[#XX] ape: Move common APE check logic to separate package

* Tree and object service have the same log for checking APE. So,
  this check should be moved to common package.

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>

pkg/services/common/ape/checker.go

@@ -0,0 +1,150 @@
+package ape
+
+import (
+	"crypto/ecdsa"
+	"errors"
+	"fmt"
+
+	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
+	frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
+	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
+	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
+	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
+	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
+)
+
+var (
+	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
+	errBearerExpired            = errors.New("bearer token has expired")
+	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
+	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
+	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
+	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
+)
+
+type CheckPrm struct {
+	// Request is an APE-request that is checked by policy engine.
+	Request aperequest.Request
+
+	Namespace string
+
+	Container cid.ID
+
+	// An encoded container's owner user ID.
+	ContainerOwner user.ID
+
+	// PublicKey is public key of the request sender.
+	PublicKey *keys.PublicKey
+
+	// The request's bearer token. It is used in order to check APE overrides with the token.
+	BearerToken *bearer.Token
+
+	// If SoftAPECheck is set to true, then NoRuleFound is interpreted as allow.
+	SoftAPECheck bool
+}
+
+type Checker struct {
+	LocalOverrideStorage   policyengine.LocalOverrideStorage
+	MorphChainStorage      policyengine.MorphRuleChainStorageReader
+	FrostFSSubjectProvider frostfsidcore.SubjectProvider
+	State                  netmap.State
+}
+
+func (c *Checker) CheckAPE(prm CheckPrm) error {
+	var cr policyengine.ChainRouter
+	if prm.BearerToken != nil && !prm.BearerToken.Impersonate() {
+		var err error
+		if err = isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, prm.PublicKey, c.State); err != nil {
+			return fmt.Errorf("bearer validation error: %w", err)
+		}
+		cr, err = router.BearerChainFeedRouter(c.LocalOverrideStorage, c.MorphChainStorage, prm.BearerToken.APEOverride())
+		if err != nil {
+			return fmt.Errorf("create chain router error: %w", err)
+		}
+	} else {
+		cr = policyengine.NewDefaultChainRouterWithLocalOverrides(c.MorphChainStorage, c.LocalOverrideStorage)
+	}
+
+	groups, err := aperequest.Groups(c.FrostFSSubjectProvider, prm.PublicKey)
+	if err != nil {
+		return fmt.Errorf("failed to get group ids: %w", err)
+	}
+
+	// Policy contract keeps group related chains as namespace-group pair.
+	for i := range groups {
+		groups[i] = fmt.Sprintf("%s:%s", prm.Namespace, groups[i])
+	}
+
+	rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, prm.PublicKey.Address()), groups)
+	status, found, err := cr.IsAllowed(apechain.Ingress, rt, prm.Request)
+	if err != nil {
+		return err
+	}
+	if !found && prm.SoftAPECheck || status == apechain.Allow {
+		return nil
+	}
+	err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", prm.Request.Operation(), status.String())
+	return apeErr(err)
+}
+
+func apeErr(err error) error {
+	errAccessDenied := &apistatus.ObjectAccessDenied{}
+	errAccessDenied.WriteReason(err.Error())
+	return errAccessDenied
+}
+
+// isValidBearer checks whether bearer token was correctly signed by authorized
+// entity. This method might be defined on whole ACL service because it will
+// require fetching current epoch to check lifetime.
+func isValidBearer(token *bearer.Token, ownerCnr user.ID, cntID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
+	if token == nil {
+		return nil
+	}
+
+	// First check token lifetime. Simplest verification.
+	if token.InvalidAt(st.CurrentEpoch()) {
+		return errBearerExpired
+	}
+
+	// Then check if bearer token is signed correctly.
+	if !token.VerifySignature() {
+		return errBearerInvalidSignature
+	}
+
+	// Check for ape overrides defined in the bearer token.
+	apeOverride := token.APEOverride()
+	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
+		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
+	}
+
+	// Then check if container is either empty or equal to the container in the request.
+	var targetCnr cid.ID
+	err := targetCnr.DecodeString(apeOverride.Target.Name)
+	if err != nil {
+		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
+	}
+	if !cntID.Equals(targetCnr) {
+		return errBearerInvalidContainerID
+	}
+
+	// Then check if container owner signed this token.
+	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
+		return errBearerNotSignedByOwner
+	}
+
+	// Then check if request sender has rights to use this token.
+	var usrSender user.ID
+	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
+
+	if !token.AssertUser(usrSender) {
+		return errBearerInvalidOwner
+	}
+
+	return nil
+}

pkg/services/object/ape/checker.go

@@ -2,47 +2,44 @@ package ape
 
 import (
 	"context"
-	"crypto/ecdsa"
 	"errors"
 	"fmt"
 
 	objectV2 "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
 	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/session"
-	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
 	frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
-	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
 	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 )
 
 type checkerImpl struct {
-	localOverrideStorage policyengine.LocalOverrideStorage
-	morphChainStorage    policyengine.MorphRuleChainStorageReader
-	headerProvider       HeaderProvider
+	checkerCore     *checkercore.Checker
 	frostFSIDClient frostfsidcore.SubjectProvider
+	headerProvider  HeaderProvider
 	nm              netmap.Source
-	st                   netmap.State
 	cnrSource       container.Source
 	nodePK          []byte
 }
 
-func NewChecker(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, st netmap.State, cnrSource container.Source, nodePK []byte) Checker {
+func NewChecker(localOverrideStorage policyengine.LocalOverrideStorage, morphChainStorage policyengine.MorphRuleChainStorageReader, headerProvider HeaderProvider, frostFSIDClient frostfsidcore.SubjectProvider, nm netmap.Source, st netmap.State, cnrSource container.Source, nodePK []byte) ObjectServiceAPE {
 	return &checkerImpl{
-		localOverrideStorage: localOverrideStorage,
-		morphChainStorage:    morphChainStorage,
-		headerProvider:       headerProvider,
+		checkerCore: &checkercore.Checker{
+			LocalOverrideStorage:   localOverrideStorage,
+			MorphChainStorage:      morphChainStorage,
+			FrostFSSubjectProvider: frostFSIDClient,
+			State:                  st,
+		},
 		frostFSIDClient: frostFSIDClient,
+		headerProvider:  headerProvider,
 		nm:              nm,
-		st:                   st,
 		cnrSource:       cnrSource,
 		nodePK:          nodePK,
 	}
@@ -85,69 +82,10 @@ type Prm struct {
 	XHeaders []session.XHeader
 }
 
-var (
-	errMissingOID               = errors.New("object ID is not set")
-	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
-	errBearerExpired            = errors.New("bearer token has expired")
-	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
-	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
-	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
-	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
-)
+var errMissingOID = errors.New("object ID is not set")
 
-// isValidBearer checks whether bearer token was correctly signed by authorized
-// entity. This method might be defined on whole ACL service because it will
-// require fetching current epoch to check lifetime.
-func isValidBearer(token *bearer.Token, ownerCnr user.ID, containerID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
-	if token == nil {
-		return nil
-	}
-
-	// First check token lifetime. Simplest verification.
-	if token.InvalidAt(st.CurrentEpoch()) {
-		return errBearerExpired
-	}
-
-	// Then check if bearer token is signed correctly.
-	if !token.VerifySignature() {
-		return errBearerInvalidSignature
-	}
-
-	// Check for ape overrides defined in the bearer token.
-	apeOverride := token.APEOverride()
-	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
-		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
-	}
-
-	// Then check if container is either empty or equal to the container in the request.
-	var targetCnr cid.ID
-	err := targetCnr.DecodeString(apeOverride.Target.Name)
-	if err != nil {
-		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
-	}
-	if !containerID.Equals(targetCnr) {
-		return errBearerInvalidContainerID
-	}
-
-	// Then check if container owner signed this token.
-	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
-		return errBearerNotSignedByOwner
-	}
-
-	// Then check if request sender has rights to use this token.
-	var usrSender user.ID
-	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
-
-	if !token.AssertUser(usrSender) {
-		return errBearerInvalidOwner
-	}
-
-	return nil
-}
-
-// CheckAPE checks if a request or a response is permitted creating an ape request and passing
-// it to chain router.
-func (c *checkerImpl) CheckAPE(ctx context.Context, prm Prm) error {
+// PrepareAndCheck prepares an APE-request and checks if it is permitted by policies.
+func (c *checkerImpl) PrepareAndCheck(ctx context.Context, prm Prm) error {
 	// APE check is ignored for some inter-node requests.
 	if prm.Role == nativeschema.PropertyValueContainerRoleContainer {
 		return nil
@@ -171,38 +109,14 @@ func (c *checkerImpl) CheckAPE(ctx context.Context, prm Prm) error {
 	if err != nil {
 		return err
 	}
-	groups, err := aperequest.Groups(c.frostFSIDClient, pub)
-	if err != nil {
-		return fmt.Errorf("failed to get group ids: %w", err)
-	}
 
-	// Policy contract keeps group related chains as namespace-group pair.
-	for i := range groups {
-		groups[i] = fmt.Sprintf("%s:%s", prm.Namespace, groups[i])
-	}
-
-	var cr policyengine.ChainRouter
-	if prm.BearerToken != nil && !prm.BearerToken.Impersonate() {
-		if err := isValidBearer(prm.BearerToken, prm.ContainerOwner, prm.Container, pub, c.st); err != nil {
-			return fmt.Errorf("bearer token validation error: %w", err)
-		}
-		cr, err = router.BearerChainFeedRouter(c.localOverrideStorage, c.morphChainStorage, prm.BearerToken.APEOverride())
-		if err != nil {
-			return fmt.Errorf("create chain router error: %w", err)
-		}
-	} else {
-		cr = policyengine.NewDefaultChainRouterWithLocalOverrides(c.morphChainStorage, c.localOverrideStorage)
-	}
-
-	rt := policyengine.NewRequestTargetExtended(prm.Namespace, prm.Container.EncodeToString(), fmt.Sprintf("%s:%s", prm.Namespace, pub.Address()), groups)
-	status, ruleFound, err := cr.IsAllowed(apechain.Ingress, rt, r)
-	if err != nil {
-		return err
-	}
-
-	if !ruleFound && prm.SoftAPECheck || status == apechain.Allow {
-		return nil
-	}
-
-	return fmt.Errorf("method %s: %s", prm.Method, status)
+	return c.checkerCore.CheckAPE(checkercore.CheckPrm{
+		Request:        r,
+		PublicKey:      pub,
+		Namespace:      prm.Method,
+		Container:      prm.Container,
+		ContainerOwner: prm.ContainerOwner,
+		BearerToken:    prm.BearerToken,
+		SoftAPECheck:   prm.SoftAPECheck,
+	})
 }

pkg/services/object/ape/checker_test.go

@@ -541,7 +541,7 @@ func TestAPECheck_BearerTokenOverrides(t *testing.T) {
 						}
 					}
 
-					err := checker.CheckAPE(context.Background(), prm)
+					err := checker.PrepareAndCheck(context.Background(), prm)
 					if test.expectAPEErr {
 						require.Error(t, err)
 					} else {
@@ -602,7 +602,7 @@ func TestAPECheck(t *testing.T) {
 						}
 					}
 
-					err := checker.CheckAPE(context.Background(), prm)
+					err := checker.PrepareAndCheck(context.Background(), prm)
 					if test.expectAPEErr {
 						require.Error(t, err)
 					} else {
@@ -748,7 +748,7 @@ func TestPutECChunk(t *testing.T) {
 			SoftAPECheck: true,
 		}
 
-		err = checker.CheckAPE(context.Background(), prm)
+		err = checker.PrepareAndCheck(context.Background(), prm)
 		require.Error(t, err)
 	})
 	t.Run("access allowed for non container node", func(t *testing.T) {
@@ -765,7 +765,7 @@ func TestPutECChunk(t *testing.T) {
 			SoftAPECheck: true,
 		}
 
-		err = checker.CheckAPE(context.Background(), prm)
+		err = checker.PrepareAndCheck(context.Background(), prm)
 		require.NoError(t, err)
 	})
 }

pkg/services/object/ape/service.go

@@ -26,7 +26,7 @@ var errFailedToCastToRequestContext = errors.New("failed cast to RequestContext"
 type Service struct {
 	log *logger.Logger
 
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	next objectSvc.ServiceServer
 }
@@ -67,10 +67,10 @@ func NewStorageEngineHeaderProvider(e *engine.StorageEngine, s *getsvc.Service)
 	}
 }
 
-func NewService(log *logger.Logger, apeChecker Checker, next objectSvc.ServiceServer) *Service {
+func NewService(log *logger.Logger, objectServiceAPE ObjectServiceAPE, next objectSvc.ServiceServer) *Service {
 	return &Service{
 		log:              log,
-		apeChecker: apeChecker,
+		objectServiceAPE: objectServiceAPE,
 		next:             next,
 	}
 }
@@ -78,7 +78,7 @@ func NewService(log *logger.Logger, apeChecker Checker, next objectSvc.ServiceSe
 type getStreamBasicChecker struct {
 	objectSvc.GetObjectStream
 
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	namespace string
 
@@ -114,7 +114,7 @@ func (g *getStreamBasicChecker) Send(resp *objectV2.GetResponse) error {
 			XHeaders:       resp.GetMetaHeader().GetXHeaders(),
 		}
 
-		if err := g.apeChecker.CheckAPE(g.Context(), prm); err != nil {
+		if err := g.objectServiceAPE.PrepareAndCheck(g.Context(), prm); err != nil {
 			return toStatusErr(err)
 		}
 	}
@@ -141,7 +141,7 @@ func (c *Service) Get(request *objectV2.GetRequest, stream objectSvc.GetObjectSt
 
 	return c.next.Get(request, &getStreamBasicChecker{
 		GetObjectStream:  stream,
-		apeChecker:      c.apeChecker,
+		objectServiceAPE: c.objectServiceAPE,
 		namespace:        reqCtx.Namespace,
 		senderKey:        reqCtx.SenderKey,
 		containerOwner:   reqCtx.ContainerOwner,
@@ -152,7 +152,7 @@ func (c *Service) Get(request *objectV2.GetRequest, stream objectSvc.GetObjectSt
 }
 
 type putStreamBasicChecker struct {
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	next objectSvc.PutObjectStream
 }
@@ -183,7 +183,7 @@ func (p *putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutR
 			XHeaders:       request.GetMetaHeader().GetXHeaders(),
 		}
 
-		if err := p.apeChecker.CheckAPE(ctx, prm); err != nil {
+		if err := p.objectServiceAPE.PrepareAndCheck(ctx, prm); err != nil {
 			return toStatusErr(err)
 		}
 	}
@@ -199,13 +199,13 @@ func (c *Service) Put() (objectSvc.PutObjectStream, error) {
 	streamer, err := c.next.Put()
 
 	return &putStreamBasicChecker{
-		apeChecker: c.apeChecker,
+		objectServiceAPE: c.objectServiceAPE,
 		next:             streamer,
 	}, err
 }
 
 type patchStreamBasicChecker struct {
-	apeChecker Checker
+	objectServiceAPE ObjectServiceAPE
 
 	next objectSvc.PatchObjectStream
 
@@ -239,7 +239,7 @@ func (p *patchStreamBasicChecker) Send(ctx context.Context, request *objectV2.Pa
 			XHeaders:       request.GetMetaHeader().GetXHeaders(),
 		}
 
-		if err := p.apeChecker.CheckAPE(ctx, prm); err != nil {
+		if err := p.objectServiceAPE.PrepareAndCheck(ctx, prm); err != nil {
 			return toStatusErr(err)
 		}
 	}
@@ -255,7 +255,7 @@ func (c *Service) Patch() (objectSvc.PatchObjectStream, error) {
 	streamer, err := c.next.Patch()
 
 	return &patchStreamBasicChecker{
-		apeChecker: c.apeChecker,
+		objectServiceAPE: c.objectServiceAPE,
 		next:             streamer,
 	}, err
 }
@@ -295,7 +295,7 @@ func (c *Service) Head(ctx context.Context, request *objectV2.HeadRequest) (*obj
 		return resp, nil
 	}
 
-	err = c.apeChecker.CheckAPE(ctx, Prm{
+	err = c.objectServiceAPE.PrepareAndCheck(ctx, Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -327,7 +327,7 @@ func (c *Service) Search(request *objectV2.SearchRequest, stream objectSvc.Searc
 		return toStatusErr(err)
 	}
 
-	err = c.apeChecker.CheckAPE(stream.Context(), Prm{
+	err = c.objectServiceAPE.PrepareAndCheck(stream.Context(), Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Method:         nativeschema.MethodSearchObject,
@@ -356,7 +356,7 @@ func (c *Service) Delete(ctx context.Context, request *objectV2.DeleteRequest) (
 		return nil, err
 	}
 
-	err = c.apeChecker.CheckAPE(ctx, Prm{
+	err = c.objectServiceAPE.PrepareAndCheck(ctx, Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -391,7 +391,7 @@ func (c *Service) GetRange(request *objectV2.GetRangeRequest, stream objectSvc.G
 		return toStatusErr(err)
 	}
 
-	err = c.apeChecker.CheckAPE(stream.Context(), Prm{
+	err = c.objectServiceAPE.PrepareAndCheck(stream.Context(), Prm{
 		Namespace:      reqCtx.Namespace,
 		Container:      cnrID,
 		Object:         objID,
@@ -439,7 +439,7 @@ func (c *Service) GetRangeHash(ctx context.Context, request *objectV2.GetRangeHa
 		return nil, err
 	}
 
-	if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
+	if err = c.objectServiceAPE.PrepareAndCheck(ctx, prm); err != nil {
 		return nil, toStatusErr(err)
 	}
 	return resp, nil
@@ -470,7 +470,7 @@ func (c *Service) PutSingle(ctx context.Context, request *objectV2.PutSingleRequ
 		XHeaders:       request.GetMetaHeader().GetXHeaders(),
 	}
 
-	if err = c.apeChecker.CheckAPE(ctx, prm); err != nil {
+	if err = c.objectServiceAPE.PrepareAndCheck(ctx, prm); err != nil {
 		return nil, toStatusErr(err)
 	}
 

pkg/services/object/ape/types.go

@@ -2,8 +2,8 @@ package ape
 
 import "context"
 
-// Checker provides methods to check requests and responses
-// with access policy engine.
-type Checker interface {
-	CheckAPE(context.Context, Prm) error
+// ObjectServiceAPE provides methods to prepare APE-request specified for object service
+// and check it with access policy engine.
+type ObjectServiceAPE interface {
+	PrepareAndCheck(context.Context, Prm) error
 }

pkg/services/tree/ape.go

@@ -2,42 +2,25 @@ package tree
 
 import (
 	"context"
-	"crypto/ecdsa"
 	"encoding/hex"
-	"errors"
 	"fmt"
 	"net"
 	"strings"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/converter"
 	aperequest "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/request"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/ape/router"
 	core "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
-	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/netmap"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/ape"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
-	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	cnrSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
-	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
-	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
-	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 	commonschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/common"
 	nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
 	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
 	"google.golang.org/grpc/peer"
 )
 
-var (
-	errInvalidTargetType        = errors.New("bearer token defines non-container target override")
-	errBearerExpired            = errors.New("bearer token has expired")
-	errBearerInvalidSignature   = errors.New("bearer token has invalid signature")
-	errBearerInvalidContainerID = errors.New("bearer token was created for another container")
-	errBearerNotSignedByOwner   = errors.New("bearer token is not signed by the container owner")
-	errBearerInvalidOwner       = errors.New("bearer token owner differs from the request sender")
-)
-
 func (s *Service) newAPERequest(ctx context.Context, namespace string,
 	cid cid.ID, operation acl.Op, role acl.Role, publicKey *keys.PublicKey,
 ) (aperequest.Request, error) {
@@ -77,56 +60,6 @@ func (s *Service) newAPERequest(ctx context.Context, namespace string,
 	), nil
 }
 
-// isValidBearer checks whether bearer token was correctly signed by authorized
-// entity. This method might be defined on whole ACL service because it will
-// require fetching current epoch to check lifetime.
-func isValidBearer(token *bearer.Token, ownerCnr user.ID, cntID cid.ID, publicKey *keys.PublicKey, st netmap.State) error {
-	if token == nil {
-		return nil
-	}
-
-	// First check token lifetime. Simplest verification.
-	if token.InvalidAt(st.CurrentEpoch()) {
-		return errBearerExpired
-	}
-
-	// Then check if bearer token is signed correctly.
-	if !token.VerifySignature() {
-		return errBearerInvalidSignature
-	}
-
-	// Check for ape overrides defined in the bearer token.
-	apeOverride := token.APEOverride()
-	if len(apeOverride.Chains) > 0 && apeOverride.Target.TargetType != ape.TargetTypeContainer {
-		return fmt.Errorf("%w: %s", errInvalidTargetType, apeOverride.Target.TargetType.ToV2().String())
-	}
-
-	// Then check if container is either empty or equal to the container in the request.
-	var targetCnr cid.ID
-	err := targetCnr.DecodeString(apeOverride.Target.Name)
-	if err != nil {
-		return fmt.Errorf("invalid cid format: %s", apeOverride.Target.Name)
-	}
-	if !cntID.Equals(targetCnr) {
-		return errBearerInvalidContainerID
-	}
-
-	// Then check if container owner signed this token.
-	if !bearer.ResolveIssuer(*token).Equals(ownerCnr) {
-		return errBearerNotSignedByOwner
-	}
-
-	// Then check if request sender has rights to use this token.
-	var usrSender user.ID
-	user.IDFromKey(&usrSender, (ecdsa.PublicKey)(*publicKey))
-
-	if !token.AssertUser(usrSender) {
-		return errBearerInvalidOwner
-	}
-
-	return nil
-}
-
 func (s *Service) checkAPE(ctx context.Context, bt *bearer.Token,
 	container *core.Container, cid cid.ID, operation acl.Op, role acl.Role, publicKey *keys.PublicKey,
 ) error {
@@ -141,45 +74,14 @@ func (s *Service) checkAPE(ctx context.Context, bt *bearer.Token,
 		return fmt.Errorf("failed to create ape request: %w", err)
 	}
 
-	var cr engine.ChainRouter
-	if bt != nil && !bt.Impersonate() {
-		if err := isValidBearer(bt, container.Value.Owner(), cid, publicKey, s.state); err != nil {
-			return fmt.Errorf("bearer validation error: %w", err)
-		}
-		cr, err = router.BearerChainFeedRouter(s.localOverrideStorage, s.morphChainStorage, bt.APEOverride())
-		if err != nil {
-			return fmt.Errorf("create chain router error: %w", err)
-		}
-	} else {
-		cr = engine.NewDefaultChainRouterWithLocalOverrides(s.morphChainStorage, s.localOverrideStorage)
-	}
-
-	groups, err := aperequest.Groups(s.frostfsidSubjectProvider, publicKey)
-	if err != nil {
-		return fmt.Errorf("failed to get group ids: %w", err)
-	}
-
-	// Policy contract keeps group related chains as namespace-group pair.
-	for i := range groups {
-		groups[i] = fmt.Sprintf("%s:%s", namespace, groups[i])
-	}
-
-	rt := engine.NewRequestTargetExtended(namespace, cid.EncodeToString(), fmt.Sprintf("%s:%s", namespace, publicKey.Address()), groups)
-	status, found, err := cr.IsAllowed(apechain.Ingress, rt, request)
-	if err != nil {
-		return err
-	}
-	if found && status == apechain.Allow {
-		return nil
-	}
-	err = fmt.Errorf("access to operation %s is denied by access policy engine: %s", request.Operation(), status.String())
-	return apeErr(err)
-}
-
-func apeErr(err error) error {
-	errAccessDenied := &apistatus.ObjectAccessDenied{}
-	errAccessDenied.WriteReason(err.Error())
-	return errAccessDenied
+	return s.apeChecker.CheckAPE(checkercore.CheckPrm{
+		Request:      request,
+		Namespace:    namespace,
+		Container:    cid,
+		PublicKey:    publicKey,
+		BearerToken:  bt,
+		SoftAPECheck: false,
+	})
 }
 
 // fillWithUserClaimTags fills ape request properties with user claim tags getting them from frostfsid contract by actor public key.

pkg/services/tree/service.go

@@ -10,6 +10,7 @@ import (
 	"sync/atomic"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/local_object_storage/pilorama"
+	checkercore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/common/ape"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
 	cidSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
@@ -37,6 +38,8 @@ type Service struct {
 
 	initialSyncDone atomic.Bool
 
+	apeChecker checkercore.Checker
+
 	// cnrMap contains existing (used) container IDs.
 	cnrMap map[cidSDK.ID]struct{}
 	// cnrMapMtx protects cnrMap
@@ -72,6 +75,13 @@ func New(opts ...Option) *Service {
 	s.syncChan = make(chan struct{})
 	s.syncPool, _ = ants.NewPool(defaultSyncWorkerCount)
 
+	s.apeChecker = checkercore.Checker{
+		LocalOverrideStorage:   s.localOverrideStorage,
+		MorphChainStorage:      s.morphChainStorage,
+		FrostFSSubjectProvider: s.frostfsidSubjectProvider,
+		State:                  s.state,
+	}
+
 	return &s
 }