TrueCloudLab/frostfs-node
20
1
Fork 27
Code Issues 106 Pull requests 12 Projects Releases 2 Activity Actions

[#1190] tree: GroupIDs must also be target of APE checks
All checks were successful
DCO action / DCO (pull_request) Successful in 4m34s
Details
Pre-commit hooks / Pre-commit (pull_request) Successful in 4m32s
Details
Vulncheck / Vulncheck (pull_request) Successful in 5m2s
Details
Tests and linters / Lint (pull_request) Successful in 5m6s
Details
Build / Build Components (1.21) (pull_request) Successful in 5m31s
Details
Build / Build Components (1.22) (pull_request) Successful in 5m29s
Details
Tests and linters / gopls check (pull_request) Successful in 6m0s
Details
Tests and linters / Staticcheck (pull_request) Successful in 6m45s
Details
Tests and linters / Tests (1.21) (pull_request) Successful in 12m33s
Details
Tests and linters / Tests with -race (pull_request) Successful in 12m34s
Details
Tests and linters / Tests (1.22) (pull_request) Successful in 13m16s
Details

Browse source 
Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
This commit is contained in:
Airat Arifullin 2024-06-20 15:49:22 +03:00
parent 76f99cfab2
commit 63c28f0052
1 changed files with 11 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
pkg/services/tree/ape.go
View file

@ -161,7 +161,17 @@ func (s *Service) checkAPE(ctx context.Context, bt *bearer.Token,
} }
} }
rt := engine.NewRequestTargetExtended(namespace, cid.EncodeToString(), fmt.Sprintf("%s:%s", namespace, publicKey.Address()), nil) groups, err := aperequest.Groups(s.frostfsidSubjectProvider, publicKey)
if err != nil {
return fmt.Errorf("failed to get group ids: %w", err)
}
// Policy contract keeps group related chains as namespace-group pair.
for i := range groups {
groups[i] = fmt.Sprintf("%s:%s", namespace, groups[i])
}
rt := engine.NewRequestTargetExtended(namespace, cid.EncodeToString(), fmt.Sprintf("%s:%s", namespace, publicKey.Address()), groups)
status, found, err := s.router.IsAllowed(apechain.Ingress, rt, request) status, found, err := s.router.IsAllowed(apechain.Ingress, rt, request)
if err != nil { if err != nil {
return apeErr(err) return apeErr(err)