bearer.Token
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue