From e361e017f37ed878a9be0c225abdb9181e8c7a43 Mon Sep 17 00:00:00 2001
From: aarifullin <a.arifullin@yadro.com>
Date: Tue, 5 Dec 2023 13:26:09 +0300
Subject: [PATCH] [#842] control: Pass target instead resource name

* Update policy-engine package version in go.mod, go.sum.
* Refactor CheckIfRequestPermitted: pass container target
  instead container ID.

Signed-off-by: Airat Arifullin <a.arifullin@yadro.com>
---
 go.mod                                       |   2 +-
 go.sum                                       | Bin 45864 -> 45864 bytes
 pkg/services/control/server/policy_engine.go |   8 ++++----
 pkg/services/object/acl/ape.go               |   5 ++++-
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index aa0f689c1..43ff1648a 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	git.frostfs.info/TrueCloudLab/frostfs-observability v0.0.0-20231101111734-b3ad3335ff65
 	git.frostfs.info/TrueCloudLab/frostfs-sdk-go v0.0.0-20231122162120-56debcfa569e
 	git.frostfs.info/TrueCloudLab/hrw v1.2.1
-	git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20231128145636-a0a35bf4bf31
+	git.frostfs.info/TrueCloudLab/policy-engine v0.0.0-20231205092054-2d4a9fc6dcb3
 	git.frostfs.info/TrueCloudLab/tzhash v1.8.0
 	github.com/cheggaaa/pb v1.0.29
 	github.com/chzyer/readline v1.5.1
diff --git a/go.sum b/go.sum
index 0167d4a51f72c26f5ef2d0280134473225d47ba9..bede02d05464809cb87a332aedb12bdd3b16af5d 100644
GIT binary patch
delta 114
zcmZ4SjA_L)rVYVtu0{r?29`j=MAs<AB+)W0*(@bF$yg!7&??0w*|{X$tSmjy(7-S-
xFVoVkFf!3SAUikME5I-+&$ZGc($`blD>1|~e`27*WJ@+FG3<tIe!=Fj1^@^~BW?fy

delta 114
zcmZ4SjA_L)rVYVtu7*Yyh9;(F#%8*S28qU|NogiYX~u>M8HQHIh9$1r8GhLwiACm~
yzA2>{Raq83Zjlz+J|RY~#pRh{o)+fDzOHFeSq2jW6((D<Nr_=MZ1W2?hcy7*Z6b^S

diff --git a/pkg/services/control/server/policy_engine.go b/pkg/services/control/server/policy_engine.go
index 1c09de918..cbb6ba803 100644
--- a/pkg/services/control/server/policy_engine.go
+++ b/pkg/services/control/server/policy_engine.go
@@ -66,7 +66,7 @@ func (s *Server) AddChainLocalOverride(_ context.Context, req *control.AddChainL
 	}
 
 	resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
-	if _, err = src.LocalStorage().AddOverride(apechain.Ingress, resource, &chain); err != nil {
+	if _, err = src.LocalStorage().AddOverride(apechain.Ingress, engine.ContainerTarget(resource), &chain); err != nil {
 		return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
 	}
 
@@ -103,7 +103,7 @@ func (s *Server) GetChainLocalOverride(_ context.Context, req *control.GetChainL
 	}
 
 	resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
-	chain, err := src.LocalStorage().GetOverride(apechain.Ingress, resource, apechain.ID(req.GetBody().GetChainId()))
+	chain, err := src.LocalStorage().GetOverride(apechain.Ingress, engine.ContainerTarget(resource), apechain.ID(req.GetBody().GetChainId()))
 	if err != nil {
 		return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
 	}
@@ -141,7 +141,7 @@ func (s *Server) ListChainLocalOverrides(_ context.Context, req *control.ListCha
 	}
 
 	resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
-	chains, err := src.LocalStorage().ListOverrides(apechain.Ingress, resource)
+	chains, err := src.LocalStorage().ListOverrides(apechain.Ingress, engine.ContainerTarget(resource))
 	if err != nil {
 		return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
 	}
@@ -183,7 +183,7 @@ func (s *Server) RemoveChainLocalOverride(_ context.Context, req *control.Remove
 	}
 
 	resource := fmt.Sprintf(nativeschema.ResourceFormatRootContainerObjects, cid.EncodeToString())
-	if err = src.LocalStorage().RemoveOverride(apechain.Ingress, resource, apechain.ID(req.GetBody().GetChainId())); err != nil {
+	if err = src.LocalStorage().RemoveOverride(apechain.Ingress, engine.ContainerTarget(resource), apechain.ID(req.GetBody().GetChainId())); err != nil {
 		return nil, status.Error(getCodeByLocalStorageErr(err), err.Error())
 	}
 	resp := &control.RemoveChainLocalOverrideResponse{
diff --git a/pkg/services/object/acl/ape.go b/pkg/services/object/acl/ape.go
index 525ed5930..a48bb5c9f 100644
--- a/pkg/services/object/acl/ape.go
+++ b/pkg/services/object/acl/ape.go
@@ -9,6 +9,7 @@ import (
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/util/logger"
 	apistatus "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/client/status"
 	apechain "git.frostfs.info/TrueCloudLab/policy-engine/pkg/chain"
+	policyengine "git.frostfs.info/TrueCloudLab/policy-engine/pkg/engine"
 )
 
 var errAPEChainNoSource = errors.New("could not get ape chain source for the container")
@@ -36,7 +37,9 @@ func (c *apeCheckerImpl) CheckIfRequestPermitted(reqInfo v2.RequestInfo) error {
 	request := new(Request)
 	request.FromRequestInfo(reqInfo)
 
-	status, ruleFound, err := chainCache.IsAllowed(apechain.Ingress, "", request)
+	cnrTarget := getResource(reqInfo).Name()
+
+	status, ruleFound, err := chainCache.IsAllowed(apechain.Ingress, policyengine.NewRequestTargetWithContainer(cnrTarget), request)
 	if err != nil {
 		return err
 	}