ape: Extend resource properties when check tree requests #1701

New issue

Closed

opened 2025-04-01 07:50:38 +00:00 by dkirillov · 0 comments

dkirillov commented

2025-04-01 07:50:38 +00:00

Member

Sometimes we want to distinguish requests (container/object/tree) in APE rules to be able to restrict only tree requests.
Currently it's not possible because tree read/write operations matched to Object.Get/Object.Put operations and are not specific.

Describe the solution you'd like

Add new system resource property "$Service:tree": <tid> when form APE request to check tree operation.

3bd4ac7f1a

Describe alternatives you've considered

Maybe there are some other options.

Additional context

This allows simplify forming native APE rules base on s3 actions
af21699dd8

## Is your feature request related to a problem? Please describe. Sometimes we want to distinguish requests (container/object/tree) in APE rules to be able to restrict only tree requests. Currently it's not possible because tree read/write operations matched to Object.Get/Object.Put operations and are not specific. ## Describe the solution you'd like Add new system resource property `"$Service:tree": <tid>` when form APE request to check tree operation. https://git.frostfs.info/dkirillov/frostfs-node/commit/3bd4ac7f1a597805a274e6d3dc28bf533912d127 ## Describe alternatives you've considered Maybe there are some other options. ## Additional context This allows simplify forming native APE rules base on s3 actions https://git.frostfs.info/dkirillov/policy-engine/commit/af21699dd83ffacdb458afda3083fa8237d5030b