frostfs-node/pkg/services/object/ape/checker_test.go

package ape

import (
	"context"
	"encoding/hex"
	"errors"
	"fmt"
	"testing"

	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/object"
	"git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/refs"
	"git.frostfs.info/TrueCloudLab/frostfs-contract/frostfsid/client"
	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/container"
	frostfsidcore "git.frostfs.info/TrueCloudLab/frostfs-node/pkg/core/frostfsid"
	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/checksum"
	containerSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container"
	cid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/container/id"
	netmapSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/netmap"
	objectSDK "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object"
	oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id"
	oidtest "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id/test"
	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/user"
	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/version"
	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
	"git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine/inmemory"
	nativeschema "git.frostfs.info/TrueCloudLab/policy-engine/schema/native"
	"github.com/nspcc-dev/neo-go/pkg/crypto/keys"
	"github.com/nspcc-dev/neo-go/pkg/util"
	"github.com/stretchr/testify/require"
)

type headerProviderMock struct {
	m map[oid.Address]*objectSDK.Object
}

var _ HeaderProvider = (*headerProviderMock)(nil)

func (h *headerProviderMock) addHeader(c cid.ID, o oid.ID, header *objectSDK.Object) {
	var addr oid.Address
	addr.SetContainer(c)
	addr.SetObject(o)
	h.m[addr] = header
}

func (h *headerProviderMock) GetHeader(_ context.Context, c cid.ID, o oid.ID, _ bool) (*objectSDK.Object, error) {
	var addr oid.Address
	addr.SetContainer(c)
	addr.SetObject(o)
	obj, ok := h.m[addr]
	if !ok {
		return nil, fmt.Errorf("address not found")
	}
	return obj, nil
}

func newHeaderProviderMock() *headerProviderMock {
	return &headerProviderMock{
		m: make(map[oid.Address]*objectSDK.Object),
	}
}

func newContainerIDSDK(t *testing.T, encodedCID string) cid.ID {
	var cnr cid.ID
	require.NoError(t, cnr.DecodeString(encodedCID))
	return cnr
}

func newObjectIDSDK(t *testing.T, encodedOID *string) *oid.ID {
	if encodedOID == nil {
		return nil
	}
	obj := new(oid.ID)
	require.NoError(t, obj.DecodeString(*encodedOID))
	return obj
}

type headerObjectSDKParams struct {
	majorVersion, minorVersion uint32
	owner                      user.ID
	epoch                      uint64
	payloadSize                uint64
	typ                        objectSDK.Type
	payloadChecksum            checksum.Checksum
	payloadHomomorphicHash     checksum.Checksum
	attributes                 []struct {
		key string
		val string
	}
}

func stringPtr(s string) *string {
	return &s
}

func newHeaderObjectSDK(cnr cid.ID, oid *oid.ID, headerObjSDK *headerObjectSDKParams) *objectSDK.Object {
	objSDK := objectSDK.New()
	objSDK.SetContainerID(cnr)
	if oid != nil {
		objSDK.SetID(*oid)
	}
	if headerObjSDK == nil {
		return objSDK
	}
	ver := new(version.Version)
	ver.SetMajor(headerObjSDK.majorVersion)
	ver.SetMinor(headerObjSDK.minorVersion)
	objSDK.SetVersion(ver)
	objSDK.SetCreationEpoch(headerObjSDK.epoch)
	objSDK.SetOwnerID(headerObjSDK.owner)
	objSDK.SetPayloadSize(headerObjSDK.payloadSize)
	objSDK.SetType(headerObjSDK.typ)
	objSDK.SetPayloadChecksum(headerObjSDK.payloadChecksum)
	objSDK.SetPayloadHomomorphicHash(headerObjSDK.payloadHomomorphicHash)

	var attrs []objectSDK.Attribute
	for _, attr := range headerObjSDK.attributes {
		attrSDK := objectSDK.NewAttribute()
		attrSDK.SetKey(attr.key)
		attrSDK.SetValue(attr.val)
		attrs = append(attrs, *attrSDK)
	}
	objSDK.SetAttributes(attrs...)

	return objSDK
}

type testHeader struct {
	headerObjSDK *headerObjectSDKParams

	// If fromHeaderProvider is set, then running test should
	// consider that a header is recieved from a header provider.
	fromHeaderProvider bool

	// If fromHeaderProvider is set, then running test should
	// consider that a header is recieved from a message header.
	fromRequestResponseHeader bool
}

var (
	methodsRequiredOID = []string{
		nativeschema.MethodGetObject,
		nativeschema.MethodHeadObject,
		nativeschema.MethodRangeObject,
		nativeschema.MethodHashObject,
		nativeschema.MethodDeleteObject,
	}

	methodsOptionalOID = []string{
		nativeschema.MethodSearchObject, nativeschema.MethodPutObject,
	}

	namespace = "test_namespace"

	containerID = "73tQMTYyUkTgmvPR1HWib6pndbhSoBovbnMF7Pws8Rcy"

	objectID = "BzQw5HH3feoxFDD5tCT87Y1726qzgLfxEE7wgtoRzB3R"

	role = "Container"

	senderPrivateKey, _ = keys.NewPrivateKey()

	senderKey = hex.EncodeToString(senderPrivateKey.PublicKey().Bytes())
)

type frostfsIDProviderMock struct {
	subjects         map[util.Uint160]*client.Subject
	subjectsExtended map[util.Uint160]*client.SubjectExtended
}

var _ frostfsidcore.SubjectProvider = (*frostfsIDProviderMock)(nil)

func newFrostfsIDProviderMock(t *testing.T) *frostfsIDProviderMock {
	return &frostfsIDProviderMock{
		subjects: map[util.Uint160]*client.Subject{
			scriptHashFromSenderKey(t, senderKey): {
				Namespace: "testnamespace",
				Name:      "test",
				KV: map[string]string{
					"tag-attr1": "value1",
					"tag-attr2": "value2",
				},
			},
		},
		subjectsExtended: map[util.Uint160]*client.SubjectExtended{
			scriptHashFromSenderKey(t, senderKey): {
				Namespace: "testnamespace",
				Name:      "test",
				KV: map[string]string{
					"tag-attr1": "value1",
					"tag-attr2": "value2",
				},
				Groups: []*client.Group{
					{
						ID:        1,
						Name:      "test",
						Namespace: "testnamespace",
						KV: map[string]string{
							"attr1": "value1",
							"attr2": "value2",
						},
					},
				},
			},
		},
	}
}

func scriptHashFromSenderKey(t *testing.T, senderKey string) util.Uint160 {
	pk, err := keys.NewPublicKeyFromString(senderKey)
	require.NoError(t, err)
	return pk.GetScriptHash()
}

func (f *frostfsIDProviderMock) GetSubject(key util.Uint160) (*client.Subject, error) {
	v, ok := f.subjects[key]
	if !ok {
		return nil, fmt.Errorf("%s", frostfsidcore.SubjectNotFoundErrorMessage)
	}
	return v, nil
}

func (f *frostfsIDProviderMock) GetSubjectExtended(key util.Uint160) (*client.SubjectExtended, error) {
	v, ok := f.subjectsExtended[key]
	if !ok {
		return nil, fmt.Errorf("%s", frostfsidcore.SubjectNotFoundErrorMessage)
	}
	return v, nil
}

func TestAPECheck(t *testing.T) {
	for _, test := range []struct {
		name           string
		container      string
		object         *string
		methods        []string
		header         testHeader
		containerRules []chain.Rule
		expectAPEErr   bool
	}{
		{
			name:      "oid required requests are allowed",
			container: containerID,
			object:    stringPtr(objectID),
			methods:   methodsRequiredOID,
			containerRules: []chain.Rule{
				{
					Status:  chain.Allow,
					Actions: chain.Actions{Names: methodsRequiredOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObject, containerID, objectID)},
					},
				},
			},
		},
		{
			name:      "oid optional requests are allowed",
			container: containerID,
			methods:   methodsOptionalOID,
			containerRules: []chain.Rule{
				{
					Status:  chain.Allow,
					Actions: chain.Actions{Names: methodsOptionalOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, containerID)},
					},
				},
			},
		},
		{
			name:      "oid required requests are denied",
			container: containerID,
			object:    stringPtr(objectID),
			methods:   methodsRequiredOID,
			containerRules: []chain.Rule{
				{
					Status:  chain.AccessDenied,
					Actions: chain.Actions{Names: methodsRequiredOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObject, containerID, objectID)},
					},
				},
			},
			expectAPEErr: true,
		},
		{
			name:      "oid required requests are denied by an attribute",
			container: containerID,
			object:    stringPtr(objectID),
			methods:   methodsRequiredOID,
			header: testHeader{
				headerObjSDK: &headerObjectSDKParams{
					attributes: []struct {
						key string
						val string
					}{
						{
							key: "attr1",
							val: "attribute_value",
						},
					},
				},
				fromHeaderProvider: true,
			},
			containerRules: []chain.Rule{
				{
					Status:  chain.AccessDenied,
					Actions: chain.Actions{Names: methodsRequiredOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObject, containerID, objectID)},
					},
					Any: true,
					Condition: []chain.Condition{
						{
							Op:     chain.CondStringLike,
							Object: chain.ObjectResource,
							Key:    "attr1",
							Value:  "attribute*",
						},
					},
				},
			},
			expectAPEErr: true,
		},
		{
			name:      "oid required requests are denied by sender",
			container: containerID,
			object:    stringPtr(objectID),
			methods:   methodsRequiredOID,
			header: testHeader{
				headerObjSDK: &headerObjectSDKParams{
					attributes: []struct {
						key string
						val string
					}{
						{
							key: "attr1",
							val: "attribute_value",
						},
					},
				},
				fromHeaderProvider: true,
			},
			containerRules: []chain.Rule{
				{
					Status:  chain.AccessDenied,
					Actions: chain.Actions{Names: methodsRequiredOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObject, containerID, objectID)},
					},
					Any: true,
					Condition: []chain.Condition{
						{
							Op:     chain.CondStringLike,
							Object: chain.ObjectRequest,
							Key:    nativeschema.PropertyKeyActorPublicKey,
							Value:  senderKey,
						},
					},
				},
			},
			expectAPEErr: true,
		},
		{
			name:      "optional oid requests reached quota limit by an attribute",
			container: containerID,
			methods:   methodsOptionalOID,
			header: testHeader{
				headerObjSDK: &headerObjectSDKParams{
					payloadSize: 1000,
				},
				fromRequestResponseHeader: true,
			},
			containerRules: []chain.Rule{
				{
					Status:  chain.QuotaLimitReached,
					Actions: chain.Actions{Names: methodsOptionalOID},
					Resources: chain.Resources{
						Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, containerID)},
					},
					Any: true,
					Condition: []chain.Condition{
						{
							Op:     chain.CondStringEquals,
							Object: chain.ObjectResource,
							Key:    nativeschema.PropertyKeyObjectPayloadLength,
							Value:  "1000",
						},
					},
				},
			},
			expectAPEErr: true,
		},
	} {
		t.Run(test.name, func(t *testing.T) {
			for _, method := range test.methods {
				t.Run(method, func(t *testing.T) {
					headerProvider := newHeaderProviderMock()
					frostfsidProvider := newFrostfsIDProviderMock(t)

					cnr := newContainerIDSDK(t, test.container)
					obj := newObjectIDSDK(t, test.object)

					ls := inmemory.NewInmemoryLocalStorage()
					ms := inmemory.NewInmemoryMorphRuleChainStorage()

					ls.AddOverride(chain.Ingress, policyengine.ContainerTarget(test.container), &chain.Chain{
						Rules:     test.containerRules,
						MatchType: chain.MatchTypeFirstMatch,
					})

					router := policyengine.NewDefaultChainRouterWithLocalOverrides(ms, ls)

					checker := NewChecker(router, headerProvider, frostfsidProvider, nil, nil, nil)

					prm := Prm{
						Method:    method,
						Container: cnr,
						Object:    obj,
						Role:      role,
						SenderKey: senderKey,
					}

					var headerObjSDK *objectSDK.Object
					if test.header.headerObjSDK != nil {
						headerObjSDK = newHeaderObjectSDK(cnr, obj, test.header.headerObjSDK)
						if test.header.fromHeaderProvider {
							require.NotNil(t, obj, "oid is required if a header is expected to be found in header provider")
							headerProvider.addHeader(cnr, *obj, headerObjSDK)
						} else if test.header.fromRequestResponseHeader {
							prm.Header = headerObjSDK.ToV2().GetHeader()
						}
					}

					err := checker.CheckAPE(context.Background(), prm)
					if test.expectAPEErr {
						require.Error(t, err)
					} else {
						require.NoError(t, err)
					}
				})
			}
		})
	}
}

type netmapStub struct {
	netmaps      map[uint64]*netmapSDK.NetMap
	currentEpoch uint64
}

func (s *netmapStub) GetNetMap(diff uint64) (*netmapSDK.NetMap, error) {
	if diff >= s.currentEpoch {
		return nil, errors.New("invalid diff")
	}
	return s.GetNetMapByEpoch(s.currentEpoch - diff)
}

func (s *netmapStub) GetNetMapByEpoch(epoch uint64) (*netmapSDK.NetMap, error) {
	if nm, found := s.netmaps[epoch]; found {
		return nm, nil
	}
	return nil, errors.New("netmap not found")
}

func (s *netmapStub) Epoch() (uint64, error) {
	return s.currentEpoch, nil
}

type testContainerSource struct {
	containers map[cid.ID]*container.Container
}

func (s *testContainerSource) Get(cnrID cid.ID) (*container.Container, error) {
	if cnr, found := s.containers[cnrID]; found {
		return cnr, nil
	}
	return nil, fmt.Errorf("container not found")
}

func (s *testContainerSource) DeletionInfo(cid.ID) (*container.DelInfo, error) {
	return nil, nil
}

func TestPutECChunk(t *testing.T) {
	headerProvider := newHeaderProviderMock()
	frostfsidProvider := newFrostfsIDProviderMock(t)

	cnr := newContainerIDSDK(t, containerID)
	obj := newObjectIDSDK(t, &objectID)

	ls := inmemory.NewInmemoryLocalStorage()
	ms := inmemory.NewInmemoryMorphRuleChainStorage()

	ls.AddOverride(chain.Ingress, policyengine.ContainerTarget(containerID), &chain.Chain{
		Rules: []chain.Rule{
			{
				Status:  chain.AccessDenied,
				Actions: chain.Actions{Names: methodsOptionalOID},
				Resources: chain.Resources{
					Names: []string{fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, containerID)},
				},
				Any: true,
				Condition: []chain.Condition{
					{
						Op:     chain.CondStringEquals,
						Object: chain.ObjectResource,
						Key:    "attr1",
						Value:  "value",
					},
				},
			},
		},
		MatchType: chain.MatchTypeFirstMatch,
	})

	router := policyengine.NewDefaultChainRouterWithLocalOverrides(ms, ls)

	node1Key, err := keys.NewPrivateKey()
	require.NoError(t, err)
	node1 := netmapSDK.NodeInfo{}
	node1.SetPublicKey(node1Key.PublicKey().Bytes())
	netmap := &netmapSDK.NetMap{}
	netmap.SetEpoch(100)
	netmap.SetNodes([]netmapSDK.NodeInfo{node1})

	nm := &netmapStub{
		currentEpoch: 100,
		netmaps: map[uint64]*netmapSDK.NetMap{
			100: netmap,
		},
	}

	cont := containerSDK.Container{}
	cont.Init()
	pp := netmapSDK.PlacementPolicy{}
	require.NoError(t, pp.DecodeString("REP 1"))
	cont.SetPlacementPolicy(pp)
	cs := &testContainerSource{
		containers: map[cid.ID]*container.Container{
			cnr: {
				Value: cont,
			},
		},
	}

	checker := NewChecker(router, headerProvider, frostfsidProvider, nm, cs, node1Key.PublicKey().Bytes())

	ecParentID := oidtest.ID()
	chunkHeader := newHeaderObjectSDK(cnr, obj, nil).ToV2().GetHeader()
	ecHeader := object.ECHeader{
		Index:  1,
		Total:  5,
		Parent: &refs.ObjectID{},
	}
	chunkHeader.SetEC(&ecHeader)
	ecParentID.WriteToV2(ecHeader.Parent)

	parentHeader := newHeaderObjectSDK(cnr, &ecParentID, &headerObjectSDKParams{
		attributes: []struct {
			key string
			val string
		}{
			{
				key: "attr1",
				val: "value",
			},
		},
	})
	headerProvider.addHeader(cnr, ecParentID, parentHeader)

	t.Run("access denied for container node", func(t *testing.T) {
		prm := Prm{
			Method:       nativeschema.MethodPutObject,
			Container:    cnr,
			Object:       obj,
			Role:         role,
			SenderKey:    senderKey,
			Header:       chunkHeader,
			SoftAPECheck: true,
		}

		err = checker.CheckAPE(context.Background(), prm)
		require.Error(t, err)
	})
	t.Run("access allowed for non container node", func(t *testing.T) {
		otherKey, err := keys.NewPrivateKey()
		require.NoError(t, err)
		checker = NewChecker(router, headerProvider, frostfsidProvider, nm, cs, otherKey.PublicKey().Bytes())
		prm := Prm{
			Method:       nativeschema.MethodPutObject,
			Container:    cnr,
			Object:       obj,
			Role:         nativeschema.PropertyValueContainerRoleOthers,
			SenderKey:    senderKey,
			Header:       chunkHeader,
			SoftAPECheck: true,
		}

		err = checker.CheckAPE(context.Background(), prm)
		require.NoError(t, err)
	})
}