From 72708296ccb1420a30b70f5020c107800fa38612 Mon Sep 17 00:00:00 2001
From: Leonard Lyubich <leonard@nspcc.ru>
Date: Fri, 3 Jun 2022 17:12:55 +0300
Subject: [PATCH] Upgrade NeoFS SDK Go to v1.0.0-rc.4 and NeoFS API Go to
 v2.12.2

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
---
 cmd/neofs-cli/modules/bearer/create.go       |   8 ++---
 go.mod                                       |   4 +--
 go.sum                                       | Bin 98369 -> 98249 bytes
 pkg/innerring/processors/container/common.go |   4 ---
 pkg/services/object/acl/acl.go               |  34 ++++++++-----------
 5 files changed, 20 insertions(+), 30 deletions(-)

diff --git a/cmd/neofs-cli/modules/bearer/create.go b/cmd/neofs-cli/modules/bearer/create.go
index 4a50456c..3796b115 100644
--- a/cmd/neofs-cli/modules/bearer/create.go
+++ b/cmd/neofs-cli/modules/bearer/create.go
@@ -103,10 +103,10 @@ func createToken(cmd *cobra.Command, _ []string) error {
 	}
 
 	var b bearer.Token
-	b.SetExpiration(exp)
-	b.SetNotBefore(nvb)
-	b.SetIssuedAt(iat)
-	b.SetOwnerID(ownerID)
+	b.SetExp(exp)
+	b.SetNbf(nvb)
+	b.SetIat(iat)
+	b.ForUser(ownerID)
 
 	eaclPath, _ := cmd.Flags().GetString(eaclFlag)
 	if eaclPath != "" {
diff --git a/go.mod b/go.mod
index c8a462f3..e9bc0412 100644
--- a/go.mod
+++ b/go.mod
@@ -17,9 +17,9 @@ require (
 	github.com/nspcc-dev/hrw v1.0.9
 	github.com/nspcc-dev/neo-go v0.98.3
 	github.com/nspcc-dev/neo-go/pkg/interop v0.0.0-20220321144137-d5a9af5860af // indirect
-	github.com/nspcc-dev/neofs-api-go/v2 v2.12.2-0.20220530190258-c82dcf7e1610
+	github.com/nspcc-dev/neofs-api-go/v2 v2.12.2
 	github.com/nspcc-dev/neofs-contract v0.15.1
-	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.3.0.20220531091404-82d762f536a3
+	github.com/nspcc-dev/neofs-sdk-go v1.0.0-rc.4
 	github.com/nspcc-dev/tzhash v1.5.2
 	github.com/panjf2000/ants/v2 v2.4.0
 	github.com/paulmach/orb v0.2.2
diff --git a/go.sum b/go.sum
index c54d95d6456548c3b43bec29ecac051f08b0e740..f054303f574f8fb7203c0f0a30881624794c06dd 100644
GIT binary patch
delta 194
zcmX@uz;^OK>jtSA`U)9_R+(vG`pE`K;f5grnXcYZIevv1X;C>AIaLt`X=ZNu*;$dH
ziB+lk897eblMl|4oh(0{kJ(7iX!GV7Q<(KlKqfdP1||iY>8AvSmY5o*c|_*B6lptG
zMHG0M`Z=a}WRxYE8x*A)n-`h*O;(&IG1*{_xS5H5dcIz6ehNr?wy8x{dU2I|gmFQ6
su~B8Fe?+Neu0f`;kyBMrdZuBBnNvZEzK@}Ik=Nt}lO;Cm&lP$M0H5AM$p8QV

delta 316
zcmX^4pY>n^+Xkr_zPbi_Mg~Sk2ByXahL#3KrWU%%7Dg$_Y38YhW`+g|8HQF~<wX@9
z;elSk{uLDlK4p2XWo}u<z6IV{;en0;5&ngyrlqCsnYrm1K?ai(XUk5OpU$Ufq-TWR
z;LYVTrZD>%>%na|G_W)@F)+~uT5fJ;lxAvdmS_yJ-7%}QDz_rS)!4{AS3k|U%)2ru
z*~B2Qys+5B)XO3;xWLi8*eOUm%*7-bXuIm<ggKm{1dP>B&)3V%PXU>poN16^QBaVc
xQW{iN<d_i^=I)(k7LZZupBYwA=AD=0QWl)!;%S+Y?Ug-w;big6+vf;91^~}+U~d2b

diff --git a/pkg/innerring/processors/container/common.go b/pkg/innerring/processors/container/common.go
index df45a5bf..a1075b31 100644
--- a/pkg/innerring/processors/container/common.go
+++ b/pkg/innerring/processors/container/common.go
@@ -158,10 +158,6 @@ func (cp *Processor) checkTokenLifetime(token session.Container) error {
 		return fmt.Errorf("could not read current epoch: %w", err)
 	}
 
-	if token.ExpiredAt(curEpoch) {
-		return fmt.Errorf("token is expired at %d", curEpoch)
-	}
-
 	if token.InvalidAt(curEpoch) {
 		return fmt.Errorf("token is not valid at %d", curEpoch)
 	}
diff --git a/pkg/services/object/acl/acl.go b/pkg/services/object/acl/acl.go
index 547ed287..39e6895d 100644
--- a/pkg/services/object/acl/acl.go
+++ b/pkg/services/object/acl/acl.go
@@ -14,6 +14,7 @@ import (
 	eaclV2 "github.com/nspcc-dev/neofs-node/pkg/services/object/acl/eacl/v2"
 	v2 "github.com/nspcc-dev/neofs-node/pkg/services/object/acl/v2"
 	bearerSDK "github.com/nspcc-dev/neofs-sdk-go/bearer"
+	neofsecdsa "github.com/nspcc-dev/neofs-sdk-go/crypto/ecdsa"
 	eaclSDK "github.com/nspcc-dev/neofs-sdk-go/eacl"
 	"github.com/nspcc-dev/neofs-sdk-go/user"
 )
@@ -218,31 +219,33 @@ func isValidBearer(reqInfo v2.RequestInfo, st netmap.State) error {
 	}
 
 	// 1. First check token lifetime. Simplest verification.
-	if !isValidLifetime(token, st.CurrentEpoch()) {
+	if token.InvalidAt(st.CurrentEpoch()) {
 		return errBearerExpired
 	}
 
 	// 2. Then check if bearer token is signed correctly.
-	if err := token.VerifySignature(); err != nil {
+	if !token.VerifySignature() {
 		return errBearerInvalidSignature
 	}
 
 	// 3. Then check if container owner signed this token.
-	issuer, ok := token.Issuer()
-	if !ok {
-		panic("unexpected false return from Issuer method on signed bearer token")
-	}
-
-	if !issuer.Equals(ownerCnr) {
+	if !bearerSDK.ResolveIssuer(*token).Equals(ownerCnr) {
 		// TODO: #767 in this case we can issue all owner keys from neofs.id and check once again
 		return errBearerNotSignedByOwner
 	}
 
 	// 4. Then check if request sender has rights to use this token.
-	tokenOwner := token.OwnerID()
-	requestSenderKey := unmarshalPublicKey(reqInfo.SenderKey())
+	var keySender neofsecdsa.PublicKey
 
-	if !isOwnerFromKey(tokenOwner, requestSenderKey) {
+	err := keySender.Decode(reqInfo.SenderKey())
+	if err != nil {
+		return fmt.Errorf("decode sender public key: %w", err)
+	}
+
+	var usrSender user.ID
+	user.IDFromKey(&usrSender, ecdsa.PublicKey(keySender))
+
+	if !token.AssertUser(usrSender) {
 		// TODO: #767 in this case we can issue all owner keys from neofs.id and check once again
 		return errBearerInvalidOwner
 	}
@@ -250,15 +253,6 @@ func isValidBearer(reqInfo v2.RequestInfo, st netmap.State) error {
 	return nil
 }
 
-func isValidLifetime(t *bearerSDK.Token, epoch uint64) bool {
-	// The "exp" (expiration time) claim identifies the expiration time on
-	// or after which the JWT MUST NOT be accepted for processing.
-	// The "nbf" (not before) claim identifies the time before which the JWT
-	// MUST NOT be accepted for processing
-	// RFC 7519 sections 4.1.4, 4.1.5
-	return epoch >= t.NotBefore() && epoch <= t.Expiration()
-}
-
 func isOwnerFromKey(id user.ID, key *keys.PublicKey) bool {
 	if key == nil {
 		return false