[#207] aclsvc: Drop outdated tag

Signed-off-by: Dmitrii Stepanov <d.stepanov@yadro.com>

pkg/services/object/acl/acl.go

@@ -14,6 +14,7 @@ import (
 	bearerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/bearer"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/acl"
+	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
 	frostfsecdsa "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/crypto/ecdsa"
 	eaclSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/eacl"
 	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
@@ -118,8 +119,6 @@ func (c *Checker) StickyBitCheck(info v2.RequestInfo, owner user.ID) bool {
 }
 
 // CheckEACL is a main check function for extended ACL.
-//
-// nolint: funlen
 func (c *Checker) CheckEACL(msg any, reqInfo v2.RequestInfo) error {
 	basicACL := reqInfo.BasicACL()
 	if !basicACL.Extendable() {
@@ -154,6 +153,44 @@ func (c *Checker) CheckEACL(msg any, reqInfo v2.RequestInfo) error {
 		return err
 	}
 
+	hdrSrc, err := c.getHeaderSource(cnr, msg, reqInfo)
+	if err != nil {
+		return err
+	}
+
+	eaclRole := getRole(reqInfo)
+
+	action, _ := c.validator.CalculateAction(new(eaclSDK.ValidationUnit).
+		WithRole(eaclRole).
+		WithOperation(eaclSDK.Operation(reqInfo.Operation())).
+		WithContainerID(&cnr).
+		WithSenderKey(reqInfo.SenderKey()).
+		WithHeaderSource(hdrSrc).
+		WithEACLTable(&table),
+	)
+
+	if action != eaclSDK.ActionAllow {
+		return errEACLDeniedByRule
+	}
+	return nil
+}
+
+func getRole(reqInfo v2.RequestInfo) eaclSDK.Role {
+	var eaclRole eaclSDK.Role
+	switch op := reqInfo.RequestRole(); op {
+	default:
+		eaclRole = eaclSDK.Role(op)
+	case acl.RoleOwner:
+		eaclRole = eaclSDK.RoleUser
+	case acl.RoleInnerRing, acl.RoleContainer:
+		eaclRole = eaclSDK.RoleSystem
+	case acl.RoleOthers:
+		eaclRole = eaclSDK.RoleOthers
+	}
+	return eaclRole
+}
+
+func (c *Checker) getHeaderSource(cnr cid.ID, msg any, reqInfo v2.RequestInfo) (eaclSDK.TypedHeaderSource, error) {
 	hdrSrcOpts := make([]eaclV2.Option, 0, 3)
 
 	hdrSrcOpts = append(hdrSrcOpts,
@@ -175,34 +212,9 @@ func (c *Checker) CheckEACL(msg any, reqInfo v2.RequestInfo) error {
 
 	hdrSrc, err := eaclV2.NewMessageHeaderSource(hdrSrcOpts...)
 	if err != nil {
-		return fmt.Errorf("can't parse headers: %w", err)
+		return nil, fmt.Errorf("can't parse headers: %w", err)
 	}
-
-	var eaclRole eaclSDK.Role
-	switch op := reqInfo.RequestRole(); op {
-	default:
-		eaclRole = eaclSDK.Role(op)
-	case acl.RoleOwner:
-		eaclRole = eaclSDK.RoleUser
-	case acl.RoleInnerRing, acl.RoleContainer:
-		eaclRole = eaclSDK.RoleSystem
-	case acl.RoleOthers:
-		eaclRole = eaclSDK.RoleOthers
-	}
-
-	action, _ := c.validator.CalculateAction(new(eaclSDK.ValidationUnit).
-		WithRole(eaclRole).
-		WithOperation(eaclSDK.Operation(reqInfo.Operation())).
-		WithContainerID(&cnr).
-		WithSenderKey(reqInfo.SenderKey()).
-		WithHeaderSource(hdrSrc).
-		WithEACLTable(&table),
-	)
-
-	if action != eaclSDK.ActionAllow {
-		return errEACLDeniedByRule
-	}
-	return nil
+	return hdrSrc, nil
 }
 
 // isValidBearer checks whether bearer token was correctly signed by authorized

pkg/services/object/acl/eacl/v2/headers.go

@@ -101,12 +101,18 @@ func requestHeaders(msg xHeaderSource) []eaclSDK.Header {
 
 var errMissingOID = errors.New("object ID is missing")
 
-// nolint: funlen
 func (h *cfg) readObjectHeaders(dst *headerSource) error {
 	switch m := h.msg.(type) {
 	default:
 		panic(fmt.Sprintf("unexpected message type %T", h.msg))
 	case requestXHeaderSource:
+		return h.readObjectHeadersFromRequestXHeaderSource(m, dst)
+	case responseXHeaderSource:
+		return h.readObjectHeadersResponseXHeaderSource(m, dst)
+	}
+}
+
+func (h *cfg) readObjectHeadersFromRequestXHeaderSource(m requestXHeaderSource, dst *headerSource) error {
 	switch req := m.req.(type) {
 	case
 		*objectV2.GetRequest,
@@ -148,7 +154,10 @@ func (h *cfg) readObjectHeaders(dst *headerSource) error {
 
 		dst.objectHeaders = []eaclSDK.Header{cidHeader(cnr)}
 	}
-	case responseXHeaderSource:
+	return nil
+}
+
+func (h *cfg) readObjectHeadersResponseXHeaderSource(m responseXHeaderSource, dst *headerSource) error {
 	switch resp := m.resp.(type) {
 	default:
 		objectHeaders, completed := h.localObjectHeaders(h.cnr, h.obj)
@@ -189,8 +198,6 @@ func (h *cfg) readObjectHeaders(dst *headerSource) error {
 
 		dst.objectHeaders = headersFromObject(object.NewFromV2(oV2), h.cnr, h.obj)
 	}
-	}
-
 	return nil
 }
 

pkg/services/object/acl/v2/service.go

@@ -443,7 +443,6 @@ func (b Service) GetRangeHash(
 	return b.next.GetRangeHash(ctx, request)
 }
 
-// nolint: funlen
 func (p putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutRequest) error {
 	body := request.GetBody()
 	if body == nil {
@@ -482,28 +481,10 @@ func (p putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutRe
 		}
 
 		var sTok *sessionSDK.Object
-
-		if tokV2 := request.GetMetaHeader().GetSessionToken(); tokV2 != nil {
-			sTok = new(sessionSDK.Object)
-
-			err = sTok.ReadFromV2(*tokV2)
-			if err != nil {
-				return fmt.Errorf("invalid session token: %w", err)
-			}
-
-			if sTok.AssertVerb(sessionSDK.VerbObjectDelete) {
-				// if session relates to object's removal, we don't check
-				// relation of the tombstone to the session here since user
-				// can't predict tomb's ID.
-				err = assertSessionRelation(*sTok, cnr, nil)
-			} else {
-				err = assertSessionRelation(*sTok, cnr, obj)
-			}
-
+		sTok, err = p.readSessionToken(cnr, obj, request)
 		if err != nil {
 			return err
 		}
-		}
 
 		bTok, err := originalBearerToken(request.GetMetaHeader())
 		if err != nil {
@@ -534,6 +515,34 @@ func (p putStreamBasicChecker) Send(ctx context.Context, request *objectV2.PutRe
 	return p.next.Send(ctx, request)
 }
 
+func (p putStreamBasicChecker) readSessionToken(cnr cid.ID, obj *oid.ID, request *objectV2.PutRequest) (*sessionSDK.Object, error) {
+	var sTok *sessionSDK.Object
+
+	if tokV2 := request.GetMetaHeader().GetSessionToken(); tokV2 != nil {
+		sTok = new(sessionSDK.Object)
+
+		err := sTok.ReadFromV2(*tokV2)
+		if err != nil {
+			return nil, fmt.Errorf("invalid session token: %w", err)
+		}
+
+		if sTok.AssertVerb(sessionSDK.VerbObjectDelete) {
+			// if session relates to object's removal, we don't check
+			// relation of the tombstone to the session here since user
+			// can't predict tomb's ID.
+			err = assertSessionRelation(*sTok, cnr, nil)
+		} else {
+			err = assertSessionRelation(*sTok, cnr, obj)
+		}
+
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return sTok, nil
+}
+
 func (p putStreamBasicChecker) CloseAndRecv(ctx context.Context) (*objectV2.PutResponse, error) {
 	return p.next.CloseAndRecv(ctx)
 }

pkg/services/object/acl/v2/util.go

@@ -166,7 +166,6 @@ func isOwnerFromKey(id user.ID, key *keys.PublicKey) bool {
 
 // assertVerb checks that token verb corresponds to op.
 func assertVerb(tok sessionSDK.Object, op acl.Op) bool {
-	//nolint:exhaustive
 	switch op {
 	case acl.OpObjectPut:
 		return tok.AssertVerb(sessionSDK.VerbObjectPut, sessionSDK.VerbObjectDelete)