package v2 import ( "crypto/ecdsa" "crypto/elliptic" "crypto/rand" "testing" "github.com/TrueCloudLab/frostfs-api-go/v2/acl" "github.com/TrueCloudLab/frostfs-api-go/v2/session" bearertest "github.com/TrueCloudLab/frostfs-sdk-go/bearer/test" aclsdk "github.com/TrueCloudLab/frostfs-sdk-go/container/acl" cidtest "github.com/TrueCloudLab/frostfs-sdk-go/container/id/test" oidtest "github.com/TrueCloudLab/frostfs-sdk-go/object/id/test" sessionSDK "github.com/TrueCloudLab/frostfs-sdk-go/session" sessiontest "github.com/TrueCloudLab/frostfs-sdk-go/session/test" "github.com/stretchr/testify/require" ) func TestOriginalTokens(t *testing.T) { sToken := sessiontest.ObjectSigned() bToken := bearertest.Token() pk, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader) require.NoError(t, bToken.Sign(*pk)) var bTokenV2 acl.BearerToken bToken.WriteToV2(&bTokenV2) // This line is needed because SDK uses some custom format for // reserved filters, so `cid.ID` is not converted to string immediately. require.NoError(t, bToken.ReadFromV2(bTokenV2)) var sTokenV2 session.Token sToken.WriteToV2(&sTokenV2) for i := 0; i < 10; i++ { metaHeaders := testGenerateMetaHeader(uint32(i), &bTokenV2, &sTokenV2) res, err := originalSessionToken(metaHeaders) require.NoError(t, err) require.Equal(t, sToken, res, i) bTok, err := originalBearerToken(metaHeaders) require.NoError(t, err) require.Equal(t, &bToken, bTok, i) } } func testGenerateMetaHeader(depth uint32, b *acl.BearerToken, s *session.Token) *session.RequestMetaHeader { metaHeader := new(session.RequestMetaHeader) metaHeader.SetBearerToken(b) metaHeader.SetSessionToken(s) for i := uint32(0); i < depth; i++ { link := metaHeader metaHeader = new(session.RequestMetaHeader) metaHeader.SetOrigin(link) } return metaHeader } func TestIsVerbCompatible(t *testing.T) { // Source: https://nspcc.ru/upload/frostfs-spec-latest.pdf#page=28 table := map[aclsdk.Op][]sessionSDK.ObjectVerb{ aclsdk.OpObjectPut: {sessionSDK.VerbObjectPut, sessionSDK.VerbObjectDelete}, aclsdk.OpObjectDelete: {sessionSDK.VerbObjectDelete}, aclsdk.OpObjectGet: {sessionSDK.VerbObjectGet}, aclsdk.OpObjectHead: { sessionSDK.VerbObjectHead, sessionSDK.VerbObjectGet, sessionSDK.VerbObjectDelete, sessionSDK.VerbObjectRange, sessionSDK.VerbObjectRangeHash, }, aclsdk.OpObjectRange: {sessionSDK.VerbObjectRange, sessionSDK.VerbObjectRangeHash}, aclsdk.OpObjectHash: {sessionSDK.VerbObjectRangeHash}, aclsdk.OpObjectSearch: {sessionSDK.VerbObjectSearch, sessionSDK.VerbObjectDelete}, } verbs := []sessionSDK.ObjectVerb{ sessionSDK.VerbObjectPut, sessionSDK.VerbObjectDelete, sessionSDK.VerbObjectHead, sessionSDK.VerbObjectRange, sessionSDK.VerbObjectRangeHash, sessionSDK.VerbObjectGet, sessionSDK.VerbObjectSearch, } var tok sessionSDK.Object for op, list := range table { for _, verb := range verbs { var contains bool for _, v := range list { if v == verb { contains = true break } } tok.ForVerb(verb) require.Equal(t, contains, assertVerb(tok, op), "%v in token, %s executing", verb, op) } } } func TestAssertSessionRelation(t *testing.T) { var tok sessionSDK.Object cnr := cidtest.ID() cnrOther := cidtest.ID() obj := oidtest.ID() objOther := oidtest.ID() // make sure ids differ, otherwise test won't work correctly require.False(t, cnrOther.Equals(cnr)) require.False(t, objOther.Equals(obj)) // bind session to the container (required) tok.BindContainer(cnr) // test container-global session require.NoError(t, assertSessionRelation(tok, cnr, nil)) require.NoError(t, assertSessionRelation(tok, cnr, &obj)) require.Error(t, assertSessionRelation(tok, cnrOther, nil)) require.Error(t, assertSessionRelation(tok, cnrOther, &obj)) // limit the session to the particular object tok.LimitByObjects(obj) // test fixed object session (here obj arg must be non-nil everywhere) require.NoError(t, assertSessionRelation(tok, cnr, &obj)) require.Error(t, assertSessionRelation(tok, cnr, &objOther)) }