[#1362] ape: Move common APE check logic to separate package

* Tree and object service have the same log for checking APE. So,
  this check should be moved to common package.

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>

pkg/services/common/ape/checker.go

@@ -0,0 +1,167 @@
+package ape
+
+import (
+	"crypto/ecdsa"
+	"errors"
+	"fmt"
+
+	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
+	frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
+	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
+	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
+)
+
+var (
+	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
+	errBearerExpired            = errors.New("bearer token has expired")
+	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
+	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
+	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
+	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
+)
+
+type CheckPrm struct {
+	// Request is an APE-request that is checked by policy engine.
+	Request aperequest.Request
+
+	Namespace string
+
+	Container cid.ID
+
+	// An encoded container's owner user ID.
+	ContainerOwner user.ID
+
+	// PublicKey is public key of the request sender.
+	PublicKey *keys.PublicKey
+
+	// The request's bearer token. It is used in order to check APE overrides with the token.
+	BearerToken *bearer.Token
+
+	// If SoftAPECheck is set to true, then NoRuleFound is interpreted as allow.
+	SoftAPECheck bool
+}
+
+// CheckCore provides methods to perform the common logic of APE check.
+type CheckCore interface {
+	// CheckAPE performs the common policy-engine check logic on a prepared request.
+	CheckAPE(prm CheckPrm) error
+}
+
+type checkerCoreImpl struct {
+	LocalOverrideStorage   policyengine.LocalOverrideStorage
+	MorphChainStorage      policyengine.MorphRuleChainStorageReader
+	FrostFSSubjectProvider frostfsidcore.SubjectProvider
+	State                  netmap.State
+}
+
+func New(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader,
+	frostFSSubjectProvider frostfsidcore.SubjectProvider, state netmap.State) CheckCore {
+	return &checkerCoreImpl{
+		LocalOverrideStorage:   localOverrideStorage,
+		MorphChainStorage:      morphChainStorage,
+		FrostFSSubjectProvider: frostFSSubjectProvider,
+		State:                  state,
+	}
+}
+
+// CheckAPE performs the common policy-engine check logic on a prepared request.
+func (c *checkerCoreImpl) CheckAPE(prm CheckPrm) error {
+	var cr policyengine.ChainRouter
+	if prm.BearerToken != nil && !prm.BearerToken.Impersonate() {
+		var err error
+		if err = isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, prm.PublicKey, c.State); err != nil {
+			return fmt.Errorf("bearer validation error: %w", err)
+		}
+		cr, err = router.BearerChainFeedRouter(c.LocalOverrideStorage, c.MorphChainStorage, prm.BearerToken.APEOverride())
+		if err != nil {
+			return fmt.Errorf("create chain router error: %w", err)
+		}
+	} else {
+		cr = policyengine.NewDefaultChainRouterWithLocalOverrides(c.MorphChainStorage, c.LocalOverrideStorage)
+	}
+
+	groups, err := aperequest.Groups(c.FrostFSSubjectProvider, prm.PublicKey)
+	if err != nil {
+		return fmt.Errorf("failed to get group ids: %w", err)
+	}
+
+	// Policy contract keeps group related chains as namespace-group pair.
+	for i := range groups {
+		groups[i] = fmt.Sprintf("%s:%s", prm.Namespace, groups[i])
+	}
+
+	rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, prm.PublicKey.Address()), groups)
+	status, found, err := cr.IsAllowed(apechain.Ingress, rt, prm.Request)
+	if err != nil {
+		return err
+	}
+	if !found && prm.SoftAPECheck || status == apechain.Allow {
+		return nil
+	}
+	err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", prm.Request.Operation(), status.String())
+	return apeErr(err)
+}
+
+func apeErr(err error) error {
+	errAccessDenied := &apistatus.ObjectAccessDenied{}
+	errAccessDenied.WriteReason(err.Error())
+	return errAccessDenied
+}
+
+// isValidBearer checks whether bearer token was correctly signed by authorized
+// entity. This method might be defined on whole ACL service because it will
+// require fetching current epoch to check lifetime.
+func isValidBearer(token *bearer.Token, ownerCnr user.ID, cntID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
+	if token == nil {
+		return nil
+	}
+
+	// First check token lifetime. Simplest verification.
+	if token.InvalidAt(st.CurrentEpoch()) {
+		return errBearerExpired
+	}
+
+	// Then check if bearer token is signed correctly.
+	if !token.VerifySignature() {
+		return errBearerInvalidSignature
+	}
+
+	// Check for ape overrides defined in the bearer token.
+	apeOverride := token.APEOverride()
+	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
+		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
+	}
+
+	// Then check if container is either empty or equal to the container in the request.
+	var targetCnr cid.ID
+	err := targetCnr.DecodeString(apeOverride.Target.Name)
+	if err != nil {
+		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
+	}
+	if !cntID.Equals(targetCnr) {
+		return errBearerInvalidContainerID
+	}
+
+	// Then check if container owner signed this token.
+	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
+		return errBearerNotSignedByOwner
+	}
+
+	// Then check if request sender has rights to use this token.
+	var usrSender user.ID
+	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
+
+	if !token.AssertUser(usrSender) {
+		return errBearerInvalidOwner
+	}
+
+	return nil
+}

pkg/services/object/ape/checker.go

@@ -2,49 +2,41 @@ package ape
 
 import (
 	"context"
-	"crypto/ecdsa"
 	"errors"
 	"fmt"
 
 	objectV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
 	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/session"
-	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
 	frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
-	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
 	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 )
 
 type checkerImpl struct {
-	localOverrideStorage policyengine.LocalOverrideStorage
-	morphChainStorage    policyengine.MorphRuleChainStorageReader
-	headerProvider       HeaderProvider
-	frostFSIDClient      frostfsidcore.SubjectProvider
-	nm                   netmap.Source
-	st                   netmap.State
-	cnrSource            container.Source
-	nodePK               []byte
+	checkerCore     checkercore.CheckCore
+	frostFSIDClient frostfsidcore.SubjectProvider
+	headerProvider  HeaderProvider
+	nm              netmap.Source
+	cnrSource       container.Source
+	nodePK          []byte
 }
 
-func NewChecker(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, st netmap.State, cnrSource container.Source, nodePK []byte) Checker {
+func NewChecker(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, st netmap.State, cnrSource container.Source, nodePK []byte) ObjectServiceAPE {
 	return &checkerImpl{
-		localOverrideStorage: localOverrideStorage,
-		morphChainStorage:    morphChainStorage,
-		headerProvider:       headerProvider,
-		frostFSIDClient:      frostFSIDClient,
-		nm:                   nm,
-		st:                   st,
-		cnrSource:            cnrSource,
-		nodePK:               nodePK,
+		checkerCore:     checkercore.New(localOverrideStorage, morphChainStorage, frostFSIDClient, st),
+		frostFSIDClient: frostFSIDClient,
+		headerProvider:  headerProvider,
+		nm:              nm,
+		cnrSource:       cnrSource,
+		nodePK:          nodePK,
 	}
 }
 
@@ -85,68 +77,9 @@ type Prm struct {
 	XHeaders []session.XHeader
 }
 
-var (
-	errMissingOID               = errors.New("object ID is not set")
-	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
-	errBearerExpired            = errors.New("bearer token has expired")
-	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
-	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
-	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
-	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
-)
+var errMissingOID = errors.New("object ID is not set")
 
-// isValidBearer checks whether bearer token was correctly signed by authorized
-// entity. This method might be defined on whole ACL service because it will
-// require fetching current epoch to check lifetime.
-func isValidBearer(token *bearer.Token, ownerCnr user.ID, containerID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
-	if token == nil {
-		return nil
-	}
-
-	// First check token lifetime. Simplest verification.
-	if token.InvalidAt(st.CurrentEpoch()) {
-		return errBearerExpired
-	}
-
-	// Then check if bearer token is signed correctly.
-	if !token.VerifySignature() {
-		return errBearerInvalidSignature
-	}
-
-	// Check for ape overrides defined in the bearer token.
-	apeOverride := token.APEOverride()
-	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
-		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
-	}
-
-	// Then check if container is either empty or equal to the container in the request.
-	var targetCnr cid.ID
-	err := targetCnr.DecodeString(apeOverride.Target.Name)
-	if err != nil {
-		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
-	}
-	if !containerID.Equals(targetCnr) {
-		return errBearerInvalidContainerID
-	}
-
-	// Then check if container owner signed this token.
-	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
-		return errBearerNotSignedByOwner
-	}
-
-	// Then check if request sender has rights to use this token.
-	var usrSender user.ID
-	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
-
-	if !token.AssertUser(usrSender) {
-		return errBearerInvalidOwner
-	}
-
-	return nil
-}
-
-// CheckAPE checks if a request or a response is permitted creating an ape request and passing
-// it to chain router.
+// CheckAPE prepares an APE-request and checks if it is permitted by policies.
 func (c *checkerImpl) CheckAPE(ctx context.Context, prm Prm) error {
 	// APE check is ignored for some inter-node requests.
 	if prm.Role == nativeschema.PropertyValueContainerRoleContainer {
@@ -171,38 +104,14 @@ func (c *checkerImpl) CheckAPE(ctx context.Context, prm Prm) error {
 	if err != nil {
 		return err
 	}
-	groups, err := aperequest.Groups(c.frostFSIDClient, pub)
-	if err != nil {
-		return fmt.Errorf("failed to get group ids: %w", err)
-	}
 
-	// Policy contract keeps group related chains as namespace-group pair.
-	for i := range groups {
-		groups[i] = fmt.Sprintf("%s:%s", prm.Namespace, groups[i])
-	}
-
-	var cr policyengine.ChainRouter
-	if prm.BearerToken != nil && !prm.BearerToken.Impersonate() {
-		if err := isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, pub, c.st); err != nil {
-			return fmt.Errorf("bearer token validation error: %w", err)
-		}
-		cr, err = router.BearerChainFeedRouter(c.localOverrideStorage, c.morphChainStorage, prm.BearerToken.APEOverride())
-		if err != nil {
-			return fmt.Errorf("create chain router error: %w", err)
-		}
-	} else {
-		cr = policyengine.NewDefaultChainRouterWithLocalOverrides(c.morphChainStorage, c.localOverrideStorage)
-	}
-
-	rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, pub.Address()), groups)
-	status, ruleFound, err := cr.IsAllowed(apechain.Ingress, rt, r)
-	if err != nil {
-		return err
-	}
-
-	if !ruleFound && prm.SoftAPECheck || status == apechain.Allow {
-		return nil
-	}
-
-	return fmt.Errorf("method %s: %s", prm.Method, status)
+	return c.checkerCore.CheckAPE(checkercore.CheckPrm{
+		Request:        r,
+		PublicKey:      pub,
+		Namespace:      prm.Method,
+		Container:      prm.Container,
+		ContainerOwner: prm.ContainerOwner,
+		BearerToken:    prm.BearerToken,
+		SoftAPECheck:   prm.SoftAPECheck,
+	})
 }

pkg/services/object/ape/service.go

@@ -26,7 +26,7 @@ var errFailedToCastToRequestContext = errors.New("failed cast to RequestContext"
 type Service struct {
 	log *logger.Logger
 
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	next objectSvc.ServiceServer
 }
@@ -67,18 +67,18 @@ func NewStorageEngineHeaderProvider(e *engine.StorageEngine, s *getsvc.Service)
 	}
 }
 
-func NewService(log *logger.Logger, apeChecker Checker, next objectSvc.ServiceServer) *Service {
+func NewService(log *logger.Logger, objectServiceAPE ObjectServiceAPE, next objectSvc.ServiceServer) *Service {
 	return &Service{
-		log:        log,
-		apeChecker: apeChecker,
-		next:       next,
+		log:              log,
+		objectServiceAPE: objectServiceAPE,
+		next:             next,
 	}
 }
 
 type getStreamBasicChecker struct {
 	objectSvc.GetObjectStream
 
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	namespace string
 
@@ -114,7 +114,7 @@ func (g *getStreamBasicChecker) Send(resp *objectV2.GetResponse) error {
 			XHeaders:       resp.GetMetaHeader().GetXHeaders(),
 		}
 
-		if err := g.apeChecker.CheckAPE(g.Context(), prm); err != nil {
+		if err := g.objectServiceAPE.CheckAPE(g.Context(), prm); err != nil {
 			return toStatusErr(err)
 		}
 	}
@@ -140,19 +140,19 @@ func (c *Service) Get(request *objectV2.GetRequest, stream objectSvc.GetObjectSt
 	}
 
 	return c.next.Get(request, &getStreamBasicChecker{
-		GetObjectStream: stream,
-		apeChecker:      c.apeChecker,
-		namespace:       reqCtx.Namespace,
-		senderKey:       reqCtx.SenderKey,
-		containerOwner:  reqCtx.ContainerOwner,
-		role:            nativeSchemaRole(reqCtx.Role),
-		softAPECheck:    reqCtx.SoftAPECheck,
-		bearerToken:     reqCtx.BearerToken,
+		GetObjectStream:  stream,
+		objectServiceAPE: c.objectServiceAPE,
+		namespace:        reqCtx.Namespace,
+		senderKey:        reqCtx.SenderKey,
+		containerOwner:   reqCtx.ContainerOwner,
+		role:             nativeSchemaRole(reqCtx.Role),
+		softAPECheck:     reqCtx.SoftAPECheck,
+		bearerToken:      reqCtx.BearerToken,
 	})
 }
 
 type putStreamBasicChecker struct {
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	next objectSvc.PutObjectStream
 }
@@ -183,7 +183,7 @@ func (p *putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutR
 			XHeaders:       request.GetMetaHeader().GetXHeaders(),
 		}
 
-		if err := p.apeChecker.CheckAPE(ctx, prm); err != nil {
+		if err := p.objectServiceAPE.CheckAPE(ctx, prm); err != nil {
 			return toStatusErr(err)
 		}
 	}
@@ -199,13 +199,13 @@ func (c *Service) Put() (objectSvc.PutObjectStream, error) {
 	streamer, err := c.next.Put()
 
 	return &putStreamBasicChecker{
-		apeChecker: c.apeChecker,
-		next:       streamer,
+		objectServiceAPE: c.objectServiceAPE,
+		next:             streamer,
 	}, err
 }
 
 type patchStreamBasicChecker struct {
-	apeChecker Checker
+	apeChecker ObjectServiceAPE
 
 	next objectSvc.PatchObjectStream
 
@@ -255,7 +255,7 @@ func (c *Service) Patch() (objectSvc.PatchObjectStream, error) {
 	streamer, err := c.next.Patch()
 
 	return &patchStreamBasicChecker{
-		apeChecker: c.apeChecker,
+		apeChecker: c.objectServiceAPE,
 		next:       streamer,
 	}, err
 }
@@ -295,7 +295,7 @@ func (c *Service) Head(ctx context.Context, request *objectV2.HeadRequest) (*obj
 		return resp, nil
 	}
 
-	err = c.apeChecker.CheckAPE(ctx, Prm{
+	err = c.objectServiceAPE.CheckAPE(ctx, Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -327,7 +327,7 @@ func (c *Service) Search(request *objectV2.SearchRequest, stream objectSvc.Searc
 		return toStatusErr(err)
 	}
 
-	err = c.apeChecker.CheckAPE(stream.Context(), Prm{
+	err = c.objectServiceAPE.CheckAPE(stream.Context(), Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Method:         nativeschema.MethodSearchObject,
@@ -356,7 +356,7 @@ func (c *Service) Delete(ctx context.Context, request *objectV2.DeleteRequest) (
 		return nil, err
 	}
 
-	err = c.apeChecker.CheckAPE(ctx, Prm{
+	err = c.objectServiceAPE.CheckAPE(ctx, Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -391,7 +391,7 @@ func (c *Service) GetRange(request *objectV2.GetRangeRequest, stream objectSvc.G
 		return toStatusErr(err)
 	}
 
-	err = c.apeChecker.CheckAPE(stream.Context(), Prm{
+	err = c.objectServiceAPE.CheckAPE(stream.Context(), Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -439,7 +439,7 @@ func (c *Service) GetRangeHash(ctx context.Context, request *objectV2.GetRangeHa
 		return nil, err
 	}
 
-	if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
+	if err = c.objectServiceAPE.CheckAPE(ctx, prm); err != nil {
 		return nil, toStatusErr(err)
 	}
 	return resp, nil
@@ -470,7 +470,7 @@ func (c *Service) PutSingle(ctx context.Context, request *objectV2.PutSingleRequ
 		XHeaders:       request.GetMetaHeader().GetXHeaders(),
 	}
 
-	if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
+	if err = c.objectServiceAPE.CheckAPE(ctx, prm); err != nil {
 		return nil, toStatusErr(err)
 	}
 

pkg/services/object/ape/types.go

@@ -2,8 +2,8 @@ package ape
 
 import "context"
 
-// Checker provides methods to check requests and responses
-// with access policy engine.
-type Checker interface {
+// CheckAPE checks if a request or a response is permitted creating an ape request and passing
+// it to chain router.
+type ObjectServiceAPE interface {
 	CheckAPE(context.Context, Prm) error
 }

pkg/services/tree/ape.go

@@ -2,42 +2,25 @@ package tree
 
 import (
 	"context"
-	"crypto/ecdsa"
 	"encoding/hex"
-	"errors"
 	"fmt"
 	"net"
 	"strings"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/converter"
 	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
 	core "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
-	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	cnrSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
-	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	commonschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/common"
 	nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"google.golang.org/grpc/peer"
 )
 
-var (
-	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
-	errBearerExpired            = errors.New("bearer token has expired")
-	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
-	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
-	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
-	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
-)
-
 func (s *Service) newAPERequest(ctx context.Context, namespace string,
 	cid cid.ID, operation acl.Op, role acl.Role, publicKey *keys.PublicKey,
 ) (aperequest.Request, error) {
@@ -77,56 +60,6 @@ func (s *Service) newAPERequest(ctx context.Context, namespace string,
 	), nil
 }
 
-// isValidBearer checks whether bearer token was correctly signed by authorized
-// entity. This method might be defined on whole ACL service because it will
-// require fetching current epoch to check lifetime.
-func isValidBearer(token *bearer.Token, ownerCnr user.ID, cntID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
-	if token == nil {
-		return nil
-	}
-
-	// First check token lifetime. Simplest verification.
-	if token.InvalidAt(st.CurrentEpoch()) {
-		return errBearerExpired
-	}
-
-	// Then check if bearer token is signed correctly.
-	if !token.VerifySignature() {
-		return errBearerInvalidSignature
-	}
-
-	// Check for ape overrides defined in the bearer token.
-	apeOverride := token.APEOverride()
-	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
-		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
-	}
-
-	// Then check if container is either empty or equal to the container in the request.
-	var targetCnr cid.ID
-	err := targetCnr.DecodeString(apeOverride.Target.Name)
-	if err != nil {
-		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
-	}
-	if !cntID.Equals(targetCnr) {
-		return errBearerInvalidContainerID
-	}
-
-	// Then check if container owner signed this token.
-	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
-		return errBearerNotSignedByOwner
-	}
-
-	// Then check if request sender has rights to use this token.
-	var usrSender user.ID
-	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
-
-	if !token.AssertUser(usrSender) {
-		return errBearerInvalidOwner
-	}
-
-	return nil
-}
-
 func (s *Service) checkAPE(ctx context.Context, bt *bearer.Token,
 	container *core.Container, cid cid.ID, operation acl.Op, role acl.Role, publicKey *keys.PublicKey,
 ) error {
@@ -141,45 +74,14 @@ func (s *Service) checkAPE(ctx context.Context, bt *bearer.Token,
 		return fmt.Errorf("failed to create ape request: %w", err)
 	}
 
-	var cr engine.ChainRouter
-	if bt != nil && !bt.Impersonate() {
-		if err := isValidBearer(bt, container.Value.Owner(), cid, publicKey, s.state); err != nil {
-			return fmt.Errorf("bearer validation error: %w", err)
-		}
-		cr, err = router.BearerChainFeedRouter(s.localOverrideStorage, s.morphChainStorage, bt.APEOverride())
-		if err != nil {
-			return fmt.Errorf("create chain router error: %w", err)
-		}
-	} else {
-		cr = engine.NewDefaultChainRouterWithLocalOverrides(s.morphChainStorage, s.localOverrideStorage)
-	}
-
-	groups, err := aperequest.Groups(s.frostfsidSubjectProvider, publicKey)
-	if err != nil {
-		return fmt.Errorf("failed to get group ids: %w", err)
-	}
-
-	// Policy contract keeps group related chains as namespace-group pair.
-	for i := range groups {
-		groups[i] = fmt.Sprintf("%s:%s", namespace, groups[i])
-	}
-
-	rt := engine.NewRequestTargetExtended(namespace, cid.EncodeToString(), fmt.Sprintf("%s:%s", namespace, publicKey.Address()), groups)
-	status, found, err := cr.IsAllowed(apechain.Ingress, rt, request)
-	if err != nil {
-		return err
-	}
-	if found && status == apechain.Allow {
-		return nil
-	}
-	err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", request.Operation(), status.String())
-	return apeErr(err)
-}
-
-func apeErr(err error) error {
-	errAccessDenied := &apistatus.ObjectAccessDenied{}
-	errAccessDenied.WriteReason(err.Error())
-	return errAccessDenied
+	return s.apeChecker.CheckAPE(checkercore.CheckPrm{
+		Request:      request,
+		Namespace:    namespace,
+		Container:    cid,
+		PublicKey:    publicKey,
+		BearerToken:  bt,
+		SoftAPECheck: false,
+	})
 }
 
 // fillWithUserClaimTags fills ape request properties with user claim tags getting them from frostfsid contract by actor public key.

pkg/services/tree/service.go

@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/local_object_storage/pilorama"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cidSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
@@ -37,6 +38,8 @@ type Service struct {
 
 	initialSyncDone atomic.Bool
 
+	apeChecker checkercore.CheckCore
+
 	// cnrMap contains existing (used) container IDs.
 	cnrMap map[cidSDK.ID]struct{}
 	// cnrMapMtx protects cnrMap
@@ -72,6 +75,8 @@ func New(opts ...Option) *Service {
 	s.syncChan = make(chan struct{})
 	s.syncPool, _ = ants.NewPool(defaultSyncWorkerCount)
 
+	s.apeChecker = checkercore.New(s.localOverrideStorage, s.morphChainStorage, s.frostfsidSubjectProvider, s.state)
+
 	return &s
 }