From 6c3c872ee41897cfa9af74eb4754f747b4f8d2a6 Mon Sep 17 00:00:00 2001
From: Leonard Lyubich <leonard@nspcc.ru>
Date: Sat, 3 Oct 2020 10:39:02 +0300
Subject: [PATCH] [#69] object/acl: Define access denied error

Signed-off-by: Leonard Lyubich <leonard@nspcc.ru>
---
 pkg/services/object/acl/basic.go | 41 ++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 12 deletions(-)

diff --git a/pkg/services/object/acl/basic.go b/pkg/services/object/acl/basic.go
index a26f8ab46..0505117fa 100644
--- a/pkg/services/object/acl/basic.go
+++ b/pkg/services/object/acl/basic.go
@@ -3,6 +3,7 @@ package acl
 import (
 	"bytes"
 	"context"
+	"fmt"
 
 	acl "github.com/nspcc-dev/neofs-api-go/pkg/acl/eacl"
 	"github.com/nspcc-dev/neofs-api-go/pkg/container"
@@ -56,11 +57,16 @@ type cfg struct {
 	next object.Service
 }
 
+type accessErr struct {
+	requestInfo
+
+	failedCheckTyp string
+}
+
 var (
-	ErrMalformedRequest  = errors.New("malformed request")
-	ErrUnknownRole       = errors.New("can't classify request sender")
-	ErrUnknownContainer  = errors.New("can't fetch container info")
-	ErrBasicAccessDenied = errors.New("access denied by basic acl")
+	ErrMalformedRequest = errors.New("malformed request")
+	ErrUnknownRole      = errors.New("can't classify request sender")
+	ErrUnknownContainer = errors.New("can't fetch container info")
 )
 
 func defaultCfg() *cfg {
@@ -99,7 +105,7 @@ func (b Service) Get(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	stream, err := b.next.Get(ctx, request)
@@ -139,7 +145,7 @@ func (b Service) Head(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	return b.next.Head(ctx, request)
@@ -167,7 +173,7 @@ func (b Service) Search(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	stream, err := b.next.Search(ctx, request)
@@ -194,7 +200,7 @@ func (b Service) Delete(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	return b.next.Delete(ctx, request)
@@ -220,7 +226,7 @@ func (b Service) GetRange(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	stream, err := b.next.GetRange(ctx, request)
@@ -247,7 +253,7 @@ func (b Service) GetRangeHash(
 	}
 
 	if !basicACLCheck(reqInfo) {
-		return nil, ErrBasicAccessDenied
+		return nil, basicACLErr(reqInfo)
 	}
 
 	return b.next.GetRangeHash(ctx, request)
@@ -282,7 +288,7 @@ func (p putStreamBasicChecker) Send(request *object.PutRequest) error {
 		}
 
 		if !basicACLCheck(reqInfo) || !stickyBitCheck(reqInfo, ownerID) {
-			return ErrBasicAccessDenied
+			return basicACLErr(reqInfo)
 		}
 	}
 
@@ -312,7 +318,7 @@ func (g getStreamBasicChecker) Recv() (*object.GetResponse, error) {
 		}
 
 		if !stickyBitCheck(g.info, ownerID) {
-			return nil, ErrBasicAccessDenied
+			return nil, basicACLErr(g.info)
 		}
 	}
 
@@ -463,3 +469,14 @@ func tokenVerbToOperation(verb session.ObjectSessionVerb) acl.Operation {
 		return acl.OperationUnknown
 	}
 }
+
+func (a *accessErr) Error() string {
+	return fmt.Sprintf("access to operation %v is denied by %s check", a.operation, a.failedCheckTyp)
+}
+
+func basicACLErr(info requestInfo) error {
+	return &accessErr{
+		requestInfo:    info,
+		failedCheckTyp: "basic ACL",
+	}
+}