diff --git a/acl/types.proto b/acl/types.proto index e9ea987..ec15021 100644 --- a/acl/types.proto +++ b/acl/types.proto @@ -6,6 +6,7 @@ option go_package = "git.frostfs.info/TrueCloudLab/frostfs-api-go/v2/acl/grpc;ac option csharp_namespace = "Neo.FileStorage.API.Acl"; import "refs/types.proto"; +import "ape/types.proto"; // Target role of the access control rule in access control list. enum Role { @@ -194,6 +195,8 @@ message BearerToken { // container. If it contains `container_id` field, bearer token is only // valid for this specific container. Otherwise, any container of the same // owner is allowed. + // + // Deprecated: eACL tables are no longer relevant - `APEOverrides` should be used instead. EACLTable eacl_table = 1 [ json_name = "eaclTable" ]; // `OwnerID` defines to whom the token was issued. It must match the request @@ -218,6 +221,23 @@ message BearerToken { // AllowImpersonate flag to consider token signer as request owner. // If this field is true extended ACL table in token body isn't processed. bool allow_impersonate = 4 [ json_name = "allowImpersonate" ]; + + // APEOverride is the list of APE chains defined for a target. + // These chains are meant to serve as overrides to the already defined (or even undefined) + // APE chains for the target (see contract `Policy`). + // + // The server-side processing of the bearer token with set APE overrides must verify if a client is permitted + // to override chains for the target, preventing unauthorized access through the APE mechanism. + message APEOverride { + // Target for which chains are applied. + frostfs.v2.ape.ChainTarget target = 1 [ json_name = "target" ]; + + // The list of APE chains. + repeated frostfs.v2.ape.Chain chains = 2 [ json_name = "chains" ]; + } + + // APE override for the target. + APEOverride ape_override = 5 [ json_name = "apeOverride" ]; } // Bearer Token body Body body = 1 [ json_name = "body" ]; diff --git a/proto-docs/acl.md b/proto-docs/acl.md index 91fd36b..19c1a8d 100644 --- a/proto-docs/acl.md +++ b/proto-docs/acl.md @@ -8,6 +8,7 @@ - Messages - [BearerToken](#neo.fs.v2.acl.BearerToken) - [BearerToken.Body](#neo.fs.v2.acl.BearerToken.Body) + - [BearerToken.Body.APEOverride](#neo.fs.v2.acl.BearerToken.Body.APEOverride) - [BearerToken.Body.TokenLifetime](#neo.fs.v2.acl.BearerToken.Body.TokenLifetime) - [EACLRecord](#neo.fs.v2.acl.EACLRecord) - [EACLRecord.Filter](#neo.fs.v2.acl.EACLRecord.Filter) @@ -57,10 +58,30 @@ container owner with additional information preventing token abuse. | Field | Type | Label | Description | | ----- | ---- | ----- | ----------- | -| eacl_table | [EACLTable](#neo.fs.v2.acl.EACLTable) | | Table of Extended ACL rules to use instead of the ones attached to the container. If it contains `container_id` field, bearer token is only valid for this specific container. Otherwise, any container of the same owner is allowed. | +| eacl_table | [EACLTable](#neo.fs.v2.acl.EACLTable) | | Table of Extended ACL rules to use instead of the ones attached to the container. If it contains `container_id` field, bearer token is only valid for this specific container. Otherwise, any container of the same owner is allowed. + +Deprecated: eACL tables are no longer relevant - `APEOverrides` should be used instead. | | owner_id | [neo.fs.v2.refs.OwnerID](#neo.fs.v2.refs.OwnerID) | | `OwnerID` defines to whom the token was issued. It must match the request originator's `OwnerID`. If empty, any token bearer will be accepted. | | lifetime | [BearerToken.Body.TokenLifetime](#neo.fs.v2.acl.BearerToken.Body.TokenLifetime) | | Token expiration and valid time period parameters | | allow_impersonate | [bool](#bool) | | AllowImpersonate flag to consider token signer as request owner. If this field is true extended ACL table in token body isn't processed. | +| ape_override | [BearerToken.Body.APEOverride](#neo.fs.v2.acl.BearerToken.Body.APEOverride) | | APE override for the target. | + + + + +### Message BearerToken.Body.APEOverride +APEOverride is the list of APE chains defined for a target. +These chains are meant to serve as overrides to the already defined (or even undefined) +APE chains for the target (see contract `Policy`). + +The server-side processing of the bearer token with set APE overrides must verify if a client is permitted +to override chains for the target, preventing unauthorized access through the APE mechanism. + + +| Field | Type | Label | Description | +| ----- | ---- | ----- | ----------- | +| target | [frostfs.v2.ape.ChainTarget](#frostfs.v2.ape.ChainTarget) | | Target for which chains are applied. | +| chains | [frostfs.v2.ape.Chain](#frostfs.v2.ape.Chain) | repeated | The list of APE chains. | diff --git a/proto-docs/ape.md b/proto-docs/ape.md index c4d7157..b101c83 100644 --- a/proto-docs/ape.md +++ b/proto-docs/ape.md @@ -72,8 +72,8 @@ TargetType is a type target to which a rule chain is defined. | ----------- | ----- | -------- | --------- | ----------- | | double | | double | double | float | | float | | float | float | float | -| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint32 instead. | int32 | int | int | -| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers – if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | +| int32 | Uses variable-length encoding. Inefficient for encoding negative numbers - if your field is likely to have negative values, use sint32 instead. | int32 | int | int | +| int64 | Uses variable-length encoding. Inefficient for encoding negative numbers - if your field is likely to have negative values, use sint64 instead. | int64 | long | int/long | | uint32 | Uses variable-length encoding. | uint32 | int | int/long | | uint64 | Uses variable-length encoding. | uint64 | long | int/long | | sint32 | Uses variable-length encoding. Signed int value. These more efficiently encode negative numbers than regular int32s. | int32 | int | int |