From 1cad101609b05039530dc28724a36d3311075f15 Mon Sep 17 00:00:00 2001 From: Denis Kirillov Date: Tue, 9 Apr 2024 17:02:50 +0300 Subject: [PATCH 1/2] [#354] Update frostfs-contract to terminate session iterator Signed-off-by: Denis Kirillov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index fc63074..c6f5a1c 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20240306101814-c1c7b344b9c0 - git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0 + git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409115729-6eb492025bdd git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20230531082742-c97d21411eb6 git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20240402141532-e5040d35e99d git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20240402080942-42497ad2424c diff --git a/go.sum b/go.sum index 5e1bca9..ee4d28a 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3f dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20240306101814-c1c7b344b9c0 h1:4iyAj9k7W29YpyzUTwMuMBbL3G3M96kMbX62OwGNGfE= git.frostfs.info/TrueCloudLab/frostfs-api-go/v2 v2.16.1-0.20240306101814-c1c7b344b9c0/go.mod h1:OBDSr+DqV1z4VDouoX3YMleNc4DPBVBWTG3WDT2PK1o= -git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0 h1:FzurjElUwC7InY9v5rzXReKbfBL5yRJKSWJPq6BKhH0= -git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.0/go.mod h1:F/fe1OoIDKr5Bz99q4sriuHDuf3aZefZy9ZsCqEtgxc= +git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409115729-6eb492025bdd h1:fujTUMMn0wnpEKNDWLejFL916EPuaYD1MdZpk1ZokU8= +git.frostfs.info/TrueCloudLab/frostfs-contract v0.19.3-0.20240409115729-6eb492025bdd/go.mod h1:F/fe1OoIDKr5Bz99q4sriuHDuf3aZefZy9ZsCqEtgxc= git.frostfs.info/TrueCloudLab/frostfs-crypto v0.6.0 h1:FxqFDhQYYgpe41qsIHVOcdzSVCB8JNSfPG7Uk4r2oSk= git.frostfs.info/TrueCloudLab/frostfs-crypto v0.6.0/go.mod h1:RUIKZATQLJ+TaYQa60X2fTDwfuhMfm8Ar60bQ5fr+vU= git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20230531082742-c97d21411eb6 h1:aGQ6QaAnTerQ5Dq5b2/f9DUQtSqPkZZ/bkMx/HKuLCo= -- 2.40.1 From 51be9d9778ee3671c5b206754867e87c24e696af Mon Sep 17 00:00:00 2001 From: Denis Kirillov Date: Tue, 9 Apr 2024 17:16:12 +0300 Subject: [PATCH 2/2] [#354] Remove policies when delete bucket Signed-off-by: Denis Kirillov --- api/handler/acl_test.go | 29 +++++++++++++++++++++++++++++ api/handler/delete.go | 13 +++++++++++++ 2 files changed, 42 insertions(+) diff --git a/api/handler/acl_test.go b/api/handler/acl_test.go index 13fb61e..ff6b0a2 100644 --- a/api/handler/acl_test.go +++ b/api/handler/acl_test.go @@ -1468,6 +1468,35 @@ func TestBucketPolicy(t *testing.T) { require.Equal(t, newPolicy, bktPolicy) } +func TestDeleteBucketWithPolicy(t *testing.T) { + hc := prepareHandlerContext(t) + + bktName := "bucket-for-policy" + createTestBucket(hc, bktName) + + newPolicy := engineiam.Policy{ + Version: "2012-10-17", + Statement: []engineiam.Statement{{ + Principal: map[engineiam.PrincipalType][]string{engineiam.Wildcard: {}}, + Effect: engineiam.AllowEffect, + Action: engineiam.Action{"s3:PutObject"}, + Resource: engineiam.Resource{"arn:aws:s3:::bucket-for-policy/*"}, + }}, + } + + putBucketPolicy(hc, bktName, newPolicy) + + require.Len(t, hc.h.ape.(*apeMock).policyMap, 1) + require.Len(t, hc.h.ape.(*apeMock).chainMap[engine.NamespaceTarget("")], 4) + + deleteBucket(t, hc, bktName, http.StatusNoContent) + + require.Empty(t, hc.h.ape.(*apeMock).policyMap) + chains, err := hc.h.ape.(*apeMock).ListChains(engine.NamespaceTarget("")) + require.NoError(t, err) + require.Empty(t, chains) +} + func TestBucketPolicyUnmarshal(t *testing.T) { for _, tc := range []struct { name string diff --git a/api/handler/delete.go b/api/handler/delete.go index 8b51e78..dd02c24 100644 --- a/api/handler/delete.go +++ b/api/handler/delete.go @@ -15,6 +15,7 @@ import ( apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status" oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id" "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/session" + "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain" "go.uber.org/zap" ) @@ -277,5 +278,17 @@ func (h *handler) DeleteBucketHandler(w http.ResponseWriter, r *http.Request) { }); err != nil { h.logAndSendError(w, "couldn't delete bucket", reqInfo, err) } + + chainIDs := []chain.ID{ + getBucketChainID(chain.S3, bktInfo), + getBucketChainID(chain.Ingress, bktInfo), + getBucketCannedChainID(chain.S3, bktInfo.CID), + getBucketCannedChainID(chain.Ingress, bktInfo.CID), + } + if err = h.ape.DeleteBucketPolicy(reqInfo.Namespace, bktInfo.CID, chainIDs); err != nil { + h.logAndSendError(w, "failed to delete policy from storage", reqInfo, err) + return + } + w.WriteHeader(http.StatusNoContent) } -- 2.40.1