TrueCloudLab/frostfs-node
20
1
Fork 28
Code Issues 109 Pull requests 4 Projects Releases 2 Packages 4 Activity Actions

[#811] ape: Update policy-engine module version and rebase
All checks were successful
DCO action / DCO (pull_request) Successful in 4m23s
Details
Vulncheck / Vulncheck (pull_request) Successful in 5m31s
Details
Build / Build Components (1.21) (pull_request) Successful in 7m33s
Details
Build / Build Components (1.20) (pull_request) Successful in 7m40s
Details
Tests and linters / Staticcheck (pull_request) Successful in 8m22s
Details
Tests and linters / Lint (pull_request) Successful in 9m23s
Details
Tests and linters / Tests with -race (pull_request) Successful in 11m20s
Details
Tests and linters / Tests (1.21) (pull_request) Successful in 11m32s
Details
Tests and linters / Tests (1.20) (pull_request) Successful in 11m41s
Details

Browse source 
Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
Airat Arifullin 2023-11-16 10:58:55 +03:00
parent fd9128d051
commit 4d5be5ccb5
14 changed files with 151 additions and 131 deletions
Download patch file Download diff file Expand all files Collapse all files

11
pkg/services/object/acl/ape.go
View file

@ -8,7 +8,7 @@ import (
v2 "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/object/acl/v2"
"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
policyengine "git.frostfs.info/TrueCloudLab/policy-engine"
apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
)
var errAPEChainNoSource = errors.New("could not get ape chain source for the container")
@ -36,9 +36,12 @@ func (c *apeCheckerImpl) CheckIfRequestPermitted(reqInfo v2.RequestInfo) error {
request := new(Request)
request.FromRequestInfo(reqInfo)
status, ruleFound := chainCache.IsAllowed(policyengine.Ingress, "", request)
status, ruleFound, err := chainCache.IsAllowed(apechain.Ingress, "", request)
if err != nil {
return err
}
if !ruleFound || status == policyengine.Allow {
if !ruleFound || status == apechain.Allow {
return nil
}
@ -47,7 +50,7 @@ func (c *apeCheckerImpl) CheckIfRequestPermitted(reqInfo v2.RequestInfo) error {
const accessDeniedAPEReasonFmt = "access to operation %s is denied by access policy engine: %s"
func apeErr(req v2.RequestInfo, status policyengine.Status) error {
func apeErr(req v2.RequestInfo, status apechain.Status) error {
errAccessDenied := &apistatus.ObjectAccessDenied{}
errAccessDenied.WriteReason(fmt.Sprintf(accessDeniedAPEReasonFmt, req.Operation(), status.String()))
return errAccessDenied