Match `native` (`frostfs-node`) objects to `APE`-objects #16

New Issue

Closed

opened 2023-11-08 14:08:17 +00:00 by aarifullin · 2 comments

aarifullin commented

2023-11-08 14:08:17 +00:00

Collaborator

We should be able to convert frostfs-node's requests to the format understandable for policy-engine.

The PR #770 converts to ape-formats in the text parser or in object service. So, we define APE specifics within frostfs-node like ARN-format resource conversion.

We could delegate this for APE:

Define constans for verbs

package native

const (
   GetObject = "native:GetObject"
   HeadObject = "native:HeadObject"
   /* ... */
)

Make resource converter

package native

func ObjectResourceNameForAllContainers() string {
      return "native:::object/*"
}

func ObjectResourceNameForContainerForAllObjects(cnrID string) string {
      return "native:::object/" + cnrID + "/*"
}

func ObjectResourceNameForContainerForObject(cnrID, objectID string) string {
      return "native:::object/" + cnrID + "/" + objectID
}

and so on

That's how frostfs-node could operate only with contants and methods and leave string conversion

Welcome to discussion

We should be able to convert frostfs-node's [requests](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/c04f6c5e593e013f42037745390e506b1730b065/pkg/services/object/acl/v2/request.go#L19) to the format [understandable](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/5ebb2e694c85192681f70f09a565be9893ea7802/resource.go#L6) for policy-engine. The PR [#770](https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/770/files) converts to ape-formats in the text [parser](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/624f9deb8702043f1462218146f0d8b4af93811a/cmd/frostfs-cli/modules/util/ape.go#L103) or in [object service](https://git.frostfs.info/TrueCloudLab/frostfs-node/src/commit/624f9deb8702043f1462218146f0d8b4af93811a/pkg/services/object/acl/ape_request.go#L60). So, we define APE specifics within frostfs-node like ARN-format resource conversion. We could delegate this for APE: 1. Define constans for verbs ```golang package native const ( GetObject = "native:GetObject" HeadObject = "native:HeadObject" /* ... */ ) ``` 2. Make resource converter ```golang package native func ObjectResourceNameForAllContainers() string { return "native:::object/*" } func ObjectResourceNameForContainerForAllObjects(cnrID string) string { return "native:::object/" + cnrID + "/*" } func ObjectResourceNameForContainerForObject(cnrID, objectID string) string { return "native:::object/" + cnrID + "/" + objectID } ``` and so on That's how frostfs-node could operate only with contants and methods and leave string conversion **Welcome to discussion**

aarifullin added the

discussion

label 2023-11-08 14:08:17 +00:00

aarifullin changed title from ~~Create converters from `native` (`frostfs-node`) objects to `APE`-objects~~ to Match `native` (`frostfs-node`) objects to `APE`-objects

2023-11-10 12:29:39 +00:00

dkirillov commented

2023-11-13 06:27:08 +00:00

Collaborator

We can also define well-known resource properties keys (e.g. FullPath that we are going to use when transform iam policy to native one)

We can also define well-known [resource properties](https://git.frostfs.info/TrueCloudLab/policy-engine/src/commit/5ebb2e694c85192681f70f09a565be9893ea7802/resource.go#L18) keys (e.g. [FullPath](https://git.frostfs.info/dkirillov/policy-engine/src/commit/0566a2b058e3bb8ca66bace34a5045db8ee236db/iam/converter.go#L17) that we are going to use when transform iam policy to native one)

aarifullin commented

2023-11-13 11:42:11 +00:00

Poster

Collaborator

The issue has got unactual - see #800.

The issue has got unactual - see [#800](https://git.frostfs.info/TrueCloudLab/frostfs-node/pulls/800).

aarifullin closed this issue

2023-11-13 11:42:12 +00:00