From b02c3daf7cfb765e1b2eb41075d35cb01599522e Mon Sep 17 00:00:00 2001
From: Airat Arifullin <a.arifullin@yadro.com>
Date: Fri, 22 Nov 2024 15:50:47 +0300
Subject: [PATCH] [#1519] cli: Make descriptive help for`--rule` option

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
---
 cmd/internal/common/ape/flags.go | 62 +++++++++++++++++++++++++++++++-
 1 file changed, 61 insertions(+), 1 deletion(-)

diff --git a/cmd/internal/common/ape/flags.go b/cmd/internal/common/ape/flags.go
index c5e2a3a99..d8b2e88a2 100644
--- a/cmd/internal/common/ape/flags.go
+++ b/cmd/internal/common/ape/flags.go
@@ -2,7 +2,6 @@ package ape
 
 const (
 	RuleFlag           = "rule"
-	RuleFlagDesc       = "Rule statement"
 	PathFlag           = "path"
 	PathFlagDesc       = "Path to encoded chain in JSON or binary format"
 	TargetNameFlag     = "target-name"
@@ -17,3 +16,64 @@ const (
 	ChainNameFlagDesc  = "Chain name(ingress|s3)"
 	AllFlag            = "all"
 )
+
+const RuleFlagDesc = `Defines an Access Policy Engine (APE) rule in the format:
+    <status>[:status_detail] <action>... <condition>... <resource>...
+
+Status:
+  - allow                   Permits specified actions
+  - deny                    Prohibits specified actions
+  - deny:QuotaLimitReached  Denies access due to quota limits
+
+Actions:
+    Object operations:
+    - Object.Put, Object.Get, etc.
+    - Object.*     (all object operations)
+    Container operations:
+    - Container.Put, Container.Get, etc.
+    - Container.*  (all container operations)
+
+Conditions:
+    ResourceCondition:
+      Format: ResourceCondition:"key"=value, "key"!=value
+        Reserved properties (use '\' before '$'):
+        - $Object:version
+        - $Object:objectID
+        - $Object:containerID
+        - $Object:ownerID
+        - $Object:creationEpoch
+        - $Object:payloadLength
+        - $Object:payloadHash
+        - $Object:objectType
+        - $Object:homomorphicHash
+
+RequestCondition:
+    Format: RequestCondition:"key"=value, "key"!=value
+      Reserved properties (use '\' before '$'):
+        - $Actor:publicKey
+        - $Actor:role
+
+      Example:
+        ResourceCondition:"check_key"!="check_value" RequestCondition:"$Actor:role"=others
+
+Resources:
+    For objects:
+      - namespace/cid/oid    (specific object)
+      - namespace/cid/*      (all objects in container)
+      - namespace/*          (all objects in namespace)
+      - *                    (all objects)
+      - /*                   (all objects in root namespace)
+      - /cid/*               (all objects in root container)
+      - /cid/oid             (specific object in root container)
+
+    For containers:
+      - namespace/cid        (specific container)
+      - namespace/*          (all containers in namespace)
+      - *                    (all containers)
+      - /cid                 (root container)
+      - /*                   (all root containers)
+
+Notes:
+    - Cannot mix object and container operations in one rule
+    - Default behavior is Any=false unless 'any' is specified
+    - Use 'all' keyword to explicitly set Any=false`