[#368] object: Reject expired objects

The lifetime of an object can be limited by specifying a correspondin
well-known attribute. Node should refuse to save expired objects.

Checking objects in FormatValidator is extended with an expiration attribute
parsing step.

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>

pkg/core/object/fmt.go

@@ -2,11 +2,14 @@ package object
 
 import (
 	"bytes"
+	"strconv"
 
 	"github.com/nspcc-dev/neofs-api-go/pkg/object"
 	"github.com/nspcc-dev/neofs-api-go/pkg/owner"
 	"github.com/nspcc-dev/neofs-api-go/pkg/storagegroup"
+	objectV2 "github.com/nspcc-dev/neofs-api-go/v2/object"
 	crypto "github.com/nspcc-dev/neofs-crypto"
+	"github.com/nspcc-dev/neofs-node/pkg/core/netmap"
 	"github.com/pkg/errors"
 )
 
@@ -20,6 +23,8 @@ type FormatValidatorOption func(*cfg)
 
 type cfg struct {
 	deleteHandler DeleteHandler
+
+	netState netmap.State
 }
 
 // DeleteHandler is an interface of delete queue processor.
@@ -69,6 +74,11 @@ func (v *FormatValidator) Validate(obj *Object) error {
 			return errors.Wrapf(err, "(%T) could not validate signature key", v)
 		}
 
+		// TODO: combine small checks
+		if err := v.checkExpiration(obj); err != nil {
+			return errors.Wrapf(err, "object did not pass expiration check")
+		}
+
 		if err := object.CheckHeaderVerificationFields(obj.SDK()); err != nil {
 			return errors.Wrapf(err, "(%T) could not validate header fields", v)
 		}
@@ -164,6 +174,38 @@ func (v *FormatValidator) ValidateContent(o *Object) error {
 	return nil
 }
 
+var errExpired = errors.New("object has expired")
+
+func (v *FormatValidator) checkExpiration(obj *Object) error {
+	for _, a := range obj.Attributes() {
+		if a.Key() != objectV2.SysAttributeExpEpoch {
+			continue
+		}
+
+		exp, err := strconv.ParseUint(a.Value(), 10, 64)
+		if err != nil {
+			return err
+		}
+
+		if exp < v.netState.CurrentEpoch() {
+			return errExpired
+		}
+
+		break
+	}
+
+	return nil
+}
+
+// WithNetState returns options to set network state interface.
+//
+// FIXME: network state is a required parameter.
+func WithNetState(netState netmap.State) FormatValidatorOption {
+	return func(c *cfg) {
+		c.netState = netState
+	}
+}
+
 // WithDeleteHandler returns option to set delete queue processor.
 func WithDeleteHandler(v DeleteHandler) FormatValidatorOption {
 	return func(c *cfg) {

pkg/core/object/fmt_test.go

@@ -4,6 +4,7 @@ import (
 	"crypto/ecdsa"
 	"crypto/rand"
 	"crypto/sha256"
+	"strconv"
 	"testing"
 
 	"github.com/nspcc-dev/neofs-api-go/pkg/container"
@@ -11,6 +12,7 @@ import (
 	"github.com/nspcc-dev/neofs-api-go/pkg/owner"
 	"github.com/nspcc-dev/neofs-api-go/pkg/storagegroup"
 	"github.com/nspcc-dev/neofs-api-go/pkg/token"
+	objectV2 "github.com/nspcc-dev/neofs-api-go/v2/object"
 	crypto "github.com/nspcc-dev/neofs-crypto"
 	"github.com/nspcc-dev/neofs-node/pkg/util/test"
 	"github.com/pkg/errors"
@@ -54,8 +56,22 @@ func blankValidObject(t *testing.T, key *ecdsa.PrivateKey) *RawObject {
 	return obj
 }
 
+type testNetState struct {
+	epoch uint64
+}
+
+func (s testNetState) CurrentEpoch() uint64 {
+	return s.epoch
+}
+
 func TestFormatValidator_Validate(t *testing.T) {
-	v := NewFormatValidator()
+	const curEpoch = 13
+
+	v := NewFormatValidator(
+		WithNetState(testNetState{
+			epoch: curEpoch,
+		}),
+	)
 
 	ownerKey := test.DecodeKey(-1)
 
@@ -156,4 +172,38 @@ func TestFormatValidator_Validate(t *testing.T) {
 
 		require.NoError(t, v.ValidateContent(obj.Object()))
 	})
+
+	t.Run("expiration", func(t *testing.T) {
+		fn := func(val string) *Object {
+			obj := blankValidObject(t, ownerKey)
+
+			a := object.NewAttribute()
+			a.SetKey(objectV2.SysAttributeExpEpoch)
+			a.SetValue(val)
+
+			obj.SetAttributes(a)
+
+			require.NoError(t, object.SetIDWithSignature(ownerKey, obj.SDK()))
+
+			return obj.Object()
+		}
+
+		t.Run("invalid attribute value", func(t *testing.T) {
+			val := "text"
+			err := v.Validate(fn(val))
+			require.Error(t, err)
+		})
+
+		t.Run("expired object", func(t *testing.T) {
+			val := strconv.FormatUint(curEpoch-1, 10)
+			err := v.Validate(fn(val))
+			require.True(t, errors.Is(err, errExpired))
+		})
+
+		t.Run("alive object", func(t *testing.T) {
+			val := strconv.FormatUint(curEpoch, 10)
+			err := v.Validate(fn(val))
+			require.NoError(t, err)
+		})
+	})
 }

pkg/services/object/put/service.go

@@ -137,6 +137,7 @@ func WithFormatValidatorOpts(v ...object.FormatValidatorOption) Option {
 func WithNetworkState(v netmap.State) Option {
 	return func(c *cfg) {
 		c.networkState = v
+		c.fmtValidatorOpts = append(c.fmtValidatorOpts, object.WithNetState(v))
 	}
 }